docguard-cli 0.11.1__tar.gz → 0.11.2__tar.gz

{docguard_cli-0.11.1/extensions/spec-kit-docguard → docguard_cli-0.11.2/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.11.1/extensions/spec-kit-docguard → docguard_cli-0.11.2/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.11.1/extensions/spec-kit-docguard → docguard_cli-0.11.2/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/.agent/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/.agent/skills/docguard-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.2] - 2026-05-25
+
+Patch release addressing the four bugs (B-1..B-4) reported from the v0.11.1 audit of `wu-whatsappinbox` (score 98/100, 572/575 passed, 1 warning), plus Antigravity/Kiro/Windsurf agent-routing aliases and a Docs-Coverage silent-fail fix that the new B-4 nudge itself exposed.
+
+### Fixed
+- **B-1: Vite intrinsics no longer reported as user env vars.** `grepEnvUsage` in `cli/shared-source.mjs` now skips `DEV`, `PROD`, `MODE`, `BASE_URL`, and `SSR` on `import.meta.env.*` — these are injected by Vite at build time, not user-configured. Real user vars like `VITE_API_URL` are still captured. (Reported by wu-whatsappinbox v0.11.1 audit.)
+- **B-2: `docguard diff` Data Entities now uses real exported names, not file basenames.** Previously the entity diff walked filenames and reported the stem (e.g. `models.py` → "models"), missing all the actual classes inside. Now uses `scanSchemasDeep` — the same code-side scanner the rest of DocGuard uses — which extracts real Pydantic/Dataclass/Mongoose/Prisma/Zod/Sequelize/Sqlx/SQLAlchemy/JPA entity names. (Reported by wu-whatsappinbox v0.11.1 audit.)
+- **B-3: Literal `` `VITE_` `` prefix in prose no longer captured as an env var name.** Tightened the env-var name regex across `shared-source.mjs`, `validators/environment.mjs`, and `commands/diff.mjs` from `[A-Z][A-Z0-9_]*` to `[A-Z][A-Z0-9_]*[A-Z0-9]` (must end with letter/digit, not underscore). Documentation like ``All vars start with `VITE_` (Vite convention)`` no longer triggers a "missing `VITE_`" warning. (Reported by wu-whatsappinbox v0.11.1 audit.)
+- **B-4 nudge surfaced: Docs-Coverage Check 5 (`checkReadmeSections`) silent-fail fixed.** The "recommended sections" loop bumped `total` without emitting a message when missing — exactly the anti-pattern B-4 flags. Recommended sections are now a true bonus: present = +1 to both passed/total, missing = no-op. Restores honest scoring on the README checker. (Found by the B-4 nudge running on the wu-whatsappinbox fixture.)
+
+### Added
+- **B-4: `--show-failing` flag and validator-bug nudge.** `docguard guard --show-failing` shows warnings/errors for every non-passing validator even if the overall status would have suppressed them. New nudge fires when a validator has `passed < total` but emits no warning or error messages — points at a likely silent-fail validator bug for the user to file an issue. (Reported by wu-whatsappinbox v0.11.1 audit.)
+- **Antigravity / Kiro / Windsurf / GEMINI agent signals.** `cli/ensure-skills.mjs` now detects these agent ecosystems via additional signal files (`.agents`, `.antigravity`, `ANTIGRAVITY.md`, `.kiro`, `.windsurf`, `GEMINI.md`) so the right skills are installed for each. Antigravity was already wired via `.agents → agy`; this expands the alias surface so neither side-by-side IDEs nor Spec Kit's `.agents` convention break detection.
+
+### Internal
+- New test file: `tests/patch-0.11.2.test.mjs` with regression coverage for B-1 (Vite intrinsics skip), B-2 (Pydantic class names, not file basename), and B-3 (literal `VITE_` not captured). **Total: 339 tests passing (was 336, +3 new).**
+- No new NPM dependencies. Zero schema or config-file changes. Bumped `pyproject.toml` from `0.11.0 → 0.11.2` to re-sync the PyPI publish (the previous patch released to npm but skipped PyPI version bump).
+
+### Out of scope (deferred to v0.12)
+- S-1 (`sync --since` surgical refresh), S-2 (sweep-needed nudge from freshness counters), S-3 (`trace --reverse` code→doc map), S-4 (rename detection via `git log --follow`), S-5 (`.docguardignore` template at init), S-6 (per-validator severity in `.docguard.json`), S-7 (generated-doc-in-draft staleness validator), S-8 (cross-reference validator for broken `§X` anchors), S-9 (pre-commit lite on changed files only), S-10 (`.docguard/fixed.json` memory of past fixes).
+
+Credit: feedback from running v0.11.1 on the `wu-whatsappinbox` enterprise monorepo (audit score 98/100, 572/575 passed).
+
 ## [0.11.1] - 2026-05-25
 
 Patch release addressing false positives surfaced by the v0.11.0 audit of the `wu-whatsappinbox` enterprise monorepo, generalized into a multi-tool IaC detector, plus several DocGuard self-audit improvements. Spec: `specs/003-v011-false-positives/`.

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docguard-cli
-Version: 0.11.1
+Version: 0.11.2
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. Zero dependencies.
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/commands/diff.mjs

@@ -10,6 +10,8 @@ import { collectPackageJsons, detectDocker, grepEnvUsage, resolveSourceRoots } f
 import { parseApiReferenceDoc, compareEndpoints } from '../scanners/api-doc.mjs';
 import { resolveApiSurface } from '../validators/api-surface.mjs';
 import { collectCodeTests } from '../validators/docs-diff.mjs';
+import { scanSchemasDeep } from '../scanners/schemas.mjs';
+import { detectDocTools } from '../scanners/doc-tools.mjs';
 
 const IGNORE_DIRS = new Set([
   'node_modules', '.git', '.next', 'dist', 'build',
@@ -163,22 +165,17 @@ function diffEntities(dir, config = {}) {
     docEntities.add(name.toLowerCase());
   }
 
-  // Find model/entity files in code — monorepo-aware (honors config.sourceRoot/workspaces).
+  // Use the REAL exported entity names from scanSchemasDeep, not file basenames
+  // (a file `dynamoModels.ts` exports `User`/`Order`/etc. — its basename is not
+  // an entity). scanSchemasDeep covers JS ORMs, SQLAlchemy/Pydantic, Diesel,
+  // Go structs, JPA, Rails, and OpenAPI schemas.
+  const docTools = detectDocTools(dir);
+  const schemas = scanSchemasDeep(dir, {}, docTools);
   const codeEntities = new Set();
-  const modelSubdirs = ['models', 'entities', 'schema', 'schemas', 'prisma'];
-  const roots = resolveSourceRoots(dir, config);
-  for (const root of roots) {
-    for (const sub of modelSubdirs) {
-      const modelDir = join(root, sub);
-      if (!existsSync(modelDir)) continue;
-      const files = getFilesRecursive(modelDir);
-      for (const f of files) {
-        const name = basename(f, extname(f)).toLowerCase();
-        // Skip non-entity infrastructure/aggregation filenames.
-        if (CODE_ENTITY_NOISE.has(name)) continue;
-        codeEntities.add(name);
-      }
-    }
+  for (const e of (schemas.entities || [])) {
+    const n = String(e.name || '').toLowerCase();
+    if (!n || CODE_ENTITY_NOISE.has(n)) continue;
+    codeEntities.add(n);
   }
 
   // No code-side entity source (e.g. DynamoDB single-table design with no model
@@ -207,7 +204,8 @@ function diffEnvVars(dir, config = {}) {
 
   // Extract env var names from ENVIRONMENT.md
   const docVars = new Set();
-  const varRegex = /`([A-Z][A-Z0-9_]{2,})`/g;
+  // Reject names ending in `_` (e.g. the literal prefix `VITE_` in prose).
+  const varRegex = /`([A-Z][A-Z0-9_]*[A-Z0-9])`/g;
   let match;
   while ((match = varRegex.exec(content)) !== null) {
     docVars.add(match[1]);
@@ -220,7 +218,7 @@ function diffEnvVars(dir, config = {}) {
     const envExamplePath = resolve(dir, envFile);
     if (existsSync(envExamplePath)) {
       const envContent = readFileSync(envExamplePath, 'utf-8');
-      const envRegex = /^([A-Z][A-Z0-9_]+)\s*=/gm;
+      const envRegex = /^([A-Z][A-Z0-9_]*[A-Z0-9])\s*=/gm;
       while ((match = envRegex.exec(envContent)) !== null) {
         codeVars.add(match[1]);
       }

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/commands/guard.mjs

@@ -194,16 +194,26 @@ export function runGuard(projectDir, config, flags) {
       console.log(`  ${c.yellow}⚠️  ${v.name}${c.reset} ${qBadge}${c.dim}  ${v.passed}/${v.total} checks passed${c.reset}`);
     }
 
-    if (flags.verbose || v.status === 'fail') {
+    // --show-failing forces enumeration of every error/warning regardless of
+    // overall validator status — useful when a validator passes overall
+    // (passed < total) without surfacing the specific failing checks.
+    const show = flags.verbose || flags.showFailing;
+    if (show || v.status === 'fail') {
       for (const err of v.errors) {
         console.log(`     ${c.red}✗ ${err}${c.reset}`);
       }
     }
-    if (flags.verbose || v.status === 'warn') {
+    if (show || v.status === 'warn') {
       for (const warn of v.warnings) {
         console.log(`     ${c.yellow}⚠ ${warn}${c.reset}`);
       }
     }
+    // If a validator reports passed < total but has no errors/warnings, surface
+    // the gap honestly so users aren't left wondering where the deficit went.
+    if (v.status === 'pass' && v.total > v.passed && v.errors.length === 0 && v.warnings.length === 0) {
+      const gap = v.total - v.passed;
+      console.log(`     ${c.yellow}⚠ ${gap} check(s) did not pass but emitted no message — likely a validator bug. Please file an issue.${c.reset}`);
+    }
   }
 
   // Summary

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/docguard.mjs

@@ -365,6 +365,8 @@ async function main() {
     } else if (args[i] === '--since' && args[i + 1]) {
       flags.since = args[i + 1];
       i++;
+    } else if (args[i] === '--show-failing') {
+      flags.showFailing = true;
     } else if (args[i] === '--doc' && args[i + 1]) {
       flags.doc = args[i + 1];
       i++;

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/ensure-skills.mjs

@@ -54,8 +54,13 @@ export function detectAgentMode(projectDir) {
     '.specify',
     '.github/copilot-instructions.md',
     'CLAUDE.md',
+    'GEMINI.md',
     '.gemini',
     '.agents',
+    '.antigravity',
+    'ANTIGRAVITY.md',
+    '.kiro',
+    '.windsurf',
   ];
 
   for (const signal of llmSignals) {
@@ -105,7 +110,9 @@ export function detectAIAgent(projectDir) {
     { signal: '.claude',                        agent: 'claude' },
     { signal: 'CLAUDE.md',                      agent: 'claude' },
     { signal: '.gemini',                        agent: 'gemini' },
-    { signal: '.agents',                        agent: 'agy' },         // Antigravity
+    { signal: '.agents',                        agent: 'agy' },         // Antigravity (Spec Kit convention)
+    { signal: '.antigravity',                   agent: 'agy' },         // Antigravity (alt convention)
+    { signal: 'ANTIGRAVITY.md',                 agent: 'agy' },         // Antigravity rules file
     { signal: '.github/copilot-instructions.md', agent: 'copilot' },
     { signal: '.windsurf',                      agent: 'windsurf' },
     { signal: '.codex',                         agent: 'codex' },

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/shared-source.mjs

@@ -210,11 +210,16 @@ export function grepEnvUsage(projectDir, config = {}) {
   const roots = resolveSourceRoots(projectDir, config);
   const seen = new Set();
 
+  // Require names to start with a letter and END with a letter/digit (NOT an
+  // underscore) — fixes "VITE_" being captured as a literal env var name.
+  const NAME = '([A-Z][A-Z0-9_]*[A-Z0-9])';
   const patterns = [
-    /process\.env\.([A-Z][A-Z0-9_]+)/g,
-    /process\.env\[\s*['"]([A-Z][A-Z0-9_]+)['"]\s*\]/g,
-    /import\.meta\.env\.([A-Z][A-Z0-9_]+)/g,
+    new RegExp(`process\\.env\\.${NAME}`, 'g'),
+    new RegExp(`process\\.env\\[\\s*['"]${NAME}['"]\\s*\\]`, 'g'),
+    new RegExp(`import\\.meta\\.env\\.${NAME}`, 'g'),
   ];
+  // Vite injects these at build time; they are not user-set env vars.
+  const VITE_INTRINSICS = new Set(['DEV', 'PROD', 'MODE', 'BASE_URL', 'SSR']);
 
   const visit = (filePath) => {
     if (seen.has(filePath)) return;
@@ -225,10 +230,16 @@ export function grepEnvUsage(projectDir, config = {}) {
     let content;
     try { content = readFileSync(filePath, 'utf-8'); } catch { return; }
     if (!content.includes('env')) return;
-    for (const re of patterns) {
+    // patterns[2] is the import.meta.env one — its matches are Vite-injected
+    // when the name is an intrinsic, and must not be reported as user env vars.
+    for (let i = 0; i < patterns.length; i++) {
       let m;
-      const rx = new RegExp(re.source, 'g');
-      while ((m = rx.exec(content)) !== null) names.add(m[1]);
+      const rx = new RegExp(patterns[i].source, 'g');
+      const isViteSource = i === 2;
+      while ((m = rx.exec(content)) !== null) {
+        if (isViteSource && VITE_INTRINSICS.has(m[1])) continue;
+        names.add(m[1]);
+      }
     }
   };
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/validators/docs-coverage.mjs

@@ -422,9 +422,12 @@ function checkReadmeSections(projectDir) {
     }
   }
 
+  // Recommended sections are a BONUS — present = +1 to both passed and total,
+  // missing = no-op. Counting missing recommended toward `total` without a
+  // corresponding warning would be a silent fail (caught by B-4 nudge).
   for (const section of recommendedSections) {
-    total++;
     if (section.patterns.some(p => lowerContent.includes(p))) {
+      total++;
       passed++;
     }
   }

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/cli/validators/environment.mjs

@@ -41,13 +41,19 @@ export function validateEnvironment(projectDir, config) {
   // CLI/library projects that declare no env vars skip this.)
   if (ptc.needsEnvVars !== false) {
     const documented = new Set();
-    const varRe = /`([A-Z][A-Z0-9_]{2,})`/g;
+    // Require the matched name to end with a letter/digit — prevents prose-only
+    // tokens like `VITE_` (the convention prefix) from being treated as a real
+    // variable name.
+    const varRe = /`([A-Z][A-Z0-9_]*[A-Z0-9])`/g;
     let m;
-    while ((m = varRe.exec(content)) !== null) documented.add(m[1]);
+    while ((m = varRe.exec(content)) !== null) {
+      if (m[1].length < 3) continue; // 'OK' / 'ID' etc. are too short to be env var refs
+      documented.add(m[1]);
+    }
     for (const envFile of ['.env.example', '.env.template']) {
       const p = resolve(projectDir, envFile);
       if (!existsSync(p)) continue;
-      const re = /^([A-Z][A-Z0-9_]+)\s*=/gm;
+      const re = /^([A-Z][A-Z0-9_]*[A-Z0-9])\s*=/gm;
       const ex = readFileSync(p, 'utf-8');
       let em;
       while ((em = re.exec(ex)) !== null) documented.add(em[1]);

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.11.1"
+  version: "0.11.2"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with 19 automated validators, 4 AI behavior skills, spec-kit skill chaining, and workflow hooks. Zero NPM runtime dependencies."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

{docguard_cli-0.11.1/.agent → docguard_cli-0.11.2/extensions/spec-kit-docguard}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.11.1/.agent → docguard_cli-0.11.2/extensions/spec-kit-docguard}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.11.1/.agent → docguard_cli-0.11.2/extensions/spec-kit-docguard}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/extensions/spec-kit-docguard/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.11.1 -->
+<!-- docguard:version: 0.11.2 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/extensions/spec-kit-docguard/skills/docguard-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.11.1
+  version: 0.11.2
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
 

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docguard-cli",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.",
   "type": "module",
   "bin": {

{docguard_cli-0.11.1 → docguard_cli-0.11.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "docguard-cli"
-version = "0.11.1"
+version = "0.11.2"
 description = "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. Zero dependencies."
 readme = "README.md"
 license = { text = "MIT" }

docguard_cli-0.11.2/tests/patch-0.11.2.test.mjs

@@ -0,0 +1,103 @@
+/**
+ * v0.11.2 patch coverage — locks in the bug fixes from the wu-whatsappinbox feedback.
+ *
+ *  B-1: Vite intrinsics (DEV/PROD/MODE/BASE_URL/SSR) on `import.meta.env.*`
+ *       must NOT be reported as user env vars.
+ *  B-2: diff Data Entities uses real exported names (not file basenames).
+ *  B-3: literal env-var-prefix tokens like `VITE_` must not be captured.
+ */
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+import { grepEnvUsage } from '../cli/shared-source.mjs';
+import { validateEnvironment } from '../cli/validators/environment.mjs';
+
+function make(files) {
+  const dir = mkdtempSync(join(tmpdir(), 'docguard-patch-'));
+  for (const [rel, content] of Object.entries(files)) {
+    const full = join(dir, rel);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, content);
+  }
+  return dir;
+}
+
+describe('v0.11.2 — bug fixes from wu-whatsappinbox feedback', () => {
+  let dir;
+  afterEach(() => { if (dir) rmSync(dir, { recursive: true, force: true }); });
+
+  it('B-1: skips Vite intrinsics on import.meta.env (DEV / PROD / MODE / BASE_URL / SSR)', () => {
+    dir = make({
+      'package.json': JSON.stringify({ dependencies: { vite: '^7', react: '^19' } }),
+      'src/config.ts': `
+        const dev = import.meta.env.DEV;
+        const prod = import.meta.env.PROD;
+        const mode = import.meta.env.MODE;
+        const base = import.meta.env.BASE_URL;
+        const ssr = import.meta.env.SSR;
+        const apiUrl = import.meta.env.VITE_API_URL;       // user-set → keep
+        const dynaTable = process.env.DYNAMO_TABLE_NAME;   // user-set → keep
+      `,
+    });
+    const names = grepEnvUsage(dir, { sourceRoot: 'src' });
+    for (const intrinsic of ['DEV', 'PROD', 'MODE', 'BASE_URL', 'SSR']) {
+      assert.ok(!names.has(intrinsic), `${intrinsic} must not be reported`);
+    }
+    assert.ok(names.has('VITE_API_URL'), 'real user env var still captured');
+    assert.ok(names.has('DYNAMO_TABLE_NAME'));
+  });
+
+  it('B-3: literal `VITE_` (convention prefix in prose) is NOT captured as a var name', () => {
+    // process.env.VITE_  is syntactically illegal in real code, so test the env-doc
+    // parser which the user actually saw flag `VITE_` from prose `` `VITE_` ``.
+    dir = make({
+      'package.json': JSON.stringify({ dependencies: { vite: '^7' } }),
+      'docs-canonical/ENVIRONMENT.md': [
+        '# Environment',
+        '## Prerequisites',
+        '## Environment Variables',
+        'All frontend variables MUST start with `VITE_` (Vite convention).',
+        'The backend reads `DYNAMO_TABLE_NAME` from the environment.',
+      ].join('\n'),
+    });
+    const result = validateEnvironment(dir, { projectTypeConfig: { needsEnvVars: true } });
+    // Only the real var should be tracked; the `VITE_` literal prefix must be ignored.
+    // The validator's warning text would mention it by name — assert it does NOT.
+    assert.ok(!result.warnings.some(w => /\bVITE_\b/.test(w)),
+      'VITE_ prefix should never appear as a flagged variable name');
+  });
+
+  it('B-2: diff Data Entities uses real exported names (Pydantic), not file basenames', async () => {
+    // Construct a project whose model FILE is named in a way that would mislead
+    // the old filename-stem heuristic. Pydantic class names inside the file are
+    // the real entities.
+    dir = make({
+      'package.json': JSON.stringify({ name: 'svc' }),
+      'pyproject.toml': '[project]\nname="svc"\ndependencies = ["pydantic"]\n',
+      // Misleading filename: "models.py" basename would naively read "models".
+      'api/models.py': `
+from pydantic import BaseModel
+
+class User(BaseModel):
+    id: int
+    email: str
+
+class Order(BaseModel):
+    id: int
+    user_id: int
+`,
+      'docs-canonical/DATA-MODEL.md': '# Data Model\n### User\n### Order\n',
+    });
+    // Drive the same code-side scan diff.mjs uses (scanSchemasDeep).
+    const { scanSchemasDeep } = await import('../cli/scanners/schemas.mjs');
+    const r = scanSchemasDeep(dir, {}, { openapi: { found: false } });
+    const names = r.entities.map(e => e.name).sort();
+    assert.ok(names.includes('User'));
+    assert.ok(names.includes('Order'));
+    assert.ok(!names.includes('models'), 'file basename must NOT be reported as an entity');
+  });
+});