fallow 2.56.0 → 2.58.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.56.0",
+  "version": "2.58.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 90 framework plugins.",
   "license": "MIT",
   "repository": {
@@ -51,16 +51,16 @@
     "detect-libc": "2.1.2"
   },
   "devDependencies": {
-    "@tanstack/intent": "0.0.29"
+    "@tanstack/intent": "0.0.32"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.56.0",
-    "@fallow-cli/darwin-x64": "2.56.0",
-    "@fallow-cli/linux-x64-gnu": "2.56.0",
-    "@fallow-cli/linux-arm64-gnu": "2.56.0",
-    "@fallow-cli/linux-x64-musl": "2.56.0",
-    "@fallow-cli/linux-arm64-musl": "2.56.0",
-    "@fallow-cli/win32-arm64-msvc": "2.56.0",
-    "@fallow-cli/win32-x64-msvc": "2.56.0"
+    "@fallow-cli/darwin-arm64": "2.58.0",
+    "@fallow-cli/darwin-x64": "2.58.0",
+    "@fallow-cli/linux-x64-gnu": "2.58.0",
+    "@fallow-cli/linux-arm64-gnu": "2.58.0",
+    "@fallow-cli/linux-x64-musl": "2.58.0",
+    "@fallow-cli/linux-arm64-musl": "2.58.0",
+    "@fallow-cli/win32-arm64-msvc": "2.58.0",
+    "@fallow-cli/win32-x64-msvc": "2.58.0"
   }
 }

package/skills/fallow/SKILL.md

@@ -88,7 +88,7 @@ cargo install fallow-cli       # build from source
 | `audit` | Combined dead-code + complexity + duplication for changed files | `--base`, `--production`, `--production-dead-code`, `--production-health`, `--production-dupes`, `--workspace`, `--changed-workspaces`, `--ci`, `--fail-on-issues`, `--explain`, `--dead-code-baseline`, `--health-baseline`, `--dupes-baseline`, `--max-crap` |
 | `flags` | Detect feature flag patterns (env vars, SDK calls, config objects) | `--top` |
 | `license` | Manage the local license JWT for paid features (activate, status, refresh, deactivate) | `activate --trial --email <addr>`, `activate --from-file`, `activate --stdin`, `status`, `refresh`, `deactivate` |
-| `coverage` | Production-coverage workflow helper (paid) | `setup`, `setup --yes`, `setup --non-interactive` |
+| `coverage` | Runtime coverage setup, focused analysis, and cloud inventory workflow helper | `setup`, `setup --yes`, `setup --non-interactive`, `analyze --runtime-coverage <path>`, `analyze --cloud --repo owner/repo`, `upload-inventory` |
 | `schema` | Dump CLI definition as JSON | |
 | `config` | Show the loaded config path and resolved config (verifies which `.fallowrc.json` is in effect) | `--path` |
 
@@ -320,7 +320,7 @@ When `--format json` is active and exit code is 2, errors are emitted as JSON on
 
 ## Configuration
 
-Fallow reads config from project root: `.fallowrc.json` > `fallow.toml` > `.fallow.toml`. Most projects work with zero configuration thanks to 90 auto-detecting framework plugins.
+Fallow reads config from project root: `.fallowrc.json` > `.fallowrc.jsonc` > `fallow.toml` > `.fallow.toml`. Both `.fallowrc.json` and `.fallowrc.jsonc` accept JSON-with-comments syntax (same parser); the `.jsonc` extension lets editors auto-detect JSONC syntax highlighting. Most projects work with zero configuration thanks to 90 auto-detecting framework plugins.
 
 ```jsonc
 {

package/skills/fallow/references/cli-reference.md

@@ -939,9 +939,10 @@ Unknown codes fall back to the backend's `message` field, or the raw body.
 
 ## `coverage`: Production-Coverage Workflow
 
-Helper subcommand for the paid runtime-coverage analyzer. Two subcommands today:
+Helper subcommand for the runtime-coverage workflow. Three subcommands today:
 
 - `coverage setup` — resumable state machine that wires license activation, sidecar installation, framework-aware coverage recipe writing, and automatic handoff into `fallow health --runtime-coverage`.
+- `coverage analyze` — focused runtime coverage analysis. Local mode reads `--runtime-coverage <path>`; cloud mode requires explicit `--cloud`, `--runtime-coverage-cloud`, or `FALLOW_RUNTIME_COVERAGE_SOURCE=cloud` and never triggers from `FALLOW_API_KEY` alone.
 - `coverage upload-inventory` — push a static function inventory to fallow cloud so the dashboard can surface `untracked` functions (those in the codebase but never called at runtime).
 
 ```bash
@@ -949,10 +950,30 @@ fallow coverage setup                         # interactive
 fallow coverage setup --yes                   # accept all prompts
 fallow coverage setup --non-interactive       # print instructions, do not prompt
 
+fallow coverage analyze --runtime-coverage ./coverage --format json
+fallow coverage analyze --cloud --repo owner/repo --format json
+
 fallow coverage upload-inventory              # infers project-id, git-sha, API key
 fallow coverage upload-inventory --dry-run    # print what would be uploaded, exit 0
 ```
 
+### `analyze` flags
+
+| Flag | Type | Default | Description |
+|------|------|---------|-------------|
+| `--runtime-coverage <PATH>` | path | none | Local V8 directory, V8 JSON file, or Istanbul coverage map. Mutually exclusive with cloud mode. |
+| `--cloud`, `--runtime-coverage-cloud` | bool | false | Explicitly fetch cloud runtime facts from `/v1/coverage/:repo/runtime-context`. |
+| `--repo <OWNER/REPO>` | string | `$FALLOW_REPO` → `git remote get-url origin` | Repository identifier for cloud mode. Encoded as one URL path segment (`owner%2Frepo`). |
+| `--api-key <KEY>` | string | `$FALLOW_API_KEY` | Fallow cloud bearer token for cloud mode. The env var alone does not opt in to cloud mode. |
+| `--api-endpoint <URL>` | string | `$FALLOW_API_URL` or `https://api.fallow.cloud` | Override for staging / on-prem. |
+| `--coverage-period <DAYS>` | integer | 30 | Cloud observation window, 1 through 90 days. |
+| `--project-id <ID>` | string | none | Optional monorepo/project disambiguator. |
+| `--environment <ENV>` | string | none | Optional cloud environment filter. |
+| `--commit-sha <SHA>` | string | none | Optional cloud commit filter. |
+| `--production` | bool | false | Analyze production code only before joining cloud facts. |
+
+Cloud analysis emits the same `runtime_coverage` JSON block as local mode. Its summary includes `data_source: "cloud"`, `last_received_at`, and `capture_quality` derived from the pulled runtime window. Cloud functions that cannot be matched to the local AST/static index are omitted from findings and reported through a `cloud_functions_unmatched` warning.
+
 ### `setup` flow
 
 1. **License check** — if missing or hard-fail, offers to start a trial.