fallow 2.73.0 → 2.74.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.73.0",
+  "version": "2.74.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 94 framework plugins.",
   "license": "MIT",
   "repository": {
@@ -73,13 +73,13 @@
     "@tanstack/intent": "0.0.40"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.73.0",
-    "@fallow-cli/darwin-x64": "2.73.0",
-    "@fallow-cli/linux-x64-gnu": "2.73.0",
-    "@fallow-cli/linux-arm64-gnu": "2.73.0",
-    "@fallow-cli/linux-x64-musl": "2.73.0",
-    "@fallow-cli/linux-arm64-musl": "2.73.0",
-    "@fallow-cli/win32-arm64-msvc": "2.73.0",
-    "@fallow-cli/win32-x64-msvc": "2.73.0"
+    "@fallow-cli/darwin-arm64": "2.74.0",
+    "@fallow-cli/darwin-x64": "2.74.0",
+    "@fallow-cli/linux-x64-gnu": "2.74.0",
+    "@fallow-cli/linux-arm64-gnu": "2.74.0",
+    "@fallow-cli/linux-x64-musl": "2.74.0",
+    "@fallow-cli/linux-arm64-musl": "2.74.0",
+    "@fallow-cli/win32-arm64-msvc": "2.74.0",
+    "@fallow-cli/win32-x64-msvc": "2.74.0"
   }
 }

package/schema.json

@@ -165,6 +165,7 @@
         "feature-flags": "off",
         "stale-suppressions": "warn",
         "unused-catalog-entries": "warn",
+        "empty-catalog-groups": "warn",
         "unresolved-catalog-references": "error",
         "unused-dependency-overrides": "warn",
         "misconfigured-dependency-overrides": "error"
@@ -953,6 +954,10 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "empty-catalog-groups": {
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "unresolved-catalog-references": {
           "$ref": "#/$defs/Severity",
           "default": "error"
@@ -1039,7 +1044,7 @@
           "const": "feature-sliced"
         },
         {
-          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other; shared utilities and server\ninfrastructure form the base layers.",
+          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other via `autoDiscover`: every\nimmediate child of `src/features/` becomes its own `features/<name>` zone,\nand cross-feature imports are reported as boundary violations.\n\n**Trade-off (intentional):** top-level files in `src/features/` (e.g.\n`src/features/index.ts` barrel, `src/features/types.ts`) do NOT match any\nchild pattern and are unclassified, meaning they are unrestricted by the\npreset. This is deliberate so feature barrels can re-export children\nwithout producing false-positive `features → features/<child>` violations.\nTo classify top-level files strictly, override the `features` zone with\nan explicit user definition that includes a `patterns` field.",
           "type": "string",
           "const": "bulletproof"
         }
@@ -1060,6 +1065,13 @@
             "type": "string"
           }
         },
+        "autoDiscover": {
+          "description": "Directories whose immediate child directories should become separate\nzones under this logical group.\n\nFor example, `{ \"name\": \"features\", \"autoDiscover\": [\"src/features\"] }`\ncreates zones such as `features/auth` and `features/billing`, each with\na pattern for its own subtree. Rules that reference `features` expand to\nevery discovered child zone. If `patterns` is also set, the parent zone\nremains as a fallback after discovered child zones.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "root": {
           "description": "Optional subtree scope for monorepo per-package boundaries.\n\nWhen set, the zone's `patterns` are matched against paths *relative*\nto this directory rather than the project root. At classification\ntime, fallow checks that a candidate path starts with `root` and\nstrips that prefix before glob-matching the patterns against the\nremainder. Files outside the subtree never match the zone.\n\nUseful for monorepos where each package has the same internal\ndirectory layout: instead of writing `packages/app/src/**` and\n`packages/core/src/**` (which collide on shared zone names), set\n`root: \"packages/app/\"` and `patterns: [\"src/**\"]` per package.\n\nTrailing slash and leading `./` are normalized; backslashes are\nconverted to forward slashes. Patterns must NOT redundantly include\nthe root prefix: `root: \"packages/app/\"` with\n`patterns: [\"packages/app/src/**\"]` is rejected with\n`FALLOW-BOUNDARY-ROOT-REDUNDANT-PREFIX` because patterns are\nresolved relative to the root.",
           "type": [
@@ -1069,8 +1081,7 @@
         }
       },
       "required": [
-        "name",
-        "patterns"
+        "name"
       ]
     },
     "BoundaryRule": {
@@ -1419,6 +1430,16 @@
             }
           ]
         },
+        "empty-catalog-groups": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unresolved-catalog-references": {
           "anyOf": [
             {

package/skills/fallow/SKILL.md

@@ -100,6 +100,8 @@ cargo install fallow-cli        # build from source
 | Test-only dependencies | n/a | Production deps only imported from test files (should be devDependencies) |
 | Unused pnpm catalog entries | `--unused-catalog-entries` | `pnpm-workspace.yaml` entries no workspace package.json references via `catalog:` (default `warn`) |
 | Unresolved pnpm catalog references | `--unresolved-catalog-references` | `package.json` references to `catalog:` / `catalog:<name>` whose catalog does not declare the package; `pnpm install` would fail. Default `error`. Suppress via `ignoreCatalogReferences: [{ package, catalog?, consumer? }]` in fallow config (package.json has no comment syntax). |
+| Unused pnpm dependency overrides | `--unused-dependency-overrides` | `pnpm-workspace.yaml#overrides` / `package.json#pnpm.overrides` entries forcing a version no workspace package depends on. Default `warn`; the `hint` field flags entries that may be intentional pins for transitive CVEs. Suppress via `ignoreDependencyOverrides: [{ package, source? }]` in fallow config. |
+| Misconfigured pnpm dependency overrides | `--misconfigured-dependency-overrides` | `pnpm.overrides` entries whose key is unparsable (empty, dangling separators, malformed selectors) or value is missing/empty. `pnpm install` would fail. Default `error`. Suppression: same `ignoreDependencyOverrides` config rule. |
 
 ## MCP Tools
 

package/skills/fallow/references/cli-reference.md

@@ -192,7 +192,7 @@ fallow dupes --format json --quiet --baseline fallow-baselines/dupes.json --thre
 
 ## `fix`: Auto-Remove Unused Code
 
-Auto-removes unused exports and dependencies.
+Auto-removes unused exports, dependencies, enum members, and pnpm catalog entries.
 
 ### Flags
 
@@ -204,6 +204,13 @@ Auto-removes unused exports and dependencies.
 | `--format` | `human\|json` | `human` | Output format |
 | `--quiet` | bool | `false` | Suppress progress bars |
 
+### What gets fixed
+
+- Unused exports (removes the `export` keyword; whole-enum block when every member is unused)
+- Unused dependencies (removed from `package.json`)
+- Unused enum members (removed from the declaration)
+- Unused pnpm catalog entries (removed from `pnpm-workspace.yaml` by line-aware deletion; comments preserved). When the last entry of a catalog group is removed, the header is rewritten to `catalog: {}` / `<name>: {}` so pnpm doesn't reject the resulting null value. Entries with non-empty `hardcoded_consumers` are skipped to avoid breaking `pnpm install`; the skip is surfaced in the JSON fix output as `{"type": "remove_catalog_entry", "applied": false, "skipped": true, "skip_reason": "hardcoded_consumers", "consumers": [...]}`. After a successful catalog edit the CLI emits a one-line `Run pnpm install to refresh pnpm-lock.yaml` reminder. The JSON envelope carries a top-level `"skipped"` count alongside `"total_fixed"` for partial-fix gating.
+
 ### Examples
 
 ```bash
@@ -425,7 +432,7 @@ fallow health --format json --quiet --trend
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.73.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -811,7 +818,7 @@ fallow audit \
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.73.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -884,7 +891,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.73.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1303,7 +1310,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.73.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1450,7 +1457,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.73.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1494,7 +1501,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "check": {
     "schema_version": 3,
-    "version": "2.72.0",
+    "version": "2.73.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],
@@ -1516,7 +1523,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "dupes": {
     "schema_version": 3,
-    "version": "2.72.0",
+    "version": "2.73.0",
     "elapsed_ms": 82,
     "total_clones": 15,
     "total_lines_duplicated": 230,
@@ -1525,7 +1532,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "health": {
     "schema_version": 3,
-    "version": "2.72.0",
+    "version": "2.73.0",
     "elapsed_ms": 32,
     "summary": {},
     "findings": [],

package/types/output-contract.d.ts

@@ -117,12 +117,16 @@ stale_suppressions: StaleSuppression[]
  * Entries in pnpm-workspace.yaml's catalog: or catalogs: sections not referenced by any workspace package via the catalog: protocol.
  */
 unused_catalog_entries?: UnusedCatalogEntry[]
+/**
+ * Named groups under pnpm-workspace.yaml's catalogs: section that declare no package entries. The top-level catalog: map is not reported.
+ */
+empty_catalog_groups?: EmptyCatalogGroup[]
 /**
  * Workspace package.json references to catalogs (catalog: or catalog:<name>) that do not declare the consumed package. pnpm install will error until the named catalog grows to include the package or the reference is switched / removed.
  */
 unresolved_catalog_references?: UnresolvedCatalogReference[]
 /**
- * Entries in pnpm-workspace.yaml's overrides: section, or package.json's pnpm.overrides block, whose target package no workspace package depends on. Default severity is warn because some entries are intentional pins for transitive CVEs; the hint field flags the cases the conservative algorithm cannot disambiguate.
+ * Entries in pnpm-workspace.yaml's overrides: section, or package.json's pnpm.overrides block, whose target package is not declared by any workspace package and is not present in pnpm-lock.yaml. Default severity is warn because projects without a readable lockfile fall back to manifest-only checks; the hint field flags those conservative cases.
  */
 unused_dependency_overrides?: UnusedDependencyOverride[]
 /**
@@ -151,7 +155,7 @@ export interface FixAction {
 /**
  * Kebab-case identifier for the fix action.
  */
-type: ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override")
+type: ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override")
 /**
  * Whether `fallow fix` can apply this fix automatically.
  */
@@ -215,9 +219,9 @@ export interface AddToConfigAction {
  */
 type: "add-to-config"
 /**
- * Always false for config actions.
+ * True when `fallow fix` can apply this config action automatically for the current action type. `ignoreExports` duplicate-export actions are auto-fixable when a config file exists; older scalar config-ignore actions remain manual.
  */
-auto_fixable: false
+auto_fixable: boolean
 /**
  * Human-readable description of the config change.
  */
@@ -604,6 +608,25 @@ hardcoded_consumers?: string[]
 actions?: IssueAction[]
 introduced?: AuditIntroduced
 }
+/**
+ * A named pnpm catalog group under catalogs: with no package entries.
+ */
+export interface EmptyCatalogGroup {
+/**
+ * Named catalog group under the top-level catalogs: map.
+ */
+catalog_name: string
+/**
+ * Relative path to pnpm-workspace.yaml.
+ */
+path: string
+/**
+ * 1-based line number of the empty catalog group header.
+ */
+line: number
+actions?: IssueAction[]
+introduced?: AuditIntroduced
+}
 /**
  * A workspace package.json reference (catalog: or catalog:<name>) pointing at a catalog that does not declare the consumed package. `pnpm install` will fail with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_CATALOG_PROTOCOL.
  */
@@ -668,7 +691,7 @@ path: string
  */
 line: number
 /**
- * Soft hint for cases the conservative algorithm cannot disambiguate (e.g. a transitive CVE pin not visible to static analysis). Omitted when absent.
+ * Soft hint reminding consumers to verify the override before removal. Present because projects without a readable lockfile use the conservative package-manifest fallback. Omitted when absent.
  */
 hint?: string
 actions?: IssueAction[]
@@ -739,6 +762,7 @@ circular_dependencies?: number
 boundary_violations?: number
 stale_suppressions?: number
 unused_catalog_entries?: number
+empty_catalog_groups?: number
 unresolved_catalog_references?: number
 unused_dependency_overrides?: number
 misconfigured_dependency_overrides?: number