fallow 2.73.0 → 2.75.0

package/README.md

@@ -75,7 +75,7 @@ fallow dupes --save-baseline       # Save current duplication as baseline
 
 ## Framework support
 
-94 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
+95 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, AdonisJS, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.73.0",
+  "version": "2.75.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 94 framework plugins.",
   "license": "MIT",
   "repository": {
@@ -73,13 +73,13 @@
     "@tanstack/intent": "0.0.40"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.73.0",
-    "@fallow-cli/darwin-x64": "2.73.0",
-    "@fallow-cli/linux-x64-gnu": "2.73.0",
-    "@fallow-cli/linux-arm64-gnu": "2.73.0",
-    "@fallow-cli/linux-x64-musl": "2.73.0",
-    "@fallow-cli/linux-arm64-musl": "2.73.0",
-    "@fallow-cli/win32-arm64-msvc": "2.73.0",
-    "@fallow-cli/win32-x64-msvc": "2.73.0"
+    "@fallow-cli/darwin-arm64": "2.75.0",
+    "@fallow-cli/darwin-x64": "2.75.0",
+    "@fallow-cli/linux-x64-gnu": "2.75.0",
+    "@fallow-cli/linux-arm64-gnu": "2.75.0",
+    "@fallow-cli/linux-x64-musl": "2.75.0",
+    "@fallow-cli/linux-arm64-musl": "2.75.0",
+    "@fallow-cli/win32-arm64-msvc": "2.75.0",
+    "@fallow-cli/win32-x64-msvc": "2.75.0"
   }
 }

package/schema.json

@@ -165,6 +165,7 @@
         "feature-flags": "off",
         "stale-suppressions": "warn",
         "unused-catalog-entries": "warn",
+        "empty-catalog-groups": "warn",
         "unresolved-catalog-references": "error",
         "unused-dependency-overrides": "warn",
         "misconfigured-dependency-overrides": "error"
@@ -953,6 +954,10 @@
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
+        "empty-catalog-groups": {
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
+        },
         "unresolved-catalog-references": {
           "$ref": "#/$defs/Severity",
           "default": "error"
@@ -1039,7 +1044,7 @@
           "const": "feature-sliced"
         },
         {
-          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other; shared utilities and server\ninfrastructure form the base layers.",
+          "description": "Bulletproof React: app → features → shared + server.\nFeature modules are isolated from each other via `autoDiscover`: every\nimmediate child of `src/features/` becomes its own `features/<name>` zone,\nand cross-feature imports are reported as boundary violations.\n\n**Trade-off (intentional):** top-level files in `src/features/` (e.g.\n`src/features/index.ts` barrel, `src/features/types.ts`) do NOT match any\nchild pattern and are unclassified, meaning they are unrestricted by the\npreset. This is deliberate so feature barrels can re-export children\nwithout producing false-positive `features → features/<child>` violations.\nTo classify top-level files strictly, override the `features` zone with\nan explicit user definition that includes a `patterns` field.",
           "type": "string",
           "const": "bulletproof"
         }
@@ -1060,6 +1065,13 @@
             "type": "string"
           }
         },
+        "autoDiscover": {
+          "description": "Directories whose immediate child directories should become separate\nzones under this logical group.\n\nFor example, `{ \"name\": \"features\", \"autoDiscover\": [\"src/features\"] }`\ncreates zones such as `features/auth` and `features/billing`, each with\na pattern for its own subtree. Rules that reference `features` expand to\nevery discovered child zone. If `patterns` is also set, the parent zone\nremains as a fallback after discovered child zones.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "root": {
           "description": "Optional subtree scope for monorepo per-package boundaries.\n\nWhen set, the zone's `patterns` are matched against paths *relative*\nto this directory rather than the project root. At classification\ntime, fallow checks that a candidate path starts with `root` and\nstrips that prefix before glob-matching the patterns against the\nremainder. Files outside the subtree never match the zone.\n\nUseful for monorepos where each package has the same internal\ndirectory layout: instead of writing `packages/app/src/**` and\n`packages/core/src/**` (which collide on shared zone names), set\n`root: \"packages/app/\"` and `patterns: [\"src/**\"]` per package.\n\nTrailing slash and leading `./` are normalized; backslashes are\nconverted to forward slashes. Patterns must NOT redundantly include\nthe root prefix: `root: \"packages/app/\"` with\n`patterns: [\"packages/app/src/**\"]` is rejected with\n`FALLOW-BOUNDARY-ROOT-REDUNDANT-PREFIX` because patterns are\nresolved relative to the root.",
           "type": [
@@ -1069,8 +1081,7 @@
         }
       },
       "required": [
-        "name",
-        "patterns"
+        "name"
       ]
     },
     "BoundaryRule": {
@@ -1419,6 +1430,16 @@
             }
           ]
         },
+        "empty-catalog-groups": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "unresolved-catalog-references": {
           "anyOf": [
             {

package/skills/fallow/SKILL.md

@@ -95,11 +95,14 @@ cargo install fallow-cli        # build from source
 | Unlisted dependencies | `--unlisted-deps` | Used packages missing from package.json. In monorepos, importing a workspace package from a workspace whose own `package.json` does not list it is reported here too; self-references stay allowed without requiring a package to depend on itself. |
 | Duplicate exports | `--duplicate-exports` | Same symbol exported from multiple modules |
 | Circular dependencies | `--circular-deps` | Import cycles in the module graph |
-| Boundary violations | `--boundary-violations` | Imports crossing architecture zone boundaries. Presets: `layered`, `hexagonal`, `feature-sliced`, `bulletproof` |
+| Boundary violations | `--boundary-violations` | Imports crossing architecture zone boundaries. Presets: `layered`, `hexagonal`, `feature-sliced`, `bulletproof`; `autoDiscover` can create one zone per feature directory |
 | Stale suppressions | `--stale-suppressions` | `fallow-ignore` comments or `@expected-unused` JSDoc tags that no longer match any issue |
 | Test-only dependencies | n/a | Production deps only imported from test files (should be devDependencies) |
 | Unused pnpm catalog entries | `--unused-catalog-entries` | `pnpm-workspace.yaml` entries no workspace package.json references via `catalog:` (default `warn`) |
+| Empty pnpm catalog groups | `--empty-catalog-groups` | Named `catalogs.<name>:` groups in `pnpm-workspace.yaml` with no entries. Top-level `catalog:` placeholders are ignored. Default `warn`. |
 | Unresolved pnpm catalog references | `--unresolved-catalog-references` | `package.json` references to `catalog:` / `catalog:<name>` whose catalog does not declare the package; `pnpm install` would fail. Default `error`. Suppress via `ignoreCatalogReferences: [{ package, catalog?, consumer? }]` in fallow config (package.json has no comment syntax). |
+| Unused pnpm dependency overrides | `--unused-dependency-overrides` | `pnpm-workspace.yaml#overrides` / `package.json#pnpm.overrides` entries whose target package is not declared by any workspace `package.json` and is not present in `pnpm-lock.yaml`. Default `warn`. When the lockfile is missing or unreadable the check degrades to a manifest-only fallback and every finding carries a `hint` reminding consumers to verify before removal. Suppress via `ignoreDependencyOverrides: [{ package, source? }]` in fallow config. |
+| Misconfigured pnpm dependency overrides | `--misconfigured-dependency-overrides` | `pnpm.overrides` entries whose key is unparsable (empty, dangling separators, malformed selectors) or value is missing/empty. `pnpm install` would fail. Default `error`. Suppression: same `ignoreDependencyOverrides` config rule. |
 
 ## MCP Tools
 

package/skills/fallow/references/cli-reference.md

@@ -72,6 +72,11 @@ Analyzes the project for unused files, exports, dependencies, types, members, an
 | `--circular-deps` | Circular dependencies |
 | `--boundary-violations` | Boundary violations (imports crossing architecture zone boundaries) |
 | `--stale-suppressions` | Stale suppression comments or `@expected-unused` JSDoc tags |
+| `--unused-catalog-entries` | Unused pnpm catalog entries |
+| `--empty-catalog-groups` | Empty named pnpm catalog groups |
+| `--unresolved-catalog-references` | Package references to missing pnpm catalog entries |
+| `--unused-dependency-overrides` | Unused pnpm dependency overrides |
+| `--misconfigured-dependency-overrides` | Malformed pnpm dependency overrides |
 
 ### Examples
 
@@ -192,7 +197,7 @@ fallow dupes --format json --quiet --baseline fallow-baselines/dupes.json --thre
 
 ## `fix`: Auto-Remove Unused Code
 
-Auto-removes unused exports and dependencies.
+Auto-removes unused exports, dependencies, enum members, and pnpm catalog entries.
 
 ### Flags
 
@@ -204,6 +209,13 @@ Auto-removes unused exports and dependencies.
 | `--format` | `human\|json` | `human` | Output format |
 | `--quiet` | bool | `false` | Suppress progress bars |
 
+### What gets fixed
+
+- Unused exports (removes the `export` keyword; whole-enum block when every member is unused)
+- Unused dependencies (removed from `package.json`)
+- Unused enum members (removed from the declaration)
+- Unused pnpm catalog entries (removed from `pnpm-workspace.yaml` by line-aware deletion; comments preserved). When the last entry of a catalog group is removed, the header is rewritten to `catalog: {}` / `<name>: {}` so pnpm doesn't reject the resulting null value. Entries with non-empty `hardcoded_consumers` are skipped to avoid breaking `pnpm install`; the skip is surfaced in the JSON fix output as `{"type": "remove_catalog_entry", "applied": false, "skipped": true, "skip_reason": "hardcoded_consumers", "consumers": [...]}`. After a successful catalog edit the CLI emits a one-line `Run pnpm install to refresh pnpm-lock.yaml` reminder. The JSON envelope carries a top-level `"skipped"` count alongside `"total_fixed"` for partial-fix gating.
+
 ### Examples
 
 ```bash
@@ -425,7 +437,7 @@ fallow health --format json --quiet --trend
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.74.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -811,7 +823,7 @@ fallow audit \
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.74.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -884,7 +896,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.74.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1303,7 +1315,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.74.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1450,7 +1462,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 ```json
 {
   "schema_version": 3,
-  "version": "2.72.0",
+  "version": "2.74.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1494,7 +1506,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "check": {
     "schema_version": 3,
-    "version": "2.72.0",
+    "version": "2.74.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],
@@ -1516,7 +1528,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "dupes": {
     "schema_version": 3,
-    "version": "2.72.0",
+    "version": "2.74.0",
     "elapsed_ms": 82,
     "total_clones": 15,
     "total_lines_duplicated": 230,
@@ -1525,7 +1537,7 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
   },
   "health": {
     "schema_version": 3,
-    "version": "2.72.0",
+    "version": "2.74.0",
     "elapsed_ms": 32,
     "summary": {},
     "findings": [],
@@ -1607,10 +1619,20 @@ Config files are searched in priority order: `.fallowrc.json` > `.fallowrc.jsonc
     "ignorePatterns": ["**/*.generated.ts"]
   },
 
-  // Architecture boundaries (preset or custom zones/rules)
+  // Architecture boundaries (preset, custom zones/rules, or auto-discovered feature zones)
   // Presets: "layered", "hexagonal", "feature-sliced", "bulletproof"
   "boundaries": {
     "preset": "bulletproof"
+    // Or:
+    // "zones": [
+    //   { "name": "app", "patterns": ["src/app/**"] },
+    //   { "name": "features", "autoDiscover": ["src/features"] },
+    //   { "name": "shared", "patterns": ["src/shared/**"] }
+    // ],
+    // "rules": [
+    //   { "from": "app", "allow": ["features", "shared"] },
+    //   { "from": "features", "allow": ["shared"] }
+    // ]
   },
 
   // Production mode

package/types/output-contract.d.ts

@@ -117,12 +117,16 @@ stale_suppressions: StaleSuppression[]
  * Entries in pnpm-workspace.yaml's catalog: or catalogs: sections not referenced by any workspace package via the catalog: protocol.
  */
 unused_catalog_entries?: UnusedCatalogEntry[]
+/**
+ * Named groups under pnpm-workspace.yaml's catalogs: section that declare no package entries. The top-level catalog: map is not reported.
+ */
+empty_catalog_groups?: EmptyCatalogGroup[]
 /**
  * Workspace package.json references to catalogs (catalog: or catalog:<name>) that do not declare the consumed package. pnpm install will error until the named catalog grows to include the package or the reference is switched / removed.
  */
 unresolved_catalog_references?: UnresolvedCatalogReference[]
 /**
- * Entries in pnpm-workspace.yaml's overrides: section, or package.json's pnpm.overrides block, whose target package no workspace package depends on. Default severity is warn because some entries are intentional pins for transitive CVEs; the hint field flags the cases the conservative algorithm cannot disambiguate.
+ * Entries in pnpm-workspace.yaml's overrides: section, or package.json's pnpm.overrides block, whose target package is not declared by any workspace package and is not present in pnpm-lock.yaml. Default severity is warn because projects without a readable lockfile fall back to manifest-only checks; the hint field flags those conservative cases.
  */
 unused_dependency_overrides?: UnusedDependencyOverride[]
 /**
@@ -151,7 +155,7 @@ export interface FixAction {
 /**
  * Kebab-case identifier for the fix action.
  */
-type: ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override")
+type: ("remove-export" | "delete-file" | "remove-dependency" | "move-dependency" | "remove-enum-member" | "remove-class-member" | "resolve-import" | "install-dependency" | "remove-duplicate" | "move-to-dev" | "refactor-cycle" | "refactor-boundary" | "export-type" | "remove-catalog-entry" | "remove-empty-catalog-group" | "update-catalog-reference" | "add-catalog-entry" | "remove-catalog-reference" | "remove-dependency-override" | "fix-dependency-override")
 /**
  * Whether `fallow fix` can apply this fix automatically.
  */
@@ -215,9 +219,9 @@ export interface AddToConfigAction {
  */
 type: "add-to-config"
 /**
- * Always false for config actions.
+ * True when `fallow fix` can apply this config action automatically for the current action type. `ignoreExports` duplicate-export actions are auto-fixable when a config file exists; older scalar config-ignore actions remain manual.
  */
-auto_fixable: false
+auto_fixable: boolean
 /**
  * Human-readable description of the config change.
  */
@@ -604,6 +608,25 @@ hardcoded_consumers?: string[]
 actions?: IssueAction[]
 introduced?: AuditIntroduced
 }
+/**
+ * A named pnpm catalog group under catalogs: with no package entries.
+ */
+export interface EmptyCatalogGroup {
+/**
+ * Named catalog group under the top-level catalogs: map.
+ */
+catalog_name: string
+/**
+ * Relative path to pnpm-workspace.yaml.
+ */
+path: string
+/**
+ * 1-based line number of the empty catalog group header.
+ */
+line: number
+actions?: IssueAction[]
+introduced?: AuditIntroduced
+}
 /**
  * A workspace package.json reference (catalog: or catalog:<name>) pointing at a catalog that does not declare the consumed package. `pnpm install` will fail with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_CATALOG_PROTOCOL.
  */
@@ -668,7 +691,7 @@ path: string
  */
 line: number
 /**
- * Soft hint for cases the conservative algorithm cannot disambiguate (e.g. a transitive CVE pin not visible to static analysis). Omitted when absent.
+ * Soft hint reminding consumers to verify the override before removal. Present because projects without a readable lockfile use the conservative package-manifest fallback. Omitted when absent.
  */
 hint?: string
 actions?: IssueAction[]
@@ -739,6 +762,7 @@ circular_dependencies?: number
 boundary_violations?: number
 stale_suppressions?: number
 unused_catalog_entries?: number
+empty_catalog_groups?: number
 unresolved_catalog_references?: number
 unused_dependency_overrides?: number
 misconfigured_dependency_overrides?: number