fallow 2.78.0 → 2.79.0

package/README.md

@@ -1,14 +1,18 @@
 # fallow
 
-Codebase intelligence for TypeScript and JavaScript, built in Rust.
+**Deterministic codebase intelligence for TypeScript and JavaScript.**
+
+Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents.
 
 [![CI](https://github.com/fallow-rs/fallow/actions/workflows/ci.yml/badge.svg)](https://github.com/fallow-rs/fallow/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/fallow.svg)](https://www.npmjs.com/package/fallow)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/fallow-rs/fallow/blob/main/LICENSE)
 
-Static analysis finds what is connected. Runtime intelligence finds what actually runs. Both land in the same report. The free static layer analyzes your codebase for unused files, exports, dependencies, and types, detects circular dependencies, finds duplicated code blocks, surfaces complexity hotspots, and enforces architecture boundaries. An optional paid runtime layer (Fallow Runtime) adds production execution evidence so you can delete and refactor with confidence. **5-41x faster** than [knip](https://knip.dev) v5 (**2-18x faster** than knip v6), **8-29x faster** than [jscpd](https://github.com/kucherenko/jscpd) for duplication detection, with no Node.js runtime dependency.
+Fallow turns a JS/TS repository into a trusted quality report: health score, changed-code risk, hotspots, duplication, architecture issues, dependency hygiene, and cleanup opportunities.
+
+It helps you answer: what changed, what got riskier, what should be reviewed, what should be refactored, and what can be safely removed. No AI inside the analyzer. Fallow produces deterministic findings, typed output contracts, and traceable explanations that downstream tools can trust.
 
-Static analysis is free and open source. Runtime intelligence is the paid team layer.
+Static analysis is free and open source. An optional paid runtime layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 97 framework plugins, 5-41x faster than [knip](https://knip.dev) v5 (2-18x faster than knip v6), 8-29x faster than [jscpd](https://github.com/kucherenko/jscpd) for duplication detection, with no Node.js runtime dependency for analysis.
 
 ## Installation
 
@@ -36,31 +40,29 @@ import type { CheckOutput, FallowJsonOutput } from "fallow/types";
 
 The types are generated from the same schema as the VS Code extension and pin to the CLI version you install. See [docs.fallow.tools](https://docs.fallow.tools) for the full output contract.
 
-## Usage
+## Quick start
 
 ```bash
-fallow                           # All analyses -- zero config, sub-second
-fallow dead-code                 # Unused code only
-fallow dupes                     # Duplication detection -- find copy-paste clones
-fallow dupes --mode semantic     # Catch clones with renamed variables
-fallow health                    # Complexity metrics -- cyclomatic + cognitive
-fallow fix --dry-run             # Preview auto-removal of unused exports and deps
+npx fallow audit                 # PR-style audit: verdict pass / warn / fail
+npx fallow audit --format json   # Machine-readable audit (for CI and agents)
+npx fallow health --score        # Quality score and grade
+npx fallow                       # Full codebase analysis: health + duplication + cleanup
+npx fallow dead-code             # Cleanup-specific findings
+npx fallow fix --dry-run         # Preview automatic cleanup
 ```
 
-## What it finds
-
-- **Unused files** -- not reachable from any entry point
-- **Unused exports** -- exported symbols never imported elsewhere
-- **Unused types** -- type aliases and interfaces never referenced
-- **Unused dependencies** -- packages in `dependencies` never imported
-- **Unused devDependencies** -- dev packages not referenced
-- **Unused enum members** -- enum values never referenced
-- **Unused class members** -- class methods and properties never referenced (tracks instance usage: `const svc = new MyService(); svc.greet()` counts `greet` as used)
-- **Unresolved imports** -- import specifiers that cannot be resolved
-- **Unlisted dependencies** -- imported packages missing from `package.json`
-- **Duplicate exports** -- same symbol exported from multiple modules
-- **Circular dependencies** -- import cycles in the module graph
-- **Type-only dependencies** -- production deps only used via `import type`
+## What Fallow reports
+
+- **Quality score** -- compact health score with grade and trend delta when snapshot history is enabled
+- **PR risk** -- changed-code analysis with pass / warn / fail verdict and per-finding attribution
+- **Hotspots** -- functions, files, and packages combining complexity, churn, size, and coupling
+- **Duplication** -- clone families across four detection modes (strict, mild, weak, semantic)
+- **Architecture** -- circular dependencies, boundary violations, re-export chains
+- **Dependency hygiene** -- unused, unlisted, unresolved, duplicate, and type-only deps; pnpm catalog and overrides
+- **Cleanup opportunities** -- unused files, exports, types, enum members, class members, stale suppressions
+- **Runtime intelligence (optional, paid)** -- hot paths, cold code, runtime-weighted health, stale flags
+
+Cleanup opportunities are findings that look safe to review for removal because no graph evidence supports keeping them. Dead code is one category of cleanup, not the product identity.
 
 ## Code duplication
 
@@ -71,11 +73,24 @@ fallow dupes --threshold 5         # Fail CI if duplication exceeds 5%
 fallow dupes --save-baseline       # Save current duplication as baseline
 ```
 
-4 detection modes (strict, mild, weak, semantic), clone family grouping with refactoring suggestions, baseline tracking, and cross-language TS/JS matching.
+Four detection modes (strict, mild, weak, semantic), clone family grouping with refactoring suggestions, baseline tracking, and cross-language TS/JS matching.
+
+## Built for agents
+
+Fallow gives AI agents structured repo truth instead of forcing them to infer everything from grep. Agents call the CLI or the MCP server to answer:
+
+- Who imports this symbol?
+- Why is this export considered used or unused?
+- What changed in this PR?
+- Which files are risky to touch?
+- What duplicate siblings exist?
+- What cleanup action is safest?
+
+Every issue in `--format json` carries a machine-actionable `actions` array with an `auto_fixable` flag so agents can self-correct.
 
 ## Framework support
 
-95 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, AdonisJS, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
+97 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, AdonisJS, Ember, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
 
 ## Configuration
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fallow",
-  "version": "2.78.0",
-  "description": "Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 95 framework plugins.",
+  "version": "2.79.0",
+  "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 96 framework plugins.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -17,14 +17,21 @@
     "docs": "https://docs.fallow.tools"
   },
   "keywords": [
-    "unused-code",
-    "circular-dependencies",
+    "code-intelligence",
+    "code-quality",
+    "pr-risk",
+    "static-analysis",
     "code-duplication",
-    "lint",
-    "analyzer",
+    "circular-dependencies",
+    "unused-code",
+    "complexity",
+    "architecture",
     "typescript",
     "javascript",
-    "static-analysis",
+    "analyzer",
+    "lint",
+    "lsp",
+    "mcp",
     "agent-skills",
     "tanstack-intent"
   ],
@@ -74,13 +81,13 @@
     "@tanstack/intent": "0.0.41"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.78.0",
-    "@fallow-cli/darwin-x64": "2.78.0",
-    "@fallow-cli/linux-x64-gnu": "2.78.0",
-    "@fallow-cli/linux-arm64-gnu": "2.78.0",
-    "@fallow-cli/linux-x64-musl": "2.78.0",
-    "@fallow-cli/linux-arm64-musl": "2.78.0",
-    "@fallow-cli/win32-arm64-msvc": "2.78.0",
-    "@fallow-cli/win32-x64-msvc": "2.78.0"
+    "@fallow-cli/darwin-arm64": "2.79.0",
+    "@fallow-cli/darwin-x64": "2.79.0",
+    "@fallow-cli/linux-x64-gnu": "2.79.0",
+    "@fallow-cli/linux-arm64-gnu": "2.79.0",
+    "@fallow-cli/linux-x64-musl": "2.79.0",
+    "@fallow-cli/linux-arm64-musl": "2.79.0",
+    "@fallow-cli/win32-arm64-msvc": "2.79.0",
+    "@fallow-cli/win32-x64-msvc": "2.79.0"
   }
 }

package/scripts/verify-binary.js

@@ -2,18 +2,27 @@
 //
 // Verifies each platform binary against a .sig file shipped alongside it in
 // the @fallow-cli/<platform> package, then cross-checks the binary bytes
-// against the SHA-256 digest published by GitHub Releases for the matching
-// version/platform asset. The .sig is produced at release time by
-// `.github/scripts/sign-binary.mjs` using the workflow's
+// against an expected SHA-256 digest. The .sig is produced at release time
+// by `.github/scripts/sign-binary.mjs` using the workflow's
 // ED25519_BINARY_SIGNING_PRIVATE_KEY secret. The matching public key (32 raw
 // bytes) is embedded below and is identical to the value already trusted by
 // the VS Code extension at editors/vscode/src/download.ts:19-22.
 //
+// SHA-256 digest source (in order of preference, refs #465 and #597):
+//   1. `fallowDigests` field in the platform package's package.json, written
+//      at release time by the `npm-prep` job. This is the steady-state path:
+//      no network traffic, immune to GitHub API rate limits.
+//   2. Fallback: GitHub Release asset digest via the public REST API. Kept
+//      for backwards compatibility with platform packages published before
+//      #597 that lack the embedded field. Shared-IP CI runners (Buildkite,
+//      pooled GHA runners) can exceed the 60 req/hr unauthenticated limit;
+//      that failure mode is what motivated #597.
+//
 // Triggered from scripts/postinstall.js and from the GitHub Action installer
 // at action/scripts/install.sh. The escape hatch FALLOW_SKIP_BINARY_VERIFY=1
 // is documented in SECURITY.md.
 //
-// No external dependencies: uses node:crypto and node:fs only. Refs #465.
+// No external dependencies: uses node:crypto and node:fs only.
 
 const crypto = require('node:crypto');
 const fs = require('node:fs');
@@ -211,6 +220,31 @@ function platformPackageDir(pkg, resolveFrom) {
   return { dir: path.dirname(manifestPath), manifestPath };
 }
 
+// Read the SHA-256 digest for a binary embedded in the platform package's
+// package.json (written by the npm-prep job at release time as
+// `fallowDigests[<filename>]`). Returns the normalized digest hex or null
+// when the manifest does not exist, cannot be parsed, lacks the field, or
+// the value is malformed. Refs #597.
+function readEmbeddedDigest(manifestPath, binaryFileName) {
+  if (typeof manifestPath !== 'string' || manifestPath.length === 0) {
+    return null;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!manifest || typeof manifest !== 'object') {
+    return null;
+  }
+  const digests = manifest.fallowDigests;
+  if (!digests || typeof digests !== 'object') {
+    return null;
+  }
+  return normalizeDigest(digests[binaryFileName]);
+}
+
 function binaryTargetsForPlatform(platformId) {
   const isWindows = process.platform === 'win32';
   const ext = isWindows ? '.exe' : '';
@@ -265,6 +299,9 @@ async function verifyInstalled(options) {
     pkg = '<override>';
     version = opts.version || '0.0.0';
     platformId = opts.platformId || 'test-platform';
+    // Lets tests drop a package.json next to the binaries to exercise the
+    // embedded-digest path. readEmbeddedDigest returns null when missing.
+    manifestPath = path.join(dir, 'package.json');
   } else {
     if (process.platform !== 'linux') {
       pkg = getPlatformPackage(process.platform, process.arch);
@@ -308,22 +345,33 @@ async function verifyInstalled(options) {
     if (!result.ok) {
       return { ...result, binary: binaryPath, package: pkg };
     }
-    let expectedDigest;
-    try {
-      expectedDigest = await digestProvider({
-        assetName: target.asset,
-        binaryPath,
-        packageName: pkg,
-        version,
-      });
-    } catch (err) {
-      return {
-        ok: false,
-        code: 'digest-unavailable',
-        message: `cannot load SHA-256 digest for ${target.asset}: ${err.message}`,
-        binary: binaryPath,
-        package: pkg,
-      };
+    // Prefer the digest embedded in the platform package's package.json
+    // (written at release time by `npm-prep`). Falling back to the GitHub
+    // release API only when no embedded digest is present preserves
+    // backwards compatibility with platform packages published before #597.
+    // The shared-IP CI rate-limit failure mode that motivated #597 only
+    // affects the fallback path, so the steady-state install path is now
+    // fully offline.
+    let expectedDigest = manifestPath
+      ? readEmbeddedDigest(manifestPath, target.binary)
+      : null;
+    if (!expectedDigest) {
+      try {
+        expectedDigest = await digestProvider({
+          assetName: target.asset,
+          binaryPath,
+          packageName: pkg,
+          version,
+        });
+      } catch (err) {
+        return {
+          ok: false,
+          code: 'digest-unavailable',
+          message: `cannot load SHA-256 digest for ${target.asset}: ${err.message}`,
+          binary: binaryPath,
+          package: pkg,
+        };
+      }
     }
     const digestResult = verifyDigestAt(binaryPath, expectedDigest);
     if (!digestResult.ok) {
@@ -340,6 +388,7 @@ module.exports = {
   _verifyWithKey,
   fetchReleaseDigest,
   normalizeDigest,
+  readEmbeddedDigest,
   sha256Hex,
   EMBEDDED_PUBLIC_KEY,
   ED25519_SPKI_HEADER,

package/scripts/verify-binary.test.js

@@ -12,6 +12,7 @@ const {
   verifyInstalled,
   sha256Hex,
   normalizeDigest,
+  readEmbeddedDigest,
   EMBEDDED_PUBLIC_KEY,
   ED25519_SPKI_HEADER,
   SKIP_ENV,
@@ -381,6 +382,141 @@ test('verifyInstalled honors FALLOW_SKIP_BINARY_VERIFY', async (t) => {
   assert.equal(result.skipped, true);
 });
 
+function computeDigestsForDir(dir) {
+  const ext = process.platform === 'win32' ? '.exe' : '';
+  const out = {};
+  for (const base of ['fallow', 'fallow-lsp', 'fallow-mcp']) {
+    const fileName = `${base}${ext}`;
+    const full = path.join(dir, fileName);
+    out[fileName] = 'sha256:' + crypto.createHash('sha256').update(fs.readFileSync(full)).digest('hex');
+  }
+  return out;
+}
+
+function writeManifest(dir, body) {
+  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(body));
+}
+
+test('readEmbeddedDigest returns null when manifest is missing', () => {
+  assert.equal(readEmbeddedDigest('/does/not/exist/package.json', 'fallow'), null);
+});
+
+test('readEmbeddedDigest returns null when fallowDigests field is absent', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fallow-vbtest-emb-'));
+  t.after(() => cleanup(dir));
+  writeManifest(dir, { name: '@fallow-cli/x', version: '1.0.0' });
+  assert.equal(readEmbeddedDigest(path.join(dir, 'package.json'), 'fallow'), null);
+});
+
+test('readEmbeddedDigest returns null when the per-binary entry is malformed', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fallow-vbtest-emb-'));
+  t.after(() => cleanup(dir));
+  writeManifest(dir, {
+    name: '@fallow-cli/x',
+    version: '1.0.0',
+    fallowDigests: { fallow: 'not-a-real-digest' },
+  });
+  assert.equal(readEmbeddedDigest(path.join(dir, 'package.json'), 'fallow'), null);
+});
+
+test('readEmbeddedDigest returns normalized hex for a valid sha256: prefixed entry', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fallow-vbtest-emb-'));
+  t.after(() => cleanup(dir));
+  const hex = 'a'.repeat(64);
+  writeManifest(dir, {
+    name: '@fallow-cli/x',
+    version: '1.0.0',
+    fallowDigests: { fallow: 'sha256:' + hex },
+  });
+  assert.equal(readEmbeddedDigest(path.join(dir, 'package.json'), 'fallow'), hex);
+});
+
+test('verifyInstalled uses the embedded digest without calling the provider', async (t) => {
+  const { privateKey, rawPub } = makeKeypair();
+  const dir = makePlatformDir(privateKey);
+  t.after(() => cleanup(dir));
+  writeManifest(dir, {
+    name: '@fallow-cli/x',
+    version: '1.0.0',
+    fallowDigests: computeDigestsForDir(dir),
+  });
+  let providerCalls = 0;
+  const result = await verifyInstalled({
+    dirOverride: dir,
+    verifyFn: (p) => _verifyWithKey(p, rawPub),
+    digestProvider: () => {
+      providerCalls += 1;
+      return Promise.reject(new Error('provider should not be called'));
+    },
+  });
+  assert.equal(result.ok, true, JSON.stringify(result));
+  assert.equal(providerCalls, 0);
+});
+
+test('verifyInstalled falls back to the provider when the embedded digest is missing', async (t) => {
+  const { privateKey, rawPub } = makeKeypair();
+  const dir = makePlatformDir(privateKey);
+  t.after(() => cleanup(dir));
+  // No package.json at all; legacy platform package shape.
+  let providerCalls = 0;
+  const result = await verifyInstalled({
+    dirOverride: dir,
+    verifyFn: (p) => _verifyWithKey(p, rawPub),
+    digestProvider: ({ binaryPath }) => {
+      providerCalls += 1;
+      return Promise.resolve('sha256:' + crypto.createHash('sha256').update(fs.readFileSync(binaryPath)).digest('hex'));
+    },
+  });
+  assert.equal(result.ok, true);
+  assert.equal(providerCalls, 3);
+});
+
+test('verifyInstalled falls back to the provider when fallowDigests is partial / malformed', async (t) => {
+  const { privateKey, rawPub } = makeKeypair();
+  const dir = makePlatformDir(privateKey);
+  t.after(() => cleanup(dir));
+  writeManifest(dir, {
+    name: '@fallow-cli/x',
+    version: '1.0.0',
+    fallowDigests: { fallow: 'not-a-real-digest' },
+  });
+  let providerCalls = 0;
+  const result = await verifyInstalled({
+    dirOverride: dir,
+    verifyFn: (p) => _verifyWithKey(p, rawPub),
+    digestProvider: ({ binaryPath }) => {
+      providerCalls += 1;
+      return Promise.resolve('sha256:' + crypto.createHash('sha256').update(fs.readFileSync(binaryPath)).digest('hex'));
+    },
+  });
+  assert.equal(result.ok, true);
+  // One call per binary because all three entries fail to normalize.
+  assert.equal(providerCalls, 3);
+});
+
+test('verifyInstalled returns digest-mismatch when the embedded digest disagrees with the binary', async (t) => {
+  const { privateKey, rawPub } = makeKeypair();
+  const dir = makePlatformDir(privateKey);
+  t.after(() => cleanup(dir));
+  const ext = process.platform === 'win32' ? '.exe' : '';
+  writeManifest(dir, {
+    name: '@fallow-cli/x',
+    version: '1.0.0',
+    fallowDigests: {
+      [`fallow${ext}`]: 'sha256:' + 'a'.repeat(64),
+      [`fallow-lsp${ext}`]: 'sha256:' + 'a'.repeat(64),
+      [`fallow-mcp${ext}`]: 'sha256:' + 'a'.repeat(64),
+    },
+  });
+  const result = await verifyInstalled({
+    dirOverride: dir,
+    verifyFn: (p) => _verifyWithKey(p, rawPub),
+    digestProvider: () => Promise.reject(new Error('should not be reached')),
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.code, 'digest-mismatch');
+});
+
 test('verifyInstalled ignores skip env when allowSkipEnv is false', async (t) => {
   const previous = process.env[SKIP_ENV];
   process.env[SKIP_ENV] = '1';

package/skills/fallow/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fallow
-description: Codebase intelligence for JavaScript and TypeScript. Free static layer finds unused code (files, exports, types, dependencies), code duplication, circular dependencies, complexity hotspots, architecture boundary violations, and feature flag patterns. Runtime coverage merges production execution data into the same health report for hot-path review, cold-path deletion confidence, and stale-flag evidence - a single local capture is free, while continuous/cloud runtime monitoring is paid. 95 framework plugins, zero configuration, sub-second static analysis. Use when asked to analyze code health, find unused code, detect duplicates, check circular dependencies, audit complexity, check architecture boundaries, detect feature flags, clean up the codebase, auto-fix issues, merge runtime coverage, or run fallow.
+description: Codebase intelligence for JavaScript and TypeScript. Free static layer finds unused code (files, exports, types, dependencies), code duplication, circular dependencies, complexity hotspots, architecture boundary violations, and feature flag patterns. Runtime coverage merges production execution data into the same health report for hot-path review, cold-path deletion confidence, and stale-flag evidence - a single local capture is free, while continuous/cloud runtime monitoring is paid. 97 framework plugins, zero configuration, sub-second static analysis. Use when asked to analyze code health, find unused code, detect duplicates, check circular dependencies, audit complexity, check architecture boundaries, detect feature flags, clean up the codebase, auto-fix issues, merge runtime coverage, or run fallow.
 license: MIT
 metadata:
   author: Bart Waardenburg
@@ -10,7 +10,7 @@ metadata:
 
 # Fallow: codebase intelligence for JavaScript and TypeScript
 
-Codebase intelligence for JavaScript and TypeScript. The free static layer finds unused code, circular dependencies, code duplication, complexity hotspots, architecture boundary violations, and feature flag patterns. Runtime coverage merges production execution data into the same `fallow health` report for hot-path review, cold-path deletion confidence, and stale-flag evidence: a single local capture is free, while continuous/cloud runtime monitoring is paid. 95 framework plugins, zero configuration, sub-second static analysis.
+Codebase intelligence for JavaScript and TypeScript. The free static layer finds unused code, circular dependencies, code duplication, complexity hotspots, architecture boundary violations, and feature flag patterns. Runtime coverage merges production execution data into the same `fallow health` report for hot-path review, cold-path deletion confidence, and stale-flag evidence: a single local capture is free, while continuous/cloud runtime monitoring is paid. 97 framework plugins, zero configuration, sub-second static analysis.
 
 ## When to Use
 
@@ -218,7 +218,7 @@ fallow list --entry-points --format json --quiet
 fallow list --plugins --format json --quiet
 ```
 
-Shows detected entry points and active framework plugins (94 built-in: Next.js, Vite, Jest, Storybook, Tailwind, PandaCSS, tap, tsd, etc.).
+Shows detected entry points and active framework plugins (97 built-in: Next.js, Vite, Ember, Jest, Storybook, Tailwind, PandaCSS, tap, tsd, etc.).
 
 ### Production-only analysis
 
@@ -323,7 +323,7 @@ When `--format json` is active and exit code is 2, errors are emitted as JSON on
 
 ## Configuration
 
-Fallow reads config from project root: `.fallowrc.json` > `.fallowrc.jsonc` > `fallow.toml` > `.fallow.toml`. Both `.fallowrc.json` and `.fallowrc.jsonc` accept JSON-with-comments syntax (same parser); the `.jsonc` extension lets editors auto-detect JSONC syntax highlighting. Most projects work with zero configuration thanks to 94 auto-detecting framework plugins.
+Fallow reads config from project root: `.fallowrc.json` > `.fallowrc.jsonc` > `fallow.toml` > `.fallow.toml`. Both `.fallowrc.json` and `.fallowrc.jsonc` accept JSON-with-comments syntax (same parser); the `.jsonc` extension lets editors auto-detect JSONC syntax highlighting. Most projects work with zero configuration thanks to 97 auto-detecting framework plugins.
 
 ```jsonc
 {
@@ -372,7 +372,7 @@ export const deprecatedHelper = () => {};
 ## Key Gotchas
 
 - **`fix --yes` is required** in non-TTY (agent) environments. Without it, `fix` exits with code 2
-- **Zero config by default.** 95 framework plugins auto-detect, including tap and tsd test entry points. Don't create config unless customization is needed
+- **Zero config by default.** 97 framework plugins auto-detect, including tap and tsd test entry points. Don't create config unless customization is needed
 - **Syntactic analysis only.** No TypeScript compiler, so fully dynamic `import(variable)` is not resolved
 - **Function overloads are deduplicated.** TypeScript function overload signatures are merged into a single export (not reported as separate unused exports)
 - **Re-export chains are resolved.** Exports through barrel files are tracked, not falsely flagged