fallow 2.82.0 → 2.83.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.82.0",
+  "version": "2.83.0",
   "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 96 framework plugins.",
   "license": "MIT",
   "repository": {
@@ -83,13 +83,13 @@
     "@tanstack/intent": "0.0.41"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.82.0",
-    "@fallow-cli/darwin-x64": "2.82.0",
-    "@fallow-cli/linux-x64-gnu": "2.82.0",
-    "@fallow-cli/linux-arm64-gnu": "2.82.0",
-    "@fallow-cli/linux-x64-musl": "2.82.0",
-    "@fallow-cli/linux-arm64-musl": "2.82.0",
-    "@fallow-cli/win32-arm64-msvc": "2.82.0",
-    "@fallow-cli/win32-x64-msvc": "2.82.0"
+    "@fallow-cli/darwin-arm64": "2.83.0",
+    "@fallow-cli/darwin-x64": "2.83.0",
+    "@fallow-cli/linux-x64-gnu": "2.83.0",
+    "@fallow-cli/linux-arm64-gnu": "2.83.0",
+    "@fallow-cli/linux-x64-musl": "2.83.0",
+    "@fallow-cli/linux-arm64-musl": "2.83.0",
+    "@fallow-cli/win32-arm64-msvc": "2.83.0",
+    "@fallow-cli/win32-x64-msvc": "2.83.0"
   }
 }

package/schema.json

@@ -64,6 +64,14 @@
       },
       "default": []
     },
+    "ignoreUnresolvedImports": {
+      "description": "Import specifier glob patterns whose `unresolved-import` findings are\nexpected and should be suppressed.\n\nMatching is against the raw import specifier string, not a filesystem\npath. Exact specifiers and subpaths must be listed separately when both\nshould be ignored, for example `[\"@example/icons\", \"@example/icons/**\"]`.\nBroad patterns such as `\"**\"` can hide real missing modules, so keep\nthis list focused on generated or runtime-provided specifiers.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
     "ignoreExports": {
       "description": "Export ignore rules.",
       "type": "array",
@@ -277,6 +285,11 @@
       "type": "boolean",
       "default": false
     },
+    "autoImports": {
+      "description": "Resolve framework convention auto-imports (Nuxt components) as real\nmodule-graph edges, and stop treating the covered convention directories\nas always-used entry points.\n\nWhen `false` (default), auto-import edges are still synthesized additively\n(so a component's default export consumed via a `<Card />` template tag is\ncredited under `includeEntryExports`), but the convention directories stay\nregistered as entry points, so genuinely-unreferenced components are never\nreported as `unused-file`.\n\nWhen `true`, the Nuxt plugin drops its component entry patterns\n(`components/**`, `app/components/**`) so an unreferenced component is\nreported as `unused-file`. This is opt-in because non-flat projects\n(custom `prefix` / `pathPrefix` / `dirs` in `nuxt.config`, dynamic\n`<component :is>`, `@nuxt/content` MDC) are not fully modeled yet and could\nproduce false positives. As a guard, if `nuxt.config` declares a\n`components:` key the entry patterns are kept regardless. Composable and\nutil entry patterns are unaffected until convention resolution covers\nthem. See issue #704.",
+      "type": "boolean",
+      "default": false
+    },
     "cache": {
       "description": "Incremental cache tuning. Today the only knob is `maxSizeMb`, which\ncaps the on-disk cache and triggers LRU eviction during save. See\n[`CacheConfig`].",
       "$ref": "#/$defs/CacheConfig"

package/scripts/run-binary.js

@@ -85,7 +85,25 @@ function writeVerifiedLineIfVersionQuery(verifyResult) {
   }
 }
 
+// Swallow EPIPE on stdout. When fallow's output is piped into a reader that
+// closes early (e.g. `fallow --version | head`), the trailing `verified:`
+// status line would otherwise surface as an unhandled EPIPE 'error' event and
+// dump a Node stack trace. EPIPE arrives as an async 'error' event on the
+// stdout stream, not as a throw, so a try/catch around the write cannot catch
+// it. The child binary's primary output is already written via inherited
+// stdio; the status line is best-effort, so exit cleanly once the reader is
+// gone. Scoped to stdout so a genuine error write to stderr still sets exit 1.
+function guardBrokenStdout() {
+  process.stdout.on("error", (err) => {
+    if (err && err.code === "EPIPE") {
+      process.exit(0);
+    }
+    throw err;
+  });
+}
+
 function runBinary(binaryBaseName) {
+  guardBrokenStdout();
   const { pkg, manifestPath, platformPkgDir } = resolvePlatformPaths();
 
   const binaryName = process.platform === "win32" ? `${binaryBaseName}.exe` : binaryBaseName;
@@ -119,4 +137,5 @@ module.exports = {
   runBinary,
   describeVerified, // test-only
   isVersionQuery, // test-only
+  guardBrokenStdout, // test-only
 };

package/scripts/run-binary.test.js

@@ -0,0 +1,39 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+
+const RUN_BINARY = path.join(__dirname, "run-binary.js");
+
+// Run a child that installs guardBrokenStdout, then emits a synthetic stdout
+// 'error' with the given code. Node delivers a broken-pipe failure as exactly
+// this event ("Emitted 'error' event on Socket instance"), so emitting it is a
+// faithful reproduction of `fallow --version | head` without needing a live
+// pipe or an installed @fallow-cli platform package. Requiring run-binary.js
+// has no side effects beyond defining functions, so no binary is resolved.
+function runGuardChild(errorCode) {
+  const script =
+    `const { guardBrokenStdout } = require(${JSON.stringify(RUN_BINARY)});` +
+    `guardBrokenStdout();` +
+    `process.stdout.emit("error", Object.assign(new Error("write ${errorCode}"), { code: "${errorCode}" }));` +
+    // Reached only if the guard neither exited (EPIPE) nor rethrew (other).
+    `process.exit(42);`;
+  return spawnSync(process.execPath, ["-e", script], { encoding: "utf8" });
+}
+
+test("guardBrokenStdout swallows EPIPE on stdout and exits 0", () => {
+  const res = runGuardChild("EPIPE");
+  assert.equal(res.status, 0, "EPIPE on stdout should exit 0 cleanly, not crash");
+  assert.doesNotMatch(res.stderr, /EPIPE/, "no EPIPE stack trace on stderr");
+});
+
+test("guardBrokenStdout rethrows non-EPIPE stdout errors (exit 1)", () => {
+  const res = runGuardChild("ENOSPC");
+  assert.equal(res.status, 1, "a non-EPIPE stdout error must surface, not be swallowed");
+  // Match the thrown error's header ("Error: write ENOSPC"), not just the
+  // message substring: a missing-guard TypeError would leak the script source
+  // (`new Error("write ENOSPC")`) into its code frame and match a looser regex,
+  // masking a regression. The colon-space header only appears on a real rethrow.
+  assert.match(res.stderr, /Error: write ENOSPC/, "the rethrown error reaches stderr");
+  assert.doesNotMatch(res.stderr, /is not a function/, "guard must be present, not absent");
+});

package/types/output-contract.d.ts

@@ -1531,8 +1531,8 @@ introduced?: (AuditIntroduced | null)
 /**
  * Wire-shape envelope for an [`UnresolvedImport`] finding. Mirrors
  * [`UnusedFileFinding`]: flattens the bare finding and carries a typed
- * `actions` array (`resolve-import` primary plus `suppress-line`
- * secondary).
+ * `actions` array (`resolve-import` primary plus config and inline
+ * suppression actions).
  */
 export interface UnresolvedImportFinding {
 /**
@@ -2533,8 +2533,8 @@ vital_signs?: (VitalSigns | null)
 health_score?: (HealthScore | null)
 /**
  * Per-file health scores. Only present when --file-scores is used. Sorted
- * by maintainability_index ascending (worst first). Zero-function files
- * (barrels) are excluded by default.
+ * by risk-aware triage concern, combining low maintainability and high
+ * CRAP risk. Zero-function files (barrels) are excluded by default.
  */
 file_scores?: FileHealthScore[]
 /**
@@ -3740,10 +3740,33 @@ untracked_ratio_percent: number
 }
 export interface RuntimeCoverageFinding {
 /**
- * Stable content-hash ID of the form `fallow:prod:<hash>`, where `<hash>`
- * is the first 8 hex characters of SHA-256(file + function + line + 'prod').
+ * Per-finding suppression key of the form `fallow:prod:<hash>` (first 8 hex
+ * of SHA-256(file + function + line + 'prod')). Hashes the current line, so
+ * it changes when the function moves. Use this to suppress one finding.
  */
 id: string
+/**
+ * Cross-surface join key of the form `fallow:fn:<hash>`
+ * (`fallow_cov_protocol::function_identity_id`, hashes file + name +
+ * start_line). The same function shares ONE value across findings, hot
+ * paths, blast-radius, and importance entries (the per-finding `id` uses a
+ * per-surface salt, so it differs by surface), and across V8, Istanbul,
+ * and oxc producers (columns are excluded from the hash). Like `id`, it
+ * changes when the function's file, name, or start line changes; it is a
+ * cross-surface / cross-producer join key, not a line-move-immune one.
+ * `null` when the producing surface (or an un-migrated cloud) supplied no
+ * `FunctionIdentity`.
+ */
+stable_id?: (string | null)
+/**
+ * Content digest of the function's full-span source slice
+ * (`fallow_cov_protocol::source_hash_for`: first 8 bytes of SHA-256 as 16
+ * lowercase hex). Unlike `stable_id`, this is stable across line moves: a
+ * moved-but-unedited function keeps the same value, so baselines can
+ * suppress it after a pure line shift. `null` when the producing surface
+ * supplied no `source_hash`.
+ */
+source_hash?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -3825,6 +3848,12 @@ export interface RuntimeCoverageHotPath {
  * Stable content-hash ID of the form `fallow:hot:<hash>`.
  */
 id: string
+/**
+ * Cross-surface join key (`fallow:fn:<hash>`) for the hot function. Stable
+ * across line moves; shared with the same function's findings / blast /
+ * importance entries. `null` when no `FunctionIdentity` was supplied.
+ */
+stable_id?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -3865,6 +3894,12 @@ export interface RuntimeCoverageBlastRadiusEntry {
  * Stable content-hash ID of the form `fallow:blast:<hash>`.
  */
 id: string
+/**
+ * Cross-surface join key (`fallow:fn:<hash>`) for the function. Stable
+ * across line moves; shared with the same function's findings / hot-path /
+ * importance entries. `null` when no `FunctionIdentity` was supplied.
+ */
+stable_id?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -3897,6 +3932,12 @@ export interface RuntimeCoverageImportanceEntry {
  * Stable content-hash ID of the form `fallow:importance:<hash>`.
  */
 id: string
+/**
+ * Cross-surface join key (`fallow:fn:<hash>`) for the function. Stable
+ * across line moves; shared with the same function's findings / hot-path /
+ * blast-radius entries. `null` when no `FunctionIdentity` was supplied.
+ */
+stable_id?: (string | null)
 /**
  * File path relative to the project root.
  */
@@ -4939,8 +4980,8 @@ vital_signs?: (VitalSigns | null)
 health_score?: (HealthScore | null)
 /**
  * Per-file health scores. Only present when --file-scores is used. Sorted
- * by maintainability_index ascending (worst first). Zero-function files
- * (barrels) are excluded by default.
+ * by risk-aware triage concern, combining low maintainability and high
+ * CRAP risk. Zero-function files (barrels) are excluded by default.
  */
 file_scores?: FileHealthScore[]
 /**