fallow 2.91.0 → 2.93.0

package/README.md

@@ -12,7 +12,7 @@ Fallow turns a JS/TS repository into a trusted quality report: health score, cha
 
 It helps you answer: what changed, what got riskier, what should be reviewed, what should be refactored, and what can be safely removed. No AI inside the analyzer. Fallow produces deterministic findings, typed output contracts, and traceable explanations that downstream tools can trust.
 
-Static analysis is free and open source. An optional paid runtime layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 97 framework plugins, 5-41x faster than [knip](https://knip.dev) v5 (2-18x faster than knip v6), 8-29x faster than [jscpd](https://github.com/kucherenko/jscpd) for duplication detection, with no Node.js runtime dependency for analysis.
+Static analysis is free and open source. An optional paid runtime layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 122 framework plugins, 5-18x faster than [knip](https://knip.dev) v5 (2.7-9x faster than knip v6), 8-29x faster than [jscpd](https://github.com/kucherenko/jscpd) for duplication detection, with no Node.js runtime dependency for analysis.
 
 ## Installation
 
@@ -90,7 +90,7 @@ Every issue in `--format json` carries a machine-actionable `actions` array with
 
 ## Framework support
 
-97 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, AdonisJS, Ember, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
+122 built-in plugins covering Next.js, Nuxt, Remix, Qwik, SvelteKit, Gatsby, Astro, Angular, NestJS, AdonisJS, Ember, Expo Router, Vite, Webpack, Vitest, Jest, Playwright, Cypress, Storybook, ESLint, TypeScript, Tailwind, UnoCSS, Prisma, Drizzle, Convex, Turborepo, Hardhat, and many more. Auto-detected from your `package.json`.
 
 ## Configuration
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fallow",
-  "version": "2.91.0",
-  "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, 96 framework plugins.",
+  "version": "2.93.0",
+  "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, zero-config framework support.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -83,13 +83,13 @@
     "@tanstack/intent": "0.0.41"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.91.0",
-    "@fallow-cli/darwin-x64": "2.91.0",
-    "@fallow-cli/linux-x64-gnu": "2.91.0",
-    "@fallow-cli/linux-arm64-gnu": "2.91.0",
-    "@fallow-cli/linux-x64-musl": "2.91.0",
-    "@fallow-cli/linux-arm64-musl": "2.91.0",
-    "@fallow-cli/win32-arm64-msvc": "2.91.0",
-    "@fallow-cli/win32-x64-msvc": "2.91.0"
+    "@fallow-cli/darwin-arm64": "2.93.0",
+    "@fallow-cli/darwin-x64": "2.93.0",
+    "@fallow-cli/linux-x64-gnu": "2.93.0",
+    "@fallow-cli/linux-arm64-gnu": "2.93.0",
+    "@fallow-cli/linux-x64-musl": "2.93.0",
+    "@fallow-cli/linux-arm64-musl": "2.93.0",
+    "@fallow-cli/win32-arm64-msvc": "2.93.0",
+    "@fallow-cli/win32-x64-msvc": "2.93.0"
   }
 }

package/schema.json

@@ -169,7 +169,8 @@
         "unused-dependency-overrides": "warn",
         "misconfigured-dependency-overrides": "error",
         "security-client-server-leak": "off",
-        "security-sink": "off"
+        "security-sink": "off",
+        "policy-violation": "warn"
       }
     },
     "boundaries": {
@@ -212,6 +213,13 @@
       },
       "default": []
     },
+    "rulePacks": {
+      "description": "Paths to declarative rule-pack files (JSON or JSONC), relative to the\nproject root. Each pack declares `banned-call` / `banned-import` rules\nthat report as `policy-violation` findings. Packs are pure data: no\nproject code is executed. Invalid or missing packs fail config load.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
     "dynamicallyLoaded": {
       "type": "array",
       "items": {
@@ -992,6 +1000,11 @@
           "description": "Opt-in (default off): a syntactic tainted-sink candidate matched against\nthe data-driven catalogue (`security_matchers.toml`). ONE knob gates ALL\ncatalogue categories. Surfaced only by `fallow security`; never under\nbare `fallow` or the `audit` gate.",
           "$ref": "#/$defs/Severity",
           "default": "off"
+        },
+        "policy-violation": {
+          "description": "Master severity for rule-pack findings (`rulePacks` config). Defaults\nto `warn` so enabling a brand-new policy pack never hard-fails CI on\nits first run; individual pack rules opt up via `\"severity\": \"error\"`.\n`off` is a kill switch that disables the whole evaluator (per-rule\nseverity cannot resurrect it).",
+          "$ref": "#/$defs/Severity",
+          "default": "warn"
         }
       }
     },
@@ -1045,6 +1058,14 @@
             "$ref": "#/$defs/BoundaryRule"
           },
           "default": []
+        },
+        "coverage": {
+          "description": "Optional policy for files that match no zone.",
+          "$ref": "#/$defs/BoundaryCoverageConfig"
+        },
+        "calls": {
+          "description": "Optional forbidden-call policy for zoned files.",
+          "$ref": "#/$defs/BoundaryCallsConfig"
         }
       }
     },
@@ -1135,6 +1156,70 @@
         "from"
       ]
     },
+    "BoundaryCoverageConfig": {
+      "description": "Boundary zone coverage policy.",
+      "type": "object",
+      "properties": {
+        "requireAllFiles": {
+          "description": "Report source files that do not match any boundary zone.",
+          "type": "boolean"
+        },
+        "allowUnmatched": {
+          "description": "Glob patterns for files that may remain unmatched by any zone.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "BoundaryCallsConfig": {
+      "description": "Boundary forbidden-call policy. Applies only to files classified into a\nzone; unzoned files are unrestricted, matching the import rules.",
+      "type": "object",
+      "properties": {
+        "forbidden": {
+          "description": "Callee patterns that files in a zone may not call.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ForbiddenCallRule"
+          }
+        }
+      }
+    },
+    "ForbiddenCallRule": {
+      "description": "One forbidden-call entry: files in zone `from` may not call callees\nmatching `callee`.",
+      "type": "object",
+      "properties": {
+        "from": {
+          "description": "Zone whose files may not make matching calls.",
+          "type": "string"
+        },
+        "callee": {
+          "description": "Forbidden callee pattern(s). Matching is segment-aware, not substring:\n`child_process.*` matches `child_process.exec` (and named imports from\n`child_process` / `node:child_process`), `fetch` matches only `fetch`,\nand a leading `*.` suffix-matches any object (`*.innerHTML`).",
+          "$ref": "#/$defs/ForbiddenCallee"
+        }
+      },
+      "required": [
+        "from",
+        "callee"
+      ]
+    },
+    "ForbiddenCallee": {
+      "description": "One callee pattern or a list of patterns for a single `from` zone.",
+      "anyOf": [
+        {
+          "description": "A single callee pattern.",
+          "type": "string"
+        },
+        {
+          "description": "Multiple callee patterns sharing the same `from` zone.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      ]
+    },
     "FlagsConfig": {
       "description": "Feature flag detection configuration.\n\nControls which patterns fallow uses to detect feature flags in source code.\nConfigured via the `flags` section in `.fallowrc.json`, `.fallowrc.jsonc`, `fallow.toml`, or `.fallow.toml`.\n\n# Examples\n\n```json\n{\n  \"flags\": {\n    \"sdkPatterns\": [\n      { \"function\": \"useFlag\", \"nameArg\": 0, \"provider\": \"LaunchDarkly\" }\n    ],\n    \"envPrefixes\": [\"FEATURE_\", \"NEXT_PUBLIC_ENABLE_\"],\n    \"configObjectHeuristics\": false\n  }\n}\n```",
       "type": "object",
@@ -1188,7 +1273,7 @@
       ]
     },
     "SecurityConfig": {
-      "description": "Scopes the security categories used by `fallow security`. An absent block\nadmits every catalogue category. `hardcoded-secret` is include-required and\nonly runs when explicitly listed in `security.categories.include`.",
+      "description": "Scopes `fallow security` catalogue behavior. An absent category block admits\nevery catalogue category. `hardcoded-secret` is include-required and only\nruns when explicitly listed in `security.categories.include`.",
       "type": "object",
       "properties": {
         "categories": {
@@ -1201,6 +1286,13 @@
               "type": "null"
             }
           ]
+        },
+        "requestReceivers": {
+          "description": "Additional project-local names for HTTP request objects. These names\nextend the built-in receiver allowlist for `*.query`, `*.params`, and\n`*.body` source patterns. They do not replace the built-ins and do not\ngate `*.searchParams`, which intentionally stays ungated.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
         }
       },
       "additionalProperties": false
@@ -1593,6 +1685,16 @@
               "type": "null"
             }
           ]
+        },
+        "policy-violation": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Severity"
+            },
+            {
+              "type": "null"
+            }
+          ]
         }
       }
     },
@@ -1715,6 +1817,24 @@
           "format": "uint",
           "minimum": 0,
           "default": 0
+        },
+        "boundaryCoverageViolations": {
+          "type": "integer",
+          "format": "uint",
+          "minimum": 0,
+          "default": 0
+        },
+        "boundaryCallViolations": {
+          "type": "integer",
+          "format": "uint",
+          "minimum": 0,
+          "default": 0
+        },
+        "policyViolations": {
+          "type": "integer",
+          "format": "uint",
+          "minimum": 0,
+          "default": 0
         }
       }
     },