fallow 2.95.0 → 2.96.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "2.95.0",
+  "version": "2.96.0",
   "description": "Deterministic codebase intelligence for TypeScript and JavaScript. Quality, risk, architecture, dependencies, duplication, and safe cleanup evidence for humans, CI, and agents. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native, sub-second, zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -83,13 +83,13 @@
     "@tanstack/intent": "0.0.41"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "2.95.0",
-    "@fallow-cli/darwin-x64": "2.95.0",
-    "@fallow-cli/linux-x64-gnu": "2.95.0",
-    "@fallow-cli/linux-arm64-gnu": "2.95.0",
-    "@fallow-cli/linux-x64-musl": "2.95.0",
-    "@fallow-cli/linux-arm64-musl": "2.95.0",
-    "@fallow-cli/win32-arm64-msvc": "2.95.0",
-    "@fallow-cli/win32-x64-msvc": "2.95.0"
+    "@fallow-cli/darwin-arm64": "2.96.0",
+    "@fallow-cli/darwin-x64": "2.96.0",
+    "@fallow-cli/linux-x64-gnu": "2.96.0",
+    "@fallow-cli/linux-arm64-gnu": "2.96.0",
+    "@fallow-cli/linux-x64-musl": "2.96.0",
+    "@fallow-cli/linux-arm64-musl": "2.96.0",
+    "@fallow-cli/win32-arm64-msvc": "2.96.0",
+    "@fallow-cli/win32-x64-msvc": "2.96.0"
   }
 }

package/schema.json

@@ -112,7 +112,7 @@
         "ignoreDefaults": true,
         "skipLocal": false,
         "crossLanguage": false,
-        "ignoreImports": false,
+        "ignoreImports": true,
         "normalization": {},
         "minCorpusSizeForShingleFilter": 1024,
         "minCorpusSizeForTokenCache": 5000
@@ -697,9 +697,9 @@
           "default": false
         },
         "ignoreImports": {
-          "description": "Exclude ES `import` declarations from clone detection.\n\nWhen enabled, all `import` statements (value imports, type imports, and\nside-effect imports) are stripped from the token stream before clone\ndetection. This reduces noise from sorted import blocks that naturally\nlook similar across files. Only affects ES `import` declarations;\nCommonJS `require()` calls are not filtered.",
+          "description": "Exclude ES `import` declarations from clone detection.\n\nDefaults to `true`: token-identical sorted import blocks are a structural\nproperty of well-formatted code, not copy-paste, so they should not\nsurface as clone groups. Set to `false` to count import blocks again.\nWhen enabled, all `import` statements (value imports, type imports, and\nside-effect imports) are stripped from the token stream before clone\ndetection. Only affects ES `import` declarations; CommonJS `require()`\ncalls and `export ... from` re-export blocks are still counted.",
           "type": "boolean",
-          "default": false
+          "default": true
         },
         "normalization": {
           "description": "Fine-grained normalization overrides on top of the detection mode.",

package/skills/fallow/SKILL.md

@@ -106,7 +106,7 @@ Route by intent before reaching for the big analysis commands. Same matrix as `f
 | `config` | Show the loaded config path and resolved config (verifies which `.fallowrc.json` is in effect) | `--path` |
 | `list` | Inspect project structure | `--files`, `--entry-points`, `--plugins`, `--boundaries`, `--workspaces` |
 | `workspaces` | Inspect monorepo workspaces + discovery diagnostics (shorthand for `list --workspaces`) | (no flags) |
-| `dupes` | Code duplication detection | `--mode`, `--threshold`, `--top`, `--changed-since`, `--workspace`, `--changed-workspaces`, `--skip-local`, `--cross-language`, `--ignore-imports`, `--explain-skipped`, `--fail-on-regression`, `--tolerance`, `--regression-baseline`, `--save-regression-baseline` |
+| `dupes` | Code duplication detection | `--mode`, `--threshold`, `--top`, `--changed-since`, `--workspace`, `--changed-workspaces`, `--skip-local`, `--cross-language`, `--ignore-imports`, `--no-ignore-imports`, `--explain-skipped`, `--fail-on-regression`, `--tolerance`, `--regression-baseline`, `--save-regression-baseline` |
 | `health` | Function complexity analysis (also covers Angular templates as synthetic `<template>` findings: external `.html` files via `templateUrl` AND inline `@Component({ template: \`...\` })` literals; suppress external with `<!-- fallow-ignore-file complexity -->` at the top of the `.html` file, suppress inline with `// fallow-ignore-next-line complexity` directly above the `@Component` decorator) | `--complexity`, `--max-cyclomatic`, `--max-cognitive`, `--max-crap`, `--top`, `--sort`, `--file-scores`, `--hotspots`, `--ownership`, `--ownership-emails`, `--targets`, `--effort`, `--score`, `--min-score`, `--since`, `--min-commits`, `--save-snapshot`, `--trend`, `--coverage-gaps`, `--coverage`, `--coverage-root`, `--runtime-coverage`, `--min-invocations-hot`, `--min-observation-volume`, `--low-traffic-threshold`, `--workspace`, `--changed-workspaces`, `--baseline`, `--save-baseline` |
 | `flags` | Detect feature flag patterns (env vars, SDK calls, config objects) | `--top` |
 | `explain` | Explain one issue type without running analysis | `<issue-type>`, `--format json` |
@@ -198,7 +198,7 @@ When using fallow via MCP (`fallow-mcp`), the following tools are available:
 | `project_info` | introspection | free | `entry_points`, `files`, `plugins`, `boundaries` | Project metadata. Set `entry_points`, `files`, `plugins`, or `boundaries` to `true` to request specific sections |
 | `list_boundaries` | introspection | free | - | Architecture boundary zones, access rules, and pre-expansion `autoDiscover` `logical_groups[]` (user-authored parent name, verbatim paths, discovered children, `status` enum, summed `file_count`). Returns `{"configured": false}` if no boundaries configured |
 | `feature_flags` | analysis | free | `workspace`, `production` | Detect feature flag patterns (env vars, SDK calls, config objects). Set `top` to limit results |
-| `impact` | introspection | free | `root` | Read the local, opt-in Fallow Impact value report (`fallow impact --format json`). Runs no analysis: current surfacing counts, trend since the last recorded run, pre-commit gate containment, and (on impact v1.5+) resolved/suppressed attribution. Read-only and `root`-only; the mutating `enable` / `disable` lifecycle is not exposed. A never-enabled project returns a populated `{"enabled": false, ...}` report (never `{}`); branch on `enabled` then `record_count` and recommend the user run `fallow impact enable` rather than toggling it. Local-developer signal: empty in ephemeral CI runners, so not a CI metric |
+| `impact` | introspection | free | `root` | Read the local, opt-in Fallow Impact value report (`fallow impact --format json`). Runs no analysis: current surfacing counts, trend since the last recorded run, pre-commit gate containment, and (on impact v1.5+) resolved/suppressed attribution. History is read from a per-project file in the user's private config dir (never inside the repo). Read-only and `root`-only; the mutating `enable` / `disable` / `default` lifecycle is not exposed. A never-enabled project returns a populated `{"enabled": false, ...}` report (never `{}`); branch on `enabled` and `enabled_source` (`project` / `user` / `default`) then `record_count`, recommending `fallow impact enable` only when `explicit_decision` is `false` (never asked) and staying silent when `true` (deliberately disabled here). Local-developer signal: fallow never records in CI, so empty there and not a CI metric |
 | `trace_export` | trace | free | `file`, `export_name` | Trace why an export is used or unused (`fallow dead-code --trace FILE:EXPORT_NAME --format json`). Required `file` and `export_name`. Returns file reachability, entry-point status, direct references, re-export chains, and a reason string. Use before deleting a supposedly-unused export |
 | `trace_file` | trace | free | `file` | Trace all graph edges for a file (`fallow dead-code --trace-file PATH --format json`). Required `file`. Returns reachability, exports, imports-from, imported-by, and re-exports. Use to decide whether a file is isolated, barrel-only, or imported by live entry points |
 | `trace_dependency` | trace | free | `package_name` | Trace where a dependency is imported (`fallow dead-code --trace-dependency PACKAGE --format json`). Required `package_name`. Returns importing files, type-only importers, total import count, `used_in_scripts` (true when invoked from package.json scripts or CI configs), and `is_used` (combined import + script signal; mirrors the unused-deps detector so build tools like `microbundle` or `vitest` are not falsely flagged as unused). Use before removing a dependency or moving between `dependencies` and `devDependencies` |
@@ -400,7 +400,7 @@ fallow impact enable
 fallow impact --format json --quiet
 ```
 
-`fallow impact enable` is a one-time, user-owned local action; the agent-facing line is the read step. The store lives at `.fallow/impact.json` (gitignored), the report is read-only, and it is empty in ephemeral CI runners.
+`fallow impact enable` is a one-time, user-owned local action; the agent-facing line is the read step. History is stored per-project in the user's private config dir (never inside the repo, so no `.fallow/` or `.gitignore` changes); `fallow impact default on` enables it for every project at once. The report is read-only and is empty in CI (fallow never records there).
 
 ### Debug why something is flagged
 

package/skills/fallow/references/cli-reference.md

@@ -147,6 +147,7 @@ By default, `fallow dupes` skips generated framework output matching `**/.next/*
 | `--skip-local` | `bool` | `false` | Only report cross-directory duplicates |
 | `--cross-language` | `bool` | `false` | Strip type annotations for TS↔JS matching |
 | `--ignore-imports` | `bool` | `false` | Exclude import declarations from clone detection |
+| `--no-ignore-imports` | `bool` | `false` | Count import declarations as clone candidates (opt out of the default import exclusion) |
 | `--top` | `string` | - | Show only the N most-duplicated clone groups (sorted by instance count desc, tiebreak: line count desc, then path/line). Summary stats reflect the full project. |
 | `--trace` | `string` | - | Deep-dive clones. `FILE:LINE` traces all clones at a location; `dup:<id>` traces a clone group by the stable fingerprint shown in the listing and on `clone_groups[].fingerprint` in JSON. Fingerprints are usually `dup:<8hex>` and widen only on rare report collisions. Trace output adds an extract-function suggestion, estimated savings, and a best-effort proposed name per group |
 
@@ -492,7 +493,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -879,7 +880,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "2.95.0",
+  "version": "2.96.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -954,7 +955,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1054,7 +1055,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1083,7 +1084,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1545,6 +1546,7 @@ Available on all commands:
 | `--dupes-skip-local` | `bool` | `false` | Only report cross-directory duplicates in combined mode |
 | `--dupes-cross-language` | `bool` | `false` | Enable cross-language duplicate detection in combined mode |
 | `--dupes-ignore-imports` | `bool` | `false` | Exclude import declarations from duplicate detection in combined mode |
+| `--dupes-no-ignore-imports` | `bool` | `false` | Count import declarations as clone candidates in combined mode (opt out of the default import exclusion) |
 | `--score` | `bool` | `false` | Compute health score (0-100 with letter grade) in combined mode. Enables the health delta header in PR comments. JSON includes `health_score` object with `score`, `grade`, and `penalties` breakdown |
 | `--trend` | `bool` | `false` | Compare current health metrics against saved snapshot. Implies `--score`. Shows per-metric deltas with directional indicators. Requires at least one saved snapshot in `.fallow/snapshots/` |
 | `--save-snapshot` | `string` | - | Save vital signs snapshot for trend tracking. Default path: `.fallow/snapshots/<timestamp>.json`. Forces file-scores + hotspot computation |
@@ -1699,7 +1701,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1859,7 +1861,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -1903,11 +1905,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "2.95.0",
+  "version": "2.96.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "2.95.0",
+    "version": "2.96.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/types/output-contract.d.ts

@@ -623,6 +623,12 @@ export type GroupByMode = ("owner" | "directory" | "package" | "section")
  * `CoverageAnalyzeSchemaVersion`).
  */
 export type ImpactReportSchemaVersion = "1"
+/**
+ * Why Impact tracking is (or is not) active for a project. `Project` = an
+ * explicit per-repo `enable`; `User` = the user-global default with no per-repo
+ * decision; `Default` = off (no per-repo decision and no global default).
+ */
+export type EnabledSource = ("project" | "user" | "default")
 /**
  * Direction of a count trend between two recorded runs.
  */
@@ -5209,6 +5215,7 @@ misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
 export interface ImpactReport {
 schema_version: ImpactReportSchemaVersion
 enabled: boolean
+enabled_source: EnabledSource
 record_count: number
 _meta?: (Meta | null)
 first_recorded?: (string | null)
@@ -5272,7 +5279,8 @@ recent_resolved: ResolutionEvent[]
 attribution_active: boolean
 /**
  * Whether the local agent onboarding prompt has been explicitly declined.
- * Stored under `.fallow/` so agents can avoid cross-session nags.
+ * Stored in the user config dir (per project) so agents avoid cross-session
+ * nags without writing into the repo.
  */
 onboarding_declined: boolean
 /**