fallow 3.1.0 → 3.2.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -87,13 +87,13 @@
     "@tanstack/intent": "0.3.2"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.1.0",
-    "@fallow-cli/darwin-x64": "3.1.0",
-    "@fallow-cli/linux-x64-gnu": "3.1.0",
-    "@fallow-cli/linux-arm64-gnu": "3.1.0",
-    "@fallow-cli/linux-x64-musl": "3.1.0",
-    "@fallow-cli/linux-arm64-musl": "3.1.0",
-    "@fallow-cli/win32-arm64-msvc": "3.1.0",
-    "@fallow-cli/win32-x64-msvc": "3.1.0"
+    "@fallow-cli/darwin-arm64": "3.2.0",
+    "@fallow-cli/darwin-x64": "3.2.0",
+    "@fallow-cli/linux-x64-gnu": "3.2.0",
+    "@fallow-cli/linux-arm64-gnu": "3.2.0",
+    "@fallow-cli/linux-x64-musl": "3.2.0",
+    "@fallow-cli/linux-arm64-musl": "3.2.0",
+    "@fallow-cli/win32-arm64-msvc": "3.2.0",
+    "@fallow-cli/win32-x64-msvc": "3.2.0"
   }
 }

package/schema.json

@@ -125,6 +125,7 @@
         "maxCognitive": 15,
         "maxCrap": 30.0,
         "crapRefactorBand": 5,
+        "maxUnitSize": 60,
         "coverage": null,
         "coverageRoot": null,
         "ignore": [],
@@ -836,6 +837,13 @@
           "maximum": 65535,
           "default": 5
         },
+        "maxUnitSize": {
+          "description": "Maximum function length in lines of code before it is reported as an\noversized \"large function\" (default: 60). Raise it globally, or per file\nvia `thresholdOverrides[].maxUnitSize`, to relax the bar for generated or\ntest files (where a `describe()` block spans hundreds of lines) without\ndisabling complexity checks on those files. This filters the reported\nlarge-functions list only; the descriptive unit-size profile and the\nhealth score still reflect raw sizes (use `health.ignore` to remove a\nfile from the score entirely).",
+          "type": "integer",
+          "format": "uint32",
+          "minimum": 0,
+          "default": 60
+        },
         "coverage": {
           "description": "Path to Istanbul-format coverage data for accurate per-function CRAP\nscores. Relative paths resolve against the project root. The CLI\n`--coverage` flag and `FALLOW_COVERAGE` environment variable override\nthis value.",
           "type": [
@@ -936,6 +944,15 @@
           ],
           "format": "double"
         },
+        "maxUnitSize": {
+          "description": "Local unit-size ceiling: maximum function length in lines of code before\nit is reported as an oversized \"large function\". Leave `functions` empty\nto relax the bar for every function in the matching files (which covers\nboth the `describe()` wrapper and the individual `it()` blocks in a test\nsuite).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0
+        },
         "reason": {
           "description": "Human-readable rationale for the exception.",
           "type": [

package/skills/fallow/SKILL.md

@@ -243,7 +243,7 @@ Most tools accept `root`, `config`, `no_cache`, and `threads` params. Exceptions
 
 All JSON responses include structured `actions` arrays on every finding (dead code, health, duplication), enabling programmatic fix application or suppression.
 
-`health.thresholdOverrides[]` lets projects keep known legacy functions visible as configured local ceilings instead of hiding them with suppressions. Each entry has `files` globs, optional exact `functions`, one or more of `maxCyclomatic`, `maxCognitive`, or `maxCrap`, and optional `reason`. Health JSON may include top-level `threshold_overrides[]` entries with `active`, `stale`, or `no_match` status, and complexity findings that use an override carry `effective_thresholds` plus `threshold_source: "override"`.
+`health.thresholdOverrides[]` lets projects keep known legacy functions visible as configured local ceilings instead of hiding them with suppressions. Each entry has `files` globs, optional exact `functions`, one or more of `maxCyclomatic`, `maxCognitive`, `maxCrap`, or `maxUnitSize`, and optional `reason`. Health JSON may include top-level `threshold_overrides[]` entries with `active`, `stale`, or `no_match` status, and complexity findings that use an override carry `effective_thresholds` plus `threshold_source: "override"`.
 
 `dead-code`, `health`, `dupes`, bare `fallow`, and `audit` JSON output also carry a top-level `next_steps` array of read-only follow-up commands computed from the run's findings: each entry is `{ id, command, reason }`. The `command` is runnable as-is (never a placeholder, never `fix` or any other mutating command); the stable kebab-case `id` (`setup`, `impact-report`, `trace-unused-export`, `trace-clone`, `complexity-breakdown`, `scope-workspaces`, `audit-changed`) maps to a verification step you should run BEFORE acting, for example tracing an export before deleting it. A leading `setup` step (command: `fallow schema`) appears only on unconfigured, non-CI projects with findings and doubles as the onboarding trigger below; it disappears after setup or `fallow init --decline`. An at-most-weekly `impact-report` step (command: `fallow impact`) carries the local value digest when impact tracking has non-zero results; it may ride a clean run. When running via MCP, dispatch on the `id` to the matching tool / `code_execute` host call (`trace_export`, `trace_clone`, `check_health` with `complexity_breakdown: true`, `audit`) rather than shelling out the CLI string. The array is deduplicated, capped at three, and omitted when empty; set `FALLOW_SUGGESTIONS=off` to suppress it.
 

package/skills/fallow/references/cli-reference.md

@@ -508,7 +508,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -532,7 +532,7 @@ fallow health --format json --quiet --trend
 }
 ```
 
-`health.thresholdOverrides[]` config entries can raise local cyclomatic, cognitive, or CRAP ceilings for matching files and optional exact function names. When an override affects output, health JSON includes top-level `threshold_overrides[]` state entries (`active`, `stale`, or `no_match`). Complexity findings evaluated with local ceilings include `effective_thresholds` and `threshold_source: "override"` so agents can see which thresholds drove the finding and avoid treating configured exceptions as hidden suppressions.
+`health.thresholdOverrides[]` config entries can raise local cyclomatic, cognitive, CRAP, or unit-size (large-function line-count) ceilings for matching files and optional exact function names. When an override affects output, health JSON includes top-level `threshold_overrides[]` state entries (`active`, `stale`, or `no_match`). Complexity findings evaluated with local ceilings include `effective_thresholds` and `threshold_source: "override"` so agents can see which thresholds drove the finding and avoid treating configured exceptions as hidden suppressions.
 
 When the unit size very-high-risk percentage is >= 3%, the JSON output includes a `large_functions` array listing functions exceeding 60 lines of code:
 
@@ -906,7 +906,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "3.1.0",
+  "version": "3.2.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -981,7 +981,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1082,7 +1082,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1111,7 +1111,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1820,7 +1820,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1980,7 +1980,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -2024,11 +2024,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "3.1.0",
+  "version": "3.2.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "3.1.0",
+    "version": "3.2.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],

package/types/output-contract.d.ts

@@ -4267,6 +4267,12 @@ export interface HealthEffectiveThresholds {
 max_cyclomatic: number
 max_cognitive: number
 max_crap: number
+/**
+ * Effective unit-size ceiling (maximum function length in lines) for the
+ * matched file, after applying any `thresholdOverrides` on top of the
+ * global `health.maxUnitSize` default.
+ */
+max_unit_size: number
 }
 /**
  * Suggested action attached to a [`ComplexityViolation`].
@@ -4340,6 +4346,14 @@ functions_above_threshold: number
 max_cyclomatic_threshold: number
 max_cognitive_threshold: number
 max_crap_threshold: number
+/**
+ * Effective global unit-size ceiling (`health.maxUnitSize`, maximum
+ * function length in lines) for this run. Sits alongside the other three
+ * `max_*_threshold` siblings so a consumer reading the summary sees every
+ * configured threshold. Per-file `thresholdOverrides` are not reflected
+ * here; this is the global default.
+ */
+max_unit_size_threshold: number
 files_scored?: (number | null)
 average_maintainability?: (number | null)
 coverage_model?: (CoverageModel | null)
@@ -4371,6 +4385,7 @@ export interface HealthConfiguredThresholds {
 max_cyclomatic?: (number | null)
 max_cognitive?: (number | null)
 max_crap?: (number | null)
+max_unit_size?: (number | null)
 }
 /**
  * Current complexity metrics for a matched threshold override entry.