fallow 3.10.0 → 3.11.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.10.0",
+  "version": "3.11.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -128,6 +128,17 @@
       "required": false,
       "description": "Compare against a previously saved baseline file"
     },
+    {
+      "name": "--baseline-mode",
+      "type": "string",
+      "required": false,
+      "description": "How `--baseline` matches health findings: per file and category (`count`, the default) or per function identity (`identity`, strict, and only against a baseline that was saved with `--baseline-mode identity`; such a baseline still reads in count mode)",
+      "default": "count",
+      "possible_values": [
+        "count",
+        "identity"
+      ]
+    },
     {
       "name": "--parent-run",
       "type": "string",
@@ -5904,6 +5915,7 @@
     "FALLOW_PRODUCTION_HEALTH": "Set to true/false to override production mode for health analysis.",
     "FALLOW_PRODUCTION_DUPES": "Set to true/false to override production mode for duplication analysis.",
     "FALLOW_REVIEW_GUIDANCE": "Set to true to append collapsed guidance blocks to review-github/review-gitlab inline comment bodies.",
+    "FALLOW_REVIEW_ID": "Stable 1-64 character identifier that isolates inline comments when multiple review jobs target the same PR/MR.",
     "FALLOW_SUMMARY_SCOPE": "Summary scope for pr-comment-github/pr-comment-gitlab: all (default) keeps project-level dependency/catalog/override findings outside the diff filter; diff applies the diff filter to them too. Inline review comments are unaffected.",
     "FALLOW_PR_COMMENT_LAYOUT": "Sticky PR comment layout: default, compact, gate-only, or details.",
     "FALLOW_CONSOLIDATED_STATUS": "When split PR gate check runs are enabled, truthy values add one aggregate Fallow check alongside the per-gate checks.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.10.0",
+  "version": "3.11.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -87,14 +87,14 @@
     "@tanstack/intent": "0.3.6"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.10.0",
-    "@fallow-cli/darwin-x64": "3.10.0",
-    "@fallow-cli/linux-x64-gnu": "3.10.0",
-    "@fallow-cli/linux-arm64-gnu": "3.10.0",
-    "@fallow-cli/linux-x64-musl": "3.10.0",
-    "@fallow-cli/linux-arm64-musl": "3.10.0",
-    "@fallow-cli/win32-arm64-msvc": "3.10.0",
-    "@fallow-cli/win32-x64-msvc": "3.10.0",
+    "@fallow-cli/darwin-arm64": "3.11.0",
+    "@fallow-cli/darwin-x64": "3.11.0",
+    "@fallow-cli/linux-x64-gnu": "3.11.0",
+    "@fallow-cli/linux-arm64-gnu": "3.11.0",
+    "@fallow-cli/linux-x64-musl": "3.11.0",
+    "@fallow-cli/linux-arm64-musl": "3.11.0",
+    "@fallow-cli/win32-arm64-msvc": "3.11.0",
+    "@fallow-cli/win32-x64-msvc": "3.11.0",
     "fallow-type-aware": "3.10.0"
   }
 }

package/skills/fallow/references/cli-reference.md

@@ -420,7 +420,7 @@ Angular templates contribute synthetic `<template>` complexity findings whenever
 | `--min-observation-volume` | `string` | - | Minimum total trace volume before the sidecar may emit high-confidence `safe_to_delete` / `review_required` verdicts. Below this, confidence is capped at `medium`. |
 | `--low-traffic-threshold` | `string` | - | Fraction of total trace count below which an invoked function is classified `low_traffic` rather than `active`. Expressed as a decimal (0.001 = 0.1%). |
 
-Common global flags for this command: [`--format`](#global-flags), [`--quiet`](#global-flags), [`--changed-since`](#global-flags), [`--churn-file`](#global-flags), [`--workspace`](#global-flags), [`--group-by`](#global-flags), [`--baseline`](#global-flags), [`--save-baseline`](#global-flags), [`--production`](#global-flags), [`--no-production`](#global-flags), [`--explain`](#global-flags).
+Common global flags for this command: [`--format`](#global-flags), [`--quiet`](#global-flags), [`--changed-since`](#global-flags), [`--churn-file`](#global-flags), [`--workspace`](#global-flags), [`--group-by`](#global-flags), [`--baseline`](#global-flags), [`--baseline-mode`](#global-flags), [`--save-baseline`](#global-flags), [`--production`](#global-flags), [`--no-production`](#global-flags), [`--explain`](#global-flags).
 <!-- generated:flags:health:end -->
 ### Exit Codes
 
@@ -473,6 +473,10 @@ fallow health --format json --quiet --workspace my-package
 fallow health --format json --quiet --save-baseline fallow-baselines/health.json
 fallow health --format json --quiet --baseline fallow-baselines/health.json
 
+# Strict adoption: a hotspot that replaces a baselined hotspot is reported
+fallow health --format json --quiet --save-baseline fallow-baselines/health.json --baseline-mode identity
+fallow health --format json --quiet --baseline fallow-baselines/health.json --baseline-mode identity
+
 # CI: fail if any function is too complex
 fallow health --max-cyclomatic 25 --max-cognitive 20 --quiet
 
@@ -1677,6 +1681,7 @@ Available on all commands:
 | `--churn-file` | `string` | - | Import change history from a `fallow-churn/v1` JSON file instead of `git log`, powering hotspots, ownership, and bus-factor on projects with no git repository (Yandex Arc, Mercurial, Perforce). A small wrapper translates your VCS log into the contract. Resolved relative to `--root`. Affects `health --hotspots` / `--ownership` / `--targets` only; `audit`, `impact`, and `--changed-since` still require git |
 | `--max-file-size` | `string` | - | Skip source files larger than this many megabytes (default 5) instead of parsing them, guarding against the out-of-memory blowup a single multi-MB generated/vendored/bundled file causes on large repos. Use `0` for no limit. Declaration files (`.d.ts`) are always analyzed. Skipped files are reported and excluded from every analysis. Also settable via `FALLOW_MAX_FILE_SIZE` |
 | `--baseline` | `string` | - | Compare to baseline |
+| `--baseline-mode` | `count\|identity` | `count` | How `--baseline` matches health findings: per file and category (`count`, the default) or per function identity (`identity`, strict, and only against a baseline saved with `--baseline-mode identity`; such a baseline still reads in count mode). Identity is file path plus function name, so renaming or moving a function that is still in the baseline reports it as new; re-save after that kind of refactor. |
 | `--parent-run` | `string` | - | Correlate this run with a previous telemetry analysis run |
 | `--save-baseline` | `string` | - | Save results as baseline |
 | `--production` | `bool` | `false` | Exclude test/dev files, only start/build scripts (applies to every analysis) |

package/types/output-contract.d.ts

@@ -747,6 +747,11 @@ export type ReviewProvider = ("github" | "gitlab")
  * GitHub Checks API conclusion field.
  */
 export type ReviewCheckConclusion = ("success" | "neutral" | "failure")
+/**
+ * Stable identifier used to isolate independent review integrations on the
+ * same pull or merge request.
+ */
+export type ReviewId = string
 /**
  * Schema-version discriminator for the review reconcile envelope.
  */
@@ -2124,19 +2129,21 @@ empty_catalog_groups?: EmptyCatalogGroupFinding[]
  */
 unresolved_catalog_references?: UnresolvedCatalogReferenceFinding[]
 /**
- * Entries in pnpm-workspace.yaml's overrides: section, or package.json's
- * pnpm.overrides block, whose target package is not declared by any
- * workspace package and is not present in pnpm-lock.yaml. Default severity
+ * Entries in pnpm-workspace.yaml's overrides: section, package.json's
+ * pnpm.overrides block, or package.json's top-level npm overrides object,
+ * whose target package is not declared by any workspace package and is
+ * not present in pnpm-lock.yaml or package-lock.json. Default severity
  * is warn because projects without a readable lockfile fall back to
  * manifest-only checks; the hint field flags those conservative cases.
  * Wrapped in [`UnusedDependencyOverrideFinding`].
  */
 unused_dependency_overrides?: UnusedDependencyOverrideFinding[]
 /**
- * pnpm.overrides entries whose key or value does not parse as a valid
- * override spec (empty key, empty value, malformed selector, unbalanced
- * parent matcher). pnpm install will reject these. Default severity is
- * error. Wrapped in [`MisconfiguredDependencyOverrideFinding`].
+ * pnpm.overrides or npm overrides entries whose key or value does not
+ * parse as a valid override spec (empty key, empty value, malformed
+ * selector, unbalanced parent matcher). The package manager will reject
+ * these at install time. Default severity is error. Wrapped in
+ * [`MisconfiguredDependencyOverrideFinding`].
  */
 misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
 /**
@@ -8613,6 +8620,7 @@ export interface ReviewEnvelopeMeta {
 schema: ReviewEnvelopeSchema
 provider: ReviewProvider
 check_conclusion?: (ReviewCheckConclusion | null)
+review_id?: (ReviewId | null)
 }
 /**
  * Envelope emitted by `fallow ci reconcile-review --format json`. Used by
@@ -9401,19 +9409,21 @@ empty_catalog_groups?: EmptyCatalogGroupFinding[]
  */
 unresolved_catalog_references?: UnresolvedCatalogReferenceFinding[]
 /**
- * Entries in pnpm-workspace.yaml's overrides: section, or package.json's
- * pnpm.overrides block, whose target package is not declared by any
- * workspace package and is not present in pnpm-lock.yaml. Default severity
+ * Entries in pnpm-workspace.yaml's overrides: section, package.json's
+ * pnpm.overrides block, or package.json's top-level npm overrides object,
+ * whose target package is not declared by any workspace package and is
+ * not present in pnpm-lock.yaml or package-lock.json. Default severity
  * is warn because projects without a readable lockfile fall back to
  * manifest-only checks; the hint field flags those conservative cases.
  * Wrapped in [`UnusedDependencyOverrideFinding`].
  */
 unused_dependency_overrides?: UnusedDependencyOverrideFinding[]
 /**
- * pnpm.overrides entries whose key or value does not parse as a valid
- * override spec (empty key, empty value, malformed selector, unbalanced
- * parent matcher). pnpm install will reject these. Default severity is
- * error. Wrapped in [`MisconfiguredDependencyOverrideFinding`].
+ * pnpm.overrides or npm overrides entries whose key or value does not
+ * parse as a valid override spec (empty key, empty value, malformed
+ * selector, unbalanced parent matcher). The package manager will reject
+ * these at install time. Default severity is error. Wrapped in
+ * [`MisconfiguredDependencyOverrideFinding`].
  */
 misconfigured_dependency_overrides?: MisconfiguredDependencyOverrideFinding[]
 /**