fallow 3.16.0 → 3.17.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -302,7 +302,7 @@
       "name": "--report-path-prefix",
       "type": "string",
       "required": false,
-      "description": "Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root`"
+      "description": "Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `pr-comment-github`, `pr-comment-gitlab`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root`"
     },
     {
       "name": "--fail-on-regression",
@@ -1897,7 +1897,7 @@
     },
     {
       "name": "report",
-      "description": "Render a saved `--format json` results file in another format without re-running analysis (analyze once, render annotations and the job summary from the same file). Supports `github-annotations`, `github-summary`, `codeclimate`, and `sarif`",
+      "description": "Render a saved `--format json` results file in another format without re-running analysis (analyze once, then render every CI surface from the same file). Supports GitHub annotations/summary, CodeClimate, SARIF, and GitHub/GitLab PR-comment and review formats",
       "flags": [
         {
           "name": "--from",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -87,14 +87,14 @@
     "@tanstack/intent": "0.3.6"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.16.0",
-    "@fallow-cli/darwin-x64": "3.16.0",
-    "@fallow-cli/linux-x64-gnu": "3.16.0",
-    "@fallow-cli/linux-arm64-gnu": "3.16.0",
-    "@fallow-cli/linux-x64-musl": "3.16.0",
-    "@fallow-cli/linux-arm64-musl": "3.16.0",
-    "@fallow-cli/win32-arm64-msvc": "3.16.0",
-    "@fallow-cli/win32-x64-msvc": "3.16.0",
-    "fallow-type-aware": "3.16.0"
+    "@fallow-cli/darwin-arm64": "3.17.0",
+    "@fallow-cli/darwin-x64": "3.17.0",
+    "@fallow-cli/linux-x64-gnu": "3.17.0",
+    "@fallow-cli/linux-arm64-gnu": "3.17.0",
+    "@fallow-cli/linux-x64-musl": "3.17.0",
+    "@fallow-cli/linux-arm64-musl": "3.17.0",
+    "@fallow-cli/win32-arm64-msvc": "3.17.0",
+    "@fallow-cli/win32-x64-msvc": "3.17.0",
+    "fallow-type-aware": "3.17.0"
   }
 }

package/scripts/run-binary.js

@@ -145,18 +145,38 @@ function resolveTypeAwareCompanion(
   }
 }
 
-function childEnvironment(resolvedVersion, resolveCompanion = resolveTypeAwareCompanion) {
+function typeAwareCommand(
+  companion,
+  { platform = process.platform, execPath = process.execPath } = {},
+) {
+  return platform === "win32"
+    ? { binary: execPath, script: companion }
+    : { binary: companion, script: undefined };
+}
+
+function childEnvironment(
+  resolvedVersion,
+  resolveCompanion = resolveTypeAwareCompanion,
+  commandOptions,
+) {
   if (process.env.FALLOW_TYPE_AWARE_BIN) return process.env;
   const companion = resolveCompanion(resolvedVersion);
-  return companion === undefined
-    ? process.env
-    : {
-        ...process.env,
-        FALLOW_TYPE_AWARE_BIN: companion,
-        // Marks the wiring as launcher-provided node_modules resolution so
-        // `type-aware status` does not report it as a user-set override.
-        FALLOW_TYPE_AWARE_BIN_SOURCE: "npm-wrapper",
-      };
+  if (companion === undefined) return process.env;
+
+  const command = typeAwareCommand(companion, commandOptions);
+  const environment = {
+    ...process.env,
+    FALLOW_TYPE_AWARE_BIN: command.binary,
+    // Marks the wiring as launcher-provided node_modules resolution so
+    // `type-aware status` does not report it as a user-set override.
+    FALLOW_TYPE_AWARE_BIN_SOURCE: "npm-wrapper",
+  };
+  if (command.script) {
+    environment.FALLOW_TYPE_AWARE_SCRIPT = command.script;
+  } else {
+    delete environment.FALLOW_TYPE_AWARE_SCRIPT;
+  }
+  return environment;
 }
 
 // Swallow EPIPE on stdout. When fallow's output is piped into a reader that

package/scripts/run-binary.test.js

@@ -162,16 +162,32 @@ test("resolveTypeAwareCompanion accepts only an exact matching package", (t) =>
 test("childEnvironment marks launcher-wired companions as npm-wrapper", (t) => {
   const { childEnvironment } = require(RUN_BINARY);
   const previousBin = process.env.FALLOW_TYPE_AWARE_BIN;
+  const previousScript = process.env.FALLOW_TYPE_AWARE_SCRIPT;
   delete process.env.FALLOW_TYPE_AWARE_BIN;
+  delete process.env.FALLOW_TYPE_AWARE_SCRIPT;
   t.after(() => {
     if (previousBin === undefined) delete process.env.FALLOW_TYPE_AWARE_BIN;
     else process.env.FALLOW_TYPE_AWARE_BIN = previousBin;
+    if (previousScript === undefined) delete process.env.FALLOW_TYPE_AWARE_SCRIPT;
+    else process.env.FALLOW_TYPE_AWARE_SCRIPT = previousScript;
   });
 
-  const env = childEnvironment("3.8.0", () => "/tmp/fallow-type-aware.mjs");
+  const env = childEnvironment("3.8.0", () => "/tmp/fallow-type-aware.mjs", {
+    platform: "linux",
+    execPath: "/usr/bin/node",
+  });
   assert.equal(env.FALLOW_TYPE_AWARE_BIN, "/tmp/fallow-type-aware.mjs");
+  assert.equal(env.FALLOW_TYPE_AWARE_SCRIPT, undefined);
   assert.equal(env.FALLOW_TYPE_AWARE_BIN_SOURCE, "npm-wrapper");
 
+  const windowsEnv = childEnvironment("3.8.0", () => "C:\\pkg\\fallow-type-aware.mjs", {
+    platform: "win32",
+    execPath: "C:\\Program Files\\nodejs\\node.exe",
+  });
+  assert.equal(windowsEnv.FALLOW_TYPE_AWARE_BIN, "C:\\Program Files\\nodejs\\node.exe");
+  assert.equal(windowsEnv.FALLOW_TYPE_AWARE_SCRIPT, "C:\\pkg\\fallow-type-aware.mjs");
+  assert.equal(windowsEnv.FALLOW_TYPE_AWARE_BIN_SOURCE, "npm-wrapper");
+
   // No resolvable companion: the environment passes through untouched.
   const untouched = childEnvironment("3.8.0", () => undefined);
   assert.equal(untouched, process.env);
@@ -181,14 +197,19 @@ test("childEnvironment marks launcher-wired companions as npm-wrapper", (t) => {
 test("childEnvironment leaves a user-set override unmarked", (t) => {
   const { childEnvironment } = require(RUN_BINARY);
   const previousBin = process.env.FALLOW_TYPE_AWARE_BIN;
+  const previousScript = process.env.FALLOW_TYPE_AWARE_SCRIPT;
   process.env.FALLOW_TYPE_AWARE_BIN = "/opt/custom-sidecar";
+  process.env.FALLOW_TYPE_AWARE_SCRIPT = "/opt/custom-sidecar.mjs";
   t.after(() => {
     if (previousBin === undefined) delete process.env.FALLOW_TYPE_AWARE_BIN;
     else process.env.FALLOW_TYPE_AWARE_BIN = previousBin;
+    if (previousScript === undefined) delete process.env.FALLOW_TYPE_AWARE_SCRIPT;
+    else process.env.FALLOW_TYPE_AWARE_SCRIPT = previousScript;
   });
 
   const env = childEnvironment("3.8.0", () => "/tmp/fallow-type-aware.mjs");
   assert.equal(env, process.env);
+  assert.equal(env.FALLOW_TYPE_AWARE_SCRIPT, "/opt/custom-sidecar.mjs");
   assert.equal(env.FALLOW_TYPE_AWARE_BIN_SOURCE, undefined);
 });
 

package/types/output-contract.d.ts

@@ -102,7 +102,7 @@ kind: "type-aware-status"
 /**
  * Schema projection for the audit envelope's exact version.
  */
-export type AuditSchemaVersion = 9
+export type AuditSchemaVersion = 10
 /**
  * Fallow CLI version that produced this envelope. Renders to the JSON wire as
  * a bare string (e.g. `"2.74.0"`).
@@ -144,7 +144,7 @@ export type SemanticCompletenessRequirement = ("best-effort" | "complete")
 /**
  * Stable reason why semantic evidence is partial or unavailable.
  */
-export type SemanticGapReason = ("no-project" | "ambiguous-project" | "blocking-diagnostics" | "unknown-symbol" | "unknown-entry-point" | "evidence-limit" | "dynamic-behavior" | "virtual-dispatch" | "dynamic-member-access" | "decorated-declaration" | "optional-contract" | "accessor-pair" | "overload-set" | "attached-comment" | "abstract-declaration" | "incomplete-project-coverage" | "framework-contract-provenance" | "capacity" | "unsupported-syntax")
+export type SemanticGapReason = ("no-project" | "ambiguous-project" | "blocking-diagnostics" | "svelte-virtual-module-exports" | "unknown-symbol" | "unknown-entry-point" | "evidence-limit" | "dynamic-behavior" | "virtual-dispatch" | "dynamic-member-access" | "decorated-declaration" | "optional-contract" | "accessor-pair" | "overload-set" | "attached-comment" | "abstract-declaration" | "incomplete-project-coverage" | "framework-contract-provenance" | "capacity" | "unsupported-syntax")
 /**
  * Value or type namespace for one exact declaration or reference.
  */
@@ -184,7 +184,7 @@ export type TypeAwareAbstentionReason = ("no-project" | "ambiguous-project" | "b
 /**
  * Schema projection for the dead-code envelope's exact version.
  */
-export type CheckSchemaVersion = 8
+export type CheckSchemaVersion = 9
 /**
  * A suggested action attached to a finding in the JSON output. Each finding
  * carries an `actions` array; consumers (agents, IDE clients, CI bots) can
@@ -782,7 +782,7 @@ export type GitLabReviewPositionType = "text"
 /**
  * Schema-version discriminator for the review envelope.
  */
-export type ReviewEnvelopeSchema = ("fallow-review-envelope/v1" | "fallow-review-envelope/v2")
+export type ReviewEnvelopeSchema = ("fallow-review-envelope/v1" | "fallow-review-envelope/v2" | "fallow-review-envelope/v3")
 /**
  * Review-envelope provider tag.
  */
@@ -821,7 +821,7 @@ export type CoverageSetupRuntimeTarget = ("node" | "browser")
 /**
  * Schema-version discriminator for [`CoverageAnalyzeOutput`].
  */
-export type CoverageAnalyzeSchemaVersion = "1"
+export type CoverageAnalyzeSchemaVersion = ("1" | "2")
 /**
  * Discovery outcome for a [`LogicalGroup`].
  */
@@ -829,7 +829,7 @@ export type LogicalGroupStatus = ("ok" | "empty" | "invalid_path")
 /**
  * Exact schema version for [`HealthOutput`].
  */
-export type HealthSchemaVersion = 10
+export type HealthSchemaVersion = 11
 /**
  * Resolver mode label for grouped envelopes (dead-code, dupes, health).
  *
@@ -842,7 +842,7 @@ export type GroupByMode = ("owner" | "directory" | "package" | "section")
  * Schema projection for the duplication envelope's CLI and programmatic
  * version lineages.
  */
-export type DupesSchemaVersion = (2 | 8)
+export type DupesSchemaVersion = (3 | 9)
 /**
  * Wire-version discriminator for [`ImpactReport`]. Independent from the global
  * `SchemaVersion` (the impact report versions on its own cadence) and from the
@@ -851,7 +851,7 @@ export type DupesSchemaVersion = (2 | 8)
  * it, matching the other independently-versioned envelopes (e.g.
  * `CoverageAnalyzeSchemaVersion`).
  */
-export type ImpactReportSchemaVersion = "1"
+export type ImpactReportSchemaVersion = ("1" | "2")
 /**
  * Why Impact tracking is (or is not) active for a project. `Project` = an
  * explicit per-repo `enable`; `User` = the user-global default with no per-repo
@@ -867,12 +867,12 @@ export type ImpactTrendDirection = ("improving" | "declining" | "stable")
  * versions separately from the per-project `ImpactReportSchemaVersion` and the
  * on-disk `STORE_SCHEMA_VERSION`).
  */
-export type CrossRepoImpactSchemaVersion = "1"
+export type CrossRepoImpactSchemaVersion = ("1" | "2")
 /**
  * The `fallow security --format json` schema version. Independently versioned
  * from the main contract, mirroring `ImpactReportSchemaVersion`.
  */
-export type SecuritySchemaVersion = ("1" | "2" | "3" | "4" | "5" | "6" | "7")
+export type SecuritySchemaVersion = ("1" | "2" | "3" | "4" | "5" | "6" | "7" | "8")
 /**
  * Severity level for rules.
  *
@@ -954,7 +954,7 @@ export type SecurityBlindSpotsSchemaVersion = "1"
 /**
  * Schema projection for the combined envelope's exact version.
  */
-export type CombinedSchemaVersion = 10
+export type CombinedSchemaVersion = 11
 /**
  * Schema projection for the feature-flags envelope's exact version.
  */
@@ -975,7 +975,7 @@ export type FeatureFlagActionType = ("investigate-flag" | "suppress-line")
  * Independently-versioned wire-version newtype for the brief envelope.
  * Serializes as the integer `REVIEW_BRIEF_SCHEMA_VERSION`.
  */
-export type ReviewBriefSchemaVersion = number
+export type ReviewBriefSchemaVersion = 7
 /**
  * The exactly-three shippable decision categories (the SOLID-3). No cut category
  * (abstraction / deletion / convention / irreversibility) is representable: this
@@ -1940,6 +1940,11 @@ ambiguous_project: number
  * Candidates retained because structural diagnostics block scanning.
  */
 blocking_diagnostics: number
+/**
+ * Candidates retained because the raw TypeScript-Go host cannot expose
+ * named exports from Svelte virtual modules.
+ */
+svelte_virtual_module_exports: number
 /**
  * Candidates whose exact declaration identity could not be resolved.
  */
@@ -9366,6 +9371,14 @@ callees?: (ChainHop[] | null)
  * Present only when `--callees` was requested.
  */
 unresolved_callees?: (UnresolvedCallee[] | null)
+/**
+ * Set when the name is unresolvable because two different `export *`
+ * sources of this file supply it. `symbol_found` is `false` in that case
+ * for the same reason it is false for an unknown name (the file exports
+ * nothing under it per ECMA-262 ResolveExport), so this field is the only
+ * thing that separates a barrel mistake from a typo.
+ */
+star_export_ambiguity?: (StarExportAmbiguity | null)
 /**
  * A human-readable summary of the trace outcome.
  */
@@ -9410,6 +9423,22 @@ export interface UnresolvedCallee {
 callee: string
 reason: UnresolvedReason
 }
+/**
+ * The `export *` collision that keeps a name from being exported.
+ */
+export interface StarExportAmbiguity {
+/**
+ * Files that each declare a colliding declaration under the traced name
+ * (project-root-relative), sorted. These are the origins to fix: keep one,
+ * rename or explicitly re-export the rest.
+ */
+sources: string[]
+/**
+ * The namespaces the collision occurs in, type before value. A name can
+ * collide in type space, value space, or both.
+ */
+namespaces: SemanticNamespace[]
+}
 /**
  * Envelope emitted by `fallow --format review-github` / `review-gitlab`.
  */