fallow 3.17.0 → 3.19.0

package/README.md

@@ -28,7 +28,7 @@ npx fallow fix --dry-run         # Preview automatic cleanup
 
 ## Output and exit codes
 
-Add `--format json --quiet` to any command for one typed JSON document on stdout. Exit code 1 means findings, not failure; 0 is clean (or an audit pass or warn verdict); 2 is a validation or runtime error, reported as a JSON error envelope rather than a stack trace.
+Add `--format json --quiet` to any command for one typed JSON document on stdout. Exit code 1 means findings, not failure; 0 is clean (or an audit pass or warn verdict); 2 is a validation or runtime error, reported as a JSON error envelope rather than a stack trace. License, coverage setup, network, and security-gate workflows use additional documented codes; read `fallow schema.exit_codes` instead of suppressing the process status.
 
 Parsing the output in TypeScript? Import the typed shapes, version-pinned to the CLI you install:
 
@@ -89,7 +89,7 @@ The bundled `fallow-mcp` server lives in `node_modules/.bin/` when installed as
 }
 ```
 
-Swap `npx` for `pnpm exec` or `yarn` to match your package manager; a globally installed `fallow-mcp` works as `"command": "fallow-mcp"` directly. See the [MCP integration guide](https://docs.fallow.tools/integrations/mcp).
+Swap `npx` for `pnpm exec` or `yarn` to match your package manager; a globally installed `fallow-mcp` works as `"command": "fallow-mcp"` directly. See the [MCP integration guide](https://docs.fallow.tools/integrations/mcp). `npx fallow agent install` writes this registration for you, together with the skill, an `AGENTS.md` task map, and the commit/push gate, for every harness it detects (Claude Code, Codex, Cursor); `--dry-run` shows the plan first.
 
 The package also ships a version-matched agent skill under `skills/fallow`, and `fallow/capabilities.json` mirrors `fallow schema` for tools that need CLI and issue-surface metadata without spawning the binary. TanStack Intent discovers both from `node_modules`:
 

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.17.0",
+  "version": "3.19.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -815,7 +815,7 @@
           "name": "--unused-dependency-overrides",
           "type": "bool",
           "required": false,
-          "description": "Only report unused pnpm dependency overrides",
+          "description": "Only report unused package-manager dependency overrides",
           "possible_values": [
             "true",
             "false"
@@ -825,7 +825,7 @@
           "name": "--misconfigured-dependency-overrides",
           "type": "bool",
           "required": false,
-          "description": "Only report misconfigured pnpm dependency overrides",
+          "description": "Only report misconfigured package-manager dependency overrides",
           "possible_values": [
             "true",
             "false"
@@ -906,6 +906,36 @@
       "description": "Inspect the optional TypeScript semantic companion",
       "flags": []
     },
+    {
+      "name": "similar-code",
+      "description": "Find semantically similar functions with a pinned local model (opt-in)",
+      "flags": [
+        {
+          "name": "--threshold",
+          "type": "string",
+          "required": false,
+          "description": "Minimum cosine similarity retained as an unverified candidate"
+        },
+        {
+          "name": "--min-lines",
+          "type": "string",
+          "required": false,
+          "description": "Minimum source lines per extracted function"
+        },
+        {
+          "name": "--top",
+          "type": "string",
+          "required": false,
+          "description": "Cap displayed candidates after bounded full-corpus comparison"
+        },
+        {
+          "name": "--file",
+          "type": "string",
+          "required": false,
+          "description": "Report pairs touching one of these project-relative files"
+        }
+      ]
+    },
     {
       "name": "inspect",
       "description": "Inspect one file or exported symbol as a bundled evidence query",
@@ -1075,6 +1105,11 @@
       "description": "Install or remove fallow-managed Git and agent hooks",
       "flags": []
     },
+    {
+      "name": "agent",
+      "description": "Wire fallow into the coding-agent harnesses used by this project in one pass (AGENTS.md task map, skill, MCP server, commit/push gate), or show and remove what was installed. `fallow init --agents` and `fallow hooks install --target agent` remain the single-piece commands underneath",
+      "flags": []
+    },
     {
       "name": "ci",
       "description": "CI helpers for PR/MR feedback envelopes",
@@ -1659,13 +1694,13 @@
           "name": "--coverage",
           "type": "string",
           "required": false,
-          "description": "Path to Istanbul-format coverage data (coverage-final.json) for accurate per-function CRAP scores in the health sub-analysis. Also configurable via FALLOW_COVERAGE"
+          "description": "Path to Istanbul-format coverage data (coverage-final.json) for accurate per-function CRAP scores in the health sub-analysis. Also configurable via FALLOW_COVERAGE or health.coverage"
         },
         {
           "name": "--coverage-root",
           "type": "string",
           "required": false,
-          "description": "Absolute prefix to strip from coverage data paths before CRAP matching. Use when coverage was generated under a different checkout root in CI or Docker"
+          "description": "Absolute prefix to strip from coverage data paths before CRAP matching. Use when coverage was generated under a different checkout root in CI or Docker. Also configurable via FALLOW_COVERAGE_ROOT or health.coverageRoot"
         },
         {
           "name": "--no-css",
@@ -3094,7 +3129,7 @@
       "rule_id": "fallow/unused-dependency-override",
       "command": "dead-code",
       "category": "Dependencies",
-      "description": "pnpm.overrides entry targets a package not declared or resolved",
+      "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
       "registry_index": 42,
@@ -3135,7 +3170,7 @@
       "rule_id": "fallow/misconfigured-dependency-override",
       "command": "dead-code",
       "category": "Dependencies",
-      "description": "pnpm.overrides entry has an unparsable key or value",
+      "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
       "registry_index": 43,
@@ -5923,18 +5958,32 @@
     "sarif",
     "compact",
     "markdown",
+    "md",
     "codeclimate",
     "gitlab-codequality",
+    "gitlab-code-quality",
     "pr-comment-github",
     "pr-comment-gitlab",
     "review-github",
     "review-gitlab",
-    "badge"
+    "badge",
+    "github-annotations",
+    "github-summary"
   ],
   "exit_codes": {
     "0": "Success (no error-severity issues found)",
-    "1": "Error-severity issues found (per rules config, or --fail-on-issues promotes warn→error)",
-    "2": "Error (invalid config, invalid input, etc.). When --format json is active, errors are emitted as structured JSON on stdout: {\"error\": true, \"message\": \"...\", \"exit_code\": 2}"
+    "1": "Error-severity issues found (per rules config, or --fail-on-issues promotes warn to error)",
+    "2": "Error (invalid config, invalid input, etc.). When --format json is active, errors are emitted as structured JSON on stdout: {\"error\": true, \"message\": \"...\", \"exit_code\": 2}",
+    "3": "Requested resource unavailable: config --path found no config, or a license is missing, invalid, or beyond its offline hard-fail window",
+    "4": "Runtime coverage sidecar is unavailable, unverifiable, protocol-incompatible, or terminated unexpectedly",
+    "5": "Runtime coverage input could not be prepared or parsed",
+    "6": "Runtime coverage sidecar reported an internal error",
+    "7": "Network or cloud request failed during a license, coverage, or CI operation",
+    "8": "Security gate matched a candidate selected by --gate",
+    "10": "Coverage inventory or static-findings upload input or project validation failed",
+    "11": "Coverage inventory or static-findings upload exceeded the server payload limit",
+    "12": "Coverage inventory or static-findings upload authentication or authorization was rejected",
+    "13": "Coverage inventory or static-findings upload failed after retries or returned another server error"
   },
   "environment_variables": {
     "FALLOW_FORMAT": "Default output format (json/human/sarif/compact/markdown/codeclimate/gitlab-codequality/pr-comment-github/pr-comment-gitlab/review-github/review-gitlab/badge/github-annotations/github-summary). CLI --format flag overrides this.",
@@ -5949,14 +5998,14 @@
     "FALLOW_PR_COMMENT_LAYOUT": "Sticky PR comment layout: default, compact, gate-only, or details.",
     "FALLOW_CONSOLIDATED_STATUS": "When split PR gate check runs are enabled, truthy values add one aggregate Fallow check alongside the per-gate checks.",
     "FALLOW_DIFF_CONTEXT": "Line radius around changed diff lines when scoping findings to a diff in the review/PR-comment formats (default 3).",
-    "FALLOW_BOT_LOGIN": "Bot or token username treated as fallow's own when reconciling existing PR/MR comments in review-github/review-gitlab. Required when posting with a personal access token (the author then carries a human identity).",
+    "FALLOW_BOT_LOGIN": "Allowlisted posting username used to recognize fallow-owned finding roots and resolution replies. When set, it narrows ownership to that exact username (an empty value matches nobody); when unset, provider-native bot metadata is trusted. This is an authorship control, not a lifecycle or deduplication token.",
     "FALLOW_API_RETRIES": "Maximum HTTP attempts for review-comment reconciliation API calls (default 3).",
     "FALLOW_API_RETRY_DELAY": "Floor delay in seconds between HTTP retry attempts (default 2); a server-supplied Retry-After overrides it on 429 responses.",
     "FALLOW_CACHE_DIR": "Directory for fallow's persistent analysis cache. Relative paths resolve from the project root and override cache.dir.",
     "FALLOW_CACHE_MAX_SIZE": "Extraction cache size cap in megabytes (default 256). Wins over the cache.maxSizeMb config field.",
     "FALLOW_EXTENDS_TIMEOUT_SECS": "Timeout in seconds for fetching https:// configs referenced via the extends field (default 5).",
-    "FALLOW_COVERAGE": "Path to Istanbul coverage data (coverage-final.json) for accurate per-function CRAP scores. CLI --coverage flag overrides this.",
-    "FALLOW_COVERAGE_ROOT": "Absolute coverage-data path prefix for rebasing Istanbul paths in CI or containers. CLI --coverage-root flag overrides this.",
+    "FALLOW_COVERAGE": "Path to Istanbul coverage data (coverage-final.json) for accurate per-function CRAP scores. CLI --coverage flag overrides this; it wins over the health.coverage config field. Honored by the health, bare fallow, and audit CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage parameter overrides it.",
+    "FALLOW_COVERAGE_ROOT": "Absolute coverage-data path prefix for rebasing Istanbul paths in CI or containers. CLI --coverage-root flag overrides this; it wins over the health.coverageRoot config field. Honored by the health, bare fallow, and audit CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage_root parameter overrides it.",
     "FALLOW_MAX_FILE_SIZE": "Per-file size ceiling in megabytes for source discovery (default 5; 0 = no limit). CLI --max-file-size flag overrides this.",
     "FALLOW_TYPE_AWARE": "Enable or disable TypeScript semantic (type-aware) analysis for the run (true/false/1/0/yes/no/on/off). Precedence: --type-aware/--no-type-aware CLI flags, then FALLOW_TYPE_AWARE, then the audit.typeAware config field, then typeAware.enabled.",
     "FALLOW_TYPE_AWARE_BIN": "Trusted executable override for the TypeScript semantic refinement sidecar used by dead-code --type-aware. Relative paths resolve from the caller's working directory before --root is applied; project node_modules and PATH are intentionally not searched. Default: sibling of the active Fallow executable.",
@@ -6461,7 +6510,7 @@
   },
   "mcp_tools": {
     "server": "fallow-mcp",
-    "note": "key_params is a curated subset; the live MCP input schemas (list_tools) are authoritative for the full parameter list. cli_command is the nearest CLI fallback, not a full MCP input-schema projection",
+    "note": "key_params is a curated subset; the live MCP input schemas (tools/list) are authoritative for the full parameter list. cli_command is the nearest CLI fallback, not a full MCP input-schema projection",
     "tools": [
       {
         "name": "code_execute",
@@ -6523,6 +6572,35 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "find_similar_code",
+        "kind": "analysis",
+        "description": "Find unverified semantically similar function candidates with the exact pinned local model",
+        "cli_command": "fallow similar-code --format json --quiet",
+        "key_params": [
+          "threshold",
+          "min_lines",
+          "top",
+          "changed_since",
+          "paths"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
+      {
+        "name": "inspect_similar_code",
+        "kind": "trace",
+        "description": "Inspect one exact candidate snapshot without rerunning retrieval or global ranking",
+        "cli_command": "fallow similar-code inspect <candidate-id> --candidates <report.json> --format json --quiet",
+        "key_params": [
+          "candidate_id",
+          "snapshot"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "inspect_target",
         "kind": "analysis",
@@ -6658,7 +6736,7 @@
       {
         "name": "get_token_blast_radius",
         "kind": "analysis",
-        "description": "Design-token blast radius for Tailwind v4 @theme tokens AND CSS-in-JS defineVars/createTheme-family token definitions: per token, a consumer_count (static lower bound) and a capped located consumers[] sample tagged theme-var/css-var/utility/apply (Tailwind) or js-member (CSS-in-JS cross-module member access); descriptive context for sizing a token change, never a deletion gate",
+        "description": "Design-token blast radius for Tailwind v4 @theme tokens AND CSS-in-JS defineVars/createTheme-family token definitions: per token, a consumer_count (static lower bound) and a capped located consumers[] sample tagged theme-var/css-var/utility/apply (Tailwind), js-member (CSS-in-JS member access), or js-call (StyleX theme-group and Panda token calls); descriptive context for sizing a token change, never a deletion gate",
         "cli_command": "fallow health --css --format json --quiet",
         "key_params": [],
         "license": "free",
@@ -6837,7 +6915,7 @@
       {
         "name": "trace_symbol",
         "kind": "trace",
-        "description": "Trace an exact TypeScript symbol with checker-backed references, namespace identity, aliases, and re-export hops. Root trace fields preserve syntactic context; treat semantic.references, semantic.status, and semantic.identity as the authoritative exact evidence. This is project-wide evidence for Fallow decisions, not a compiler-diagnostic or lint-rule surface.",
+        "description": "Trace an exact TypeScript symbol with checker-backed references, namespace identity, aliases, and re-export hops. Root trace fields preserve syntactic context; treat semantic.references, semantic.status, and semantic.identity as the authoritative exact evidence. The proof covers only the lane named by semantic.target.namespace, so a root trace that lists a reference the proof does not is wider evidence rather than stale. This is project-wide evidence for Fallow decisions, not a compiler-diagnostic or lint-rule surface.",
         "cli_command": "fallow dead-code --type-aware --trace <file:export> --format json --quiet",
         "key_params": [
           "file",
@@ -6920,8 +6998,78 @@
       }
     ]
   },
+  "mcp_resources": {
+    "server": "fallow-mcp",
+    "note": "Read-only reference material served in-process by fallow-mcp; every JSON payload carries fallow_version. Rows with template: true are RFC 6570 URI templates listed under resources/templates/list; the catalogue is static, so the server declares neither subscribe nor listChanged",
+    "resources": [
+      {
+        "uri": "fallow://tools",
+        "name": "tools",
+        "title": "Tool manifest",
+        "description": "MCP tool manifest: name, kind, one-line description, nearest CLI fallback, key params, license, and read-only flag for every tool",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://issue-types",
+        "name": "issue-types",
+        "title": "Issue type registry",
+        "description": "Every issue type with its command, category, config key, zero-config default severity, opt-in flag, fixable flag, docs URL, and explain resource URI",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://explain",
+        "name": "explain",
+        "title": "Explain index",
+        "description": "Index of every explainable issue type with its one-line summary and the fallow://explain/{issue_type} URI to read",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://task-matrix",
+        "name": "task-matrix",
+        "title": "Agent task matrix",
+        "description": "Agent task-to-command matrix: which read-only fallow command to run before deleting, refactoring, committing, or scoping work",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://schema/config",
+        "name": "schema-config",
+        "title": "Config JSON Schema",
+        "description": "JSON Schema of the fallow config file (same document as fallow config-schema)",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://schema/plugin",
+        "name": "schema-plugin",
+        "title": "Plugin JSON Schema",
+        "description": "JSON Schema of a user-authored external plugin (same document as fallow plugin-schema)",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://schema/rule-pack",
+        "name": "schema-rule-pack",
+        "title": "Rule pack JSON Schema",
+        "description": "JSON Schema of a declarative rule pack (same document as fallow rule-pack-schema)",
+        "mime_type": "application/json",
+        "template": false
+      },
+      {
+        "uri": "fallow://explain/{issue_type}",
+        "name": "explain-issue-type",
+        "title": "Explain one issue type",
+        "description": "Explain document for one issue type (same payload as fallow explain <issue-type> --format json): name, summary, rationale, example, fix guidance, docs URL. issue_type accepts the bare id (unused-export), the namespaced id (fallow/unused-export), or the CLI filter spelling; see fallow://explain for the index",
+        "mime_type": "application/json",
+        "template": true
+      }
+    ]
+  },
   "plugins": {
-    "count": 123,
+    "count": 124,
     "note": "Built-in framework plugins, auto-activated when their enabler dependency is present; run fallow list --plugins for the set active in a specific project",
     "names": [
       "nextjs",
@@ -7029,6 +7177,7 @@
       "lint-staged",
       "lefthook",
       "simple-git-hooks",
+      "size-limit",
       "svgo",
       "svgr",
       "graphql-codegen",

package/issue-registry.json

@@ -1558,7 +1558,7 @@
       "rule_id": "fallow/unused-dependency-override",
       "command": "dead-code",
       "category": "Dependencies",
-      "description": "pnpm.overrides entry targets a package not declared or resolved",
+      "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
       "registry_index": 42,
@@ -1599,7 +1599,7 @@
       "rule_id": "fallow/misconfigured-dependency-override",
       "command": "dead-code",
       "category": "Dependencies",
-      "description": "pnpm.overrides entry has an unparsable key or value",
+      "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
       "registry_index": 43,

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "fallow",
-  "version": "3.17.0",
+  "version": "3.19.0",
+  "mcpName": "io.github.fallow-rs/fallow",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -87,14 +88,14 @@
     "@tanstack/intent": "0.3.6"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.17.0",
-    "@fallow-cli/darwin-x64": "3.17.0",
-    "@fallow-cli/linux-x64-gnu": "3.17.0",
-    "@fallow-cli/linux-arm64-gnu": "3.17.0",
-    "@fallow-cli/linux-x64-musl": "3.17.0",
-    "@fallow-cli/linux-arm64-musl": "3.17.0",
-    "@fallow-cli/win32-arm64-msvc": "3.17.0",
-    "@fallow-cli/win32-x64-msvc": "3.17.0",
-    "fallow-type-aware": "3.17.0"
+    "@fallow-cli/darwin-arm64": "3.19.0",
+    "@fallow-cli/darwin-x64": "3.19.0",
+    "@fallow-cli/linux-x64-gnu": "3.19.0",
+    "@fallow-cli/linux-arm64-gnu": "3.19.0",
+    "@fallow-cli/linux-x64-musl": "3.19.0",
+    "@fallow-cli/linux-arm64-musl": "3.19.0",
+    "@fallow-cli/win32-arm64-msvc": "3.19.0",
+    "@fallow-cli/win32-x64-msvc": "3.19.0",
+    "fallow-type-aware": "3.19.0"
   }
 }

package/schema.json

@@ -143,6 +143,15 @@
         "minCorpusSizeForTokenCache": 5000
       }
     },
+    "similarCode": {
+      "description": "Configures the explicit local `similar-code` candidate workflow:\n`threshold` (0.80, model-specific cosine floor), `minLines` (3), and\nadditional `ignore` globs. Provider identity, setup, executables,\nendpoints, credentials, and consent cannot be set by project config.",
+      "$ref": "#/$defs/SimilarCodeConfig",
+      "default": {
+        "threshold": 0.8,
+        "minLines": 3,
+        "ignore": []
+      }
+    },
     "health": {
       "description": "Sets complexity and health thresholds for `fallow health` (also applied in combined `fallow` and `fallow audit`): `maxCyclomatic` (20), `maxCognitive` (15), `maxCrap` (30.0, findings at or above this are reported), `crapRefactorBand` (5, cyclomatic band below `maxCyclomatic` where a secondary refactor action is added), `maxUnitSize` (max function lines before a large-function finding, 60), `coverage`/`coverageRoot` (Istanbul coverage path and path-prefix strip for accurate CRAP), `ignore` globs (remove files from findings AND the health score), `thresholdOverrides` (per-file/per-function ceilings via `files`/`functions`/`maxCyclomatic`/`maxCognitive`/`maxCrap`/`maxUnitSize`/`reason`), `ownership` (`botPatterns` and `emailMode` for `--ownership`), and `suggestInlineSuppression` (true, emit `suppress-line` action hints in JSON). Raise thresholds to relax which functions are flagged, wire `coverage` for real CRAP scores, or exempt generated/test files via `ignore` (drops them from the score too) or `thresholdOverrides` (keeps them visible under a higher ceiling). The four `max*` thresholds govern findings only and never move `health_score`: its penalties use fixed calibration so grades stay comparable across projects, and `ignore` is the lever that removes files from the score.",
       "$ref": "#/$defs/HealthConfig",
@@ -986,6 +995,36 @@
         }
       }
     },
+    "SimilarCodeConfig": {
+      "description": "Project-owned tuning for the explicit `fallow similar-code` workflow.\n\nProvider identity, executable discovery, model setup, credentials, and\nconsent are intentionally absent. Project configuration cannot select code\ndestinations or authorize model downloads.",
+      "type": "object",
+      "properties": {
+        "threshold": {
+          "description": "Minimum model-specific cosine similarity retained as an unverified\ncandidate. It is not a probability or refactor-safety verdict.",
+          "type": "number",
+          "format": "double",
+          "minimum": 0.0,
+          "maximum": 1.0,
+          "default": 0.8
+        },
+        "minLines": {
+          "description": "Minimum source line count for a function to enter model inference.",
+          "type": "integer",
+          "format": "uint",
+          "minimum": 1,
+          "default": 3
+        },
+        "ignore": {
+          "description": "Additional project-root-relative globs excluded only from similar-code\nextraction. Global `ignorePatterns` remain authoritative first.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "default": []
+        }
+      },
+      "additionalProperties": false
+    },
     "HealthConfig": {
       "description": "Configuration for complexity health metrics (`fallow health`).",
       "type": "object",
@@ -1028,7 +1067,7 @@
           "default": 60
         },
         "coverage": {
-          "description": "Path to Istanbul-format coverage data for accurate per-function CRAP\nscores. Relative paths resolve against the project root. The CLI\n`--coverage` flag and `FALLOW_COVERAGE` environment variable override\nthis value.",
+          "description": "Path to Istanbul-format coverage data for accurate per-function CRAP\nscores. Relative paths resolve against the project root. The CLI\n`--coverage` flag and `FALLOW_COVERAGE` environment variable override\nthis value. Consulted by `fallow health`, bare `fallow`, `fallow audit`,\nand the MCP `audit` / `check_health` tools.",
           "type": [
             "string",
             "null"
@@ -1036,7 +1075,7 @@
           "default": null
         },
         "coverageRoot": {
-          "description": "Absolute prefix to strip from Istanbul file paths before CRAP matching.\nUse when coverage was generated under a different checkout root in CI\nor Docker. The CLI `--coverage-root` flag and `FALLOW_COVERAGE_ROOT`\nenvironment variable override this value.",
+          "description": "Absolute prefix to strip from Istanbul file paths before CRAP matching.\nUse when coverage was generated under a different checkout root in CI\nor Docker. The CLI `--coverage-root` flag and `FALLOW_COVERAGE_ROOT`\nenvironment variable override this value. Consulted by `fallow health`,\nbare `fallow`, `fallow audit`, and the MCP `audit` / `check_health`\ntools.",
           "type": [
             "string",
             "null"
@@ -1458,12 +1497,12 @@
           "default": "error"
         },
         "unused-dependency-overrides": {
-          "description": "A pnpm `overrides:` / `pnpm.overrides` entry whose target package no\nworkspace `package.json` declares. Defaults to `warn`.",
+          "description": "A pnpm, npm, or Bun override entry whose target package no workspace\n`package.json` declares and the active readable lockfile does not\nresolve. Defaults to `warn`.",
           "$ref": "#/$defs/Severity",
           "default": "warn"
         },
         "misconfigured-dependency-overrides": {
-          "description": "A pnpm `overrides:` / `pnpm.overrides` entry whose key or value cannot\nbe parsed into a valid pnpm shape. Defaults to `error`.",
+          "description": "A pnpm, npm, or Bun override or Bun `resolutions` entry whose key or\nvalue cannot be parsed in its declaration source's grammar. Defaults to\n`error`.",
           "$ref": "#/$defs/Severity",
           "default": "error"
         },

package/scripts/lazy-verify.js

@@ -29,7 +29,7 @@ const { verifyInstalledSync, SKIP_ENV } = require("./verify-binary");
 // Bumped to 2 when SHA-256 + platformPkgDir binding landed (closes the
 // cross-install reuse gap in the shared $XDG fallback cache). v1 sentinels
 // without these fields are invalidated automatically.
-const SENTINEL_SCHEMA_VERSION = 2;
+const SENTINEL_SCHEMA_VERSION = 3;
 const VERIFY_LOG_ENV = "FALLOW_VERIFY_LOG";
 
 // One-shot warning state: each warning class fires once per process,
@@ -66,11 +66,10 @@ function emitVerifyLog(env, payload) {
 }
 
 function binaryTargetsForPlatform(platform) {
-  // Platform packages ship one binary: the multicall `fallow`. The bundled
-  // lsp/mcp launchers spawn `fallow lsp-server` / `fallow mcp-server`, so there
-  // is only one binary to sentinel-track and verify.
+  // Track every executable the multicall CLI may launch without another
+  // wrapper verification boundary.
   const ext = platform === "win32" ? ".exe" : "";
-  return [`fallow${ext}`];
+  return [`fallow${ext}`, `fallow-similar-code${ext}`];
 }
 
 function statMtimeMs(absPath) {
@@ -235,6 +234,9 @@ function isSkipRequested(env) {
 //                    production install path always has fallowDigests)
 //   env            - process.env (defaults to process.env)
 //   platform       - process.platform (defaults to process.platform)
+//   homedir        - os.homedir() override (tests only)
+//   isWritable     - sentinel directory probe override (tests only)
+//   ensureDir      - sentinel directory creation override (tests only)
 //   logger         - function (line: string) -> void (defaults to stderr)
 //
 // Returns one of:
@@ -253,6 +255,16 @@ function buildVerifyOptions(input, manifest) {
   return opts;
 }
 
+function buildSentinelOptions(input, platformPkgDir, packageName, env, platform) {
+  const opts = { platformPkgDir, packageName, env, platform };
+  for (const key of ["homedir", "isWritable", "ensureDir"]) {
+    if (Object.prototype.hasOwnProperty.call(input, key)) {
+      opts[key] = input[key];
+    }
+  }
+  return opts;
+}
+
 // Persist the sentinel on a successful verify. Logs (warn-once) when the
 // resolved cache location is read-only or every cascade step failed.
 function persistSentinel(sentinel, platformPkgDir, manifest, platform) {
@@ -315,7 +327,9 @@ function ensureVerified(input) {
     };
   }
 
-  const sentinel = resolveSentinelPath({ platformPkgDir, packageName, env, platform });
+  const sentinel = resolveSentinelPath(
+    buildSentinelOptions(input || {}, platformPkgDir, packageName, env, platform),
+  );
 
   // Cache hit: sentinel exists, schema matches, mtimes match, version matches.
   if (sentinel.path && isSentinelValid(sentinel.path, platformPkgDir, manifest, platform)) {