fallow 3.2.0 → 3.4.2

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.2.0",
+  "version": "3.4.2",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -18,6 +18,16 @@
       "description": "Path to config file (.fallowrc.json, .fallowrc.jsonc, fallow.toml, or .fallow.toml)",
       "short": "-c"
     },
+    {
+      "name": "--allow-remote-extends",
+      "type": "bool",
+      "required": false,
+      "description": "Allow trusted config files to extend HTTPS URLs",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--format",
       "type": "string",
@@ -36,7 +46,9 @@
         "pr-comment-gitlab",
         "review-github",
         "review-gitlab",
-        "badge"
+        "badge",
+        "github-annotations",
+        "github-summary"
       ]
     },
     {
@@ -266,6 +278,12 @@
       "description": "Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr",
       "short": "-o"
     },
+    {
+      "name": "--report-path-prefix",
+      "type": "string",
+      "required": false,
+      "description": "Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root`"
+    },
     {
       "name": "--fail-on-regression",
       "type": "bool",
@@ -985,6 +1003,11 @@
       "description": "Print the JSON Schema for external plugin files",
       "flags": []
     },
+    {
+      "name": "plugin-check",
+      "description": "Dry-run external plugins: report what each activated and seeded",
+      "flags": []
+    },
     {
       "name": "rule-pack-schema",
       "description": "Print the JSON Schema for rule pack files",
@@ -1023,6 +1046,11 @@
         }
       ]
     },
+    {
+      "name": "recommend",
+      "description": "Recommend a project-tailored config for an agent to author",
+      "flags": []
+    },
     {
       "name": "list",
       "description": "List discovered entry points, files, plugins, boundaries, and workspaces",
@@ -1438,6 +1466,18 @@
         }
       ]
     },
+    {
+      "name": "suppressions",
+      "description": "List active fallow-ignore suppression markers (read-only inventory)",
+      "flags": [
+        {
+          "name": "--file",
+          "type": "string",
+          "required": false,
+          "description": "Only list suppressions in the specified files. Accepts multiple values"
+        }
+      ]
+    },
     {
       "name": "explain",
       "description": "Explain one fallow issue type without running an analysis",
@@ -1743,6 +1783,18 @@
         }
       ]
     },
+    {
+      "name": "report",
+      "description": "Render a saved `--format json` results file in another format without re-running analysis (analyze once, render annotations and the job summary from the same file). v1 renders the GitHub-native formats only: `--format github-annotations` or `--format github-summary`",
+      "flags": [
+        {
+          "name": "--from",
+          "type": "string",
+          "required": true,
+          "description": "Path to a fallow JSON results file produced by `--format json` (dead-code, dupes, health, audit, security, or bare combined)"
+        }
+      ]
+    },
     {
       "name": "schema",
       "description": "Dump fallow's capability manifest (CLI commands and flags, issue types, MCP tools, framework plugins, env vars) as machine-readable JSON for agent introspection. Always JSON, regardless of --format",
@@ -1909,6 +1961,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file unused-file",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -1943,6 +1998,9 @@
       "fixable": true,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-export",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -1974,6 +2032,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-type",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2008,6 +2069,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line private-type-leak",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in API hygiene check; the rule defaults to off",
       "license": "free",
       "license_note": null,
@@ -2042,6 +2106,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "--unused-deps controls unused-dependency, unused-dev-dependency, unused-optional-dependency, type-only-dependency, and test-only-dependency",
       "license": "free",
       "license_note": null,
@@ -2079,6 +2146,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "--unused-deps controls unused-dependency, unused-dev-dependency, unused-optional-dependency, type-only-dependency, and test-only-dependency",
       "license": "free",
       "license_note": null,
@@ -2116,6 +2186,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "--unused-deps controls unused-dependency, unused-dev-dependency, unused-optional-dependency, type-only-dependency, and test-only-dependency",
       "license": "free",
       "license_note": null,
@@ -2150,6 +2223,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Only reported in --production mode; --unused-deps scopes it together with the other dependency kinds",
       "license": "free",
       "license_note": null,
@@ -2184,6 +2260,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Not reported in --production mode (test files are excluded there); --unused-deps scopes it together with the other dependency kinds",
       "license": "free",
       "license_note": null,
@@ -2218,6 +2297,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2252,6 +2334,9 @@
       "fixable": true,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-enum-member",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2286,6 +2371,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-class-member",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2322,6 +2410,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-store-member",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2356,6 +2447,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unresolved-import",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2390,6 +2484,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2424,6 +2521,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file duplicate-export",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "fallow fix can add an ignoreExports rule to the fallow config instead of editing source",
       "license": "free",
       "license_note": null,
@@ -2460,6 +2560,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line circular-dependency",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2498,6 +2601,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file re-export-cycle",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2532,6 +2638,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line boundary-violation",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires configured boundary zones (boundaries config)",
       "license": "free",
       "license_note": null,
@@ -2565,6 +2674,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file boundary-violation",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires boundaries.coverage.requireAllFiles",
       "license": "free",
       "license_note": null,
@@ -2599,6 +2711,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line boundary-call-violation",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires boundaries.calls.forbidden patterns",
       "license": "free",
       "license_note": null,
@@ -2632,6 +2747,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line policy-violation",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires a configured rule pack (rulePacks config)",
       "license": "free",
       "license_note": null,
@@ -2665,6 +2783,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Fix by removing the stale suppression marker itself",
       "license": "free",
       "license_note": null,
@@ -2694,6 +2815,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2731,6 +2855,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2768,6 +2895,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2805,6 +2935,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2843,6 +2976,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2881,6 +3017,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2914,6 +3053,11 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line invalid-client-export",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [
+        "next"
+      ],
       "note": "Requires the project to declare next",
       "license": "free",
       "license_note": null,
@@ -2947,6 +3091,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line mixed-client-server-barrel",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires the project to declare next",
       "license": "free",
       "license_note": null,
@@ -2980,6 +3127,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line misplaced-directive",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires the project to declare next",
       "license": "free",
       "license_note": null,
@@ -3013,6 +3163,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unprovided-inject",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3046,6 +3199,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unrendered-component",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3079,6 +3235,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-prop",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3112,6 +3271,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-emit",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3145,6 +3307,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-input",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3178,6 +3343,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-output",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3211,6 +3379,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-svelte-event",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3244,6 +3415,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-server-action",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3277,6 +3451,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-load-data-key",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3306,6 +3483,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line prop-drilling",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in: set rules.prop-drilling to warn or error to enable. Defaults to off.",
       "license": "free",
       "license_note": null,
@@ -3337,6 +3517,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line thin-wrapper",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in: set rules.thin-wrapper to warn or error to enable. Defaults to off.",
       "license": "free",
       "license_note": null,
@@ -3368,6 +3551,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line duplicate-prop-shape",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in: set rules.duplicate-prop-shape to warn or error to enable. Defaults to off.",
       "license": "free",
       "license_note": null,
@@ -3401,6 +3587,11 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file route-collision",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [
+        "next"
+      ],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3434,6 +3625,11 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file dynamic-segment-name-conflict",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [
+        "next"
+      ],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3461,6 +3657,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3488,6 +3687,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3515,6 +3717,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3542,6 +3747,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3569,6 +3777,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3596,6 +3807,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-token-drift",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3623,6 +3837,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-duplicate-block",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3650,6 +3867,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-selector-complexity",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3677,6 +3897,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-dead-surface",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3704,6 +3927,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-broken-reference",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3731,6 +3957,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file coverage-gaps",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3758,6 +3987,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file coverage-gaps",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3785,6 +4017,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3812,6 +4047,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3839,6 +4077,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3866,6 +4107,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3893,6 +4137,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3920,6 +4167,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3947,6 +4197,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3974,6 +4227,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -4001,6 +4257,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -4028,6 +4287,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line code-duplication",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Reported by fallow dupes (and bare fallow / fallow audit)",
       "license": "free",
       "license_note": null,
@@ -4055,6 +4317,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line feature-flag",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Reported by fallow flags",
       "license": "free",
       "license_note": null,
@@ -4082,6 +4347,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -4109,6 +4377,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file security-client-server-leak",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -4136,6 +4407,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Include-required category: enable via security.categories.include",
       "license": "free",
       "license_note": null,
@@ -4163,6 +4437,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4190,6 +4467,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4217,6 +4497,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4244,6 +4527,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4271,6 +4557,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4298,6 +4587,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4325,6 +4617,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4352,6 +4647,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4379,6 +4677,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4406,6 +4707,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4433,6 +4737,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4460,6 +4767,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4487,6 +4797,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4514,6 +4827,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4541,6 +4857,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4568,6 +4887,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4595,6 +4917,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4622,6 +4947,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4649,6 +4977,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4676,6 +5007,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4703,6 +5037,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4730,6 +5067,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4757,6 +5097,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4784,6 +5127,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4811,6 +5157,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4838,6 +5187,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4865,6 +5217,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4892,6 +5247,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4919,6 +5277,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4946,6 +5307,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4973,6 +5337,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5000,6 +5367,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5027,6 +5397,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5054,6 +5427,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5081,6 +5457,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5108,6 +5487,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5135,6 +5517,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5162,6 +5547,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5189,6 +5577,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5216,6 +5607,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5243,6 +5637,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5270,6 +5667,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5297,6 +5697,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5324,6 +5727,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5351,6 +5757,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5434,14 +5843,481 @@
     "warn",
     "off"
   ],
+  "field_notes": {
+    "default_severity": "The rule's severity under zero config (error/warn/off). null means the finding is not gated by a rules.* severity (a metric or command-driven finding, or a security-catalogue row).",
+    "opt_in": "true when the rule defaults to off and reports nothing until enabled. Enabling an opt_in rule blindly is the most common way to flood a repo with findings, so treat true as a deliberate decision.",
+    "frameworks": "Non-empty ONLY when the rule's DETECTOR self-gates on that framework (it does nothing unless the framework is declared). An EMPTY array does NOT mean the rule is framework-agnostic: many rules are framework-relevant (see the description) yet fire on any matching syntax, so never disable a rule solely because frameworks is empty.",
+    "config_key": "The canonical key under `rules` in the config file, i.e. rules.<config_key>. The `id` is an accepted alias. null for findings that are not configured via a rules.* severity."
+  },
+  "related_schemas": {
+    "note": "This manifest lists RULES, capabilities, presets, and the taste catalog. To author a config FILE you also need its shape, which is a separate schema.",
+    "config_schema_command": "fallow config-schema",
+    "config_schema_note": "Full JSON Schema of the config file: every top-level key (rules, entry, ignorePatterns, workspaces, boundaries, duplicates, health, security, rulePacks, production, cache, ...) and its shape. entry and ignorePatterns are how you declare entry points and exclusions; fallow also auto-honors package.json exports/main/module for library public APIs.",
+    "rule_pack_schema_command": "fallow rule-pack-schema",
+    "rule_pack_schema_note": "JSON Schema for a declarative rule pack referenced from rulePacks.",
+    "plugin_schema_command": "fallow plugin-schema",
+    "plugin_schema_note": "JSON Schema for a user-authored external plugin (fallow-plugin-*.jsonc). Teach fallow about an unsupported framework declaratively: detection, entryPoints, alwaysUsed, usedExports, usedClassMembers, and manifestEntries (derive entry points from per-package manifest files).",
+    "plugin_check_command": "fallow plugin-check",
+    "plugin_check_note": "Read-only dry-run of your external plugins: reports which activated, which manifests each manifestEntries rule matched, what it seeded (with path-exists), and typed warnings (manifests-matched-none, when-excluded-all, field-path-unresolved, entries-empty, manifest-parse-failed, entry-outside-root, seeded-paths-missing). Run it after authoring a fallow-plugin-*.jsonc to verify it before a full analysis.",
+    "config_files": [
+      ".fallowrc.json",
+      ".fallowrc.jsonc",
+      "fallow.toml",
+      ".fallow.toml"
+    ]
+  },
+  "boundary_presets": [
+    {
+      "name": "layered",
+      "description": "Classic layers: presentation depends on application depends on domain; infrastructure depends on domain and application.",
+      "config": "boundaries.preset: \"layered\""
+    },
+    {
+      "name": "hexagonal",
+      "description": "Ports and adapters: adapters depend on ports, ports depend on the domain; the domain depends on nothing outward.",
+      "config": "boundaries.preset: \"hexagonal\""
+    },
+    {
+      "name": "feature-sliced",
+      "description": "Feature-Sliced Design: app, pages, widgets, features, entities, shared; each layer may only import from the layers below it.",
+      "config": "boundaries.preset: \"feature-sliced\""
+    },
+    {
+      "name": "bulletproof",
+      "description": "Bulletproof React: app and features depend on shared and server; features stay isolated from each other.",
+      "config": "boundaries.preset: \"bulletproof\""
+    }
+  ],
+  "taste_choices": [
+    {
+      "id": "ci-strictness",
+      "header": "CI gate",
+      "prompt": "Should the cleanup rules that default to warn (unused dev/optional dependencies, component-level dead code, styling drift) fail CI, or stay advisory?",
+      "tier": "taste",
+      "first_run": true,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.unused-dev-dependencies",
+        "rules.unused-optional-dependencies",
+        "rules.stale-suppressions"
+      ],
+      "default_summary": "These rules default to warn: reported, never failing CI. The structural rules (unused files/exports/deps, circular deps, unresolved imports, boundary violations) already default to error.",
+      "options": [
+        {
+          "label": "Advisory",
+          "effect": "Keep the warn-default rules at warn.",
+          "tradeoff": "Cleanup drift is visible but never blocks a merge; the team addresses it on its own cadence."
+        },
+        {
+          "label": "Strict",
+          "effect": "Promote the warn-default cleanup rules to error.",
+          "tradeoff": "A PR that adds unused dev deps or dead component surface fails CI; noisier on legacy code, tighter on new code."
+        }
+      ]
+    },
+    {
+      "id": "private-type-leak",
+      "header": "API hygiene",
+      "prompt": "Enable the opt-in private-type-leak check, which flags exported signatures that reference a same-file private type (a break for consumers)?",
+      "tier": "taste",
+      "first_run": true,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.private-type-leaks"
+      ],
+      "default_summary": "Off by default: it is a lower-confidence API-hygiene check, so fallow does not enable it unless you opt in.",
+      "options": [
+        {
+          "label": "Keep off",
+          "effect": "Leave private-type-leak disabled.",
+          "tradeoff": "No API-hygiene findings; a leaked private type in a public signature goes unflagged."
+        },
+        {
+          "label": "Enable (warn)",
+          "effect": "Set rules.private-type-leaks to warn.",
+          "tradeoff": "Catches public signatures that reference private types; can be noisy on libraries with intentional internal-type re-use."
+        }
+      ]
+    },
+    {
+      "id": "dupes-sensitivity",
+      "header": "Dupes",
+      "prompt": "Code-duplication sensitivity (how large and how repeated a clone must be before it is reported).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "duplicates.mode",
+        "duplicates.minTokens",
+        "duplicates.minOccurrences"
+      ],
+      "default_summary": "mild mode, minTokens 50, minOccurrences 2: reports moderately sized clones that appear at least twice. Raise minOccurrences to 3 to focus on widespread duplication only. Note: `fallow init`'s starter config seeds minOccurrences at 3 to hide pair-only noise on a first run, so its output is intentionally stricter than this zero-config default of 2.",
+      "options": []
+    },
+    {
+      "id": "complexity-ceilings",
+      "header": "Complexity",
+      "prompt": "Function complexity ceilings used by fallow health.",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "health.maxCyclomaticComplexity",
+        "health.maxCognitiveComplexity",
+        "health.maxCrapThreshold",
+        "health.maxUnitSize"
+      ],
+      "default_summary": "cyclomatic 20, cognitive 15, CRAP 30, unit size 60 lines. These are SIG-aligned; raise them for an established codebase that would otherwise report a large existing backlog.",
+      "options": []
+    },
+    {
+      "id": "styling-drift",
+      "header": "Styling",
+      "prompt": "Design-system styling-drift strictness (hardcoded values where a token exists, duplicate blocks, selector complexity).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.css-token-drift",
+        "rules.css-duplicate-block",
+        "rules.css-selector-complexity"
+      ],
+      "default_summary": "All css-* rules default to warn (advisory, verdict-neutral). Promote to error only once the design system is stable enough that drift should block a merge.",
+      "options": []
+    },
+    {
+      "id": "react-health-signals",
+      "header": "React heur",
+      "prompt": "React/Preact structural health signals (prop-drilling, thin-wrapper, duplicate-prop-shape).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": true,
+      "config_paths": [
+        "rules.prop-drilling",
+        "rules.thin-wrapper",
+        "rules.duplicate-prop-shape"
+      ],
+      "default_summary": "Off by default: opinion-heavy heuristics that are noisy on established component trees. Enable per-rule (warn) only if the team wants refactor pressure on component structure.",
+      "options": []
+    },
+    {
+      "id": "coverage-gaps",
+      "header": "Cov gaps",
+      "prompt": "Coverage-gap detection (runtime files/exports with no test dependency path).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.coverage-gaps"
+      ],
+      "default_summary": "Off by default and most useful once runtime coverage data is available. Not surfaced on a first run because a cold project rarely has the inputs it needs.",
+      "options": []
+    },
+    {
+      "id": "security",
+      "header": "Security",
+      "prompt": "Opt-in security candidate detection (client/server secret leaks, tainted sinks). Surfaced by the separate fallow security command.",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.security-client-server-leak",
+        "rules.security-sink"
+      ],
+      "default_summary": "Off by default: candidates are unverified and high-noise, so enabling security is a deliberate decision, not a first-run default. Run fallow security to explore candidates without changing config.",
+      "options": []
+    }
+  ],
+  "security_categories": {
+    "note": "Valid ids for security.categories.include / exclude. include-required categories (hardcoded-secret, secret-to-network) run only when explicitly listed in categories.include; all others are admitted by default unless an include list restricts to a whitelist.",
+    "categories": [
+      {
+        "id": "angular-trusted-html",
+        "title": "Angular bypassSecurityTrust sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "cleartext-transport",
+        "title": "Cleartext transport URL",
+        "cwe": 319,
+        "include_required": false
+      },
+      {
+        "id": "code-injection",
+        "title": "Code injection sink",
+        "cwe": 94,
+        "include_required": false
+      },
+      {
+        "id": "command-injection",
+        "title": "OS command injection sink",
+        "cwe": 78,
+        "include_required": false
+      },
+      {
+        "id": "dangerous-html",
+        "title": "Dangerous HTML sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "deprecated-cipher",
+        "title": "Deprecated cipher constructor",
+        "cwe": 327,
+        "include_required": false
+      },
+      {
+        "id": "dom-document-write",
+        "title": "DOM document.write sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "dynamic-module-load",
+        "title": "Dynamic module load sink",
+        "cwe": 95,
+        "include_required": false
+      },
+      {
+        "id": "dynamic-regex",
+        "title": "Dynamic regular expression sink",
+        "cwe": 1333,
+        "include_required": false
+      },
+      {
+        "id": "electron-unsafe-webpreferences",
+        "title": "Unsafe Electron BrowserWindow preferences",
+        "cwe": 1188,
+        "include_required": false
+      },
+      {
+        "id": "hardcoded-secret",
+        "title": "Hardcoded secret candidate",
+        "cwe": null,
+        "include_required": true
+      },
+      {
+        "id": "header-injection",
+        "title": "HTTP response header injection sink",
+        "cwe": 113,
+        "include_required": false
+      },
+      {
+        "id": "insecure-cookie",
+        "title": "Insecure cookie options",
+        "cwe": 614,
+        "include_required": false
+      },
+      {
+        "id": "insecure-randomness",
+        "title": "Insecure randomness sink",
+        "cwe": 338,
+        "include_required": false
+      },
+      {
+        "id": "insecure-temp-file",
+        "title": "Predictable temporary file path",
+        "cwe": 377,
+        "include_required": false
+      },
+      {
+        "id": "jquery-html",
+        "title": "jQuery .html() sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "jwt-alg-none",
+        "title": "JWT alg none",
+        "cwe": 347,
+        "include_required": false
+      },
+      {
+        "id": "jwt-verify-missing-algorithms",
+        "title": "JWT verify missing algorithms allowlist",
+        "cwe": 347,
+        "include_required": false
+      },
+      {
+        "id": "llm-call-injection",
+        "title": "Untrusted input reaches an LLM call",
+        "cwe": 1427,
+        "include_required": false
+      },
+      {
+        "id": "mass-assignment",
+        "title": "Mass assignment sink",
+        "cwe": 915,
+        "include_required": false
+      },
+      {
+        "id": "mysql-multiple-statements",
+        "title": "MySQL multiple statements enabled",
+        "cwe": 89,
+        "include_required": false
+      },
+      {
+        "id": "nextjs-open-redirect",
+        "title": "Next.js open redirect sink",
+        "cwe": 601,
+        "include_required": false
+      },
+      {
+        "id": "nosql-injection",
+        "title": "NoSQL injection sink",
+        "cwe": 943,
+        "include_required": false
+      },
+      {
+        "id": "open-redirect",
+        "title": "Open redirect sink",
+        "cwe": 601,
+        "include_required": false
+      },
+      {
+        "id": "path-traversal",
+        "title": "Path traversal sink",
+        "cwe": 22,
+        "include_required": false
+      },
+      {
+        "id": "permissive-cors",
+        "title": "Permissive CORS policy",
+        "cwe": 942,
+        "include_required": false
+      },
+      {
+        "id": "postmessage-wildcard-origin",
+        "title": "Wildcard postMessage target origin",
+        "cwe": 346,
+        "include_required": false
+      },
+      {
+        "id": "prototype-pollution",
+        "title": "Prototype pollution sink",
+        "cwe": 1321,
+        "include_required": false
+      },
+      {
+        "id": "redos-regex",
+        "title": "ReDoS regex sink",
+        "cwe": 1333,
+        "include_required": false
+      },
+      {
+        "id": "resource-amplification",
+        "title": "Resource amplification sink",
+        "cwe": 400,
+        "include_required": false
+      },
+      {
+        "id": "route-send-file",
+        "title": "Route file-send path traversal sink",
+        "cwe": 22,
+        "include_required": false
+      },
+      {
+        "id": "secret-pii-log",
+        "title": "Secret or PII logged",
+        "cwe": 532,
+        "include_required": false
+      },
+      {
+        "id": "secret-to-network",
+        "title": "Secret reaches a network request",
+        "cwe": 201,
+        "include_required": true
+      },
+      {
+        "id": "sql-injection",
+        "title": "SQL injection sink",
+        "cwe": 89,
+        "include_required": false
+      },
+      {
+        "id": "ssrf",
+        "title": "Server-side request forgery sink",
+        "cwe": 918,
+        "include_required": false
+      },
+      {
+        "id": "ssti",
+        "title": "Server-side template injection sink",
+        "cwe": 1336,
+        "include_required": false
+      },
+      {
+        "id": "template-escape-bypass",
+        "title": "Template escape bypass sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "tls-validation-disabled",
+        "title": "TLS validation disabled",
+        "cwe": 295,
+        "include_required": false
+      },
+      {
+        "id": "unsafe-buffer-alloc",
+        "title": "Unsafe Buffer allocation sink",
+        "cwe": 1188,
+        "include_required": false
+      },
+      {
+        "id": "unsafe-deserialization",
+        "title": "Unsafe deserialization sink",
+        "cwe": 502,
+        "include_required": false
+      },
+      {
+        "id": "weak-crypto",
+        "title": "Runtime-selectable crypto algorithm",
+        "cwe": 327,
+        "include_required": false
+      },
+      {
+        "id": "webview-injection",
+        "title": "WebView injected-script sink",
+        "cwe": 94,
+        "include_required": false
+      },
+      {
+        "id": "world-writable-permission",
+        "title": "World-writable chmod mode",
+        "cwe": 732,
+        "include_required": false
+      },
+      {
+        "id": "xpath-injection",
+        "title": "XPath injection sink",
+        "cwe": 643,
+        "include_required": false
+      },
+      {
+        "id": "xxe",
+        "title": "XML external entity (XXE) sink",
+        "cwe": 611,
+        "include_required": false
+      },
+      {
+        "id": "zip-slip",
+        "title": "Archive path-traversal (zip-slip) sink",
+        "cwe": 22,
+        "include_required": false
+      }
+    ]
+  },
   "mcp_tools": {
     "server": "fallow-mcp",
-    "note": "key_params is a curated subset; the live MCP input schemas (list_tools) are authoritative for the full parameter list",
+    "note": "key_params is a curated subset; the live MCP input schemas (list_tools) are authoritative for the full parameter list. cli_command is the nearest CLI fallback, not a full MCP input-schema projection",
     "tools": [
       {
         "name": "code_execute",
         "kind": "composition",
         "description": "Run a bounded read-only JavaScript snippet that composes fallow's analysis tools inside a sandbox (Code Mode meta-tool, not a plain analysis call)",
+        "cli_command": null,
         "key_params": [
           "code",
           "timeout_ms",
@@ -5455,6 +6331,7 @@
         "name": "analyze",
         "kind": "analysis",
         "description": "Full dead-code analysis: unused files, exports, types, dependencies, circular dependencies, and boundary violations",
+        "cli_command": "fallow dead-code --format json --quiet",
         "key_params": [
           "issue_types",
           "production",
@@ -5471,6 +6348,7 @@
         "name": "check_changed",
         "kind": "analysis",
         "description": "Incremental dead-code analysis scoped to files changed since a git ref (ideal for PR review)",
+        "cli_command": "fallow dead-code --changed-since <ref> --format json --quiet",
         "key_params": [
           "since",
           "baseline",
@@ -5484,6 +6362,7 @@
         "name": "security_candidates",
         "kind": "analysis",
         "description": "Unverified local security candidates (tainted sinks) for downstream agent verification",
+        "cli_command": "fallow security --format json --quiet",
         "key_params": [
           "gate",
           "surface",
@@ -5498,6 +6377,7 @@
         "name": "inspect_target",
         "kind": "analysis",
         "description": "One evidence bundle for a file or exported symbol: trace, dead-code actions, duplication, complexity, and security candidates",
+        "cli_command": "fallow inspect --format json --quiet",
         "key_params": [
           "target",
           "production"
@@ -5510,6 +6390,7 @@
         "name": "guard",
         "kind": "introspection",
         "description": "Report the architecture rules that apply to given files before editing them: boundary zone, allowed import zones, forbidden calls, and rule-pack policies",
+        "cli_command": "fallow guard <file> --format json --quiet",
         "key_params": [
           "files"
         ],
@@ -5521,6 +6402,7 @@
         "name": "find_dupes",
         "kind": "analysis",
         "description": "Code duplication detection with clone groups and refactoring suggestions",
+        "cli_command": "fallow dupes --format json --quiet",
         "key_params": [
           "mode",
           "min_tokens",
@@ -5536,6 +6418,7 @@
         "name": "check_health",
         "kind": "analysis",
         "description": "Complexity, styling health, hotspots, ownership, refactoring targets, coverage gaps, and CSS/CSS-in-JS candidates",
+        "cli_command": "fallow health --format json --quiet",
         "key_params": [
           "score",
           "css",
@@ -5555,6 +6438,7 @@
         "name": "check_runtime_coverage",
         "kind": "runtime-coverage",
         "description": "Merge V8 or Istanbul runtime coverage into the health report (hot paths, cold paths, verdicts)",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "min_invocations_hot",
@@ -5570,6 +6454,7 @@
         "name": "get_hot_paths",
         "kind": "runtime-coverage",
         "description": "Production hot paths from runtime coverage, sorted by invocation volume",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "top",
@@ -5583,6 +6468,7 @@
         "name": "get_blast_radius",
         "kind": "runtime-coverage",
         "description": "Blast-radius context (caller counts, risk bands) from runtime coverage; augments review only, never gates safe_to_delete (three-state tracking issues that verdict)",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "group_by"
@@ -5595,6 +6481,7 @@
         "name": "get_importance",
         "kind": "runtime-coverage",
         "description": "Production-importance scores (0-100) combining invocations, complexity, and ownership; augments review only, never gates safe_to_delete (three-state tracking issues that verdict)",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "group_by"
@@ -5607,6 +6494,7 @@
         "name": "get_cleanup_candidates",
         "kind": "runtime-coverage",
         "description": "Cleanup candidates with safe_to_delete, review_required, and low_traffic verdicts from runtime coverage",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "group_by"
@@ -5619,6 +6507,7 @@
         "name": "get_token_blast_radius",
         "kind": "analysis",
         "description": "Design-token blast radius for Tailwind v4 @theme tokens AND CSS-in-JS defineVars/createTheme-family token definitions: per token, a consumer_count (static lower bound) and a capped located consumers[] sample tagged theme-var/css-var/utility/apply (Tailwind) or js-member (CSS-in-JS cross-module member access); descriptive context for sizing a token change, never a deletion gate",
+        "cli_command": "fallow health --css --format json --quiet",
         "key_params": [],
         "license": "free",
         "license_note": null,
@@ -5628,6 +6517,7 @@
         "name": "audit",
         "kind": "analysis",
         "description": "Combined dead-code, complexity, duplication, and styling audit for changed files with a pass/warn/fail verdict",
+        "cli_command": "fallow audit --format json --quiet",
         "key_params": [
           "gate",
           "base",
@@ -5644,6 +6534,7 @@
         "name": "decision_surface",
         "kind": "analysis",
         "description": "Surface the few consequential structural decisions a change embeds (coupling, public API, dependency), each as a judgment question with the routed expert; ranked, capped, and signal_id-anchored",
+        "cli_command": "fallow decision-surface --format json --quiet",
         "key_params": [
           "base",
           "max_decisions",
@@ -5657,6 +6548,7 @@
         "name": "fallow_explain",
         "kind": "introspection",
         "description": "Explain one issue type (rationale, examples, fix guidance) without running an analysis",
+        "cli_command": "fallow explain <issue-type> --format json --quiet",
         "key_params": [
           "issue_type"
         ],
@@ -5668,6 +6560,7 @@
         "name": "fix_preview",
         "kind": "fix",
         "description": "Dry-run auto-fix preview; shows what would change without modifying files",
+        "cli_command": "fallow fix --dry-run --format json --quiet",
         "key_params": [
           "no_create_config"
         ],
@@ -5679,6 +6572,7 @@
         "name": "fix_apply",
         "kind": "fix",
         "description": "Apply auto-fixes: removes unused exports, dependencies, and enum members (mutates files)",
+        "cli_command": "fallow fix --yes --format json --quiet",
         "key_params": [
           "no_create_config"
         ],
@@ -5690,6 +6584,7 @@
         "name": "project_info",
         "kind": "introspection",
         "description": "Project metadata: active framework plugins, discovered files, entry points, and boundary zones",
+        "cli_command": "fallow list --files --entry-points --plugins --format json --quiet",
         "key_params": [
           "entry_points",
           "files",
@@ -5700,10 +6595,23 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "recommend",
+        "kind": "introspection",
+        "description": "Recommend a project-tailored config from framework/workspace/tooling detection: a loader-validated proposed_config and three-valued auto/default/taste decisions for cold-start onboarding",
+        "cli_command": "fallow recommend --format json --quiet",
+        "key_params": [
+          "root"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "list_boundaries",
         "kind": "introspection",
         "description": "List architecture boundary zones and access rules",
+        "cli_command": "fallow list --boundaries --format json --quiet",
         "key_params": [],
         "license": "free",
         "license_note": null,
@@ -5713,6 +6621,7 @@
         "name": "feature_flags",
         "kind": "analysis",
         "description": "Detect feature flag patterns (environment variables, SDK calls, config objects)",
+        "cli_command": "fallow flags --format json --quiet",
         "key_params": [
           "workspace",
           "production"
@@ -5721,10 +6630,25 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "list_suppressions",
+        "kind": "analysis",
+        "description": "List active fallow-ignore suppression markers grouped per file (line, kind, level, reason, and a stale cross-reference); a read-only governance inventory that always exits 0",
+        "cli_command": "fallow suppressions --format json --quiet",
+        "key_params": [
+          "workspace",
+          "changed_since",
+          "file"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "impact",
         "kind": "introspection",
         "description": "Read the local Fallow Impact value-tracking report (per-project history in the user config dir, never in the repo; local-dev only)",
+        "cli_command": "fallow impact --format json --quiet",
         "key_params": [
           "root"
         ],
@@ -5736,6 +6660,7 @@
         "name": "impact_all",
         "kind": "introspection",
         "description": "Roll every tracked fallow project on this machine into one cross-repo value report (hashed keys plus basename labels, never paths; local-dev only)",
+        "cli_command": "fallow impact --all --format json --quiet",
         "key_params": [
           "sort",
           "limit"
@@ -5748,6 +6673,7 @@
         "name": "trace_export",
         "kind": "trace",
         "description": "Trace why an export is used or unused, including re-export chains and entry-point status",
+        "cli_command": "fallow dead-code --trace <file:export> --format json --quiet",
         "key_params": [
           "file",
           "export_name"
@@ -5760,6 +6686,7 @@
         "name": "trace_file",
         "kind": "trace",
         "description": "Trace all module-graph edges for a file (imports, exports, importers, re-exports)",
+        "cli_command": "fallow dead-code --trace-file <file> --format json --quiet",
         "key_params": [
           "file"
         ],
@@ -5767,10 +6694,23 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "impact_closure",
+        "kind": "trace",
+        "description": "Trace the transitive affected-but-not-in-diff set and coordination gaps for one file",
+        "cli_command": "fallow dead-code --impact-closure <path> --format json --quiet",
+        "key_params": [
+          "path"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "trace_dependency",
         "kind": "trace",
         "description": "Trace where a dependency is imported and whether scripts or CI use it",
+        "cli_command": "fallow dead-code --trace-dependency <package> --format json --quiet",
         "key_params": [
           "package_name"
         ],
@@ -5782,6 +6722,7 @@
         "name": "trace_clone",
         "kind": "trace",
         "description": "Deep-dive a duplicate-code clone group by location or fingerprint",
+        "cli_command": "fallow dupes --trace <file:line> --format json --quiet",
         "key_params": [
           "file",
           "line",