fallow 3.3.0 → 3.5.0

package/README.md

@@ -20,7 +20,7 @@ Static analysis is open source. An optional runtime layer adds production execut
 npm install --save-dev fallow   # or: pnpm add -D fallow / yarn add -D fallow / bun add -d fallow
 ```
 
-Installs the `fallow` CLI plus the companion `fallow-lsp` and `fallow-mcp` binaries in your project.
+Installs the `fallow` CLI in your project, along with the `fallow-lsp` and `fallow-mcp` launchers that start the LSP and MCP servers from the same binary.
 
 The package also ships a version-matched Agent Skill under `skills/fallow`.
 For tools that need CLI and issue-surface metadata without spawning the binary,
@@ -119,7 +119,7 @@ Create a config file in your project root, or run `fallow init`:
 ```jsonc
 // .fallowrc.json
 {
-  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json",
+  "$schema": "./node_modules/fallow/schema.json",
   "entry": ["src/workers/*.ts", "scripts/*.ts"],
   "ignorePatterns": ["**/*.generated.ts"],
   "rules": {
@@ -130,6 +130,16 @@ Create a config file in your project root, or run `fallow init`:
 }
 ```
 
+`$schema` gives editors autocomplete and validation and has no effect on
+analysis. As an npm package, `fallow` always ships a version-aligned schema at
+`./node_modules/fallow/schema.json`, which `fallow init` and
+`fallow recommend` point at by default: offline, no editor trust prompt. If
+you install fallow another way (cargo, homebrew, a bare binary) with no
+`node_modules/fallow` to point at, use the remote fallback instead:
+`https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json`. Some
+editors, including VS Code, refuse to load a remote schema URL until you
+explicitly trust the domain.
+
 Also supports TOML (`fallow init --toml` creates `fallow.toml`).
 
 ## Documentation

package/bin/fallow-lsp

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
 
+// Launcher shim: the platform packages ship a single multicall `fallow`
+// binary, so `fallow-lsp` spawns `fallow lsp-server` with the same stdio,
+// signal, and exit-code forwarding as a bare `fallow` invocation.
 const { runBinary } = require('../scripts/run-binary');
-runBinary('fallow-lsp');
+runBinary('fallow', { prependArgs: ['lsp-server'] });

package/bin/fallow-mcp

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
 
+// Launcher shim: the platform packages ship a single multicall `fallow`
+// binary, so `fallow-mcp` spawns `fallow mcp-server` with the same stdio,
+// signal, and exit-code forwarding as a bare `fallow` invocation.
 const { runBinary } = require('../scripts/run-binary');
-runBinary('fallow-mcp');
+runBinary('fallow', { prependArgs: ['mcp-server'] });

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -18,6 +18,16 @@
       "description": "Path to config file (.fallowrc.json, .fallowrc.jsonc, fallow.toml, or .fallow.toml)",
       "short": "-c"
     },
+    {
+      "name": "--allow-remote-extends",
+      "type": "bool",
+      "required": false,
+      "description": "Allow trusted config files to extend HTTPS URLs",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--format",
       "type": "string",
@@ -36,7 +46,9 @@
         "pr-comment-gitlab",
         "review-github",
         "review-gitlab",
-        "badge"
+        "badge",
+        "github-annotations",
+        "github-summary"
       ]
     },
     {
@@ -266,6 +278,12 @@
       "description": "Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr",
       "short": "-o"
     },
+    {
+      "name": "--report-path-prefix",
+      "type": "string",
+      "required": false,
+      "description": "Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root`"
+    },
     {
       "name": "--fail-on-regression",
       "type": "bool",
@@ -836,6 +854,16 @@
             "true",
             "false"
           ]
+        },
+        {
+          "name": "--churn",
+          "type": "bool",
+          "required": false,
+          "description": "OPT-IN: attach target-level git churn evidence from the health hotspot subsystem. Default off to avoid git-history latency",
+          "possible_values": [
+            "true",
+            "false"
+          ]
         }
       ]
     },
@@ -1448,6 +1476,18 @@
         }
       ]
     },
+    {
+      "name": "suppressions",
+      "description": "List active fallow-ignore suppression markers (read-only inventory)",
+      "flags": [
+        {
+          "name": "--file",
+          "type": "string",
+          "required": false,
+          "description": "Only list suppressions in the specified files. Accepts multiple values"
+        }
+      ]
+    },
     {
       "name": "explain",
       "description": "Explain one fallow issue type without running an analysis",
@@ -1753,6 +1793,18 @@
         }
       ]
     },
+    {
+      "name": "report",
+      "description": "Render a saved `--format json` results file in another format without re-running analysis (analyze once, render annotations and the job summary from the same file). v1 renders the GitHub-native formats only: `--format github-annotations` or `--format github-summary`",
+      "flags": [
+        {
+          "name": "--from",
+          "type": "string",
+          "required": true,
+          "description": "Path to a fallow JSON results file produced by `--format json` (dead-code, dupes, health, audit, security, or bare combined)"
+        }
+      ]
+    },
     {
       "name": "schema",
       "description": "Dump fallow's capability manifest (CLI commands and flags, issue types, MCP tools, framework plugins, env vars) as machine-readable JSON for agent introspection. Always JSON, regardless of --format",
@@ -6338,7 +6390,8 @@
         "cli_command": "fallow inspect --format json --quiet",
         "key_params": [
           "target",
-          "production"
+          "production",
+          "include_churn"
         ],
         "license": "free",
         "license_note": null,
@@ -6588,6 +6641,20 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "list_suppressions",
+        "kind": "analysis",
+        "description": "List active fallow-ignore suppression markers grouped per file (line, kind, level, reason, and a stale cross-reference); a read-only governance inventory that always exits 0",
+        "cli_command": "fallow suppressions --format json --quiet",
+        "key_params": [
+          "workspace",
+          "changed_since",
+          "file"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "impact",
         "kind": "introspection",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "description": "Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles, optional paid runtime intelligence (Fallow Runtime). Quality, risk, architecture, dependencies, duplication, and design-system drift for humans, CI, and the agents writing your code. Zero-config framework support.",
   "license": "MIT",
   "repository": {
@@ -36,7 +36,7 @@
     "tanstack-intent"
   ],
   "engines": {
-    "node": ">=16"
+    "node": ">=22"
   },
   "bin": {
     "fallow": "bin/fallow",
@@ -87,13 +87,13 @@
     "@tanstack/intent": "0.3.2"
   },
   "optionalDependencies": {
-    "@fallow-cli/darwin-arm64": "3.3.0",
-    "@fallow-cli/darwin-x64": "3.3.0",
-    "@fallow-cli/linux-x64-gnu": "3.3.0",
-    "@fallow-cli/linux-arm64-gnu": "3.3.0",
-    "@fallow-cli/linux-x64-musl": "3.3.0",
-    "@fallow-cli/linux-arm64-musl": "3.3.0",
-    "@fallow-cli/win32-arm64-msvc": "3.3.0",
-    "@fallow-cli/win32-x64-msvc": "3.3.0"
+    "@fallow-cli/darwin-arm64": "3.5.0",
+    "@fallow-cli/darwin-x64": "3.5.0",
+    "@fallow-cli/linux-x64-gnu": "3.5.0",
+    "@fallow-cli/linux-arm64-gnu": "3.5.0",
+    "@fallow-cli/linux-x64-musl": "3.5.0",
+    "@fallow-cli/linux-arm64-musl": "3.5.0",
+    "@fallow-cli/win32-arm64-msvc": "3.5.0",
+    "@fallow-cli/win32-x64-msvc": "3.5.0"
   }
 }

package/schema.json

@@ -4,7 +4,7 @@
   "type": "object",
   "properties": {
     "$schema": {
-      "description": "A string pointing at fallow's JSON Schema URL, used only by editors for autocomplete and validation of the config file; it has no effect on analysis and is stripped before serialization (serde skip_serializing, writeOnly in the schema). Set it to `https://fallow.dev/schema.json` to get editor IntelliSense; any other value is ignored by fallow.",
+      "description": "A string pointing at fallow's JSON Schema URL, used only by editors for autocomplete and validation of the config file; it has no effect on analysis and is stripped before serialization (serde skip_serializing, writeOnly in the schema). Set it to `./node_modules/fallow/schema.json` for npm installs (version-aligned, offline, avoids VS Code's untrusted-remote-schema prompt), or `https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json` for non-npm installs; any other value is ignored by fallow.",
       "type": [
         "string",
         "null"

package/scripts/lazy-verify.js

@@ -66,8 +66,11 @@ function emitVerifyLog(env, payload) {
 }
 
 function binaryTargetsForPlatform(platform) {
+  // Platform packages ship one binary: the multicall `fallow`. The bundled
+  // lsp/mcp launchers spawn `fallow lsp-server` / `fallow mcp-server`, so there
+  // is only one binary to sentinel-track and verify.
   const ext = platform === "win32" ? ".exe" : "";
-  return [`fallow${ext}`, `fallow-lsp${ext}`, `fallow-mcp${ext}`];
+  return [`fallow${ext}`];
 }
 
 function statMtimeMs(absPath) {

package/scripts/lazy-verify.test.js

@@ -28,7 +28,8 @@ function ext() {
 }
 
 function binaryNames() {
-  return [`fallow${ext()}`, `fallow-lsp${ext()}`, `fallow-mcp${ext()}`];
+  // Platform packages ship a single multicall `fallow` binary.
+  return [`fallow${ext()}`];
 }
 
 function computeDigestsForDir(dir) {
@@ -116,7 +117,7 @@ test("ensureVerified verifies on cache miss and writes the sentinel", (t) => {
   assert.equal(sentinel.schemaVersion, SENTINEL_SCHEMA_VERSION);
   assert.equal(sentinel.packageVersion, "2.81.0");
   assert.equal(sentinel.packageName, "@fallow-cli/test-platform");
-  assert.equal(Object.keys(sentinel.binaries).length, 3);
+  assert.equal(Object.keys(sentinel.binaries).length, 1);
 });
 
 test("ensureVerified returns cached:true on a valid sentinel", (t) => {
@@ -164,7 +165,7 @@ test("ensureVerified invalidates sentinel on mtime drift", (t) => {
   );
   assert.equal(result.ok, true);
   assert.equal(result.cached, false);
-  assert.equal(verifyCallCount, 3, "verify should rerun for all three binaries");
+  assert.equal(verifyCallCount, 1, "verify should rerun for the single binary");
 });
 
 test("ensureVerified invalidates sentinel on packageVersion drift", (t) => {
@@ -215,12 +216,6 @@ test("ensureVerified invalidates sentinel on packageName drift", (t) => {
       packageName: "@fallow-cli/wrong-name",
       binaries: {
         [`fallow${ext()}`]: { mtimeMs: fs.statSync(path.join(dir, `fallow${ext()}`)).mtimeMs },
-        [`fallow-lsp${ext()}`]: {
-          mtimeMs: fs.statSync(path.join(dir, `fallow-lsp${ext()}`)).mtimeMs,
-        },
-        [`fallow-mcp${ext()}`]: {
-          mtimeMs: fs.statSync(path.join(dir, `fallow-mcp${ext()}`)).mtimeMs,
-        },
       },
     }),
   );
@@ -266,13 +261,13 @@ test("ensureVerified invalidates sentinel on schemaVersion drift", (t) => {
 test("ensureVerified returns sig-invalid on a tampered signature", (t) => {
   _resetWarningState();
   const { privateKey, rawPub } = makeKeypair();
-  const dir = mkPlatformDir(privateKey, { corruptSigFor: `fallow-lsp${ext()}` });
+  const dir = mkPlatformDir(privateKey, { corruptSigFor: `fallow${ext()}` });
   t.after(() => cleanup(dir));
 
   const result = ensureVerified(baseInput(dir, (p) => _verifyWithKey(p, rawPub)));
   assert.equal(result.ok, false);
   assert.equal(result.code, "sig-invalid");
-  assert.match(result.binary, /fallow-lsp/);
+  assert.match(result.binary, /fallow/);
   // Sentinel must NOT have been written on failure
   assert.equal(fs.existsSync(path.join(dir, SENTINEL_FILENAME)), false);
 });

package/scripts/run-binary.js

@@ -146,7 +146,15 @@ function guardBrokenStdout() {
   });
 }
 
-function runBinary(binaryBaseName) {
+// Run the resolved platform binary. `options.prependArgs` (default none) is a
+// list of leading arguments inserted before the process argv, used by the
+// `fallow-lsp` / `fallow-mcp` launcher shims to spawn the multicall binary as
+// `fallow lsp-server` / `fallow mcp-server`. Because the platform packages ship
+// a single `fallow` binary, those shims pass `binaryBaseName = "fallow"` and
+// the subcommand via `prependArgs`; signal, exit-code, and version-line
+// handling stay identical to a bare `fallow` invocation.
+function runBinary(binaryBaseName, options = {}) {
+  const prependArgs = Array.isArray(options.prependArgs) ? options.prependArgs : [];
   guardBrokenStdout();
   const { pkg, manifestPath, platformPkgDir } = resolvePlatformPaths();
   const resolvedVersion = readResolvedVersion(manifestPath);
@@ -166,7 +174,7 @@ function runBinary(binaryBaseName) {
   }
 
   try {
-    execFileSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });
+    execFileSync(binaryPath, [...prependArgs, ...process.argv.slice(2)], { stdio: "inherit" });
   } catch (e) {
     if (e.status === undefined) throw e;
     if (e.status === null) {

package/scripts/verify-binary.js

@@ -293,11 +293,15 @@ function binaryTargetsForPlatform(platformId) {
   // and tests can synthesize a Windows verify without running on Windows.
   const isWindows = typeof platformId === "string" && platformId.startsWith("win32");
   const ext = isWindows ? ".exe" : "";
-  return [
-    { binary: `fallow${ext}`, asset: `fallow-${platformId}${ext}` },
-    { binary: `fallow-lsp${ext}`, asset: `fallow-lsp-${platformId}${ext}` },
-    { binary: `fallow-mcp${ext}`, asset: `fallow-mcp-${platformId}${ext}` },
-  ];
+  // Platform packages ship ONE binary now: the multicall `fallow` (CLI + LSP +
+  // MCP in one engine). The bundled `fallow-lsp` / `fallow-mcp` launchers live
+  // in the wrapper and spawn `fallow lsp-server` / `fallow mcp-server`. The
+  // authoritative digest is the `fallowDigests.fallow` field the release
+  // pipeline embeds for every bundled package; the `asset` below is only the
+  // legacy GitHub-release fallback for pre-embedded-digest packages, which
+  // never shipped this bundled binary, so it is inert for bundled installs and
+  // fails closed (digest-mismatch) in the impossible case it is ever reached.
+  return [{ binary: `fallow${ext}`, asset: `fallow-${platformId}${ext}` }];
 }
 
 function isSkipRequested() {

package/scripts/verify-binary.test.js

@@ -243,7 +243,7 @@ function makePlatformDir(privateKey, options) {
   const opts = options || {};
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fallow-vbtest-"));
   const ext = process.platform === "win32" ? ".exe" : "";
-  for (const base of ["fallow", "fallow-lsp", "fallow-mcp"]) {
+  for (const base of ["fallow"]) {
     const binaryPath = path.join(dir, `${base}${ext}`);
     const content = Buffer.from(`mock ${base} contents`);
     fs.writeFileSync(binaryPath, content);
@@ -349,7 +349,7 @@ test("verifyInstalled resolves a global npm install from the fallow package dire
   );
 
   const ext = process.platform === "win32" ? ".exe" : "";
-  for (const base of ["fallow", "fallow-lsp", "fallow-mcp"]) {
+  for (const base of ["fallow"]) {
     const binaryPath = path.join(platformDir, `${base}${ext}`);
     const content = Buffer.from(`global install ${base}`);
     fs.writeFileSync(binaryPath, content);
@@ -367,9 +367,9 @@ test("verifyInstalled resolves a global npm install from the fallow package dire
   assert.equal(result.version, "9.9.9");
 });
 
-test("verifyInstalled with dirOverride fails fast on the first bad signature", async (t) => {
+test("verifyInstalled with dirOverride fails on a bad signature", async (t) => {
   const { privateKey, rawPub } = makeKeypair();
-  const dir = makePlatformDir(privateKey, { corruptSigFor: "fallow-lsp" });
+  const dir = makePlatformDir(privateKey, { corruptSigFor: "fallow" });
   t.after(() => cleanup(dir));
   const result = await verifyInstalled({
     dirOverride: dir,
@@ -378,12 +378,12 @@ test("verifyInstalled with dirOverride fails fast on the first bad signature", a
   });
   assert.equal(result.ok, false);
   assert.equal(result.code, "sig-invalid");
-  assert.match(result.binary, /fallow-lsp/);
+  assert.match(result.binary, /fallow/);
 });
 
 test("verifyInstalled with dirOverride reports sig-missing when a .sig is absent", async (t) => {
   const { privateKey, rawPub } = makeKeypair();
-  const dir = makePlatformDir(privateKey, { skipSigFor: "fallow-mcp" });
+  const dir = makePlatformDir(privateKey, { skipSigFor: "fallow" });
   t.after(() => cleanup(dir));
   const result = await verifyInstalled({
     dirOverride: dir,
@@ -392,13 +392,13 @@ test("verifyInstalled with dirOverride reports sig-missing when a .sig is absent
   });
   assert.equal(result.ok, false);
   assert.equal(result.code, "sig-missing");
-  assert.match(result.binary, /fallow-mcp/);
+  assert.match(result.binary, /fallow/);
 });
 
 test("verifyInstalled threads the resolved version into the sig-missing message", async (t) => {
   const { privateKey, rawPub } = makeKeypair();
-  const preDir = makePlatformDir(privateKey, { skipSigFor: "fallow-mcp" });
-  const eraDir = makePlatformDir(privateKey, { skipSigFor: "fallow-mcp" });
+  const preDir = makePlatformDir(privateKey, { skipSigFor: "fallow" });
+  const eraDir = makePlatformDir(privateKey, { skipSigFor: "fallow" });
   t.after(() => {
     cleanup(preDir);
     cleanup(eraDir);
@@ -463,7 +463,7 @@ test("verifyInstalled honors FALLOW_SKIP_BINARY_VERIFY", async (t) => {
 function computeDigestsForDir(dir) {
   const ext = process.platform === "win32" ? ".exe" : "";
   const out = {};
-  for (const base of ["fallow", "fallow-lsp", "fallow-mcp"]) {
+  for (const base of ["fallow"]) {
     const fileName = `${base}${ext}`;
     const full = path.join(dir, fileName);
     out[fileName] =
@@ -549,7 +549,7 @@ test("verifyInstalled falls back to the provider when the embedded digest is mis
     },
   });
   assert.equal(result.ok, true);
-  assert.equal(providerCalls, 3);
+  assert.equal(providerCalls, 1);
 });
 
 test("verifyInstalled falls back to the provider when fallowDigests is partial / malformed", async (t) => {
@@ -573,8 +573,8 @@ test("verifyInstalled falls back to the provider when fallowDigests is partial /
     },
   });
   assert.equal(result.ok, true);
-  // One call per binary because all three entries fail to normalize.
-  assert.equal(providerCalls, 3);
+  // One call for the single shipped binary because its entry fails to normalize.
+  assert.equal(providerCalls, 1);
 });
 
 test("verifyInstalled returns digest-mismatch when the embedded digest disagrees with the binary", async (t) => {
@@ -587,8 +587,6 @@ test("verifyInstalled returns digest-mismatch when the embedded digest disagrees
     version: "1.0.0",
     fallowDigests: {
       [`fallow${ext}`]: "sha256:" + "a".repeat(64),
-      [`fallow-lsp${ext}`]: "sha256:" + "a".repeat(64),
-      [`fallow-mcp${ext}`]: "sha256:" + "a".repeat(64),
     },
   });
   const result = await verifyInstalled({
@@ -644,9 +642,9 @@ test("verifyInstalledSync with embedded digests returns ok end-to-end", (t) => {
   assert.equal(result.package, "<override>");
 });
 
-test("verifyInstalledSync fails fast on first bad signature", (t) => {
+test("verifyInstalledSync fails on a bad signature", (t) => {
   const { privateKey, rawPub } = makeKeypair();
-  const dir = makePlatformDir(privateKey, { corruptSigFor: "fallow-lsp" });
+  const dir = makePlatformDir(privateKey, { corruptSigFor: "fallow" });
   t.after(() => cleanup(dir));
   writeManifest(dir, {
     name: "@fallow-cli/x",
@@ -659,7 +657,7 @@ test("verifyInstalledSync fails fast on first bad signature", (t) => {
   });
   assert.equal(result.ok, false);
   assert.equal(result.code, "sig-invalid");
-  assert.match(result.binary, /fallow-lsp/);
+  assert.match(result.binary, /fallow/);
 });
 
 test("verifyInstalledSync reports digest-mismatch when bytes diverge from embedded digest", (t) => {
@@ -671,11 +669,7 @@ test("verifyInstalledSync reports digest-mismatch when bytes diverge from embedd
     version: "9.9.9",
     fallowDigests: {
       fallow: "sha256:" + "a".repeat(64),
-      "fallow-lsp": "sha256:" + "a".repeat(64),
-      "fallow-mcp": "sha256:" + "a".repeat(64),
       "fallow.exe": "sha256:" + "a".repeat(64),
-      "fallow-lsp.exe": "sha256:" + "a".repeat(64),
-      "fallow-mcp.exe": "sha256:" + "a".repeat(64),
     },
   });
   const result = verifyInstalledSync({

package/skills/fallow/SKILL.md

@@ -106,11 +106,13 @@ Route by intent before reaching for the big analysis commands. Same matrix as `f
 | `dupes` | Code duplication detection | `--mode`, `--threshold`, `--top`, `--changed-since`, `--workspace`, `--changed-workspaces`, `--skip-local`, `--cross-language`, `--ignore-imports`, `--no-ignore-imports`, `--explain-skipped`, `--fail-on-regression`, `--tolerance`, `--regression-baseline`, `--save-regression-baseline` |
 | `health` | Function complexity analysis (also covers Angular templates as synthetic `<template>` findings: external `.html` files via `templateUrl` AND inline `@Component({ template: \`...\` })` literals; suppress external with `<!-- fallow-ignore-file complexity -->` at the top of the `.html` file, suppress inline with `// fallow-ignore-next-line complexity` directly above the `@Component` decorator) | `--complexity`, `--max-cyclomatic`, `--max-cognitive`, `--max-crap`, `--top`, `--sort`, `--file-scores`, `--hotspots`, `--ownership`, `--ownership-emails`, `--targets`, `--effort`, `--score`, `--min-score`, `--since`, `--min-commits`, `--save-snapshot`, `--trend`, `--coverage-gaps`, `--coverage`, `--coverage-root`, `--runtime-coverage`, `--min-invocations-hot`, `--min-observation-volume`, `--low-traffic-threshold`, `--css`, `--complexity-breakdown`, `--min-severity`, `--report-only`, `--workspace`, `--changed-workspaces`, `--baseline`, `--save-baseline` |
 | `flags` | Detect feature flag patterns (env vars, SDK calls, config objects) | `--top` |
+| `suppressions` | List active fallow-ignore suppression markers (read-only inventory) | `--file` |
 | `explain` | Explain one issue type without running analysis | `<issue-type>`, `--format json` |
 | `audit` | Combined dead-code + complexity + duplication + styling for changed files, returns a verdict; `fallow review` is an alias for `fallow audit --brief` (advisory orientation brief, always exits 0) | `--base`, `--gate`, `--brief`, `--max-decisions`, `--walkthrough-guide`, `--walkthrough-file`, `--show-deprioritized`, `--production`, `--production-dead-code`, `--production-health`, `--production-dupes`, `--workspace`, `--changed-workspaces`, `--ci`, `--fail-on-issues`, `--explain`, `--explain-skipped`, `--dead-code-baseline`, `--health-baseline`, `--dupes-baseline`, `--max-crap`, `--coverage`, `--coverage-root`, `--no-css`, `--css-deep`, `--no-css-deep`, `--include-entry-exports` |
 | `decision-surface` | Surface the consequential structural DECISIONS a change embeds (the apex of the review brief), each framed as a judgment question with the routed expert to ask | `--max-decisions` |
 | `impact` | Show what fallow has done for you: how many issues it is surfacing, the trend since the last recorded run, and how many commits it contained at the pre-commit gate | `--all`, `--sort`, `--limit` |
 | `security` | Surface opt-in local security candidates for agent verification (not confirmed vulnerabilities). Rule families include the graph rule `client-server-leak`, a data-driven `tainted-sink` catalogue, and the include-required `hardcoded-secret` category for provider-prefix credentials and high-entropy literals assigned to secret-shaped identifiers. Most catalogue rows require non-literal input; narrowly literal-aware rows flag deterministic unsafe literals. Rules default off; suppress a file with `// fallow-ignore-file security-sink`; scope categories with `security.categories`. Add project-local request object names with `security.requestReceivers`; it extends the built-in `req` / `request` / `ctx` / `context` / `event` allowlist for HTTP `query`, `params`, and `body` reads. `hardcoded-secret` runs only when listed in `security.categories.include`. | `--format human\|json\|sarif`, `--changed-since`, `--file`, `--diff-file`, `--workspace`, `--changed-workspaces`, `--surface`, `--ci`, `--fail-on-issues`, `--sarif-file`, `--summary` |
+| `report` | Render a saved `--format json` results file in another format without re-running analysis (analyze once, render annotations and the job summary from the same file). | `--from` |
 | `schema` | Dump CLI definition as JSON |  |
 | `ci-template` | Print or vendor CI integration templates |  |
 | `migrate` | Convert knip/jscpd config | `--dry-run`, `--from PATH` |

package/skills/fallow/references/cli-reference.md

@@ -509,7 +509,7 @@ fallow health --format json --quiet --trend
 {
   "kind": "health",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 32,
   "summary": {
     "files_analyzed": 482,
@@ -907,7 +907,7 @@ fallow audit \
 {
   "kind": "audit",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.5.0",
   "command": "audit",
   "verdict": "fail",
   "changed_files_count": 12,
@@ -982,7 +982,7 @@ fallow flags --format json --quiet --workspace my-package
 ```json
 {
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 116,
   "feature_flags": [],
   "total_flags": 0
@@ -1083,7 +1083,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1112,7 +1112,7 @@ fallow security --gate newly-reachable --changed-since origin/main
 {
   "kind": "security",
   "schema_version": "4",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 42,
   "config": {
     "rules": {
@@ -1185,6 +1185,7 @@ Compose one evidence bundle before editing a file or exported symbol. This is th
 ```bash
 fallow inspect --file src/api.ts --format json --quiet
 fallow inspect --symbol src/api.ts:fetchUser --format json --quiet
+fallow inspect --file src/api.ts --churn --format json --quiet
 ```
 
 ### Target Flags
@@ -1193,6 +1194,7 @@ fallow inspect --symbol src/api.ts:fetchUser --format json --quiet
 |------|-------------|
 | `--file <PATH>` | Inspect one project-relative file |
 | `--symbol <FILE:EXPORT>` | Inspect one exported symbol. Supporting dead-code, duplication, complexity, and security evidence is file-scoped in the first version |
+| `--churn` | Add target-level git churn evidence. Off by default; missing git history is reported as `unavailable` |
 
 Common global flags: `--format`, `--quiet`, `--root`, `--config`, `--workspace`, `--production`, `--no-cache`, `--threads`.
 
@@ -1215,13 +1217,14 @@ Common global flags: `--format`, `--quiet`, `--root`, `--config`, `--workspace`,
     "dead_code": { "status": "ok", "scope": "file", "data": {} },
     "duplication": { "status": "ok", "scope": "project_filtered_to_file", "data": {} },
     "complexity": { "status": "ok", "scope": "project_filtered_to_file", "data": {} },
-    "security": { "status": "ok", "scope": "file", "data": {} }
+    "security": { "status": "ok", "scope": "file", "data": {} },
+    "churn": { "status": "ok", "scope": "project_filtered_to_file", "data": {} }
   },
   "warnings": []
 }
 ```
 
-Each evidence section carries `status` and `scope`. Non-fatal child-analysis failures become section-level errors and warnings, so callers can still use the remaining evidence.
+Each evidence section carries `status` and `scope`. The optional churn section can report `ok`, `unavailable`, or `error`. Non-fatal analysis failures become section-level errors and warnings, so callers can still use the remaining evidence.
 
 ---
 
@@ -1632,7 +1635,8 @@ Available on all commands:
 |---|---|---|---|
 | `-r, --root` | `string` | - | Project root directory |
 | `-c, --config` | `string` | - | Config file path |
-| `-f, --format` | `human\|json\|sarif\|compact\|markdown\|codeclimate\|pr-comment-github\|pr-comment-gitlab\|review-github\|review-gitlab\|badge` | `human` | Output format (alias: --output) |
+| `--allow-remote-extends` | `bool` | `false` | Allow trusted config files to extend HTTPS URLs |
+| `-f, --format` | `human\|json\|sarif\|compact\|markdown\|codeclimate\|pr-comment-github\|pr-comment-gitlab\|review-github\|review-gitlab\|badge\|github-annotations\|github-summary` | `human` | Output format (alias: --output) |
 | `-q, --quiet` | `bool` | `false` | Suppress progress output |
 | `--no-cache` | `bool` | `false` | Disable incremental caching |
 | `--threads` | `string` | - | Number of parser threads |
@@ -1660,6 +1664,7 @@ Available on all commands:
 | `--fail-on-issues` | `bool` | `false` | Exit 1 if any issues found (promotes `warn` to `error`) |
 | `--sarif-file` | `string` | - | Write SARIF output to a file instead of stdout |
 | `-o, --output-file` | `string` | - | Write the report to a file instead of stdout, for any --format (no ANSI codes). Useful on large projects where the terminal scrollback truncates the top. Progress and the confirmation stay on stderr |
+| `--report-path-prefix` | `string` | - | Prefix prepended to every path in the CI-facing formats (`github-annotations`, `github-summary`, `codeclimate`, `review-github`, `review-gitlab`). CI platforms address files by repository-root-relative path, so when the analyzed project lives in a subdirectory (e.g. `packages/app/`), paths need that offset. fallow detects the offset via the git toplevel automatically; this flag overrides the detection. Pass an empty string to disable rebasing and emit paths relative to `--root` |
 | `--fail-on-regression` | `bool` | `false` | Fail if issue count increased beyond tolerance vs a regression baseline |
 | `--tolerance` | `string` | `0` | Allowed increase: `"2%"` (percentage) or `"5"` (absolute). Default: `"0"` |
 | `--regression-baseline` | `string` | - | Path to regression baseline file (default: `.fallow/regression-baseline.json`) |
@@ -1796,7 +1801,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 
 ## CI Integration
 
-- **GitHub Actions**: `uses: fallow-rs/fallow@v2` - supports SARIF upload to Code Scanning, inline PR annotations (`annotations: true`), PR comments, all commands. Annotations use workflow commands (no Advanced Security required); limit with `max-annotations` (default 50). Set `score: true` to compute health score and enable the health delta header in PR comments
+- **GitHub Actions**: `uses: fallow-rs/fallow@v3` - supports SARIF upload to Code Scanning, inline PR annotations (`annotations: true`), PR comments, all commands. Annotations use workflow commands (no Advanced Security required); limit with `max-annotations` (default 50). Set `score: true` to compute health score and enable the health delta header in PR comments
 - **GitLab CI**: include `ci/gitlab-ci.yml` template and extend `.fallow` - generates Code Quality reports via `--format codeclimate` / `--format gitlab-codequality` (inline MR annotations), rich MR comments, code review comments, all commands. Use `fallow ci-template gitlab --vendor` when runners cannot reach `raw.githubusercontent.com`; commit the generated `ci/` and `action/` files and use GitLab's local include syntax. Variables use `FALLOW_` prefix (e.g., `FALLOW_COMMAND`, `FALLOW_FAIL_ON_ISSUES`). Set `FALLOW_SCORE: "true"` to compute health score; `FALLOW_TREND: "true"` to compare against saved snapshots
 - **Any CI**: `npx fallow --ci` - equivalent to `--format sarif --fail-on-issues --quiet`
 
@@ -1831,7 +1836,7 @@ The HTTP layer mirrors the bash `gh_api_retry` / `curl_retry` helpers: `FALLOW_A
 {
   "kind": "dead-code",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 45,
   "total_issues": 12,
   "entry_points": {
@@ -1991,7 +1996,7 @@ When `--baseline` is used in combined output, the JSON includes a `baseline_delt
 {
   "kind": "dupes",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 82,
   "total_clones": 15,
   "total_lines_duplicated": 230,
@@ -2035,11 +2040,11 @@ When running `fallow` with no subcommand (all analyses), the JSON output combine
 {
   "kind": "combined",
   "schema_version": 7,
-  "version": "3.3.0",
+  "version": "3.5.0",
   "elapsed_ms": 159,
   "check": {
     "schema_version": 7,
-    "version": "3.3.0",
+    "version": "3.5.0",
     "elapsed_ms": 45,
     "total_issues": 12,
     "unused_files": [],