fallow 3.30.0 → 3.31.0

package/README.md

@@ -2,7 +2,7 @@
 
 **Codebase intelligence for TypeScript and JavaScript.**
 
-One binary finds unused code, circular dependencies, duplication, complexity hotspots, boundary violations, and design-system styling drift. An optional paid layer, Fallow Runtime, adds production execution evidence. No AI inside the analyzer, and no TypeScript compiler or Node.js runtime needed for static analysis: runs are deterministic, with typed output contracts and traceable explanations.
+One binary finds unused code, circular dependencies, duplication, complexity hotspots, boundary violations, and design-system styling drift. An optional paid product, Fallow Cloud, adds production coverage: which functions run in production. No AI inside the analyzer, and no TypeScript compiler or Node.js runtime needed for static analysis: runs are deterministic, with typed output contracts and traceable explanations.
 
 [![CI](https://github.com/fallow-rs/fallow/actions/workflows/ci.yml/badge.svg)](https://github.com/fallow-rs/fallow/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/fallow.svg)](https://www.npmjs.com/package/fallow)
@@ -48,9 +48,7 @@ Every issue carries an `actions[]` array with an `auto_fixable` flag, so scripts
 - Design-system styling drift for CSS and CSS-in-JS (Sass/Less, CSS Modules, Tailwind, styled-components, Emotion, and more)
 - A changed-file PR gate with per-finding attribution (`fallow audit`)
 - Optional TypeScript checker evidence for exact symbol use, affected files, targeted tests, cross-file private type leaks, and public-signature coupling (`--type-aware`)
-- Optional runtime intelligence: hot paths, cold code, runtime-weighted health (licensed Fallow Runtime; a single local coverage capture is free)
-
-For head-to-head timings against [knip](https://knip.dev) and [jscpd](https://github.com/kucherenko/jscpd), see [BENCHMARKS.md](https://github.com/fallow-rs/fallow/blob/main/BENCHMARKS.md): fallow is faster than knip on smaller projects, knip is faster on several larger repos, and jscpd's Rust rewrite is faster at raw duplication scanning.
+- Optional production coverage with Fallow Cloud: hot paths, cold code, runtime-weighted health (licensed; a single local coverage capture is free)
 
 ### Optional TypeScript semantic evidence
 

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.30.0",
+  "version": "3.31.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -100,6 +100,16 @@
       "required": false,
       "description": "Only report issues in files changed since this git ref (e.g., main, HEAD~5)"
     },
+    {
+      "name": "--no-package-baselines",
+      "type": "bool",
+      "required": false,
+      "description": "Ignore the per-package refs of `workspaces.changedSince` for this run",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
     {
       "name": "--diff-file",
       "type": "string",
@@ -330,6 +340,22 @@
         "false"
       ]
     },
+    {
+      "name": "--fail-on-baseline-growth",
+      "type": "bool",
+      "required": false,
+      "description": "Exit with code 1 if a loaded baseline has a key that the same file at the base ref does not have",
+      "possible_values": [
+        "true",
+        "false"
+      ]
+    },
+    {
+      "name": "--baseline-base",
+      "type": "string",
+      "required": false,
+      "description": "The git ref that --fail-on-baseline-growth compares the baseline with"
+    },
     {
       "name": "--fail-on-parse-error",
       "type": "bool",
@@ -799,6 +825,16 @@
             "false"
           ]
         },
+        {
+          "name": "--package-cycles",
+          "type": "bool",
+          "required": false,
+          "description": "Only report dependency cycles between workspace packages",
+          "possible_values": [
+            "true",
+            "false"
+          ]
+        },
         {
           "name": "--boundary-violations",
           "type": "bool",
@@ -931,6 +967,12 @@
           "required": false,
           "description": "Only report issues in the specified file(s). Accepts multiple values. The full project graph is still built, but only issues in matching files are reported. Useful for lint-staged pre-commit hooks"
         },
+        {
+          "name": "--finding-id",
+          "type": "string",
+          "required": false,
+          "description": "Only report the findings with these `finding_id` values. Repeat the flag or pass a comma-separated list. Ids stay the same under every filter. The JSON output adds `finding_id_query`: a missing id means \"resolved\" only when `conclusive` is true"
+        },
         {
           "name": "path",
           "type": "string",
@@ -3047,6 +3089,45 @@
       "license_note": null,
       "docs_url": "https://docs.fallow.tools/explanations/dead-code#re-export-cycles"
     },
+    {
+      "id": "package-cycle",
+      "rule_id": "fallow/package-cycle",
+      "command": "dead-code",
+      "category": "Architecture",
+      "description": "Two or more workspace packages import each other in a loop",
+      "label": "Package Cycles",
+      "config_key": "package-cycle",
+      "registry_index": 20,
+      "aliases": [
+        "package-cycles"
+      ],
+      "lsp": true,
+      "filter_flag": "--package-cycles",
+      "result_key": "package_cycles",
+      "summary_label": "Package cycles",
+      "summary_docs_anchor": "package-cycles",
+      "sarif_rule_ids": [
+        "fallow/package-cycle"
+      ],
+      "codeclimate_check_names": [
+        "fallow/package-cycle"
+      ],
+      "ts_alias": {
+        "name": "PackageCycle",
+        "parent": "PackageCycleFinding"
+      },
+      "counts_in_total": true,
+      "fixable": false,
+      "suppressible": true,
+      "suppress_comment": "// fallow-ignore-next-line package-cycle",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
+      "note": "Requires a workspace with two or more packages",
+      "license": "free",
+      "license_note": null,
+      "docs_url": "https://docs.fallow.tools/explanations/dead-code#package-cycles"
+    },
     {
       "id": "boundary-violation",
       "rule_id": "fallow/boundary-violation",
@@ -3055,7 +3136,7 @@
       "description": "Import crosses a configured architecture boundary",
       "label": "Boundary Violations",
       "config_key": "boundary-violation",
-      "registry_index": 20,
+      "registry_index": 21,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--boundary-violations",
@@ -3092,7 +3173,7 @@
       "description": "Source file matches no configured architecture boundary zone",
       "label": "Boundary Coverage",
       "config_key": "boundary-violation",
-      "registry_index": 21,
+      "registry_index": 22,
       "aliases": [
         "boundary-coverage-violations"
       ],
@@ -3128,7 +3209,7 @@
       "description": "Zoned file calls a callee its zone forbids",
       "label": "Boundary Call Violations",
       "config_key": "boundary-violation",
-      "registry_index": 22,
+      "registry_index": 23,
       "aliases": [
         "boundary-calls",
         "boundary-call-violations"
@@ -3165,7 +3246,7 @@
       "description": "Banned usage matched a rule-pack rule",
       "label": "Policy Violations",
       "config_key": "policy-violation",
-      "registry_index": 23,
+      "registry_index": 24,
       "aliases": [
         "policy-violations"
       ],
@@ -3201,7 +3282,7 @@
       "description": "Suppression comment or tag no longer matches any issue",
       "label": "Stale Suppressions",
       "config_key": "stale-suppressions",
-      "registry_index": 38,
+      "registry_index": 39,
       "aliases": [],
       "lsp": true,
       "filter_flag": "--stale-suppressions",
@@ -3237,7 +3318,7 @@
       "description": "Suppression comment omits a required reason",
       "label": "Missing Suppression Reasons",
       "config_key": "require-suppression-reason",
-      "registry_index": 39,
+      "registry_index": 40,
       "aliases": [
         "missing-suppression-reasons"
       ],
@@ -3269,7 +3350,7 @@
       "description": "Catalog entry not referenced by any workspace package",
       "label": "Unused Catalog Entries",
       "config_key": "unused-catalog-entries",
-      "registry_index": 40,
+      "registry_index": 41,
       "aliases": [
         "catalog",
         "unused-catalog-entries"
@@ -3309,7 +3390,7 @@
       "description": "Named catalog group has no entries",
       "label": "Empty Catalog Groups",
       "config_key": "empty-catalog-groups",
-      "registry_index": 41,
+      "registry_index": 42,
       "aliases": [
         "empty-catalog",
         "empty-catalog-groups"
@@ -3349,7 +3430,7 @@
       "description": "package.json references a catalog that does not declare the package",
       "label": "Unresolved Catalog References",
       "config_key": "unresolved-catalog-references",
-      "registry_index": 42,
+      "registry_index": 43,
       "aliases": [
         "unresolved-catalog",
         "unresolved-catalog-references"
@@ -3389,7 +3470,7 @@
       "description": "Package-manager override target is not declared or resolved",
       "label": "Unused Dependency Overrides",
       "config_key": "unused-dependency-overrides",
-      "registry_index": 43,
+      "registry_index": 44,
       "aliases": [
         "unused-dependency-overrides",
         "unused-override",
@@ -3430,7 +3511,7 @@
       "description": "Package-manager override has an unparsable key or value",
       "label": "Misconfigured Dependency Overrides",
       "config_key": "misconfigured-dependency-overrides",
-      "registry_index": 44,
+      "registry_index": 45,
       "aliases": [
         "misconfigured-dependency-overrides",
         "misconfigured-override",
@@ -3471,7 +3552,7 @@
       "description": "\"use client\" file exports a server-only / route-config name",
       "label": "Invalid Client Exports",
       "config_key": "invalid-client-export",
-      "registry_index": 24,
+      "registry_index": 25,
       "aliases": [
         "invalid-client-exports"
       ],
@@ -3509,7 +3590,7 @@
       "description": "Barrel re-exports both a \"use client\" module and a server-only module",
       "label": "Mixed Client/Server Barrels",
       "config_key": "mixed-client-server-barrel",
-      "registry_index": 25,
+      "registry_index": 26,
       "aliases": [
         "mixed-client-server-barrels"
       ],
@@ -3545,7 +3626,7 @@
       "description": "\"use client\" / \"use server\" directive is not in the leading position and is ignored",
       "label": "Misplaced Directives",
       "config_key": "misplaced-directive",
-      "registry_index": 26,
+      "registry_index": 27,
       "aliases": [
         "misplaced-directives"
       ],
@@ -3581,7 +3662,7 @@
       "description": "inject() / getContext() reads a key that no provide() / setContext() supplies",
       "label": "Unprovided Injects",
       "config_key": "unprovided-injects",
-      "registry_index": 27,
+      "registry_index": 28,
       "aliases": [
         "unprovided-injects"
       ],
@@ -3617,7 +3698,7 @@
       "description": "A Vue / Svelte component is reachable through a barrel but rendered nowhere",
       "label": "Unrendered Components",
       "config_key": "unrendered-components",
-      "registry_index": 28,
+      "registry_index": 29,
       "aliases": [
         "unrendered-components"
       ],
@@ -3653,7 +3734,7 @@
       "description": "A Vue, Svelte, or React component prop is referenced nowhere in its own component",
       "label": "Unused Component Props",
       "config_key": "unused-component-props",
-      "registry_index": 29,
+      "registry_index": 30,
       "aliases": [
         "unused-component-props"
       ],
@@ -3689,7 +3770,7 @@
       "description": "A Vue <script setup> defineEmits event is emitted nowhere in its own component",
       "label": "Unused Component Emits",
       "config_key": "unused-component-emits",
-      "registry_index": 30,
+      "registry_index": 31,
       "aliases": [
         "unused-component-emits"
       ],
@@ -3725,7 +3806,7 @@
       "description": "An Angular @Input() / signal input() / model() input is read nowhere in its own component",
       "label": "Unused Component Inputs",
       "config_key": "unused-component-inputs",
-      "registry_index": 31,
+      "registry_index": 32,
       "aliases": [
         "unused-component-inputs"
       ],
@@ -3761,7 +3842,7 @@
       "description": "An Angular @Output() / signal output() output is emitted nowhere in its own component",
       "label": "Unused Component Outputs",
       "config_key": "unused-component-outputs",
-      "registry_index": 32,
+      "registry_index": 33,
       "aliases": [
         "unused-component-outputs"
       ],
@@ -3797,7 +3878,7 @@
       "description": "A Svelte component dispatches a createEventDispatcher event whose name is listened to nowhere in the project",
       "label": "Unused Svelte Events",
       "config_key": "unused-svelte-events",
-      "registry_index": 33,
+      "registry_index": 34,
       "aliases": [
         "unused-svelte-events"
       ],
@@ -3833,7 +3914,7 @@
       "description": "A Next.js Server Action exported from a \"use server\" file is referenced by no code in the project",
       "label": "Unused Server Actions",
       "config_key": "unused-server-actions",
-      "registry_index": 34,
+      "registry_index": 35,
       "aliases": [
         "unused-server-actions"
       ],
@@ -3869,7 +3950,7 @@
       "description": "A SvelteKit load() return-object key is read by no consumer",
       "label": "Unused Load Data Keys",
       "config_key": "unused-load-data-keys",
-      "registry_index": 35,
+      "registry_index": 36,
       "aliases": [
         "unused-load-data-keys"
       ],
@@ -3905,9 +3986,9 @@
       "description": "A React/Preact prop is forwarded unchanged through 3+ pass-through components to a distant consumer",
       "label": "Prop Drilling",
       "config_key": "prop-drilling",
-      "registry_index": 50,
+      "registry_index": 51,
       "aliases": [],
-      "lsp": false,
+      "lsp": true,
       "filter_flag": null,
       "result_key": "prop_drilling_chains",
       "summary_label": "Prop drilling",
@@ -3937,11 +4018,11 @@
       "description": "A React/Preact component whose whole body is a single spread-forwarded child render (a candidate for inlining)",
       "label": "Thin Wrappers",
       "config_key": "thin-wrapper",
-      "registry_index": 51,
+      "registry_index": 52,
       "aliases": [
         "thin-wrappers"
       ],
-      "lsp": false,
+      "lsp": true,
       "filter_flag": null,
       "result_key": "thin_wrappers",
       "summary_label": "Thin wrappers",
@@ -3971,11 +4052,11 @@
       "description": "Three or more React/Preact components across two or more files declare an identical prop-name set (a missing shared Props type)",
       "label": "Duplicate Prop Shapes",
       "config_key": "duplicate-prop-shape",
-      "registry_index": 52,
+      "registry_index": 53,
       "aliases": [
         "duplicate-prop-shapes"
       ],
-      "lsp": false,
+      "lsp": true,
       "filter_flag": null,
       "result_key": "duplicate_prop_shapes",
       "summary_label": "Duplicate prop shapes",
@@ -4005,7 +4086,7 @@
       "description": "Two or more Next.js App Router route files resolve to the same URL",
       "label": "Route Collisions",
       "config_key": "route-collision",
-      "registry_index": 36,
+      "registry_index": 37,
       "aliases": [
         "route-collisions"
       ],
@@ -4043,7 +4124,7 @@
       "description": "Sibling Next.js dynamic route segments use different slug names at the same position",
       "label": "Dynamic Segment Conflicts",
       "config_key": "dynamic-segment-name-conflict",
-      "registry_index": 37,
+      "registry_index": 38,
       "aliases": [
         "dynamic-segment-name-conflicts"
       ],
@@ -4231,7 +4312,7 @@
       "description": "CSS or CSS-in-JS hardcoded styling value bypasses the design token system",
       "label": "CSS Token Drift",
       "config_key": "css-token-drift",
-      "registry_index": 53,
+      "registry_index": 54,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4261,7 +4342,7 @@
       "description": "CSS or CSS-in-JS declaration block is duplicated across rules",
       "label": "CSS Duplicate Block",
       "config_key": "css-duplicate-block",
-      "registry_index": 54,
+      "registry_index": 55,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4291,7 +4372,7 @@
       "description": "CSS selector, nesting, or important usage is structurally complex",
       "label": "CSS Selector Complexity",
       "config_key": "css-selector-complexity",
-      "registry_index": 55,
+      "registry_index": 56,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4321,7 +4402,7 @@
       "description": "CSS or CSS-in-JS surface appears unused",
       "label": "CSS Dead Surface",
       "config_key": "css-dead-surface",
-      "registry_index": 56,
+      "registry_index": 57,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4351,7 +4432,7 @@
       "description": "CSS or CSS-in-JS reference resolves to no stylesheet definition",
       "label": "CSS Broken Reference",
       "config_key": "css-broken-reference",
-      "registry_index": 57,
+      "registry_index": 58,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -4741,7 +4822,7 @@
       "description": "Detected feature flag pattern",
       "label": "Feature Flags",
       "config_key": "feature-flags",
-      "registry_index": 48,
+      "registry_index": 49,
       "aliases": [],
       "lsp": false,
       "filter_flag": null,
@@ -6290,6 +6371,7 @@
     "FALLOW_API_RETRY_DELAY": "Floor delay in seconds between HTTP retry attempts (default 2); a server-supplied Retry-After overrides it on 429 responses.",
     "FALLOW_CACHE_DIR": "Directory for fallow's persistent analysis cache. Relative paths resolve from the project root and override cache.dir.",
     "FALLOW_CACHE_MAX_SIZE": "Extraction cache size cap in megabytes (default 256). Wins over the cache.maxSizeMb config field.",
+    "FALLOW_PACKAGE_BASELINES": "Set to false, 0, no or off to ignore workspaces.changedSince for every run of the process, like --no-package-baselines.",
     "FALLOW_EXTENDS_TIMEOUT_SECS": "Timeout in seconds for fetching https:// configs referenced via the extends field (default 5).",
     "FALLOW_COVERAGE": "Path to Istanbul coverage data (coverage-final.json) or raw V8 coverage (a NODE_V8_COVERAGE directory or one V8 JSON file) for accurate per-function CRAP scores. CLI --coverage flag overrides this; it wins over the health.coverage config field. Honored by the health, bare fallow, audit, and viz CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage parameter overrides it. Viz reads it through the same precedence and has no coverage flag of its own.",
     "FALLOW_COVERAGE_ROOT": "Absolute coverage-data path prefix for rebasing Istanbul paths in CI or containers. CLI --coverage-root flag overrides this; it wins over the health.coverageRoot config field. Honored by the health, bare fallow, audit, and viz CLI commands and by the MCP audit and check_health tools on both their typed route and their CLI fallback, where the explicit coverage_root parameter overrides it. Viz reads it through the same precedence and has no coverage flag of its own.",
@@ -6301,16 +6383,16 @@
     "FALLOW_AUDIT_CACHE_MAX_AGE_DAYS": "GC threshold in days for reusable audit base-snapshot caches (default 30; 0 disables the sweep).",
     "FALLOW_IMPACT_STORE_MAX_AGE_DAYS": "GC threshold in days for per-project fallow impact stores; a recorded run reclaims stores older than this (unset/0 keeps every store forever).",
     "FALLOW_ROOT": "Project root used by the review-github/review-gitlab renderers to read source for suggestion blocks. Set it alongside --root when rendering review formats outside the bundled CI integrations.",
-    "FALLOW_LICENSE": "License JWT (full string) for the paid runtime intelligence layer; intended for shared CI runners.",
+    "FALLOW_LICENSE": "License JWT (full string) for Fallow Cloud, the paid product; intended for shared CI runners.",
     "FALLOW_LICENSE_PATH": "File path containing the license JWT.",
     "FALLOW_LICENSE_SKEW_TOLERANCE_SECONDS": "Clock-skew tolerance applied to the license JWT's iat claim (default 86400).",
     "FALLOW_COV_BIN": "Explicit path override for the fallow-cov runtime-coverage sidecar binary.",
     "FALLOW_COV_BINARY_PATH": "Secondary explicit path override for the fallow-cov sidecar, checked after FALLOW_COV_BIN (air-gapped installs, distro-packaged sidecars, shared Docker images).",
     "FALLOW_RUNTIME_COVERAGE_SOURCE": "Set to cloud to select cloud runtime coverage in fallow coverage analyze without passing --cloud.",
     "FALLOW_REPO": "owner/repo fallback for fallow coverage analyze --cloud when --repo is not passed (otherwise parsed from the git origin remote).",
-    "FALLOW_API_URL": "Base URL override for fallow cloud API calls (license refresh, trial, coverage uploads).",
-    "FALLOW_API_KEY": "fallow cloud bearer token for coverage upload commands, and the fallback bearer for fallow license refresh when the stored license JWT is missing or too stale.",
-    "FALLOW_CA_BUNDLE": "Path to a PEM certificate bundle for fallow cloud and provider HTTP calls (replaces the default WebPKI roots).",
+    "FALLOW_API_URL": "Base URL override for Fallow Cloud API calls (license refresh, trial, coverage uploads).",
+    "FALLOW_API_KEY": "Fallow Cloud bearer token for coverage upload commands, and the fallback bearer for fallow license refresh when the stored license JWT is missing or too stale.",
+    "FALLOW_CA_BUNDLE": "Path to a PEM certificate bundle for Fallow Cloud and provider HTTP calls (replaces the default WebPKI roots).",
     "FALLOW_UPDATE_CHECK": "Set to off/0/false to disable the human-TTY upgrade nudge and its background version check.",
     "FALLOW_SUGGESTIONS": "Set to off/0/false/no/disabled to suppress the next_steps[] array of read-only follow-up commands in JSON output (and the human Next: line). Useful for CI consumers that snapshot-diff raw --format json output. Default on.",
     "FALLOW_TELEMETRY": "Opt-in telemetry mode: off, on, or inspect (print the payload to stderr without sending). Telemetry is off by default.",
@@ -6820,7 +6902,7 @@
       {
         "name": "analyze",
         "kind": "analysis",
-        "description": "Full dead-code analysis: unused files, exports, types, dependencies, circular dependencies, and boundary violations",
+        "description": "Full dead-code analysis: unused files, exports, types, dependencies, circular dependencies, and boundary violations, each with a stable finding_id",
         "cli_command": "fallow dead-code --format json --quiet",
         "key_params": [
           "issue_types",
@@ -6838,7 +6920,7 @@
       {
         "name": "check_changed",
         "kind": "analysis",
-        "description": "Incremental dead-code analysis scoped to files changed since a git ref (ideal for PR review)",
+        "description": "Incremental dead-code analysis scoped to files changed since a git ref (ideal for PR review); findings keep their finding_id",
         "cli_command": "fallow dead-code --changed-since <ref> --format json --quiet",
         "key_params": [
           "since",
@@ -7041,7 +7123,7 @@
       {
         "name": "get_cloud_runtime_context",
         "kind": "runtime-coverage",
-        "description": "Runtime coverage pulled from fallow cloud for a repository, merged into the same runtime_coverage block the local runtime-coverage tools return",
+        "description": "Runtime coverage pulled from Fallow Cloud for a repository, merged into the same runtime_coverage block the local runtime-coverage tools return",
         "cli_command": "fallow coverage analyze --cloud --repo <owner/repo> --format json --quiet",
         "key_params": [
           "repo",
@@ -7051,7 +7133,40 @@
           "top"
         ],
         "license": "freemium",
-        "license_note": "Reading runtime coverage from fallow cloud needs a FALLOW_API_KEY for an org on the Team tier; the cloud refuses the request otherwise. No local license is involved.",
+        "license_note": "Reading runtime coverage from Fallow Cloud needs a FALLOW_API_KEY for an org on the Team tier; the cloud refuses the request otherwise. No local license is involved.",
+        "read_only": true,
+        "code_mode_alias": null
+      },
+      {
+        "name": "get_cloud_review_packet",
+        "kind": "runtime-coverage",
+        "description": "Production facts of a few changed files or functions, read from fallow cloud without the full runtime-context pull",
+        "cli_command": "fallow coverage review-packet --repo <owner/repo> --file <path> --format json --quiet",
+        "key_params": [
+          "repo",
+          "files",
+          "functions",
+          "period_days",
+          "project_id"
+        ],
+        "license": "freemium",
+        "license_note": "Reading runtime coverage from Fallow Cloud needs a FALLOW_API_KEY for an org on the Team tier; the cloud refuses the request otherwise. No local license is involved.",
+        "read_only": true,
+        "code_mode_alias": null
+      },
+      {
+        "name": "get_cloud_deployment_changes",
+        "kind": "runtime-coverage",
+        "description": "How production behavior changed between two deployments, read from the fallow cloud change report",
+        "cli_command": "fallow coverage deployment-changes --repo <owner/repo> --sha <sha> --format json --quiet",
+        "key_params": [
+          "repo",
+          "sha",
+          "base",
+          "change"
+        ],
+        "license": "freemium",
+        "license_note": "Reading runtime coverage from Fallow Cloud needs a FALLOW_API_KEY for an org on the Team tier; the cloud refuses the request otherwise. No local license is involved.",
         "read_only": true,
         "code_mode_alias": null
       },