v0.3.0: agent integration, fuzz consumers and safer fix

This release connects cargo-fallow to coding agents. A gate stops an agent commit or push that adds a new finding, and a skill tells the agent how to use each command. The release also makes fix continue past one bad edit, and lets fuzz targets count as users of workspace items.

cargo install cargo-fallow --locked

Coding agents

• cargo fallow hooks install --target agent installs a gate for Claude Code and Codex. Before an agent runs git commit or git push, the gate runs cargo fallow check on the changed files. It blocks only a finding that the base commit does not have, and it lists each finding. An error of the tool does not block.
• cargo fallow hooks install --target git installs the same check as a git pre-commit hook. hooks uninstall removes the files, and hooks status shows them.
• The cargo-fallow skill tells a coding agent how to run each command, read the JSON output and fix the findings after a block. The skill is in skills/cargo-fallow/SKILL.md, with a Codex interface file. The Fallow plugin also contains it.
• cargo fallow agent install sets up a repository in one step: a guide block in AGENTS.md, the skill for Claude Code and Codex, and the gate. agent status shows the parts, and agent uninstall removes them. cargo fallow init --agents runs the same setup.

Use a release build of cargo-fallow with the gate. On a large workspace, a debug build can take more time than the hook timeout of the agent.

Configuration and checks

• consumers in [workspace.metadata.fallow.visibility] lists separate workspaces that use the items of the workspace, for example fuzz/Cargo.toml. visibility then does not report an item that a fuzz target calls, and fix does not narrow it. Without the key, fuzz/Cargo.toml counts when it exists.
• A boundaries.sources rule reports an allow entry whose file has fewer matches than max. The finding kind is allow-entry, so the list stays exact. An entry can also take require = ["pattern"], so the file must contain each pattern.
• cargo fallow api --public-crate <CRATE> sets the external libraries for one run. --all-published reads each published library.

cargo fallow fix

• fix no longer stops the run for one edit that adds a compiler warning or error. It leaves out that edit, applies the others, and records the reason in skip_reason and diagnostic.
• The guard now sees a new dead_code warning, so an edit that makes an item dead is left out.
• The guard also builds each consumers workspace.

Changed behavior

• A dead-public finding and a finding with test_only: true are no longer auto_fixable. A narrower keyword on such an item makes the compiler report dead code. A dead-public finding has a second action, remove-item.
• cargo fallow api --base reads the same libraries that visibility treats as an external API. When public-crates is set, a narrowed item of an internal crate is no longer a removed finding.
• cargo fallow init --ci github writes fallow-rs/cargo-fallow@v0, the newest 0.x release, and not @main.

Fixes

• The GitHub Action and the GitLab CI template now work with a jq that ends each line with CRLF, as jq on Windows does. Before, the gate outputs, the annotation count, the job summary and the GitLab note pages kept a CR. With bash 3.2, the GitLab comment step could loop without end.

v0.2.0...v0.3.0