v2.70.0: hot-path-touched, pnpm catalog detection, faster discovery

Highlights

• Reviewers see immediately when a PR touches production-hot code. Pass a unified diff (fallow audit --diff-file <unified.diff>, or the new diff-file input on the GitHub Action / GitLab CI template) and fallow intersects the changed line ranges against production-hot paths captured by the coverage sidecar, firing a dedicated hot-path-touched verdict and rendering a "hot path touched" framing in PR / MR comments. Built on fallow-cov-protocol 0.5 (per-hot-path line spans, structured multi-signal verdict array). Paid, runtime-backed.

• Unused pnpm catalog entries are now detected. A new unused-catalog-entries rule (default warn) reads pnpm-workspace.yaml, walks the default catalog: map plus every named catalog under catalogs:, and reports entries no workspace package.json references via the catalog: protocol. Findings include a hardcoded_consumers list pointing at workspace packages that still declare the dependency with a pinned version, so the choice between "switch consumers to catalog:" and "delete the entry" stays explicit. Surfaced across all output formats, CI annotations, LSP diagnostics, MCP, and the VS Code "Unused Code" tree. Thanks @Luzefiru. (Closes #329)

Notable fixes

• Node / Bun / Cloudflare builtin imports (node:url, bun:sqlite, etc.) are no longer flagged as unresolved-import when tsconfig.json declares a catch-all "*": ["./src/*"] path mapping. Thanks @FunctionDJ. (Closes #327)
• Multi-hop export * as N from './source' chains across workspace packages no longer produce false unused-export findings on shadcn-style and namespace-barrel layouts. Thanks @filipw01. (Closes #328)
• Namespace re-export members are now credited through the named-import form, so export * as Foo from './bar'; import { Foo } from './barrel'; Foo.X(...) no longer flags X as unused. Real-world delta on a large Astro-style project: 103 false positives gone. Thanks @ivayloc. (Closes #324)
• VS Code: "Unused Code" tree renders unlisted-dependency rows correctly and no longer crashes when one is present. Plus tree categories for namespace-barrel duplicate exports, circular dependencies, boundary violations, and unused-catalog-entries. Thanks @FunctionDJ. (Closes #323)
• ignoreExports gates duplicate-exports in shadcn / Radix-style component-library layouts, with a JSON add-to-config action emitted in the primary slot so the non-destructive path is the default for AI agents. The --format human rendering now surfaces a namespace-barrel orientation hint when the findings look like shadcn / bits-ui. Thanks @Vantrongs. (Closes #317, refs #322)
• Duplicate-clone detector filters out bare function-call shapes (someFn(\n arg1,\n arg2,\n) and similar): there is nothing to extract from a single call, so the findings were noise. Thanks @danielo515. (Refs discussion #320)
• // fallow-ignore-next-line accepts stacked single-kind comments, matching the comma-list form that has always worked. (Closes #318)
• Singular rule keys in .fallowrc work as aliases for every plural rule. "boundary-violation": "warn" is no longer silently ignored.

Other improvements

• Faster discovery on monorepos. Workspace package walking and per-project plugin extraction now distribute over rayon, dead-code analysis early-skips modules with no exports and lazy-builds detector matcher lists, and duplicate-clone detection memoises per-file suppression metadata so long files with overlapping clone groups stop re-scanning. No JSON, CLI, or cache-format change.
• add-to-config actions in JSON output carry an optional value_schema JSON Pointer URL so AI agents can validate writes before applying them. The URL points at the schema fragment describing the action's value shape. (Closes #331)
• overrides.rules.{duplicate-exports,circular-dependency} warnings dedupe per-process in workspace mode (no more 200 identical warn lines on a 200-package monorepo).

Security

• Replaced the unmaintained serde_yml 0.0.12 (RUSTSEC-2025-0068, unsound segfault) with serde_yaml_ng 0.10 in the pnpm catalog parser. API-compatible swap; same pnpm-workspace.yaml shapes parsed.

Full Changelog: v2.69.0...v2.70.0