v2.74.0: boundary autoDiscover, ignoreExports auto-fix, empty pnpm catalog groups

Highlights

Architecture boundaries now auto-discover per-feature zones. A single { "name": "features", "autoDiscover": ["src/features"] } declaration replaces the per-feature zone + rule pairs that Bulletproof React projects used to write by hand, and the Bulletproof preset uses it by default so sibling-feature isolation now works out of the box. fallow fix also gained an ignoreExports writer so suppressions land directly in your .fallowrc.json / fallow.toml (with comment + CRLF preservation, symlink-safe), and we detect + auto-fix empty named pnpm catalog groups left behind by previous fixer runs.

Added

• Architecture boundary auto-discovery (autoDiscover on BoundaryZone). Declares one logical zone, expands into one zone per immediate child directory:

  {
    "boundaries": {
      "zones": [
        { "name": "app", "patterns": ["src/app/**"] },
        { "name": "features", "autoDiscover": ["src/features"] },
        { "name": "shared", "patterns": ["src/shared/**"] }
      ],
      "rules": [
        { "from": "app", "allow": ["features", "shared"] },
        { "from": "features", "allow": ["shared"] }
      ]
    }
  }

  If src/features/auth/ and src/features/billing/ exist, fallow creates features/auth and features/billing zones and expands rules referencing features to both. Explicit child rules ({ "from": "features/auth", "allow": [...] }) override generated parent rules regardless of declaration order. The Bulletproof preset uses this for the features zone by default; top-level src/features/index.ts barrels stay unrestricted by design so they can re-export children without false positives.

  Two follow-up issues are open: #372 for differentiated parent-vs-child rule expansion (strict mode on non-barrel top-level files), and #373 for surfacing the logical-group name in list --boundaries JSON. (Closes #368. Thanks @DrJonki for the report.)

• fallow fix auto-applies ignoreExports rules to the active fallow config. Previously the only way to silence a stubborn unused-export finding was a per-file // fallow-ignore-next-line comment or hand-editing ignoreExports. The fixer now writes the suppression into the active config file, preserving JSONC comments and CRLF line endings, following --config <path> overrides, and deduplicating absolute-path entries against existing relative ones. (Closes #366.)

• Empty named pnpm catalog group detection + auto-fix. Named catalogs.<name>: groups in pnpm-workspace.yaml with no entries now flag as empty-catalog-group (default warn); fallow fix deletes the header, the LSP offers a quick-fix code action with an anchored key-prefix guard so sibling groups with shared prefixes (react17 vs react18) cannot be deleted by mistake. The top-level catalog: map is never flagged. (Closes #359.)

Fixed

• unused-dependency-overrides false positives on transitive-only overrides. CVE-fix overrides that pin a purely transitive dependency (no direct dep in any workspace package.json) are no longer flagged as unused when pnpm-lock.yaml resolves them. (Closes #371. Thanks @cloud-walker for the report.)

• add-to-config action metadata now respects explicit --config <path>. Tools that gate auto-fix on the auto_fixable bool will no longer skip a fix that is actually applicable to the explicitly-named config. (Closes #367.)

• fallow audit --gate new-only now attributes unused-catalog-entries and empty-catalog-groups as introduced vs inherited so changed-file gates fire correctly when a fresh catalog entry lands.

Install

npm install --save-dev fallow            # or pnpm/yarn/bun
cargo install fallow-cli                 # build from source

Schema / API additions

• BoundaryZone.autoDiscover: string[] (new, optional)
• BoundaryZone.patterns is now optional in .fallowrc.json
• rules.empty-catalog-groups (default warn)
• IssueKind::EmptyCatalogGroup (discriminant 25)
• EmptyCatalogGroup finding struct on AnalysisResults

Full Changelog: v2.73.0...v2.74.0