v3.40.0: Namespace checks, workspace settings and runtime context

Fallow 3.40.0 adds checks for unused namespace members, duplicate export aliases and missing command-line tools, plus workspace-specific settings and targeted mutation analysis.

New analysis and configuration

• unused-namespace-members, duplicate-export-aliases and unlisted-binaries report through the CLI and integrations. These rules default to warnings. With --fail-on-issues, new warnings can fail CI. Disable a rule in top-level rules to retain the previous result.
• ignoreBinaries excludes intentional external commands. workspaces.settings configures dependency exclusions and entry exports per workspace. supportEntry separates development entry points from production analysis. Migration preserves these settings.
• Security analysis recognizes more command, template, network, file and deserialization sinks within existing categories, also when a destructured require() binds the sink.
• mutation --kill-matrix-for checks named tests for redundant mutant kills without running a full kill matrix. Vitest mutation runs now forward the active mutant to Node child processes. Audit counts @effect/vitest tests.

Runtime context and integrations

• Inventory uploads with --with-callers include the entry routes that can reach each function.
• coverage analyze --cloud retains error and performance context. inspect --file --cloud retains browser and caller context. These fields do not change verdicts.
• The MCP server routes Rust workspaces to cargo-fallow. Packaged skill guidance also documents the hosted Fallow Cloud MCP server.
• VS Code keeps sidebar groups expanded after refresh and updates its language client.

Correctness and maintenance

Dead-code analysis fixes false positives involving inherited method results, inline import types, calls with arguments and re-exported schemas. Resolution fixes cover URL-loaded modules, package assets, build-output imports and workspace folder dependencies. Configuration fixes cover project wrappers and framework aliases. Dependency checks recognize config-required packages. Migration handles namespace issue types, and declaration merges avoid duplicate-export findings.

fallow doctor uses the project's package manager for dependency-install commands. Packaged skill guidance now starts with this readiness check.

Graph caches invalidate after dependency installs and after Yarn Plug'n'Play changes. Audit comments explain attribution and gate effects. Initial analysis rebuilds caches after this upgrade. Contributors can set up a checkout with pnpm bootstrap. Shared report types retain their JSON shape. This release also updates dependencies.

Thanks @Smrtnyk for the reports and @cr101 for the targeted mutation-analysis proposal.

v3.39.0...v3.40.0