Agent code reviews that fallow checks against the code graph

Fallow skills 1.4.41 is out. These skills teach a coding agent to run fallow on TypeScript and JavaScript code and read what it reports. Most of this release keeps the skills in step with fallow itself, so each feature runs in the fallow tool you install. The biggest change is a review that fallow checks before you read it.

Here's the new loop. The agent gates the change with fallow audit and saves a walkthrough guide outside the project. Then it writes its review as a judgment file. Each note cites a signal or a changed region from the guide, with an action like fyi or address.

review="${TMPDIR:-/tmp}"
# 1. gate the change
fallow audit --format json --quiet
# 2. read the guide
fallow audit --walkthrough-guide \
  --format json --quiet \
  > "$review/fallow-guide.json"
# 4. fallow checks the judgment
fallow audit \
  --walkthrough-file "$review/fallow-judgment.json" \
  --format json --quiet

{
  "graph_snapshot_hash": "<copy from the guide>",
  "judgments": [
    { "signal_id": "sig:<from digest.decisions>",
      "framing": "Callers keep their imports.",
      "action": "fyi" },
    { "change_anchor": "chg:<from change_anchors>",
      "framing": "unusedHelper has no caller.",
      "action": "address" }
  ]
}

Fallow then checks where each note points. Notes that cite something fallow emitted are accepted, and the agent reports only those. An id fallow didn't emit is rejected. If the tree moved and the snapshot hash no longer matches, fallow refuses the whole file as stale. The opinion in each note stays the agent's own.

The fallow-review skill now reads test reach for each changed export. Transitive means a test reaches it without naming it. Mocked-only means the tests swap the file for a mock, so the real code doesn't run. None and none-file mean tests miss the export, or the whole file. So a test that imports the file no longer counts as proof, and the agent asks the author how the change was verified.

The skill now knows the diff risk rules in fallow audit, which report facts about the change itself. Weakening tests or a coverage threshold, adding a suppression comment, or adding a test-only branch to source code all land in its findings. Two more are opt-in: editing one copy of duplicated code but not its siblings, and adding a dependency.

The sync covers more of fallow, too. An opt-in mutation command measures how well your tests catch code changes, and two MCP tools plan and inspect mutants without running tests. Three rules cover Effect code. Health hotspots list files that change together with no import between them. And traces flag consumers that a plain grep would miss.

One removal affects Claude Code users who set up the optional live-feedback hooks. fallow-review drops the two hooks that watched the fallow review app's feed file and injected reviewer notes into your running session. The terminal walkthrough stays. The agent relays accepted human verdicts into the coding session itself, with each note's action. If you copied those hooks into a repo, the skill no longer ships or documents them.

Some smaller changes affect what the agent writes and runs. Config examples now use double star globs, because a single star stays within one folder level. The setup skill spots more Oxlint and Oxfmt config files. And the setup step fallow suggests is now fallow agent install, as a dry run.

The install commands are the same as before. The skills describe what fallow emits, so run a recent fallow with them. An older fallow doesn't emit test reach, and the review skill falls back to test adjacency. The README badge now names fallow 3.34.1. Keep both current, and your agent's code reviews come back checked against fallow's code graph.

# Claude Code
/plugin marketplace add fallow-rs/fallow-skills
/plugin install fallow@fallow-skills
# OpenAI Codex
codex plugin marketplace add fallow-rs/fallow-skills
codex plugin add fallow@fallow-skills
# Agent Skills CLI
npx skills add fallow-rs/fallow-skills