Repository navigation
Fallow dead-code false positives with Nuxt auto-imports and file-based routing #192
Description
Problem
Fallow dead-code analysis produces false positives on Nuxt framework patterns. Static analysis cannot trace:
- File-based routing —
.vuecomponents inpages/,components/loaded by router - Auto-imported composables —
useSanitize(),useFoo()resolved by Nuxt without explicit imports - Nitro file-based handlers —
server/api/**/*.tsexport default defineEventHandler(...)resolved by Nitro - Nitro plugins —
server/plugins/*.tshooks registered by Nuxt
This blocks the pre-commit hook (fallow audit --gate-marker agent) on any PR touching these files.
Scope
From PR #191, 5 new-introduced dead-code findings are all Nuxt false positives:
| Pattern | Example | Why false |
|---|---|---|
unused_file |
server/composables/useSanitize.ts |
Auto-imported by 9 Vue components |
unused_file |
server/components/Directory/News.vue |
File-based component routing |
unused_export |
server/server/api/v1/admin/library/index.get.ts:default |
Nitro handler pattern |
unused_type |
AdminLibraryGame |
Internal type in handler file |
unresolved_import |
useSanitize() in Metadata.vue |
Nuxt auto-import |
Proposed fix
Add Nuxt-specific patterns to fallow.toml ignorePatterns:
ignorePatterns = [
# ... existing patterns ...
# Nuxt auto-import false positives
"server/composables/**",
"server/components/**",
"server/pages/**",
"server/server/api/**",
"server/server/plugins/**",
"server/server/middleware/**",
"server/server/routes/**",
]Trade-off: This suppresses ALL dead-code analysis in these directories, including valid findings. A more targeted approach would be fallow-ignore-file comments per file, but that scales poorly in a Nuxt codebase.
Related
- PR fix(security): remediation bundle — AES-256-GCM, DOMPurify, WebSocket auth, 4 CVEs, SonarCloud #191 — initial detection
fallow.toml— existing config at workspace root
Activity