Fallow dead-code false positives with Nuxt auto-imports and file-based routing

[BillyOutlast]

Problem

Fallow dead-code analysis produces false positives on Nuxt framework patterns. Static analysis cannot trace:

• File-based routing — .vue components in pages/, components/ loaded by router
• Auto-imported composables — useSanitize(), useFoo() resolved by Nuxt without explicit imports
• Nitro file-based handlers — server/api/**/*.ts export default defineEventHandler(...) resolved by Nitro
• Nitro plugins — server/plugins/*.ts hooks registered by Nuxt

This blocks the pre-commit hook (fallow audit --gate-marker agent) on any PR touching these files.

Scope

From PR #191, 5 new-introduced dead-code findings are all Nuxt false positives:

Pattern	Example	Why false
unused_file	server/composables/useSanitize.ts	Auto-imported by 9 Vue components
unused_file	server/components/Directory/News.vue	File-based component routing
unused_export	server/server/api/v1/admin/library/index.get.ts:default	Nitro handler pattern
unused_type	AdminLibraryGame	Internal type in handler file
unresolved_import	useSanitize() in Metadata.vue	Nuxt auto-import

Proposed fix

Add Nuxt-specific patterns to fallow.toml ignorePatterns:

ignorePatterns = [
  # ... existing patterns ...
  # Nuxt auto-import false positives
  "server/composables/**",
  "server/components/**",
  "server/pages/**",
  "server/server/api/**",
  "server/server/plugins/**",
  "server/server/middleware/**",
  "server/server/routes/**",
]

Trade-off: This suppresses ALL dead-code analysis in these directories, including valid findings. A more targeted approach would be fallow-ignore-file comments per file, but that scales poorly in a Nuxt codebase.

Related

• PR fix(security): remediation bundle — AES-256-GCM, DOMPurify, WebSocket auth, 4 CVEs, SonarCloud #191 — initial detection
• fallow.toml — existing config at workspace root