Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

src/labels/php.rs

@@ -3,8 +3,24 @@ use phf::{Map, phf_map};
 
 pub static RULES: &[LabelRule] = &[
     // ─────────── Sources ───────────
+    // Note: PHP `$` prefix is stripped by collect_idents, so match without `$`.
     LabelRule {
-        matchers: &["$_GET", "$_POST", "$_REQUEST", "$_COOKIE"],
+        matchers: &[
+            "$_GET",
+            "_GET",
+            "$_POST",
+            "_POST",
+            "$_REQUEST",
+            "_REQUEST",
+            "$_COOKIE",
+            "_COOKIE",
+            "$_FILES",
+            "_FILES",
+            "$_SERVER",
+            "_SERVER",
+            "$_ENV",
+            "_ENV",
+        ],
         label: DataLabel::Source(Cap::all()),
     },
     LabelRule {
@@ -20,17 +36,44 @@ pub static RULES: &[LabelRule] = &[
         matchers: &["escapeshellarg", "escapeshellcmd"],
         label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
     },
+    LabelRule {
+        matchers: &["basename"],
+        label: DataLabel::Sanitizer(Cap::FILE_IO),
+    },
     // ─────────── Sinks ─────────────
     LabelRule {
-        matchers: &["system", "exec", "passthru", "shell_exec"],
+        matchers: &[
+            "system",
+            "exec",
+            "passthru",
+            "shell_exec",
+            "proc_open",
+            "popen",
+        ],
         label: DataLabel::Sink(Cap::SHELL_ESCAPE),
     },
+    LabelRule {
+        matchers: &["eval", "assert"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["include", "include_once", "require", "require_once"],
+        label: DataLabel::Sink(Cap::FILE_IO),
+    },
+    LabelRule {
+        matchers: &["unserialize"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["move_uploaded_file", "copy", "file_put_contents", "fwrite"],
+        label: DataLabel::Sink(Cap::FILE_IO),
+    },
     LabelRule {
         matchers: &["echo", "print"],
         label: DataLabel::Sink(Cap::HTML_ESCAPE),
     },
     LabelRule {
-        matchers: &["mysqli_query", "pg_query"],
+        matchers: &["mysqli_query", "pg_query", "query"],
         label: DataLabel::Sink(Cap::SHELL_ESCAPE),
     },
 ];
@@ -41,16 +84,29 @@ pub static KINDS: Map<&'static str, Kind> = phf_map! {
     "while_statement"               => Kind::While,
     "for_statement"                 => Kind::For,
     "foreach_statement"             => Kind::For,
+    "do_statement"                  => Kind::While,
 
     "return_statement"              => Kind::Return,
+    "throw_expression"              => Kind::Return,
     "break_statement"               => Kind::Break,
     "continue_statement"            => Kind::Continue,
 
     // structure
     "program"                       => Kind::SourceFile,
     "compound_statement"            => Kind::Block,
+    "else_clause"                   => Kind::Block,
+    "else_if_clause"                => Kind::Block,
     "function_definition"           => Kind::Function,
     "method_declaration"            => Kind::Function,
+    "switch_statement"              => Kind::Block,
+    "switch_block"                  => Kind::Block,
+    "case_statement"                => Kind::Block,
+    "default_statement"             => Kind::Block,
+    "try_statement"                 => Kind::Block,
+    "catch_clause"                  => Kind::Block,
+    "finally_clause"                => Kind::Block,
+    "colon_block"                   => Kind::Block,
+    "class_declaration"             => Kind::Block,
 
     // data-flow
     "function_call_expression"      => Kind::CallFn,