Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/real_world/cpp/cfg/lambda_capture.cpp

@@ -0,0 +1,10 @@
+#include <cstdlib>
+#include <functional>
+#include <string>
+
+std::function<void()> create_dangerous_lambda(const char *user_input) {
+    std::string cmd = std::string("echo ") + user_input;
+    return [cmd]() {
+        system(cmd.c_str());
+    };
+}

tests/fixtures/real_world/cpp/cfg/lambda_capture.expect.json

@@ -0,0 +1,24 @@
+{
+  "description": "system() call inside lambda capturing user input by value",
+  "tags": [
+    "cmdi",
+    "cfg",
+    "lambda"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "cpp.cmdi.system",
+      "severity": null,
+      "must_match": true,
+      "line_range": [
+        6,
+        10
+      ],
+      "evidence_contains": [],
+      "notes": "system() called inside lambda with captured user-derived command string"
+    }
+  ]
+}

tests/fixtures/real_world/cpp/cfg/namespace_scope.cpp

@@ -0,0 +1,19 @@
+#include <cstdlib>
+#include <cstdio>
+
+namespace security {
+    void validate(const char *input) {
+        if (input == nullptr) return;
+    }
+}
+
+namespace execution {
+    void run(const char *cmd) {
+        system(cmd);
+    }
+}
+
+void handler(const char *user_input) {
+    security::validate(user_input);
+    execution::run(user_input);
+}

tests/fixtures/real_world/cpp/cfg/namespace_scope.expect.json

@@ -0,0 +1,35 @@
+{
+  "description": "system() in namespace \u2014 validation function does not actually sanitize input",
+  "tags": [
+    "cmdi",
+    "cfg",
+    "namespace"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "cpp.cmdi.system",
+      "severity": null,
+      "must_match": true,
+      "line_range": [
+        10,
+        14
+      ],
+      "evidence_contains": [],
+      "notes": "system(cmd) in execution::run \u2014 AST pattern detects system() call"
+    },
+    {
+      "rule_id": "taint-unsanitised-flow",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        15,
+        20
+      ],
+      "evidence_contains": [],
+      "notes": "user_input flows through validate (which only null-checks) to system \u2014 aspirational cross-function taint"
+    }
+  ]
+}

tests/fixtures/real_world/cpp/cfg/raii_vs_manual.cpp

@@ -0,0 +1,19 @@
+#include <fstream>
+#include <cstdio>
+#include <string>
+
+std::string read_raii(const char *path) {
+    std::ifstream file(path);
+    std::string content;
+    std::getline(file, content);
+    return content;
+    // RAII: ifstream destructor closes
+}
+
+std::string read_manual(const char *path) {
+    FILE *f = fopen(path, "r");
+    char buf[256];
+    fgets(buf, sizeof(buf), f);
+    // f not closed -- manual leak
+    return std::string(buf);
+}

tests/fixtures/real_world/cpp/cfg/raii_vs_manual.expect.json

@@ -0,0 +1,24 @@
+{
+  "description": "RAII ifstream vs manual FILE* \u2014 RAII auto-closes, manual version leaks",
+  "tags": [
+    "cfg",
+    "resource-leak",
+    "raii"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "cfg-resource-leak",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        12,
+        20
+      ],
+      "evidence_contains": [],
+      "notes": "fopen at line 14 never fclose'd in read_manual \u2014 aspirational CFG finding"
+    }
+  ]
+}

tests/fixtures/real_world/cpp/cfg/try_catch.cpp

@@ -0,0 +1,30 @@
+#include <cstdio>
+#include <stdexcept>
+
+void process_file(const char *path) {
+    FILE *f = fopen(path, "r");
+    try {
+        char buf[256];
+        if (fgets(buf, sizeof(buf), f) == NULL) {
+            throw std::runtime_error("read failed");
+        }
+        fclose(f);
+    } catch (...) {
+        // f leaked in catch
+        throw;
+    }
+}
+
+void process_safe(const char *path) {
+    FILE *f = fopen(path, "r");
+    try {
+        char buf[256];
+        if (fgets(buf, sizeof(buf), f) == NULL) {
+            fclose(f);
+            throw std::runtime_error("read failed");
+        }
+        fclose(f);
+    } catch (...) {
+        throw;
+    }
+}

tests/fixtures/real_world/cpp/cfg/try_catch.expect.json

@@ -0,0 +1,24 @@
+{
+  "description": "Resource leak in exception path: fopen not closed when exception thrown. Safe version closes before throw.",
+  "tags": [
+    "cfg",
+    "resource-leak",
+    "exception"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "cfg-resource-leak",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        3,
+        17
+      ],
+      "evidence_contains": [],
+      "notes": "fopen at line 5 leaked when exception thrown at line 9 \u2014 catch block re-throws without closing. Aspirational."
+    }
+  ]
+}