Phase 1 (#33)

* chore: Exclude CLAUDE.md from Cargo.toml

* feat: add callgraph module and integrate into main analysis flow

* feat: enhance CLI with new severity filtering and analysis modes

* feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling

* feat: implement state-model dataflow analysis for resource lifecycle and auth state

* feat: enhance diagnostic output formatting and add evidence structure

* feat: implement attack surface ranking for diagnostics with scoring and sorting

* feat: add comprehensive documentation for installation, usage, and rules reference

* feat: add multiple language support for command execution and evaluation endpoints

* feat: implement inline suppression for findings using `nyx:ignore` comments

* feat: add confidence levels to AST patterns and update output structure

* feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets

* feat: bump version to 0.4.0 and update changelog with new features and improvements

* feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs

tests/fixtures/real_world/java/state/branch_close.expect.json

@@ -0,0 +1,23 @@
+{
+  "description": "FileInputStream closed only in one branch of conditionalClose; both branches close in bothBranchesClose",
+  "tags": [
+    "state",
+    "resource-leak"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "state-resource-leak-possible",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        3,
+        13
+      ],
+      "evidence_contains": [],
+      "notes": "fis only closed inside if(flag) \u2014 leaked when flag is false"
+    }
+  ]
+}

tests/fixtures/real_world/java/state/branch_close.java

@@ -0,0 +1,24 @@
+import java.io.*;
+
+public class BranchClose {
+    public void conditionalClose(String path, boolean flag) throws IOException {
+        FileInputStream fis = new FileInputStream(path);
+        if (flag) {
+            byte[] data = new byte[1024];
+            fis.read(data);
+            fis.close();
+        }
+        // fis leaked if !flag
+    }
+
+    public void bothBranchesClose(String path, boolean flag) throws IOException {
+        FileInputStream fis = new FileInputStream(path);
+        if (flag) {
+            byte[] data = new byte[1024];
+            fis.read(data);
+            fis.close();
+        } else {
+            fis.close();
+        }
+    }
+}

tests/fixtures/real_world/java/state/connection_lifecycle.expect.json

@@ -0,0 +1,24 @@
+{
+  "description": "Database connection and statement opened but never closed in queryAndLeak; properly nested finally in queryAndClose",
+  "tags": [
+    "state",
+    "resource-leak",
+    "database"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "state-resource-leak",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        3,
+        10
+      ],
+      "evidence_contains": [],
+      "notes": "Connection and Statement opened but never closed in queryAndLeak"
+    }
+  ]
+}

tests/fixtures/real_world/java/state/connection_lifecycle.java

@@ -0,0 +1,24 @@
+import java.sql.*;
+
+public class DatabaseManager {
+    public void queryAndLeak(String url) throws SQLException {
+        Connection conn = DriverManager.getConnection(url);
+        Statement stmt = conn.createStatement();
+        stmt.executeQuery("SELECT 1");
+        // conn and stmt never closed
+    }
+
+    public void queryAndClose(String url) throws SQLException {
+        Connection conn = DriverManager.getConnection(url);
+        try {
+            Statement stmt = conn.createStatement();
+            try {
+                stmt.executeQuery("SELECT 1");
+            } finally {
+                stmt.close();
+            }
+        } finally {
+            conn.close();
+        }
+    }
+}

tests/fixtures/real_world/java/state/double_close.expect.json

@@ -0,0 +1,35 @@
+{
+  "description": "Double close of FileInputStream and use-after-close read operation",
+  "tags": [
+    "state",
+    "double-close",
+    "use-after-close"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "state-double-close",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        3,
+        9
+      ],
+      "evidence_contains": [],
+      "notes": "fis.close() called twice on lines 6 and 7"
+    },
+    {
+      "rule_id": "state-use-after-close",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        9,
+        16
+      ],
+      "evidence_contains": [],
+      "notes": "fis.read(data) on line 14 after fis.close() on line 12"
+    }
+  ]
+}

tests/fixtures/real_world/java/state/double_close.java

@@ -0,0 +1,16 @@
+import java.io.*;
+
+public class DoubleClose {
+    public void doubleCloseStream(String path) throws IOException {
+        FileInputStream fis = new FileInputStream(path);
+        fis.close();
+        fis.close();
+    }
+
+    public void useAfterClose(String path) throws IOException {
+        FileInputStream fis = new FileInputStream(path);
+        fis.close();
+        byte[] data = new byte[1024];
+        fis.read(data);
+    }
+}

tests/fixtures/real_world/java/state/stream_lifecycle.expect.json

@@ -0,0 +1,23 @@
+{
+  "description": "FileInputStream opened and never closed in readAndLeak; properly closed via finally in readAndClose",
+  "tags": [
+    "state",
+    "resource-leak"
+  ],
+  "modes": [
+    "full"
+  ],
+  "expected": [
+    {
+      "rule_id": "state-resource-leak",
+      "severity": null,
+      "must_match": false,
+      "line_range": [
+        3,
+        11
+      ],
+      "evidence_contains": [],
+      "notes": "FileInputStream fis opened on line 5 and never closed before return on line 8"
+    }
+  ]
+}

tests/fixtures/real_world/java/state/stream_lifecycle.java

@@ -0,0 +1,22 @@
+import java.io.*;
+
+public class StreamManager {
+    public String readAndLeak(String path) throws IOException {
+        FileInputStream fis = new FileInputStream(path);
+        byte[] data = new byte[1024];
+        fis.read(data);
+        return new String(data);
+        // fis never closed
+    }
+
+    public String readAndClose(String path) throws IOException {
+        FileInputStream fis = new FileInputStream(path);
+        try {
+            byte[] data = new byte[1024];
+            fis.read(data);
+            return new String(data);
+        } finally {
+            fis.close();
+        }
+    }
+}