Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/api/client.ts

@@ -3,13 +3,57 @@ const CSRF_HEADER = 'X-Nyx-CSRF';
 let csrfTokenPromise: Promise<string> | null = null;
 
 export class ApiError extends Error {
+  /**
+   * Stable machine-readable code (matches backend `ApiError`'s `code` field).
+   * Falls back to a synthetic value when the response wasn't structured —
+   * `network` for fetch failures, `http_<status>` for plain-text responses.
+   */
+  public code: string;
+  public detail?: unknown;
+
   constructor(
-    public status: number,
+    status: number,
     message: string,
+    code?: string,
+    detail?: unknown,
   ) {
     super(message);
     this.name = 'ApiError';
+    this.status = status;
+    this.code = code ?? `http_${status}`;
+    this.detail = detail;
   }
+
+  public status: number;
+
+  /** True when the failure was a network/abort, not an HTTP response. */
+  isNetwork(): boolean {
+    return this.status === 0;
+  }
+}
+
+/** Build an ApiError from a non-OK Response, parsing a JSON error body if present. */
+async function errorFromResponse(res: Response): Promise<ApiError> {
+  const text = await res.text().catch(() => '');
+  if (text) {
+    try {
+      const parsed = JSON.parse(text) as {
+        error?: unknown;
+        code?: unknown;
+        detail?: unknown;
+      };
+      const msg =
+        typeof parsed.error === 'string' && parsed.error.length > 0
+          ? parsed.error
+          : res.statusText || `HTTP ${res.status}`;
+      const code = typeof parsed.code === 'string' ? parsed.code : undefined;
+      return new ApiError(res.status, msg, code, parsed.detail);
+    } catch {
+      // Plain-text body — use as-is.
+      return new ApiError(res.status, text);
+    }
+  }
+  return new ApiError(res.status, res.statusText || `HTTP ${res.status}`);
 }
 
 async function getCsrfToken(): Promise<string> {
@@ -17,10 +61,7 @@ async function getCsrfToken(): Promise<string> {
     csrfTokenPromise = fetch(`${BASE}/session`)
       .then(async (res) => {
         if (!res.ok) {
-          throw new ApiError(
-            res.status,
-            await res.text().catch(() => res.statusText),
-          );
+          throw await errorFromResponse(res);
         }
 
         const text = await res.text();
@@ -31,7 +72,7 @@ async function getCsrfToken(): Promise<string> {
           typeof payload.csrf_token !== 'string' ||
           payload.csrf_token.length === 0
         ) {
-          throw new ApiError(500, 'Missing CSRF token');
+          throw new ApiError(500, 'Missing CSRF token', 'missing_csrf_token');
         }
 
         return payload.csrf_token;
@@ -67,14 +108,23 @@ async function request<T>(path: string, opts: RequestInit = {}): Promise<T> {
   if (opts.body) {
     headers['Content-Type'] = 'application/json';
   }
-  const res = await fetch(url, {
-    ...rest,
-    headers,
-  });
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      ...rest,
+      headers,
+    });
+  } catch (err) {
+    if (err instanceof DOMException && err.name === 'AbortError') {
+      throw err;
+    }
+    const message =
+      err instanceof Error ? err.message : 'Network request failed';
+    throw new ApiError(0, message, 'network');
+  }
 
   if (!res.ok) {
-    const text = await res.text().catch(() => res.statusText);
-    throw new ApiError(res.status, text);
+    throw await errorFromResponse(res);
   }
 
   // Handle empty responses
@@ -99,6 +149,26 @@ export function apiPost<T>(
   });
 }
 
-export function apiDelete<T>(path: string, signal?: AbortSignal): Promise<T> {
-  return request<T>(path, { method: 'DELETE', signal });
+export function apiPut<T>(
+  path: string,
+  body?: unknown,
+  signal?: AbortSignal,
+): Promise<T> {
+  return request<T>(path, {
+    method: 'PUT',
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal,
+  });
+}
+
+export function apiDelete<T>(
+  path: string,
+  body?: unknown,
+  signal?: AbortSignal,
+): Promise<T> {
+  return request<T>(path, {
+    method: 'DELETE',
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal,
+  });
 }