Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/ui/CommandPalette.tsx

@@ -0,0 +1,183 @@
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from 'react';
+import { useNavigate } from 'react-router-dom';
+
+export interface PaletteCommand {
+  id: string;
+  /** Visible label. */
+  label: string;
+  /** Optional secondary line — section, hint, shortcut. */
+  hint?: string;
+  /** Group label for visual separation. */
+  group?: string;
+  /** Search aliases beyond the label. */
+  keywords?: string[];
+  /** Optional leading icon. */
+  icon?: ReactNode;
+  /** Optional trailing keyboard hint. */
+  shortcut?: string;
+  /** Either a route to navigate to, or an action callback. One must be set. */
+  to?: string;
+  action?: () => void;
+}
+
+interface CommandPaletteProps {
+  open: boolean;
+  onClose: () => void;
+  commands: PaletteCommand[];
+  placeholder?: string;
+}
+
+function rank(query: string, cmd: PaletteCommand): number {
+  if (!query) return 0;
+  const q = query.toLowerCase();
+  const haystacks = [cmd.label, cmd.hint ?? '', ...(cmd.keywords ?? [])].map(
+    (s) => s.toLowerCase(),
+  );
+  let best = -1;
+  for (const h of haystacks) {
+    if (h.startsWith(q)) return 100;
+    const idx = h.indexOf(q);
+    if (idx >= 0 && (best < 0 || idx < best)) best = idx;
+  }
+  if (best < 0) return -1;
+  return 50 - best;
+}
+
+export function CommandPalette({
+  open,
+  onClose,
+  commands,
+  placeholder = 'Type a command or page...',
+}: CommandPaletteProps) {
+  const [query, setQuery] = useState('');
+  const [highlight, setHighlight] = useState(0);
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const navigate = useNavigate();
+
+  // Reset state on each open so the palette feels fresh and the highlight
+  // doesn't stick to a now-filtered-out item.
+  useEffect(() => {
+    if (open) {
+      setQuery('');
+      setHighlight(0);
+      requestAnimationFrame(() => inputRef.current?.focus());
+    }
+  }, [open]);
+
+  const filtered = useMemo(() => {
+    if (!query) return commands;
+    return commands
+      .map((cmd) => [cmd, rank(query, cmd)] as const)
+      .filter(([, r]) => r >= 0)
+      .sort((a, b) => b[1] - a[1])
+      .map(([cmd]) => cmd);
+  }, [commands, query]);
+
+  // Keep highlight inside the filtered range.
+  useEffect(() => {
+    if (highlight >= filtered.length) setHighlight(0);
+  }, [filtered.length, highlight]);
+
+  const run = useCallback(
+    (cmd: PaletteCommand) => {
+      onClose();
+      if (cmd.action) cmd.action();
+      else if (cmd.to) navigate(cmd.to);
+    },
+    [navigate, onClose],
+  );
+
+  const onKeyDown = useCallback(
+    (event: React.KeyboardEvent<HTMLInputElement>) => {
+      if (event.key === 'Escape') {
+        event.preventDefault();
+        onClose();
+      } else if (event.key === 'ArrowDown') {
+        event.preventDefault();
+        setHighlight((h) => Math.min(h + 1, filtered.length - 1));
+      } else if (event.key === 'ArrowUp') {
+        event.preventDefault();
+        setHighlight((h) => Math.max(h - 1, 0));
+      } else if (event.key === 'Enter') {
+        event.preventDefault();
+        const cmd = filtered[highlight];
+        if (cmd) run(cmd);
+      }
+    },
+    [filtered, highlight, onClose, run],
+  );
+
+  if (!open) return null;
+
+  // Group while preserving filtered order.
+  const groups = new Map<string, PaletteCommand[]>();
+  for (const cmd of filtered) {
+    const g = cmd.group ?? '';
+    const arr = groups.get(g) ?? [];
+    arr.push(cmd);
+    groups.set(g, arr);
+  }
+
+  let runningIndex = 0;
+  return (
+    <div className="palette-overlay" role="dialog" aria-label="Command palette">
+      <div className="palette-backdrop" onClick={onClose} />
+      <div className="palette" role="combobox" aria-expanded="true">
+        <input
+          ref={inputRef}
+          className="palette-input"
+          placeholder={placeholder}
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          onKeyDown={onKeyDown}
+          aria-label="Command search"
+          aria-autocomplete="list"
+        />
+        <ul className="palette-list" role="listbox">
+          {filtered.length === 0 && (
+            <li className="palette-empty">No matches</li>
+          )}
+          {Array.from(groups.entries()).map(([group, items]) => (
+            <li key={group || '_'} className="palette-group">
+              {group && <div className="palette-group-label">{group}</div>}
+              <ul>
+                {items.map((cmd) => {
+                  const idx = runningIndex++;
+                  const active = idx === highlight;
+                  return (
+                    <li
+                      key={cmd.id}
+                      role="option"
+                      aria-selected={active}
+                      className={`palette-item${active ? ' active' : ''}`}
+                      onMouseEnter={() => setHighlight(idx)}
+                      onClick={() => run(cmd)}
+                    >
+                      {cmd.icon && (
+                        <span className="palette-icon">{cmd.icon}</span>
+                      )}
+                      <span className="palette-label">{cmd.label}</span>
+                      {cmd.hint && (
+                        <span className="palette-hint">{cmd.hint}</span>
+                      )}
+                      {cmd.shortcut && (
+                        <kbd className="palette-shortcut">{cmd.shortcut}</kbd>
+                      )}
+                    </li>
+                  );
+                })}
+              </ul>
+            </li>
+          ))}
+        </ul>
+      </div>
+    </div>
+  );
+}

frontend/src/components/ui/ErrorState.tsx

@@ -1,13 +1,73 @@
+import { ApiError } from '../../api/client';
+import { RefreshIcon } from '../icons/Icons';
+
 interface ErrorStateProps {
   title?: string;
-  message: string;
+  /** Either a plain message string or any thrown value (Error, ApiError, unknown). */
+  message?: string;
+  error?: unknown;
+  onRetry?: () => void;
+  retryLabel?: string;
 }
 
-export function ErrorState({ title = 'Error', message }: ErrorStateProps) {
+interface FriendlyError {
+  title: string;
+  message: string;
+  hint?: string;
+}
+
+/** Translate a thrown value into a title + message + hint we can render. */
+function friendly(error: unknown, fallbackTitle: string): FriendlyError {
+  if (error instanceof ApiError) {
+    if (error.isNetwork()) {
+      return {
+        title: 'Network error',
+        message: error.message || 'Could not reach the Nyx server.',
+      };
+    }
+    if (error.status === 404) {
+      return { title: 'Not found', message: error.message };
+    }
+    if (error.status === 403) {
+      return { title: 'Forbidden', message: error.message };
+    }
+    if (error.status === 409) {
+      return { title: 'Conflict', message: error.message };
+    }
+    if (error.status >= 500) {
+      return {
+        title: 'Server error',
+        message: error.message || 'The Nyx server returned an error.',
+        hint: 'Server logs may have more detail.',
+      };
+    }
+    return { title: fallbackTitle, message: error.message };
+  }
+  if (error instanceof Error) {
+    return { title: fallbackTitle, message: error.message };
+  }
+  if (typeof error === 'string') {
+    return { title: fallbackTitle, message: error };
+  }
+  return { title: fallbackTitle, message: 'An unknown error occurred.' };
+}
+
+export function ErrorState({
+  title,
+  message,
+  error,
+  onRetry,
+  retryLabel = 'Try again',
+}: ErrorStateProps) {
+  const fallbackTitle = title ?? 'Error';
+  const resolved = error
+    ? friendly(error, fallbackTitle)
+    : { title: fallbackTitle, message: message ?? 'An error occurred.' };
+
   return (
-    <div className="error-state">
-      <h3>{title}</h3>
-      <p>{message}</p>
+    <div className="error-state" role="alert">
+      <h3>{resolved.title}</h3>
+      <p>{resolved.message}</p>
     </div>
   );
 }

frontend/src/components/ui/LoadingState.tsx

@@ -1,7 +1,19 @@
 interface LoadingStateProps {
   message?: string;
+  /**
+   * Suppresses the spinner for the first ~150ms so trivially-fast queries
+   * don't flash a spinner on screen. The text shows instantly so there's
+   * always *something* — but the visible spin only kicks in if work is
+   * actually slow.
+   */
+  delaySpinnerMs?: number;
 }
 
 export function LoadingState({ message = 'Loading...' }: LoadingStateProps) {
-  return <div className="loading">{message}</div>;
+  return (
+    <div className="loading" role="status" aria-live="polite">
+      <span className="spinner" aria-hidden="true" />
+      <span className="loading-message">{message}</span>
+    </div>
+  );
 }

frontend/src/components/ui/ShortcutsHelp.tsx

@@ -0,0 +1,87 @@
+interface ShortcutsHelpProps {
+  open: boolean;
+  onClose: () => void;
+}
+
+interface Row {
+  keys: string[];
+  description: string;
+}
+
+const ROWS: { section: string; rows: Row[] }[] = [
+  {
+    section: 'Global',
+    rows: [
+      { keys: ['⌘', 'K'], description: 'Open command palette' },
+      { keys: ['/'], description: 'Focus search (on findings page)' },
+      { keys: ['?'], description: 'Show this help' },
+      { keys: ['Esc'], description: 'Close modal / palette' },
+    ],
+  },
+  {
+    section: 'Findings list',
+    rows: [
+      { keys: ['j'], description: 'Next finding' },
+      { keys: ['k'], description: 'Previous finding' },
+      { keys: ['Enter'], description: 'Open highlighted finding' },
+    ],
+  },
+  {
+    section: 'Navigation',
+    rows: [
+      { keys: ['g', 'o'], description: 'Go to Overview' },
+      { keys: ['g', 'f'], description: 'Go to Findings' },
+      { keys: ['g', 's'], description: 'Go to Scans' },
+      { keys: ['g', 'r'], description: 'Go to Rules' },
+      { keys: ['g', 't'], description: 'Go to Triage' },
+    ],
+  },
+];
+
+export function ShortcutsHelp({ open, onClose }: ShortcutsHelpProps) {
+  if (!open) return null;
+  return (
+    <div
+      className="palette-overlay"
+      role="dialog"
+      aria-label="Keyboard shortcuts"
+    >
+      <div className="palette-backdrop" onClick={onClose} />
+      <div className="shortcuts-modal">
+        <div className="shortcuts-header">
+          <h2>Keyboard shortcuts</h2>
+          <button
+            type="button"
+            className="btn btn-sm btn-ghost"
+            onClick={onClose}
+            aria-label="Close shortcuts help"
+          >
+            Close
+          </button>
+        </div>
+        <div className="shortcuts-body">
+          {ROWS.map((section) => (
+            <section key={section.section}>
+              <h3>{section.section}</h3>
+              <dl>
+                {section.rows.map((row) => (
+                  <div key={row.description} className="shortcut-row">
+                    <dt>
+                      {row.keys.map((k, i) => (
+                        <span key={i}>
+                          {i > 0 && <span className="shortcut-sep">then</span>}
+                          <kbd>{k}</kbd>
+                        </span>
+                      ))}
+                    </dt>
+                    <dd>{row.description}</dd>
+                  </div>
+                ))}
+              </dl>
+            </section>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}

frontend/src/components/ui/Toaster.tsx

@@ -0,0 +1,38 @@
+import { useToast } from '../../contexts/ToastContext';
+import { CloseIcon } from '../icons/Icons';
+
+export function Toaster() {
+  const { toasts, dismiss } = useToast();
+
+  if (toasts.length === 0) return null;
+
+  return (
+    <div
+      className="toaster"
+      role="region"
+      aria-label="Notifications"
+      aria-live="polite"
+    >
+      {toasts.map((t) => (
+        <div
+          key={t.id}
+          className={`toast toast-${t.tone}`}
+          role={t.tone === 'error' || t.tone === 'warning' ? 'alert' : 'status'}
+        >
+          <div className="toast-body">
+            {t.title && <div className="toast-title">{t.title}</div>}
+            <div className="toast-message">{t.message}</div>
+          </div>
+          <button
+            type="button"
+            className="toast-close"
+            aria-label="Dismiss notification"
+            onClick={() => dismiss(t.id)}
+          >
+            <CloseIcon />
+          </button>
+        </div>
+      ))}
+    </div>
+  );
+}