Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/hooks/useChordNavigation.ts

@@ -0,0 +1,62 @@
+import { useEffect, useRef } from 'react';
+import { useNavigate } from 'react-router-dom';
+
+const CHORD_TIMEOUT_MS = 800;
+
+const ROUTES: Record<string, string> = {
+  o: '/',
+  f: '/findings',
+  s: '/scans',
+  r: '/rules',
+  t: '/triage',
+  c: '/config',
+  e: '/explorer',
+  d: '/debug',
+};
+
+function isTypingTarget(target: EventTarget | null): boolean {
+  if (!(target instanceof HTMLElement)) return false;
+  const tag = target.tagName;
+  if (tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT') return true;
+  if (target.isContentEditable) return true;
+  return false;
+}
+
+/**
+ * Vim-style "g then X" navigation: press `g`, then within 800ms press a
+ * letter to jump to that section. Cancels if the user types in an input.
+ */
+export function useChordNavigation() {
+  const navigate = useNavigate();
+  const armed = useRef<number | null>(null);
+
+  useEffect(() => {
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (isTypingTarget(event.target)) return;
+      if (event.metaKey || event.ctrlKey || event.altKey) return;
+
+      if (armed.current !== null) {
+        const route = ROUTES[event.key.toLowerCase()];
+        window.clearTimeout(armed.current);
+        armed.current = null;
+        if (route) {
+          event.preventDefault();
+          navigate(route);
+        }
+        return;
+      }
+
+      if (event.key === 'g') {
+        event.preventDefault();
+        armed.current = window.setTimeout(() => {
+          armed.current = null;
+        }, CHORD_TIMEOUT_MS);
+      }
+    };
+    document.addEventListener('keydown', onKeyDown);
+    return () => {
+      document.removeEventListener('keydown', onKeyDown);
+      if (armed.current !== null) window.clearTimeout(armed.current);
+    };
+  }, [navigate]);
+}

frontend/src/hooks/useFindingsURLState.ts

@@ -1,5 +1,6 @@
-import { useCallback, useMemo } from 'react';
+import { useCallback, useEffect, useMemo } from 'react';
 import { useSearchParams } from 'react-router-dom';
+import { usePersistedState } from './usePersistedState';
 
 export interface FindingsURLState {
   page: string;
@@ -29,6 +30,21 @@ const FINDINGS_DEFAULTS: FindingsURLState = {
   search: '',
 };
 
+/** Subset of state we remember across sessions. Filters intentionally are
+ * NOT persisted — they're scan-specific and should reset by default, but the
+ * URL still reflects them so a shared link reproduces them exactly. */
+interface PersistedFindingsPrefs {
+  per_page: string;
+  sort_by: string;
+  sort_dir: string;
+}
+
+const DEFAULT_PREFS: PersistedFindingsPrefs = {
+  per_page: '50',
+  sort_by: '',
+  sort_dir: 'asc',
+};
+
 const FILTER_KEYS: ReadonlySet<string> = new Set([
   'severity',
   'category',
@@ -49,16 +65,42 @@ const NON_RESET_KEYS: ReadonlySet<string> = new Set([
 
 export function useFindingsURLState() {
   const [searchParams, setSearchParams] = useSearchParams();
+  const [prefs, setPrefs] = usePersistedState<PersistedFindingsPrefs>(
+    'findings:prefs',
+    DEFAULT_PREFS,
+  );
 
   const state: FindingsURLState = useMemo(() => {
     const s = {} as FindingsURLState;
     for (const key of Object.keys(
       FINDINGS_DEFAULTS,
     ) as (keyof FindingsURLState)[]) {
-      s[key] = searchParams.get(key) || FINDINGS_DEFAULTS[key];
+      // URL wins; fall back to remembered prefs for keys we persist;
+      // last resort is the global default.
+      const fromUrl = searchParams.get(key);
+      if (fromUrl) {
+        s[key] = fromUrl;
+      } else if (
+        key === 'per_page' ||
+        key === 'sort_by' ||
+        key === 'sort_dir'
+      ) {
+        s[key] = prefs[key] || FINDINGS_DEFAULTS[key];
+      } else {
+        s[key] = FINDINGS_DEFAULTS[key];
+      }
     }
     return s;
-  }, [searchParams]);
+  }, [searchParams, prefs]);
+
+  // Persist user-driven changes to per_page / sort_*.
+  useEffect(() => {
+    setPrefs({
+      per_page: state.per_page,
+      sort_by: state.sort_by,
+      sort_dir: state.sort_dir,
+    });
+  }, [state.per_page, state.sort_by, state.sort_dir, setPrefs]);
 
   const updateState = useCallback(
     (updates: Partial<FindingsURLState>) => {

frontend/src/hooks/useKeyboardShortcuts.ts

@@ -0,0 +1,63 @@
+import { useEffect } from 'react';
+
+export interface Shortcut {
+  /** Key string per `KeyboardEvent.key` (e.g. "k", "/", "Escape"). */
+  key: string;
+  /** Require Cmd/Ctrl (matches the same on each OS). */
+  meta?: boolean;
+  /** Require Shift. */
+  shift?: boolean;
+  /** Require Alt. */
+  alt?: boolean;
+  description: string;
+  handler: (event: KeyboardEvent) => void;
+  /**
+   * If true, the shortcut still fires when focus is in an input/textarea/
+   * contenteditable. Default is false — shortcuts shouldn't hijack typing.
+   */
+  allowInInput?: boolean;
+}
+
+function isTypingTarget(target: EventTarget | null): boolean {
+  if (!(target instanceof HTMLElement)) return false;
+  const tag = target.tagName;
+  if (tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT') return true;
+  if (target.isContentEditable) return true;
+  return false;
+}
+
+function matches(event: KeyboardEvent, shortcut: Shortcut): boolean {
+  if (event.key !== shortcut.key) return false;
+  const wantMeta = !!shortcut.meta;
+  const hasMeta = event.metaKey || event.ctrlKey;
+  if (wantMeta !== hasMeta) return false;
+  if (!!shortcut.shift !== event.shiftKey) return false;
+  if (!!shortcut.alt !== event.altKey) return false;
+  return true;
+}
+
+/**
+ * Register a list of keyboard shortcuts at the document level.
+ *
+ * Pass a stable array (memoize or hoist outside the component) to avoid
+ * unnecessary re-binding. Shortcuts with `meta: true` match either Cmd or
+ * Ctrl so the same binding works on macOS and Linux/Windows.
+ */
+export function useKeyboardShortcuts(shortcuts: Shortcut[]) {
+  useEffect(() => {
+    if (shortcuts.length === 0) return;
+    const onKeyDown = (event: KeyboardEvent) => {
+      const typing = isTypingTarget(event.target);
+      for (const sc of shortcuts) {
+        if (typing && !sc.allowInInput) continue;
+        if (matches(event, sc)) {
+          event.preventDefault();
+          sc.handler(event);
+          return;
+        }
+      }
+    };
+    document.addEventListener('keydown', onKeyDown);
+    return () => document.removeEventListener('keydown', onKeyDown);
+  }, [shortcuts]);
+}

frontend/src/hooks/usePageTitle.ts

@@ -0,0 +1,19 @@
+import { useEffect } from 'react';
+
+const APP_NAME = 'Nyx';
+
+/**
+ * Sets `document.title` to `<page> · Nyx`. Restores the previous title on
+ * unmount so transient pages (e.g. modals that re-render the page) don't
+ * leave the title stuck.
+ */
+export function usePageTitle(title: string | null | undefined) {
+  useEffect(() => {
+    if (!title) return;
+    const prev = document.title;
+    document.title = `${title} · ${APP_NAME}`;
+    return () => {
+      document.title = prev;
+    };
+  }, [title]);
+}

frontend/src/hooks/usePersistedState.ts

@@ -0,0 +1,59 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+const STORAGE_PREFIX = 'nyx:';
+
+function storageKey(key: string) {
+  return `${STORAGE_PREFIX}${key}`;
+}
+
+function read<T>(key: string, fallback: T): T {
+  try {
+    const raw = window.localStorage.getItem(storageKey(key));
+    if (raw === null) return fallback;
+    return JSON.parse(raw) as T;
+  } catch {
+    return fallback;
+  }
+}
+
+function write<T>(key: string, value: T): void {
+  try {
+    window.localStorage.setItem(storageKey(key), JSON.stringify(value));
+  } catch {
+    // Quota exceeded or storage disabled — silently degrade.
+  }
+}
+
+/**
+ * `useState` that persists to `localStorage` under `nyx:<key>`.
+ *
+ * Suitable for view preferences (theme, sidebar collapse, default page size).
+ * Not suitable for sensitive data — `localStorage` is not encrypted.
+ *
+ * Cross-tab sync is not implemented; if the user opens two tabs they get
+ * independent state until next load. That's the common-case ergonomic.
+ */
+export function usePersistedState<T>(
+  key: string,
+  initial: T,
+): [T, (next: T | ((prev: T) => T)) => void] {
+  const [state, setState] = useState<T>(() => read(key, initial));
+
+  // Avoid writing back the initial value on first mount when nothing changed.
+  const hydrated = useRef(false);
+  useEffect(() => {
+    if (!hydrated.current) {
+      hydrated.current = true;
+      return;
+    }
+    write(key, state);
+  }, [key, state]);
+
+  const set = useCallback((next: T | ((prev: T) => T)) => {
+    setState((prev) =>
+      typeof next === 'function' ? (next as (p: T) => T)(prev) : next,
+    );
+  }, []);
+
+  return [state, set];
+}