Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/pages/debug/AuthAnalysisPage.tsx

@@ -0,0 +1,309 @@
+import { useDebugAuth } from '../../api/queries/debug';
+import { ApiError } from '../../api/client';
+import { EmptyState } from '../../components/ui/EmptyState';
+import { ErrorState } from '../../components/ui/ErrorState';
+import { LoadingState } from '../../components/ui/LoadingState';
+import type {
+  AuthAnalysisView,
+  AuthCheckView,
+  AuthOperationView,
+  AuthRouteView,
+  AuthUnitView,
+  AuthValueRefView,
+} from '../../api/types';
+
+interface AuthAnalysisPanelProps {
+  file: string;
+}
+
+export function AuthAnalysisPanel({ file }: AuthAnalysisPanelProps) {
+  const { data, isLoading, error } = useDebugAuth(file);
+
+  if (isLoading) {
+    return <LoadingState message="Running authorization extraction..." />;
+  }
+  if (error) {
+    if (error instanceof ApiError && error.status === 400) {
+      return (
+        <EmptyState message="Auth analysis only runs on supported source files. Try a .ts / .py / .rb / .rs / .go / .java / .php file." />
+      );
+    }
+    return <ErrorState message="Failed to run authorization extraction." />;
+  }
+  if (!data) {
+    return null;
+  }
+
+  if (!data.enabled) {
+    return (
+      <EmptyState message="Authorization analysis is disabled for this file's language. Toggle scanner.auth_analysis.enable in your nyx.toml to opt in." />
+    );
+  }
+
+  if (data.routes.length === 0 && data.units.length === 0) {
+    return (
+      <EmptyState message="No routes or analysis units were extracted from this file. Auth analysis fires on framework route handlers and helper functions whose body matches an authorization-check pattern." />
+    );
+  }
+
+  return (
+    <div className="abstract-interp-viewer">
+      <AuthSummaryHeader data={data} />
+      {data.routes.length > 0 && <AuthRoutesBlock routes={data.routes} />}
+      {data.units.length > 0 && <AuthUnitsBlock units={data.units} />}
+    </div>
+  );
+}
+
+function AuthSummaryHeader({ data }: { data: AuthAnalysisView }) {
+  const totalChecks = data.units.reduce(
+    (acc, u) => acc + u.auth_checks.length,
+    0,
+  );
+  const totalOps = data.units.reduce((acc, u) => acc + u.operations.length, 0);
+  return (
+    <div className="abstract-block">
+      <div className="abstract-block-header">
+        <h3 style={{ margin: 0 }}>Authorization Model</h3>
+        <span className="text-secondary">
+          {data.routes.length} route{data.routes.length === 1 ? '' : 's'} ·{' '}
+          {data.units.length} unit{data.units.length === 1 ? '' : 's'} ·{' '}
+          {totalChecks} auth check{totalChecks === 1 ? '' : 's'} · {totalOps}{' '}
+          sensitive op{totalOps === 1 ? '' : 's'}
+        </span>
+      </div>
+    </div>
+  );
+}
+
+function AuthRoutesBlock({ routes }: { routes: AuthRouteView[] }) {
+  return (
+    <div className="abstract-block">
+      <div className="abstract-block-header">
+        <h3 style={{ margin: 0 }}>Routes</h3>
+        <span className="text-secondary">
+          {routes.length} registration{routes.length === 1 ? '' : 's'}
+        </span>
+      </div>
+      <table className="abstract-table">
+        <thead>
+          <tr>
+            <th>Method</th>
+            <th>Path</th>
+            <th>Framework</th>
+            <th>Middleware</th>
+            <th>Handler Params</th>
+            <th>Line</th>
+            <th>Unit</th>
+          </tr>
+        </thead>
+        <tbody>
+          {routes.map((r, i) => (
+            <tr key={`${r.method}-${r.path}-${i}`}>
+              <td>
+                <span className="cap-badge cap-badge-source">{r.method}</span>
+              </td>
+              <td className="mono">{r.path}</td>
+              <td>{r.framework}</td>
+              <td className="mono">
+                {r.middleware.length > 0 ? r.middleware.join(', ') : '-'}
+              </td>
+              <td className="mono">
+                {r.handler_params.length > 0
+                  ? r.handler_params.join(', ')
+                  : '-'}
+              </td>
+              <td className="mono">L{r.line}</td>
+              <td className="mono">#{r.unit_idx}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+function AuthUnitsBlock({ units }: { units: AuthUnitView[] }) {
+  return (
+    <>
+      {units.map((u, i) => (
+        <AuthUnitCard key={`${u.name ?? '<anon>'}-${i}`} unit={u} index={i} />
+      ))}
+    </>
+  );
+}
+
+function AuthUnitCard({ unit, index }: { unit: AuthUnitView; index: number }) {
+  const hasDetails =
+    unit.params.length > 0 ||
+    unit.self_actor_vars.length > 0 ||
+    unit.typed_bounded_vars.length > 0 ||
+    unit.authorized_sql_vars.length > 0 ||
+    unit.const_bound_vars.length > 0;
+
+  return (
+    <div className="abstract-block">
+      <div className="abstract-block-header">
+        <h3 style={{ margin: 0 }}>
+          #{index} {unit.name ?? '<anonymous>'}
+          <span className="text-secondary" style={{ marginLeft: 8 }}>
+            {unit.kind} · L{unit.line}
+          </span>
+        </h3>
+        <span className="text-secondary">
+          {unit.auth_checks.length} check
+          {unit.auth_checks.length === 1 ? '' : 's'} · {unit.operations.length}{' '}
+          op
+          {unit.operations.length === 1 ? '' : 's'}
+        </span>
+      </div>
+      {hasDetails && (
+        <div className="auth-detail-list">
+          {unit.params.length > 0 && (
+            <DetailRow label="Params" value={unit.params.join(', ')} />
+          )}
+          {unit.self_actor_vars.length > 0 && (
+            <DetailRow
+              label="Self-actor vars"
+              value={unit.self_actor_vars.join(', ')}
+            />
+          )}
+          {unit.typed_bounded_vars.length > 0 && (
+            <DetailRow
+              label="Typed-bounded params"
+              value={unit.typed_bounded_vars.join(', ')}
+            />
+          )}
+          {unit.authorized_sql_vars.length > 0 && (
+            <DetailRow
+              label="Authorized SQL vars"
+              value={unit.authorized_sql_vars.join(', ')}
+            />
+          )}
+          {unit.const_bound_vars.length > 0 && (
+            <DetailRow
+              label="Const-bound vars"
+              value={unit.const_bound_vars.join(', ')}
+            />
+          )}
+        </div>
+      )}
+
+      {unit.auth_checks.length > 0 && (
+        <AuthCheckTable checks={unit.auth_checks} />
+      )}
+      {unit.operations.length > 0 && (
+        <OperationTable operations={unit.operations} />
+      )}
+    </div>
+  );
+}
+
+function DetailRow({ label, value }: { label: string; value: string }) {
+  return (
+    <div className="auth-detail-row">
+      <span className="auth-detail-label">{label}</span>
+      <span className="auth-detail-value mono">{value}</span>
+    </div>
+  );
+}
+
+function AuthCheckTable({ checks }: { checks: AuthCheckView[] }) {
+  return (
+    <div className="auth-subsection">
+      <div className="auth-subsection-title">Auth Checks</div>
+      <table className="abstract-table">
+        <thead>
+          <tr>
+            <th>Kind</th>
+            <th>Callee</th>
+            <th>Subjects</th>
+            <th>Line</th>
+          </tr>
+        </thead>
+        <tbody>
+          {checks.map((c, i) => (
+            <tr key={`${c.callee}-${c.line}-${i}`}>
+              <td>
+                <span className="cap-badge cap-badge-source">{c.kind}</span>
+              </td>
+              <td className="mono">{c.callee}</td>
+              <td>
+                {c.subjects.length === 0 ? (
+                  '-'
+                ) : (
+                  <SubjectChips subjects={c.subjects} />
+                )}
+              </td>
+              <td className="mono">L{c.line}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+function OperationTable({ operations }: { operations: AuthOperationView[] }) {
+  return (
+    <div className="auth-subsection">
+      <div className="auth-subsection-title">Sensitive Operations</div>
+      <table className="abstract-table">
+        <thead>
+          <tr>
+            <th>Kind</th>
+            <th>Sink Class</th>
+            <th>Callee</th>
+            <th>Subjects</th>
+            <th>Line</th>
+          </tr>
+        </thead>
+        <tbody>
+          {operations.map((op, i) => (
+            <tr key={`${op.callee}-${op.line}-${i}`}>
+              <td>
+                <span className="cap-badge cap-badge-sanitizer">{op.kind}</span>
+              </td>
+              <td>
+                {op.sink_class ? (
+                  <span className="cap-badge cap-badge-sink">
+                    {op.sink_class}
+                  </span>
+                ) : (
+                  '-'
+                )}
+              </td>
+              <td className="mono" title={op.text}>
+                {op.callee}
+              </td>
+              <td>
+                {op.subjects.length === 0 ? (
+                  '-'
+                ) : (
+                  <SubjectChips subjects={op.subjects} />
+                )}
+              </td>
+              <td className="mono">L{op.line}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+function SubjectChips({ subjects }: { subjects: AuthValueRefView[] }) {
+  return (
+    <div className="auth-subject-chips">
+      {subjects.map((s, i) => (
+        <span
+          key={`${s.name}-${i}`}
+          className="cap-badge"
+          title={`${s.source_kind}${s.base ? ` (base: ${s.base})` : ''}`}
+        >
+          {s.name}
+        </span>
+      ))}
+    </div>
+  );
+}

frontend/src/pages/debug/FunctionSelector.tsx

@@ -1,3 +1,4 @@
+import { useMemo, useState } from 'react';
 import { useDebugFunctions } from '../../api/queries/debug';
 import type { FunctionInfo } from '../../api/types';
 
@@ -15,9 +16,24 @@ export function FunctionSelector({
   showFilePath = true,
 }: Props) {
   const { data: functions, isLoading } = useDebugFunctions(file || null);
+  const [showClosures, setShowClosures] = useState(false);
+
+  const closureCount = useMemo(
+    () => functions?.filter((fn) => fn.func_kind === 'closure').length ?? 0,
+    [functions],
+  );
+
+  const visible = useMemo(() => {
+    if (!functions) return functions;
+    return showClosures
+      ? functions
+      : functions.filter((fn) => fn.func_kind !== 'closure');
+  }, [functions, showClosures]);
 
   return (
-    <div className="function-selector">
+    <div
+      className={`function-selector${showFilePath ? '' : ' function-selector-flat'}`}
+    >
       {showFilePath && (
         <div className="function-selector-path">
           <span className="function-selector-path-label">File:</span>
@@ -31,19 +47,19 @@ export function FunctionSelector({
         <select
           value={selectedFunction ?? ''}
           onChange={(e) => onFunctionChange(e.target.value || null)}
-          disabled={!functions || functions.length === 0}
+          disabled={!visible || visible.length === 0}
           className="function-selector-select"
         >
           <option value="">
             {isLoading
               ? 'Loading...'
-              : !functions || functions.length === 0
+              : !visible || visible.length === 0
                 ? 'No functions found'
                 : 'Select function'}
           </option>
-          {functions?.map((fn: FunctionInfo) => (
+          {visible?.map((fn: FunctionInfo) => (
             <option key={fn.name} value={fn.name}>
-              {fn.name}({fn.param_count} params) — L{fn.line}
+              {formatFunctionLabel(fn)}
               {fn.source_caps.length > 0 &&
                 ` [src: ${fn.source_caps.join(',')}]`}
               {fn.sink_caps.length > 0 && ` [sink: ${fn.sink_caps.join(',')}]`}
@@ -51,6 +67,30 @@ export function FunctionSelector({
           ))}
         </select>
       </div>
+      {closureCount > 0 && (
+        <label className="function-selector-toggle">
+          <input
+            type="checkbox"
+            checked={showClosures}
+            onChange={(e) => setShowClosures(e.target.checked)}
+          />
+          <span>
+            Show {closureCount} anonymous closure
+            {closureCount === 1 ? '' : 's'}
+          </span>
+        </label>
+      )}
     </div>
   );
 }
+
+function formatFunctionLabel(fn: FunctionInfo): string {
+  const sig = `(${fn.param_count} params) — L${fn.line}`;
+  if (fn.func_kind === 'closure' && fn.container) {
+    return `${fn.name} [closure in ${fn.container}] ${sig}`;
+  }
+  if (fn.func_kind === 'closure') {
+    return `${fn.name} [closure] ${sig}`;
+  }
+  return `${fn.name}${sig}`;
+}

frontend/src/pages/debug/PointerViewerPage.tsx

@@ -0,0 +1,200 @@
+import { useMemo } from 'react';
+import { useDebugPointer } from '../../api/queries/debug';
+import { ApiError } from '../../api/client';
+import { EmptyState } from '../../components/ui/EmptyState';
+import { ErrorState } from '../../components/ui/ErrorState';
+import { LoadingState } from '../../components/ui/LoadingState';
+import type {
+  PointerLocationView,
+  PointerValueView,
+  PointerFieldEntryView,
+} from '../../api/types';
+
+interface PointerAnalysisPanelProps {
+  file: string;
+  functionName: string;
+}
+
+export function PointerAnalysisPanel({
+  file,
+  functionName,
+}: PointerAnalysisPanelProps) {
+  const { data, isLoading, error } = useDebugPointer(file, functionName);
+
+  if (isLoading) {
+    return <LoadingState message="Loading points-to facts..." />;
+  }
+  if (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      return (
+        <EmptyState message="Pointer analysis is not available for the selected function." />
+      );
+    }
+    return <ErrorState message="Failed to load pointer analysis." />;
+  }
+  if (
+    !data ||
+    (data.values.length === 0 &&
+      data.field_reads.length === 0 &&
+      data.field_writes.length === 0)
+  ) {
+    return (
+      <EmptyState message="No points-to facts were derived for this function. Pointer analysis flags up parameters, allocation sites, and field projections; functions that only manipulate scalars will appear empty." />
+    );
+  }
+
+  return (
+    <div className="abstract-interp-viewer">
+      <div className="abstract-block">
+        <div className="abstract-block-header">
+          <h3 style={{ margin: 0 }}>Per-Value Points-To</h3>
+          <span className="text-secondary">
+            {data.values.length} value
+            {data.values.length === 1 ? '' : 's'} · {data.location_count}{' '}
+            location
+            {data.location_count === 1 ? '' : 's'}
+          </span>
+        </div>
+        {data.values.length === 0 ? (
+          <p className="abstract-empty">
+            All SSA values point to nothing tracked.
+          </p>
+        ) : (
+          <PointerValueTable values={data.values} locations={data.locations} />
+        )}
+      </div>
+
+      {data.field_reads.length > 0 && (
+        <FieldEntriesBlock
+          title="Field Reads"
+          entries={data.field_reads}
+          emptyHint="(no parameter field reads recorded)"
+        />
+      )}
+
+      {data.field_writes.length > 0 && (
+        <FieldEntriesBlock
+          title="Field Writes"
+          entries={data.field_writes}
+          emptyHint="(no parameter field writes recorded)"
+        />
+      )}
+    </div>
+  );
+}
+
+function PointerValueTable({
+  values,
+  locations,
+}: {
+  values: PointerValueView[];
+  locations: PointerLocationView[];
+}) {
+  const locById = useMemo(() => {
+    const map = new Map<number, PointerLocationView>();
+    for (const loc of locations) map.set(loc.id, loc);
+    return map;
+  }, [locations]);
+
+  return (
+    <table className="abstract-table">
+      <thead>
+        <tr>
+          <th>Value</th>
+          <th>Name</th>
+          <th>Points-To</th>
+        </tr>
+      </thead>
+      <tbody>
+        {values.map((v) => (
+          <tr key={v.ssa_value}>
+            <td className="mono">v{v.ssa_value}</td>
+            <td className="mono">{v.var_name ?? '-'}</td>
+            <td>
+              {v.is_top ? (
+                <span
+                  className="cap-badge cap-badge-sink"
+                  title="Over-approximation"
+                >
+                  ⊤ (top)
+                </span>
+              ) : (
+                v.points_to.map((id) => (
+                  <LocationChip key={id} loc={locById.get(id)} />
+                ))
+              )}
+            </td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
+
+function LocationChip({ loc }: { loc?: PointerLocationView }) {
+  if (!loc) {
+    return (
+      <span className="cap-badge" title="Unknown location id">
+        ?
+      </span>
+    );
+  }
+  const className =
+    loc.kind === 'Top'
+      ? 'cap-badge cap-badge-sink'
+      : loc.kind === 'Field'
+        ? 'cap-badge cap-badge-sanitizer'
+        : 'cap-badge cap-badge-source';
+  return (
+    <span
+      className={className}
+      title={`${loc.kind} (loc#${loc.id})`}
+      style={{ marginRight: 4 }}
+    >
+      {loc.display}
+    </span>
+  );
+}
+
+function FieldEntriesBlock({
+  title,
+  entries,
+  emptyHint,
+}: {
+  title: string;
+  entries: PointerFieldEntryView[];
+  emptyHint: string;
+}) {
+  return (
+    <div className="abstract-block">
+      <div className="abstract-block-header">
+        <h3 style={{ margin: 0 }}>{title}</h3>
+        <span className="text-secondary">
+          {entries.length} entr{entries.length === 1 ? 'y' : 'ies'}
+        </span>
+      </div>
+      {entries.length === 0 ? (
+        <p className="abstract-empty">{emptyHint}</p>
+      ) : (
+        <table className="abstract-table">
+          <thead>
+            <tr>
+              <th>Target</th>
+              <th>Field</th>
+            </tr>
+          </thead>
+          <tbody>
+            {entries.map((e, i) => (
+              <tr key={`${e.param_index ?? 'self'}-${e.field}-${i}`}>
+                <td className="mono">
+                  {e.param_index === null ? 'self' : `param[${e.param_index}]`}
+                </td>
+                <td className="mono">{e.field}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </div>
+  );
+}

frontend/src/pages/debug/SummaryExplorerPage.tsx

@@ -1,4 +1,4 @@
-import { useState } from 'react';
+import { useMemo, useState } from 'react';
 import { useDebugSummaries } from '../../api/queries/debug';
 import { ApiError } from '../../api/client';
 import { EmptyState } from '../../components/ui/EmptyState';
@@ -22,6 +22,17 @@ export function SummaryAnalysisPanel({
     scope === 'global' ? null : (functionName ?? null),
   );
   const [expanded, setExpanded] = useState<string | null>(null);
+  const [showClosures, setShowClosures] = useState(false);
+
+  const closureCount = useMemo(
+    () => data?.filter((s) => s.func_kind === 'closure').length ?? 0,
+    [data],
+  );
+
+  const visible = useMemo(() => {
+    if (!data) return data;
+    return showClosures ? data : data.filter((s) => s.func_kind !== 'closure');
+  }, [data, showClosures]);
 
   if (isLoading) {
     return <LoadingState message="Loading summaries..." />;
@@ -48,15 +59,32 @@ export function SummaryAnalysisPanel({
     );
   }
 
+  const visibleCount = visible?.length ?? 0;
+  const totalCount = data.length;
+
   return (
     <div className="summary-explorer">
       <div className="summary-header">
         <span className="text-secondary">
-          {data.length}{' '}
+          {visibleCount}
+          {visibleCount !== totalCount && ` of ${totalCount}`}{' '}
           {scope === 'global'
             ? 'functions across the project'
             : 'functions in this file'}
         </span>
+        {closureCount > 0 && (
+          <label className="summary-toggle">
+            <input
+              type="checkbox"
+              checked={showClosures}
+              onChange={(e) => setShowClosures(e.target.checked)}
+            />
+            <span>
+              Show {closureCount} anonymous closure
+              {closureCount === 1 ? '' : 's'}
+            </span>
+          </label>
+        )}
       </div>
       <table className="summary-table">
         <thead>
@@ -71,20 +99,19 @@ export function SummaryAnalysisPanel({
           </tr>
         </thead>
         <tbody>
-          {data.map((s) => (
-            <SummaryRow
-              key={`${s.namespace}::${s.name}`}
-              summary={s}
-              isExpanded={expanded === `${s.namespace}::${s.name}`}
-              onToggle={() =>
-                setExpanded(
-                  expanded === `${s.namespace}::${s.name}`
-                    ? null
-                    : `${s.namespace}::${s.name}`,
-                )
-              }
-            />
-          ))}
+          {visible?.map((s) => {
+            const rowKey = `${s.namespace}::${s.container}::${s.name}`;
+            return (
+              <SummaryRow
+                key={rowKey}
+                summary={s}
+                isExpanded={expanded === rowKey}
+                onToggle={() =>
+                  setExpanded(expanded === rowKey ? null : rowKey)
+                }
+              />
+            );
+          })}
         </tbody>
       </table>
     </div>
@@ -104,10 +131,23 @@ function SummaryRow({
   isExpanded: boolean;
   onToggle: () => void;
 }) {
+  const isClosure = summary.func_kind === 'closure';
   return (
     <>
       <tr onClick={onToggle} style={{ cursor: 'pointer' }}>
-        <td className="mono">{summary.name}</td>
+        <td className="mono">
+          {summary.name}
+          {isClosure && (
+            <span
+              className="text-secondary"
+              style={{ marginLeft: 8, fontSize: '0.85em' }}
+            >
+              {summary.container
+                ? `[closure in ${summary.container}]`
+                : '[closure]'}
+            </span>
+          )}
+        </td>
         <td>{summary.lang}</td>
         <td>{summary.param_count}</td>
         <td>

frontend/src/pages/debug/TypeFactsPage.tsx

@@ -0,0 +1,202 @@
+import { useDebugTypeFacts } from '../../api/queries/debug';
+import { ApiError } from '../../api/client';
+import { EmptyState } from '../../components/ui/EmptyState';
+import { ErrorState } from '../../components/ui/ErrorState';
+import { LoadingState } from '../../components/ui/LoadingState';
+import type { TypeFactDetailView, DtoFactView } from '../../api/types';
+
+interface TypeFactsAnalysisPanelProps {
+  file: string;
+  functionName: string;
+}
+
+const SECURITY_TYPES = new Set([
+  'HttpClient',
+  'HttpResponse',
+  'DatabaseConnection',
+  'FileHandle',
+  'Url',
+  'LocalCollection',
+]);
+
+export function TypeFactsAnalysisPanel({
+  file,
+  functionName,
+}: TypeFactsAnalysisPanelProps) {
+  const { data, isLoading, error } = useDebugTypeFacts(file, functionName);
+
+  if (isLoading) {
+    return <LoadingState message="Loading type facts..." />;
+  }
+  if (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      return (
+        <EmptyState message="Type facts are not available for the selected function." />
+      );
+    }
+    return <ErrorState message="Failed to load type facts." />;
+  }
+  if (!data || data.facts.length === 0) {
+    return (
+      <EmptyState message="No type facts were inferred for this function. Type analysis fires when constructors, framework extractors, or constant literals reveal a value's type." />
+    );
+  }
+
+  const securityFacts = data.facts.filter((f) => SECURITY_TYPES.has(f.kind));
+  const dtoFacts = data.facts.filter((f) => f.kind === 'Dto');
+  const scalarFacts = data.facts.filter(
+    (f) => !SECURITY_TYPES.has(f.kind) && f.kind !== 'Dto',
+  );
+
+  return (
+    <div className="abstract-interp-viewer">
+      <div className="abstract-block">
+        <div className="abstract-block-header">
+          <h3 style={{ margin: 0 }}>Inferred Types</h3>
+          <span className="text-secondary">
+            {data.facts.length} of {data.total_values} SSA values typed ·{' '}
+            {data.unknown_count} unknown
+          </span>
+        </div>
+      </div>
+
+      {securityFacts.length > 0 && (
+        <TypeFactGroup
+          title="Security-Relevant Types"
+          subtitle="HttpClient, DatabaseConnection, Url, … — drive type-qualified callee resolution and sink suppression"
+          facts={securityFacts}
+          highlight
+        />
+      )}
+
+      {dtoFacts.length > 0 && (
+        <DtoFactGroup
+          title="DTO Types"
+          subtitle="Framework-injected DTO bodies with known field shapes (Phase 6)"
+          facts={dtoFacts}
+        />
+      )}
+
+      {scalarFacts.length > 0 && (
+        <TypeFactGroup
+          title="Scalar Types"
+          subtitle="String / Int / Bool / Object / Array / Null inferences"
+          facts={scalarFacts}
+        />
+      )}
+    </div>
+  );
+}
+
+function TypeFactGroup({
+  title,
+  subtitle,
+  facts,
+  highlight,
+}: {
+  title: string;
+  subtitle?: string;
+  facts: TypeFactDetailView[];
+  highlight?: boolean;
+}) {
+  return (
+    <div className="abstract-block">
+      <div className="abstract-block-header">
+        <h3 style={{ margin: 0 }}>{title}</h3>
+        <span className="text-secondary">
+          {facts.length} value{facts.length === 1 ? '' : 's'}
+        </span>
+      </div>
+      {subtitle && <p className="abstract-subtitle">{subtitle}</p>}
+      <table className="abstract-table">
+        <thead>
+          <tr>
+            <th>Value</th>
+            <th>Name</th>
+            <th>Type</th>
+            <th>Container</th>
+            <th>Nullable</th>
+            <th>Line</th>
+          </tr>
+        </thead>
+        <tbody>
+          {facts.map((f) => (
+            <tr key={f.ssa_value}>
+              <td className="mono">v{f.ssa_value}</td>
+              <td className="mono">{f.var_name ?? '-'}</td>
+              <td>
+                <span
+                  className={`cap-badge ${
+                    highlight ? 'cap-badge-sink' : 'cap-badge-source'
+                  }`}
+                >
+                  {f.kind}
+                </span>
+              </td>
+              <td className="mono">{f.container ?? '-'}</td>
+              <td>{f.nullable ? 'Yes' : 'No'}</td>
+              <td className="mono">{f.line > 0 ? `L${f.line}` : '-'}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+function DtoFactGroup({
+  title,
+  subtitle,
+  facts,
+}: {
+  title: string;
+  subtitle?: string;
+  facts: TypeFactDetailView[];
+}) {
+  return (
+    <div className="abstract-block">
+      <div className="abstract-block-header">
+        <h3 style={{ margin: 0 }}>{title}</h3>
+        <span className="text-secondary">
+          {facts.length} DTO{facts.length === 1 ? '' : 's'}
+        </span>
+      </div>
+      {subtitle && <p className="abstract-subtitle">{subtitle}</p>}
+      {facts.map((f) => (
+        <div key={f.ssa_value} style={{ padding: '8px 12px' }}>
+          <div className="debug-detail-row">
+            <span className="debug-detail-label">DTO</span>
+            <span className="debug-detail-value mono">
+              v{f.ssa_value} {f.var_name ? `(${f.var_name}) ` : ''}:{' '}
+              {f.dto?.class_name ?? '?'}
+            </span>
+          </div>
+          {f.dto && f.dto.fields.length > 0 && <DtoFieldTable dto={f.dto} />}
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function DtoFieldTable({ dto }: { dto: DtoFactView }) {
+  return (
+    <table className="abstract-table">
+      <thead>
+        <tr>
+          <th>Field</th>
+          <th>Kind</th>
+        </tr>
+      </thead>
+      <tbody>
+        {dto.fields.map((f) => (
+          <tr key={f.name}>
+            <td className="mono">{f.name}</td>
+            <td>
+              <span className="cap-badge cap-badge-source">{f.kind}</span>
+            </td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}