Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/abstract_interp/bit_domain.rs

@@ -570,4 +570,158 @@ mod tests {
     fn is_non_negative_unknown() {
         assert!(!BitFact::top().is_non_negative());
     }
+
+    // ── Additional lattice algebra laws ──────────────────────────────
+
+    fn sample_bits() -> Vec<BitFact> {
+        vec![
+            BitFact::bottom(),
+            BitFact::top(),
+            BitFact::from_const(0),
+            BitFact::from_const(1),
+            BitFact::from_const(-1),
+            BitFact::from_const(0xFF),
+            BitFact::from_const(i64::MIN),
+            BitFact::from_const(i64::MAX),
+        ]
+    }
+
+    #[test]
+    fn join_associative_bit() {
+        let xs = sample_bits();
+        for a in &xs {
+            for b in &xs {
+                for c in &xs {
+                    let lhs = a.join(b).join(c);
+                    let rhs = a.join(&b.join(c));
+                    assert_eq!(
+                        lhs, rhs,
+                        "join not associative for {:?}, {:?}, {:?}",
+                        a, b, c
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn meet_idempotent_bit() {
+        for a in sample_bits() {
+            assert_eq!(a.meet(&a), a, "meet not idempotent for {:?}", a);
+        }
+    }
+
+    #[test]
+    fn meet_associative_bit() {
+        let xs = sample_bits();
+        for a in &xs {
+            for b in &xs {
+                for c in &xs {
+                    let lhs = a.meet(b).meet(c);
+                    let rhs = a.meet(&b.meet(c));
+                    assert_eq!(
+                        lhs, rhs,
+                        "meet not associative for {:?}, {:?}, {:?}",
+                        a, b, c
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn meet_top_identity_bit() {
+        for a in sample_bits() {
+            assert_eq!(a.meet(&BitFact::top()), a, "x ⊓ ⊤ failed for {:?}", a);
+        }
+    }
+
+    #[test]
+    fn meet_bottom_absorbing_bit() {
+        for a in sample_bits() {
+            assert_eq!(
+                a.meet(&BitFact::bottom()),
+                BitFact::bottom(),
+                "x ⊓ ⊥ failed for {:?}",
+                a
+            );
+        }
+    }
+
+    #[test]
+    fn join_top_absorbing_bit() {
+        for a in sample_bits() {
+            assert_eq!(
+                a.join(&BitFact::top()),
+                BitFact::top(),
+                "x ⊔ ⊤ failed for {:?}",
+                a
+            );
+        }
+    }
+
+    #[test]
+    fn widen_idempotent_bit() {
+        for a in sample_bits() {
+            assert_eq!(a.widen(&a), a, "widen(x, x) failed for {:?}", a);
+        }
+    }
+
+    /// **Soundness**: `widen(a, b) ⊒ join(a, b)` for the bit lattice.
+    #[test]
+    fn widen_over_approximates_join_bit() {
+        let xs = sample_bits();
+        for a in &xs {
+            for b in &xs {
+                let j = a.join(b);
+                let w = a.widen(b);
+                assert!(
+                    j.leq(&w),
+                    "widen({:?}, {:?}) = {:?} does not over-approx join = {:?}",
+                    a,
+                    b,
+                    w,
+                    j
+                );
+            }
+        }
+    }
+
+    /// `a ⊓ b ⊑ a` and `a ⊓ b ⊑ b` — meet is the greatest lower bound.
+    #[test]
+    fn meet_is_lower_bound_bit() {
+        let xs = sample_bits();
+        for a in &xs {
+            for b in &xs {
+                let m = a.meet(b);
+                assert!(m.leq(a), "a ⊓ b ⊑ a failed for {:?}, {:?}", a, b);
+                assert!(m.leq(b), "a ⊓ b ⊑ b failed for {:?}, {:?}", a, b);
+            }
+        }
+    }
+
+    /// `a ⊑ a ⊔ b` and `b ⊑ a ⊔ b` — join is the least upper bound.
+    #[test]
+    fn join_is_upper_bound_bit() {
+        let xs = sample_bits();
+        for a in &xs {
+            for b in &xs {
+                let j = a.join(b);
+                assert!(a.leq(&j), "a ⊑ a ⊔ b failed for {:?}, {:?}", a, b);
+                assert!(b.leq(&j), "b ⊑ a ⊔ b failed for {:?}, {:?}", a, b);
+            }
+        }
+    }
+
+    /// Joining `i64::MIN` and `i64::MAX` (extreme sign-bit-different
+    /// constants) must not panic and must produce a valid Top-or-bottom
+    /// bit fact (used in path-merging).
+    #[test]
+    fn join_min_max_signbit_safe() {
+        let a = BitFact::from_const(i64::MIN);
+        let b = BitFact::from_const(i64::MAX);
+        let _ = a.join(&b); // must not panic
+        let _ = a.meet(&b);
+        let _ = a.widen(&b);
+    }
 }

src/abstract_interp/interval.rs

@@ -1032,4 +1032,360 @@ mod tests {
         let shift = IntervalFact::exact(1);
         assert!(x.right_shift(&shift).is_top());
     }
+
+    /// `a - b` overflows when `a.lo - b.hi` underflows or
+    /// `a.hi - b.lo` overflows. We expect the corresponding bound to
+    /// drop to `None`. Mirrors `overflow_add` / `overflow_mul`.
+    #[test]
+    fn overflow_sub() {
+        let a = IntervalFact::exact(i64::MIN);
+        let b = IntervalFact::exact(1);
+        let r = a.sub(&b);
+        assert_eq!(r.lo, None, "underflow on i64::MIN - 1 must drop lo to None");
+        // hi: i64::MIN - 1 also underflows, so hi must also be None.
+        assert_eq!(r.hi, None, "i64::MIN - 1 underflows on hi too");
+    }
+
+    /// Division of `i64::MIN` by `-1` overflows (`i64::MAX + 1`).
+    /// `checked_div` returns `None` for that case; we want the bound to
+    /// gracefully degrade, not panic.
+    #[test]
+    fn div_i64_min_by_minus_one_does_not_panic() {
+        let a = IntervalFact::exact(i64::MIN);
+        let b = IntervalFact::exact(-1);
+        let r = a.div(&b);
+        // Either bound becomes None (graceful) — exact representation
+        // depends on the impl, but we mainly assert no panic occurred
+        // and the result is a valid interval.
+        assert!(
+            r.lo.is_none() || r.hi.is_none() || (r.lo.is_some() && r.hi.is_some()),
+            "div should never panic on i64::MIN / -1"
+        );
+    }
+
+    /// Modulo with a single-point negative divisor: `[0,10] % -3` must
+    /// be a valid interval (no panic, no negative-zero bound nonsense).
+    #[test]
+    fn modulo_negative_divisor_singleton() {
+        let a = IntervalFact {
+            lo: Some(0),
+            hi: Some(10),
+        };
+        let b = IntervalFact::exact(-3);
+        let r = a.modulo(&b);
+        // |b| = 3 ⇒ result bounded by [0, 2] for non-negative dividend.
+        assert_eq!(r.lo, Some(0));
+        assert_eq!(r.hi, Some(2));
+    }
+
+    /// Modulo by an interval that *contains* zero must escape to Top —
+    /// modulo-by-zero is undefined and we cannot precise-narrow it.
+    #[test]
+    fn modulo_divisor_spans_zero_is_top() {
+        let a = IntervalFact {
+            lo: Some(0),
+            hi: Some(100),
+        };
+        let b = IntervalFact {
+            lo: Some(-1),
+            hi: Some(1),
+        };
+        let r = a.modulo(&b);
+        assert!(r.is_top(), "modulo by zero-spanning divisor must be Top");
+    }
+
+    /// `[i64::MIN, i64::MAX]` is the maximal interval. Any join with
+    /// any other interval must remain `[i64::MIN, i64::MAX]` (or Top
+    /// equivalent) — this guards against accidental narrowing on join.
+    #[test]
+    fn full_range_is_join_absorbing() {
+        let full = IntervalFact {
+            lo: Some(i64::MIN),
+            hi: Some(i64::MAX),
+        };
+        let small = IntervalFact {
+            lo: Some(0),
+            hi: Some(10),
+        };
+        let j = full.join(&small);
+        assert_eq!(j.lo, Some(i64::MIN), "join must not narrow lo");
+        assert_eq!(j.hi, Some(i64::MAX), "join must not narrow hi");
+    }
+
+    // ── Additional lattice algebra laws ──────────────────────────────
+    // These guard the soundness of the dataflow framework: join/meet/widen
+    // must satisfy the standard lattice axioms or fixpoint convergence
+    // and abstract correctness break.
+
+    fn sample_intervals() -> Vec<IntervalFact> {
+        vec![
+            IntervalFact::bottom(),
+            IntervalFact::top(),
+            IntervalFact::exact(0),
+            IntervalFact::exact(-7),
+            IntervalFact {
+                lo: Some(2),
+                hi: Some(8),
+            },
+            IntervalFact {
+                lo: None,
+                hi: Some(10),
+            },
+            IntervalFact {
+                lo: Some(-5),
+                hi: None,
+            },
+        ]
+    }
+
+    #[test]
+    fn join_with_top_is_top() {
+        for a in sample_intervals() {
+            let j = a.join(&IntervalFact::top());
+            assert!(j.is_top(), "x ⊔ ⊤ = ⊤ failed for {:?}", a);
+            let j2 = IntervalFact::top().join(&a);
+            assert!(j2.is_top(), "⊤ ⊔ x = ⊤ failed for {:?}", a);
+        }
+    }
+
+    #[test]
+    fn meet_idempotent() {
+        for a in sample_intervals() {
+            assert_eq!(a.meet(&a), a, "x ⊓ x = x failed for {:?}", a);
+        }
+    }
+
+    #[test]
+    fn meet_commutative() {
+        let xs = sample_intervals();
+        for a in &xs {
+            for b in &xs {
+                assert_eq!(
+                    a.meet(b),
+                    b.meet(a),
+                    "meet not commutative for {:?} / {:?}",
+                    a,
+                    b
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn meet_associative() {
+        let xs = sample_intervals();
+        for a in &xs {
+            for b in &xs {
+                for c in &xs {
+                    let lhs = a.meet(b).meet(c);
+                    let rhs = a.meet(&b.meet(c));
+                    assert_eq!(lhs, rhs, "meet not associative for {:?},{:?},{:?}", a, b, c);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn meet_top_identity() {
+        for a in sample_intervals() {
+            assert_eq!(
+                a.meet(&IntervalFact::top()),
+                a,
+                "x ⊓ ⊤ = x failed for {:?}",
+                a
+            );
+        }
+    }
+
+    #[test]
+    fn meet_bottom_absorbing() {
+        for a in sample_intervals() {
+            assert!(
+                a.meet(&IntervalFact::bottom()).is_bottom(),
+                "x ⊓ ⊥ = ⊥ failed for {:?}",
+                a
+            );
+        }
+    }
+
+    #[test]
+    fn widen_idempotent() {
+        for a in sample_intervals() {
+            assert_eq!(a.widen(&a), a, "widen(x, x) = x failed for {:?}", a);
+        }
+    }
+
+    /// **Soundness**: widening must over-approximate join.
+    /// `widen(a, b) ⊒ join(a, b)` for all a, b.
+    /// Without this, fixpoint iteration converges to an unsound result.
+    #[test]
+    fn widen_over_approximates_join() {
+        let xs = sample_intervals();
+        for a in &xs {
+            for b in &xs {
+                let j = a.join(b);
+                let w = a.widen(b);
+                assert!(
+                    j.leq(&w),
+                    "widen({:?}, {:?}) = {:?} does not over-approximate join = {:?}",
+                    a,
+                    b,
+                    w,
+                    j
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn leq_reflexive() {
+        for a in sample_intervals() {
+            assert!(a.leq(&a), "x ⊑ x failed for {:?}", a);
+        }
+    }
+
+    #[test]
+    fn leq_transitive() {
+        // a ⊑ b ⊑ c ⇒ a ⊑ c
+        let a = IntervalFact::exact(5);
+        let b = IntervalFact {
+            lo: Some(0),
+            hi: Some(10),
+        };
+        let c = IntervalFact::top();
+        assert!(a.leq(&b));
+        assert!(b.leq(&c));
+        assert!(a.leq(&c), "leq must be transitive");
+    }
+
+    /// `x ⊔ y` is the least upper bound: both x and y must be ⊑ join(x,y).
+    #[test]
+    fn join_is_upper_bound() {
+        let xs = sample_intervals();
+        for a in &xs {
+            for b in &xs {
+                let j = a.join(b);
+                assert!(a.leq(&j), "a ⊑ a ⊔ b failed for {:?}, {:?}", a, b);
+                assert!(b.leq(&j), "b ⊑ a ⊔ b failed for {:?}, {:?}", a, b);
+            }
+        }
+    }
+
+    /// `x ⊓ y` is the greatest lower bound: meet(x,y) ⊑ both x and y.
+    #[test]
+    fn meet_is_lower_bound() {
+        let xs = sample_intervals();
+        for a in &xs {
+            for b in &xs {
+                let m = a.meet(b);
+                assert!(m.leq(a), "a ⊓ b ⊑ a failed for {:?}, {:?}", a, b);
+                assert!(m.leq(b), "a ⊓ b ⊑ b failed for {:?}, {:?}", a, b);
+            }
+        }
+    }
+
+    // ── Arithmetic edge cases not previously covered ─────────────────
+
+    /// Multiplication by exact zero must yield exact zero, regardless
+    /// of the other operand. This is critical for taint suppression
+    /// (`x * 0` is provably bounded).
+    #[test]
+    fn mul_by_zero_singleton_is_zero() {
+        let zero = IntervalFact::exact(0);
+        let inputs = [
+            IntervalFact::exact(42),
+            IntervalFact {
+                lo: Some(-100),
+                hi: Some(100),
+            },
+            IntervalFact {
+                lo: Some(i64::MIN),
+                hi: Some(i64::MAX),
+            },
+            IntervalFact::top(),
+        ];
+        for a in inputs.iter() {
+            // Note: when a is Top, mul currently short-circuits to Top.
+            // The zero-singleton case is the precise one we care about
+            // for sink suppression; assert it for non-Top inputs.
+            if !a.is_top() {
+                let r = a.mul(&zero);
+                assert_eq!(r, IntervalFact::exact(0), "x * 0 should be 0 for {:?}", a);
+                let r2 = zero.mul(a);
+                assert_eq!(r2, IntervalFact::exact(0), "0 * x should be 0 for {:?}", a);
+            }
+        }
+    }
+
+    /// Bottom propagates through every arithmetic op.
+    #[test]
+    fn bottom_propagates_through_arith() {
+        let bot = IntervalFact::bottom();
+        let x = IntervalFact::exact(5);
+        assert!(bot.add(&x).is_bottom());
+        assert!(x.add(&bot).is_bottom());
+        assert!(bot.sub(&x).is_bottom());
+        assert!(bot.mul(&x).is_bottom());
+        assert!(bot.div(&x).is_bottom());
+        assert!(bot.modulo(&x).is_bottom());
+        assert!(bot.bit_and(&x).is_bottom());
+        assert!(bot.bit_or(&x).is_bottom());
+        assert!(bot.bit_xor(&x).is_bottom());
+        assert!(bot.left_shift(&x).is_bottom());
+        assert!(bot.right_shift(&x).is_bottom());
+    }
+
+    /// Division by exact zero must escape to Top (not crash, not produce
+    /// a bogus interval). Currently handled by the spans-zero check.
+    #[test]
+    fn div_by_exact_zero_is_top() {
+        let a = IntervalFact::exact(10);
+        let zero = IntervalFact::exact(0);
+        assert!(
+            a.div(&zero).is_top(),
+            "division by exact zero must escape to Top"
+        );
+    }
+
+    /// Modulo with exact-zero divisor — must escape to Top.
+    #[test]
+    fn modulo_by_exact_zero_is_top() {
+        let a = IntervalFact {
+            lo: Some(0),
+            hi: Some(100),
+        };
+        let zero = IntervalFact::exact(0);
+        assert!(a.modulo(&zero).is_top());
+    }
+
+    /// Add involving Top stays Top on the unbounded side.
+    #[test]
+    fn add_with_top_is_top() {
+        let r = IntervalFact::exact(5).add(&IntervalFact::top());
+        assert!(r.is_top(), "5 + Top should be Top, got {:?}", r);
+    }
+
+    /// Subtraction: i64::MAX - i64::MIN should overflow gracefully.
+    #[test]
+    fn sub_overflow_extreme() {
+        let a = IntervalFact::exact(i64::MAX);
+        let b = IntervalFact::exact(i64::MIN);
+        let r = a.sub(&b); // i64::MAX - i64::MIN overflows
+        assert!(
+            r.lo.is_none() || r.hi.is_none(),
+            "extreme subtraction must not panic and must drop a bound"
+        );
+    }
+
+    /// `bottom().widen(x)` must be defined and converge.
+    #[test]
+    fn widen_with_bottom() {
+        let x = IntervalFact::exact(5);
+        let bot = IntervalFact::bottom();
+        let w1 = bot.widen(&x);
+        // Bottom widens to the new value (no growth observed yet).
+        assert_eq!(w1, x);
+        let w2 = x.widen(&bot);
+        assert_eq!(w2, x);
+    }
 }

src/abstract_interp/path_domain.rs

@@ -424,6 +424,23 @@ pub fn classify_path_rejection_axes(text: &str) -> smallvec::SmallVec<[PathRejec
     let mut out: smallvec::SmallVec<[PathRejection; 3]> = smallvec::SmallVec::new();
     for clause in split_top_level_or(text) {
         let clause = clause.trim();
+        // Multi-axis special case: `!filepath.IsLocal(p)` (Go).
+        // `filepath.IsLocal` returns true iff the path stays within the
+        // current directory — no leading `/`, no `..` segments, no Windows
+        // drive root.  Idiomatic Go path-traversal guard:
+        //   `if !filepath.IsLocal(p) { return }`
+        // The TRUE branch terminates; the FALSE branch (where IsLocal is
+        // true) proves both `dotdot = No` and `absolute = No` on the
+        // argument simultaneously.  Recognise it here so both axes flow
+        // into the surviving branch's PathFact narrowing.
+        if has_negated_filepath_is_local(clause) {
+            for axis in [PathRejection::DotDot, PathRejection::IsAbsolute] {
+                if !out.contains(&axis) {
+                    out.push(axis);
+                }
+            }
+            continue;
+        }
         let cls = classify_path_rejection_atom(clause);
         if !matches!(cls, PathRejection::None) && !out.contains(&cls) {
             out.push(cls);
@@ -432,6 +449,29 @@ pub fn classify_path_rejection_axes(text: &str) -> smallvec::SmallVec<[PathRejec
     out
 }
 
+/// Detect `!filepath.IsLocal(<expr>)` — Go's idiomatic path-traversal
+/// guard.  Whitespace-tolerant: `! filepath.IsLocal(`, `!filepath . IsLocal(`,
+/// etc.  Used by [`classify_path_rejection_axes`] to inject both
+/// [`PathRejection::DotDot`] and [`PathRejection::IsAbsolute`] on the false
+/// branch (which is the local-path branch by construction).
+fn has_negated_filepath_is_local(clause: &str) -> bool {
+    // Strip surrounding parens once to handle `(!filepath.IsLocal(p))`.
+    let trimmed = clause.trim();
+    let inner = trimmed
+        .strip_prefix('(')
+        .and_then(|s| s.strip_suffix(')'))
+        .unwrap_or(trimmed)
+        .trim();
+    // Remove the leading `!` and any whitespace.
+    let after_not = match inner.strip_prefix('!') {
+        Some(rest) => rest.trim_start(),
+        None => return false,
+    };
+    // Compress whitespace around `.` so `filepath . IsLocal(` matches.
+    let compact: String = after_not.chars().filter(|c| !c.is_whitespace()).collect();
+    compact.starts_with("filepath.IsLocal(")
+}
+
 fn classify_path_rejection_atom(clause: &str) -> PathRejection {
     // `.contains("..")` (Rust, Java) / `.includes("..")` (JS/TS) /
     // `.include?("..")` (Ruby) / `strings.Contains(s, "..")` (Go) /

src/abstract_interp/string_domain.rs

@@ -76,32 +76,54 @@ impl StringFact {
 
     /// Exact known string value: prefix and suffix are the full string, and
     /// the finite domain is `{s}`.
+    ///
+    /// Empty prefix/suffix are normalised to `None` because "starts/ends with
+    /// the empty string" carries no constraint — keeping `Some("")` would
+    /// break join idempotence (`Some("")` ⊔ `Some("")` collapses to `None`).
     pub fn exact(s: &str) -> Self {
         let prefix = truncate_prefix(s);
         let suffix = truncate_suffix(s);
         Self {
-            prefix: Some(prefix),
-            suffix: Some(suffix),
+            prefix: if prefix.is_empty() {
+                None
+            } else {
+                Some(prefix)
+            },
+            suffix: if suffix.is_empty() {
+                None
+            } else {
+                Some(suffix)
+            },
             domain: Some(vec![s.to_string()]),
             is_bottom: false,
         }
     }
 
-    /// Known prefix only.
+    /// Known prefix only. Empty `p` normalises to no-prefix-info (`None`).
     pub fn from_prefix(p: &str) -> Self {
+        let prefix = truncate_prefix(p);
         Self {
-            prefix: Some(truncate_prefix(p)),
+            prefix: if prefix.is_empty() {
+                None
+            } else {
+                Some(prefix)
+            },
             suffix: None,
             domain: None,
             is_bottom: false,
         }
     }
 
-    /// Known suffix only.
+    /// Known suffix only. Empty `s` normalises to no-suffix-info (`None`).
     pub fn from_suffix(s: &str) -> Self {
+        let suffix = truncate_suffix(s);
         Self {
             prefix: None,
-            suffix: Some(truncate_suffix(s)),
+            suffix: if suffix.is_empty() {
+                None
+            } else {
+                Some(suffix)
+            },
             domain: None,
             is_bottom: false,
         }
@@ -386,25 +408,31 @@ fn truncate_suffix(s: &str) -> String {
     }
 }
 
-/// Longest common prefix of two strings.
+/// Longest common prefix of two strings, char-aligned.
+///
+/// Iterates by `char` rather than `byte` so multi-byte UTF-8 code points are
+/// either kept whole or dropped — a byte-wise comparison would slice into the
+/// middle of a code point and produce mojibake (`x as char` on a UTF-8
+/// continuation byte yields a garbage Latin-1 character).
 pub fn longest_common_prefix(a: &str, b: &str) -> String {
-    a.bytes()
-        .zip(b.bytes())
+    a.chars()
+        .zip(b.chars())
         .take_while(|(x, y)| x == y)
-        .map(|(x, _)| x as char)
+        .map(|(x, _)| x)
         .collect()
 }
 
-/// Longest common suffix of two strings.
+/// Longest common suffix of two strings, char-aligned.
 pub fn longest_common_suffix(a: &str, b: &str) -> String {
-    let lcs: String = a
-        .bytes()
+    let mut lcs: Vec<char> = a
+        .chars()
         .rev()
-        .zip(b.bytes().rev())
+        .zip(b.chars().rev())
         .take_while(|(x, y)| x == y)
-        .map(|(x, _)| x as char)
+        .map(|(x, _)| x)
         .collect();
-    lcs.chars().rev().collect()
+    lcs.reverse();
+    lcs.into_iter().collect()
 }
 
 #[cfg(test)]
@@ -675,4 +703,256 @@ mod tests {
             !StringFact::finite_set(vec!["ls".into(), "rm;reboot".into()]).is_finite_shell_safe()
         );
     }
+
+    /// `concat("", x)` and `concat(x, "")` must round-trip the
+    /// non-empty operand's prefix/suffix. The current `concat` keeps
+    /// LHS prefix and RHS suffix verbatim. After empty-string
+    /// normalisation, `exact("")` carries no prefix/suffix info, so
+    /// the LHS prefix is `None` (unknown) and only the RHS suffix
+    /// survives.
+    #[test]
+    fn concat_empty_string_lhs_preserves_rhs_suffix() {
+        let empty = StringFact::exact("");
+        let rhs = StringFact::exact("x");
+        let r = empty.concat(&rhs);
+        assert_eq!(r.prefix, None);
+        assert_eq!(r.suffix.as_deref(), Some("x"));
+    }
+
+    #[test]
+    fn concat_empty_string_rhs_preserves_lhs_prefix() {
+        let lhs = StringFact::exact("x");
+        let empty = StringFact::exact("");
+        let r = lhs.concat(&empty);
+        assert_eq!(r.prefix.as_deref(), Some("x"));
+        assert_eq!(r.suffix, None);
+    }
+
+    /// Bottom is concat-absorbing: concat with bottom in either
+    /// position yields bottom (no flow can reach the call site).
+    #[test]
+    fn concat_with_bottom_is_bottom() {
+        let bot = StringFact::bottom();
+        let any = StringFact::exact("anything");
+        assert!(bot.concat(&any).is_bottom());
+        assert!(any.concat(&bot).is_bottom());
+    }
+
+    /// Joining two distinct URL prefixes must reduce to their LCP, not
+    /// fall through to `None`. This is the property SSRF prefix-lock
+    /// suppression depends on at phi nodes.
+    #[test]
+    fn join_distinct_urls_reduces_to_lcp() {
+        let a = StringFact::from_prefix("https://api.example.com/");
+        let b = StringFact::from_prefix("https://db.example.com/");
+        let r = a.join(&b);
+        // Common prefix is "https://" — anything past that diverges.
+        assert_eq!(
+            r.prefix.as_deref(),
+            Some("https://"),
+            "join must compute LCP, not drop the prefix entirely"
+        );
+    }
+
+    /// Meet of two prefix-locks with no overlap must collapse to
+    /// bottom (it represents an unsatisfiable conjunction).
+    #[test]
+    fn meet_disjoint_prefixes_is_bottom() {
+        let a = StringFact::from_prefix("/var/");
+        let b = StringFact::from_prefix("/etc/");
+        let r = a.meet(&b);
+        assert!(
+            r.is_bottom(),
+            "meet of disjoint prefix-locks must be bottom"
+        );
+    }
+
+    // ── Additional lattice algebra laws ──────────────────────────────
+
+    fn sample_strings() -> Vec<StringFact> {
+        vec![
+            StringFact::bottom(),
+            StringFact::top(),
+            StringFact::exact(""),
+            StringFact::exact("hello"),
+            StringFact::from_prefix("https://"),
+            StringFact::from_suffix(".com"),
+            StringFact::finite_set(vec!["a".into(), "b".into()]),
+        ]
+    }
+
+    /// `x ⊔ x = x` — join is idempotent across all sample shapes.
+    #[test]
+    fn join_idempotent_string() {
+        for a in sample_strings() {
+            assert_eq!(a.join(&a), a, "join not idempotent for {:?}", a);
+        }
+    }
+
+    /// `x ⊔ y = y ⊔ x` — join is commutative.
+    #[test]
+    fn join_commutative_string() {
+        let xs = sample_strings();
+        for a in &xs {
+            for b in &xs {
+                assert_eq!(
+                    a.join(b),
+                    b.join(a),
+                    "join not commutative for {:?} / {:?}",
+                    a,
+                    b
+                );
+            }
+        }
+    }
+
+    /// `x ⊓ x = x` — meet is idempotent.
+    #[test]
+    fn meet_idempotent_string() {
+        for a in sample_strings() {
+            assert_eq!(a.meet(&a), a, "meet not idempotent for {:?}", a);
+        }
+    }
+
+    /// `x ⊓ y = y ⊓ x` — meet is commutative.
+    #[test]
+    fn meet_commutative_string() {
+        let xs = sample_strings();
+        for a in &xs {
+            for b in &xs {
+                assert_eq!(
+                    a.meet(b),
+                    b.meet(a),
+                    "meet not commutative for {:?} / {:?}",
+                    a,
+                    b
+                );
+            }
+        }
+    }
+
+    /// `x ⊓ ⊤ = x` and `x ⊓ ⊥ = ⊥`.
+    #[test]
+    fn meet_identity_string() {
+        for a in sample_strings() {
+            assert_eq!(a.meet(&StringFact::top()), a, "x ⊓ ⊤ failed for {:?}", a);
+            assert!(
+                a.meet(&StringFact::bottom()).is_bottom(),
+                "x ⊓ ⊥ failed for {:?}",
+                a
+            );
+        }
+    }
+
+    /// `x ⊑ x` — leq is reflexive.
+    #[test]
+    fn leq_reflexive_string() {
+        for a in sample_strings() {
+            assert!(a.leq(&a), "x ⊑ x failed for {:?}", a);
+        }
+    }
+
+    /// **Soundness**: `widen(a, b) ⊒ join(a, b)` — widening must
+    /// over-approximate join, otherwise dataflow loses information.
+    #[test]
+    fn widen_over_approximates_join_string() {
+        let xs = sample_strings();
+        for a in &xs {
+            for b in &xs {
+                let j = a.join(b);
+                let w = a.widen(b);
+                assert!(
+                    j.leq(&w),
+                    "widen({:?}, {:?}) = {:?} does not over-approximate join = {:?}",
+                    a,
+                    b,
+                    w,
+                    j
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn widen_idempotent_string() {
+        for a in sample_strings() {
+            assert_eq!(a.widen(&a), a, "widen(x, x) failed for {:?}", a);
+        }
+    }
+
+    /// Join is upper bound: `a ⊑ a ⊔ b` and `b ⊑ a ⊔ b`.
+    #[test]
+    fn join_is_upper_bound_string() {
+        let xs = sample_strings();
+        for a in &xs {
+            for b in &xs {
+                let j = a.join(b);
+                assert!(
+                    a.leq(&j),
+                    "a ⊑ a ⊔ b failed for {:?}, {:?} (join={:?})",
+                    a,
+                    b,
+                    j
+                );
+                assert!(
+                    b.leq(&j),
+                    "b ⊑ a ⊔ b failed for {:?}, {:?} (join={:?})",
+                    a,
+                    b,
+                    j
+                );
+            }
+        }
+    }
+
+    /// Empty-string exact value must distinguish from Top — it is a
+    /// singleton (`{""}`), not unconstrained. After the empty-prefix
+    /// normalisation, prefix/suffix are `None` (carry no extra info)
+    /// but the `domain` field still pins the value to exactly `""`.
+    #[test]
+    fn exact_empty_string_is_not_top() {
+        let e = StringFact::exact("");
+        assert!(!e.is_top(), "exact(\"\") must not be Top");
+        assert!(!e.is_bottom(), "exact(\"\") must not be Bottom");
+        assert_eq!(e.prefix, None, "empty prefix normalised to None");
+        assert_eq!(e.suffix, None, "empty suffix normalised to None");
+        assert_eq!(e.domain.as_deref(), Some(&[String::new()][..]));
+    }
+
+    /// LCP/LCS with multi-byte UTF-8 chars must not split a code point
+    /// (would produce invalid UTF-8 strings or panic).
+    #[test]
+    fn lcp_lcs_unicode_safe() {
+        // Both start with é (2-byte char in UTF-8).
+        let a = StringFact::exact("éclair");
+        let b = StringFact::exact("éclat");
+        let j = a.join(&b);
+        // LCP should be "écla" (still valid UTF-8). At minimum it must
+        // be a valid Rust string and not panic.
+        let prefix = j.prefix.as_deref().unwrap_or("");
+        assert!(prefix.is_char_boundary(prefix.len()));
+        assert!(prefix.starts_with('é'));
+
+        // Suffix with multibyte: "café" vs "naïvé" share "é" suffix?
+        // Simpler: both end with "好" (3-byte CJK).
+        let a = StringFact::exact("你好");
+        let b = StringFact::exact("您好");
+        let j = a.join(&b);
+        let suffix = j.suffix.as_deref().unwrap_or("");
+        assert!(suffix.is_char_boundary(0) && suffix.is_char_boundary(suffix.len()));
+        assert!(suffix.ends_with('好'));
+    }
+
+    /// Concat with empty-string `exact("")` should preserve the other
+    /// side's prefix/suffix knowledge (empty is the identity).
+    #[test]
+    fn concat_with_empty_exact_preserves_other() {
+        let s = StringFact::exact("hello");
+        let e = StringFact::exact("");
+        let r = s.concat(&e);
+        // Concat should preserve prefix from `s`.
+        assert_eq!(r.prefix.as_deref(), Some("hello"));
+        let r2 = e.concat(&s);
+        assert_eq!(r2.suffix.as_deref(), Some("hello"));
+    }
 }