Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/auth_analysis/extract/axum.rs

@@ -378,6 +378,19 @@ fn classify_rocket_param(
     }
 }
 
+/// Classify a route-handler parameter type as a route-level auth
+/// guard.  Used to tag the route as gated by a login or admin check
+/// when one of its parameters is a typed auth extractor.
+///
+/// **Looser than [`super::common::is_self_actor_type_text`] by
+/// design.**  This recogniser runs only on the type of a route-bound
+/// parameter — appearing in a route handler signature is itself a
+/// strong signal — and a false positive here just over-credits the
+/// route with a login guard, which is conservative w.r.t. flagging.
+/// `is_self_actor_type_text` runs on every parameter, including in
+/// non-route functions, and a false positive there suppresses
+/// downstream `V.id` flagging entirely; that path uses a structural
+/// recogniser keyed on the `<PREFIX>User<SUFFIX>?` shape.
 fn classify_guard_type(type_text: &str) -> Option<AuthCheckKind> {
     let lower = type_text.to_ascii_lowercase();
     if is_extractor_wrapper(&lower) {

src/auth_analysis/extract/django.rs

@@ -9,6 +9,7 @@ use crate::auth_analysis::extract::common::{attach_route_handler, collect_top_le
 use crate::auth_analysis::model::{
     AnalysisUnitKind, AuthorizationModel, CallSite, Framework, HttpMethod,
 };
+use crate::labels::bare_method_name;
 use crate::utils::project::{DetectedFramework, FrameworkContext};
 use std::path::Path;
 use tree_sitter::{Node, Tree};
@@ -55,7 +56,7 @@ fn maybe_collect_django_path(
         return;
     };
     let callee = text(function, bytes);
-    let target = callee.rsplit('.').next().unwrap_or(&callee);
+    let target = bare_method_name(&callee);
     if !matches!(target, "path" | "re_path") {
         return;
     }

src/auth_analysis/extract/flask.rs

@@ -6,6 +6,7 @@ use super::common::{
 use crate::auth_analysis::config::{AuthAnalysisRules, matches_name};
 use crate::auth_analysis::extract::common::{collect_top_level_units, decorated_definition_child};
 use crate::auth_analysis::model::{AuthorizationModel, CallSite, Framework, HttpMethod};
+use crate::labels::bare_method_name;
 use crate::utils::project::{DetectedFramework, FrameworkContext};
 use std::path::Path;
 use tree_sitter::{Node, Tree};
@@ -117,7 +118,7 @@ fn parse_flask_route_decorator(
     };
 
     let callee = text(function, bytes);
-    let method_name = callee.rsplit('.').next().unwrap_or(&callee);
+    let method_name = bare_method_name(&callee);
     let arguments = decorator_expr.child_by_field_name("arguments")?;
     let args = named_children(arguments);
 

src/auth_analysis/extract/rails.rs

@@ -7,6 +7,7 @@ use crate::auth_analysis::config::{AuthAnalysisRules, matches_name, strip_quotes
 use crate::auth_analysis::model::{
     AnalysisUnitKind, AuthorizationModel, CallSite, Framework, HttpMethod, RouteRegistration,
 };
+use crate::labels::bare_method_name;
 use crate::utils::project::{DetectedFramework, FrameworkContext};
 use std::path::Path;
 use tree_sitter::{Node, Tree};
@@ -175,7 +176,7 @@ fn class_filter_directives(body: Node<'_>, bytes: &[u8]) -> Vec<FilterDirective>
             continue;
         }
         let callee = call_name(child, bytes);
-        let directive_name = callee.rsplit('.').next().unwrap_or(&callee);
+        let directive_name = bare_method_name(&callee);
         if !matches_name(directive_name, "before_action")
             && !matches_name(directive_name, "prepend_before_action")
             && !matches_name(directive_name, "skip_before_action")

src/auth_analysis/extract/sinatra.rs

@@ -7,6 +7,7 @@ use crate::auth_analysis::config::{AuthAnalysisRules, matches_name};
 use crate::auth_analysis::model::{
     AnalysisUnitKind, AuthorizationModel, CallSite, Framework, HttpMethod, RouteRegistration,
 };
+use crate::labels::bare_method_name;
 use crate::utils::project::{DetectedFramework, FrameworkContext};
 use std::path::Path;
 use tree_sitter::{Node, Tree};
@@ -43,7 +44,7 @@ fn collect_before_filters(root: Node<'_>, bytes: &[u8]) -> Vec<CallSite> {
             continue;
         }
         let callee = call_name(child, bytes);
-        let target = callee.rsplit('.').next().unwrap_or(&callee);
+        let target = bare_method_name(&callee);
         if !matches_name(target, "before") {
             continue;
         }
@@ -79,7 +80,7 @@ fn maybe_collect_route(
     model: &mut AuthorizationModel,
 ) {
     let callee = call_name(node, bytes);
-    let route_name = callee.rsplit('.').next().unwrap_or(&callee);
+    let route_name = bare_method_name(&callee);
     let method = match route_name.to_ascii_lowercase().as_str() {
         "get" => HttpMethod::Get,
         "post" => HttpMethod::Post,