Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/auth_analysis/model.rs

@@ -168,6 +168,26 @@ pub struct AnalysisUnit {
     /// row-level ownership-equality check on the row implicitly covers
     /// downstream uses of fields read from the same row.
     pub row_field_vars: HashMap<String, String>,
+    /// Map from local variable name to the full member-chain expression
+    /// it was bound from (`let community_id = req.community_id` →
+    /// `community_id → "req.community_id"`).  Distinct from
+    /// `row_field_vars`, which records only the receiver (loses the
+    /// field name).  Powers the row-population reverse-walk's local-
+    /// alias case: when a sink subject is a plain identifier, the
+    /// reverse walk consults this map to also accept rows whose
+    /// population args contain the aliased chain.
+    pub var_alias_chain: HashMap<String, String>,
+    /// Per row-binding metadata: the `let ROW = CALL(..)` declaration
+    /// line and the value-refs appearing in the call's arguments.
+    /// Populated for every `let V = call(..)` shape.  Powers the
+    /// "fetch-then-authorize" exemption in `checks.rs`: if a row-fetch
+    /// operation produces variable `V` and SOME auth check elsewhere
+    /// in the unit names `V`, the row-fetch operation is considered
+    /// authorized — even though the check appears textually after the
+    /// fetch.  This is the standard idiom in row-level authz code:
+    /// fetch the row first to extract the resource id, then call
+    /// `check_<resource>_<role>(&user, &row, ...)` to authorize it.
+    pub row_population_data: HashMap<String, (usize, Vec<ValueRef>)>,
     /// Variables bound to an authenticated-user value. Populated from
     /// `let V = require_auth(..).await?` (or any call matching the
     /// configured login-guard / authorization-check names) and from
@@ -196,6 +216,46 @@ pub struct AnalysisUnit {
     /// and treats a subject as covered when the chain terminates in
     /// one of these names.
     pub authorized_sql_vars: HashSet<String>,
+    /// Local variables bound (by `let`, `:=`, `var`, `const`) to a
+    /// pure literal — string, integer, float, or boolean.  These are
+    /// developer-chosen constants and cannot be user-controlled, so
+    /// they must never trip `<lang>.auth.missing_ownership_check`
+    /// even when the variable name passes `is_id_like`.  Closes the
+    /// gin/context_test.go FP where `id := "id"` triggered the rule.
+    pub const_bound_vars: HashSet<String>,
+    /// Function parameter names whose static type maps to a
+    /// payload-incompatible scalar ([`crate::ssa::type_facts::TypeKind::Int`]
+    /// or [`crate::ssa::type_facts::TypeKind::Bool`]).  Populated
+    /// per-file by [`super::apply_typed_bounded_params`] using the
+    /// SSA-derived `VarTypes` map.  Consulted by
+    /// `is_typed_bounded_subject` so parameters like Spring `Long
+    /// userId`, Axum `Path<i64>`, or FastAPI `user_id: int` are not
+    /// classified as scoped-identifier subjects even when their name
+    /// passes `is_id_like` — the framework guarantees the value is a
+    /// number that cannot carry a SQL/file/shell payload.
+    pub typed_bounded_vars: HashSet<String>,
+    /// Phase 6: per-DTO-extractor parameter, the field names whose
+    /// declared type is a payload-incompatible scalar.  Map key is the
+    /// parameter name (e.g. `dto`), value is the list of field names
+    /// (e.g. `["age", "count"]`).  Populated by
+    /// [`super::apply_typed_bounded_params`] only when the parameter
+    /// itself was recognised as a typed extractor by a Phase 1-2
+    /// matcher — bare parameters with no framework gate never lift
+    /// their fields.
+    pub typed_bounded_dto_fields: HashMap<String, Vec<String>>,
+    /// Per-unit dynamic session-base text set, supplementing the
+    /// hard-coded list in `is_self_scoped_session_base`.  Populated by
+    /// the extractor when a parameter's static type signals a known
+    /// auth-context shape — e.g. TRPC's `Options { ctx: { user:
+    /// NonNullable<TrpcSessionUser> } }` adds `<localCtx>.user` so
+    /// downstream `ctx.user.id` accesses count as actor context.  Each
+    /// entry is the dotted base text (e.g. `"ctx.user"`,
+    /// `"opts.ctx.user"`) that should match a subject's `base` when
+    /// the subject's `field` is an id-like field name.  Distinct from
+    /// `self_actor_vars` (single-segment locals) because TRPC
+    /// destructures route through a base chain, not a top-level
+    /// binding.
+    pub self_scoped_session_bases: HashSet<String>,
 }
 
 /// Per-function summary of which positional parameters are