Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/cfg_analysis/error_handling.rs

@@ -4,6 +4,32 @@ use crate::patterns::Severity;
 use petgraph::graph::NodeIndex;
 use petgraph::visit::EdgeRef;
 
+/// Strict err-identifier match for cfg-error-fallthrough.
+///
+/// The previous heuristic `lower.contains("err")` over-matched method
+/// names like Java `logger.isErrorEnabled()` (the camelCase identifier
+/// `isErrorEnabled` matched because it contains `err`).  The rule's
+/// real target is a variable / field that holds an error value.
+///
+/// Returns true if the identifier is exactly `err` / `error` or a
+/// snake-case error name (`err_x`, `error_x`, `x_err`, `x_error`).
+/// CamelCase names (`isErrorEnabled`, `getError`, `errorMsg`) are
+/// rejected — the cost is occasional FNs on Java-style error fields,
+/// which is acceptable for a precision fix.
+fn is_error_var_ident(name: &str) -> bool {
+    let lower = name.to_ascii_lowercase();
+    if lower == "err" || lower == "error" {
+        return true;
+    }
+    if lower.starts_with("err_") || lower.starts_with("error_") {
+        return true;
+    }
+    if lower.ends_with("_err") || lower.ends_with("_error") {
+        return true;
+    }
+    false
+}
+
 /// Does the condition text contain a unary `!` (logical-not, NOT `!=`)
 /// applied to an identifier or member chain whose name contains "err"?
 ///
@@ -137,14 +163,31 @@ fn terminates_on_all_paths(
     true
 }
 
-/// Find successor nodes after an If node merges (nodes reachable from both branches).
+/// Find successor nodes after an If node merges.
+///
+/// Walks **only** the False edge of the if (and Seq edges from there),
+/// so that sinks inside the True body are NOT counted as "post-if"
+/// fallthrough sinks.  The False edge represents the no-error branch,
+/// which is the path the rule wants to scan for "did execution fall
+/// through past an unhandled error?".
+///
+/// For `if err != nil { warn(); }` with no statement after the if,
+/// the False edge leads to the function exit and no sinks are found.
+/// For `if err != nil { warn(); } sink(x)`, the False edge leads to
+/// `sink(x)` and the rule fires correctly.
 fn find_post_if_sinks(cfg: &crate::cfg::Cfg, if_node: NodeIndex) -> Vec<NodeIndex> {
     let mut sinks_after = Vec::new();
-
-    // Get all successors of the if node's merge point
-    // Walk through successors looking for sinks
     let mut visited = std::collections::HashSet::new();
-    let mut stack: Vec<NodeIndex> = cfg.neighbors(if_node).collect();
+
+    // Seed from the False edge only.  If the if has no explicit False
+    // edge (some CFG shapes omit it for one-branch ifs), fall back to
+    // Seq edges from the if node — but never follow True edges, which
+    // lead into the body.
+    let mut stack: Vec<NodeIndex> = cfg
+        .edges(if_node)
+        .filter(|e| matches!(e.weight(), EdgeKind::False | EdgeKind::Seq))
+        .map(|e| e.target())
+        .collect();
 
     while let Some(current) = stack.pop() {
         if !visited.insert(current) {
@@ -156,13 +199,13 @@ fn find_post_if_sinks(cfg: &crate::cfg::Cfg, if_node: NodeIndex) -> Vec<NodeInde
             sinks_after.push(current);
         }
 
-        for succ in cfg.neighbors(current) {
-            let is_back_edge = cfg
-                .edges(current)
-                .any(|e| e.target() == succ && matches!(e.weight(), EdgeKind::Back));
-            if !is_back_edge {
-                stack.push(succ);
+        for edge in cfg.edges(current) {
+            let succ = edge.target();
+            // Don't follow back edges (loops) or exception edges.
+            if matches!(edge.weight(), EdgeKind::Back | EdgeKind::Exception) {
+                continue;
             }
+            stack.push(succ);
         }
     }
 
@@ -193,10 +236,7 @@ impl CfgAnalysis for IncompleteErrorHandling {
                 continue;
             }
 
-            let mentions_err = info.condition_vars.iter().any(|u| {
-                let lower = u.to_ascii_lowercase();
-                lower == "err" || lower == "error" || lower.contains("err")
-            });
+            let mentions_err = info.condition_vars.iter().any(|u| is_error_var_ident(u));
 
             if !mentions_err {
                 continue;
@@ -289,3 +329,45 @@ mod negation_tests {
         assert!(!contains_negated_err_identifier("hasError(x)"));
     }
 }
+
+#[cfg(test)]
+mod err_ident_tests {
+    use super::is_error_var_ident;
+
+    #[test]
+    fn matches_canonical_error_vars() {
+        assert!(is_error_var_ident("err"));
+        assert!(is_error_var_ident("error"));
+        assert!(is_error_var_ident("ERR"));
+        assert!(is_error_var_ident("Error"));
+    }
+
+    #[test]
+    fn matches_snake_case_error_vars() {
+        assert!(is_error_var_ident("err_resp"));
+        assert!(is_error_var_ident("error_msg"));
+        assert!(is_error_var_ident("response_err"));
+        assert!(is_error_var_ident("parse_error"));
+    }
+
+    #[test]
+    fn rejects_camelcase_method_names() {
+        // Spring `logger.isErrorEnabled()` lifts `isErrorEnabled` into
+        // `condition_vars`; under the old `lower.contains("err")` check
+        // this fired the rule.  The new strict check rejects it — the
+        // condition is asking "is logging enabled", not "is there an
+        // error".
+        assert!(!is_error_var_ident("isErrorEnabled"));
+        assert!(!is_error_var_ident("getError"));
+        assert!(!is_error_var_ident("hasError"));
+        assert!(!is_error_var_ident("errorMsg"));
+        assert!(!is_error_var_ident("errCode"));
+    }
+
+    #[test]
+    fn rejects_unrelated_idents() {
+        assert!(!is_error_var_ident("user"));
+        assert!(!is_error_var_ident("merry"));
+        assert!(!is_error_var_ident("perform"));
+    }
+}

src/cfg_analysis/guards.rs

@@ -266,6 +266,10 @@ fn ssa_operand_const_or_param(
             }
             SsaOp::Source => return false,
             SsaOp::Nop | SsaOp::Undef => {}
+            // FieldProj: walk the receiver — `obj.f` is constant iff `obj`
+            // is constant under the same definition.  The field name itself
+            // is structural and adds no runtime value.
+            SsaOp::FieldProj { receiver, .. } => stack.push(*receiver),
         }
     }
     true
@@ -332,6 +336,9 @@ fn ssa_operand_constant(
             // Undef is a non-user, non-dynamic sentinel — treat like Const
             // (no additional operands to trace).
             SsaOp::Undef => {}
+            // FieldProj: structural field read; constness reduces to the
+            // receiver's constness.
+            SsaOp::FieldProj { receiver, .. } => stack.push(*receiver),
         }
     }
     true

src/cfg_analysis/mod.rs

@@ -28,6 +28,15 @@ pub struct BodyConstFacts {
     pub ssa: SsaBody,
     pub const_values: HashMap<SsaValue, ConstLattice>,
     pub type_facts: TypeFactResult,
+    /// Field-sensitive Steensgaard points-to facts.
+    ///
+    /// Computed only when [`crate::pointer::is_enabled()`] (i.e. the
+    /// `NYX_POINTER_ANALYSIS=1` env var is set).  Phase 2 of the
+    /// pointer-analysis rollout consumes this in `state::transfer.rs`
+    /// to suppress proxy-acquire mis-attribution on field-aliased
+    /// locals like `m := c.mu`.  When `None`, every consumer must fall
+    /// back to its existing pointer-unaware behaviour.
+    pub pointer_facts: Option<crate::pointer::PointsToFacts>,
 }
 
 /// Lower a body to SSA and run constant propagation.  Returns `None` when
@@ -42,11 +51,22 @@ pub fn build_body_const_facts(body: &crate::cfg::BodyCfg, lang: Lang) -> Option<
         &body.meta.params,
     )
     .ok()?;
-    let opt = crate::ssa::optimize_ssa(&mut ssa, &body.graph, Some(lang));
+    let opt = crate::ssa::optimize_ssa_with_param_types(
+        &mut ssa,
+        &body.graph,
+        Some(lang),
+        &body.meta.param_types,
+    );
+    let pointer_facts = if crate::pointer::is_enabled() {
+        Some(crate::pointer::analyse_body(&ssa, body.meta.id))
+    } else {
+        None
+    };
     Some(BodyConstFacts {
         ssa,
         const_values: opt.const_values,
         type_facts: opt.type_facts,
+        pointer_facts,
     })
 }