Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/benchmark/corpus/cpp/cmdi/cmdi_class_inline_method.cpp

@@ -0,0 +1,29 @@
+// Phase 4 (cpp-precision): a tainted env var flows through an
+// inline-defined class member function into `std::system()`.
+//
+// Pre-Phase-4, the C++ KINDS map left `class_specifier` unmapped,
+// which made the CFG walker treat the entire class declaration as a
+// single leaf `Seq` node — inline member-function bodies were never
+// extracted as separate functions and intra-file calls like
+// `inner.run(input)` could not resolve to the body summary.
+//
+// With `class_specifier` (and `struct_specifier`/`union_specifier`/
+// `enum_specifier`/`template_declaration`/`linkage_specification`)
+// mapped to `Kind::Block`, the walker descends into the body and
+// inline methods participate in summary resolution.
+
+#include <cstdlib>
+
+class Inner {
+public:
+    void run(const char* arg) {
+        std::system(arg);              // SHELL_ESCAPE sink
+    }
+};
+
+int main() {
+    char *input = std::getenv("USER_CMD");
+    Inner inner;
+    inner.run(input);                  // resolves to Inner::run
+    return 0;
+}

tests/benchmark/corpus/cpp/cmdi/cmdi_lambda_passthrough.cpp

@@ -0,0 +1,18 @@
+// Phase 3 (cpp-precision): tainted user input flows through a C++ lambda
+// that returns its argument unchanged. The default Call-arg propagation
+// in the SSA taint engine carries the argument's taint into the result,
+// so the downstream system() shell sink fires.
+//
+// This fixture pins the "lambda as identity-passthrough" behaviour;
+// captures and lambda-body sanitisation through summaries are separate
+// Phase 7 / summary work and are deliberately not exercised here.
+
+#include <cstdlib>
+#include <string>
+
+int main() {
+    char *input = std::getenv("USER_CMD");
+    auto echo = [](const char* s) { return s; };
+    std::system(echo(input));         // SHELL_ESCAPE sink — must fire
+    return 0;
+}

tests/benchmark/corpus/cpp/cmdi/cmdi_stl_vector_string.cpp

@@ -0,0 +1,19 @@
+// Phase 2 (cpp-precision): tainted user input is stored in a
+// std::vector<std::string>, then read back via `front()` and converted
+// to a `char*` via `c_str()`.  The c_str() conversion must propagate
+// taint from the receiver to the result so that the downstream
+// `system()` shell sink fires.
+
+#include <cstdlib>
+#include <string>
+#include <vector>
+
+int main() {
+    char *input = std::getenv("USER_CMD");
+    std::vector<std::string> commands;
+    commands.push_back(input);            // store tainted string
+
+    std::string cmd = commands.front();   // load tainted string
+    std::system(cmd.c_str());             // SHELL_ESCAPE sink
+    return 0;
+}

tests/benchmark/corpus/cpp/safe/safe_builder_const_host.cpp

@@ -0,0 +1,23 @@
+// Phase 5 (cpp-precision): a fluent builder chain whose host is a
+// hardcoded literal. Even though `.connect()` is an SSRF sink, the
+// host carries no taint, so the engine must not fire on this chain.
+// Counterpart to `ssrf_builder_user_host.cpp`.
+
+#include <cstdlib>
+#include <string>
+
+class Socket {
+public:
+    static Socket builder() { return Socket(); }
+    Socket& host(const std::string& h) { host_ = h; return *this; }
+    Socket& port(int p) { port_ = p; return *this; }
+    void connect() {}
+private:
+    std::string host_;
+    int port_ = 0;
+};
+
+int main() {
+    Socket::builder().host("api.example.com").port(8080).connect();
+    return 0;
+}

tests/benchmark/corpus/cpp/safe/safe_stl_vector_int.cpp

@@ -0,0 +1,25 @@
+// Phase 1 (cpp-precision): a tainted env var is sanitised through
+// `std::stoi` *before* being stored in a `std::vector<int>`. The vector
+// itself is treated by the engine as a Store/Load container, but every
+// value flowing through it is a sanitised integer, so neither the
+// sprintf nor the `system()` sink should fire.
+
+#include <cstdio>
+#include <cstdlib>
+#include <string>
+#include <vector>
+
+int main() {
+    char *input = std::getenv("PORT_NUM");
+    int port = std::stoi(input);          // sanitiser: clears Cap::all()
+
+    std::vector<int> ports;
+    ports.push_back(port);                // store sanitised int
+
+    int p = ports.front();                // load sanitised int
+
+    char buf[256];
+    std::snprintf(buf, sizeof(buf), "ping -c 1 -p %d localhost", p);
+    std::system(buf);                     // shell sink with no tainted data
+    return 0;
+}

tests/benchmark/corpus/cpp/ssrf/ssrf_builder_user_host.cpp

@@ -0,0 +1,26 @@
+// Phase 5 (cpp-precision): a tainted env var flows through a fluent
+// builder chain (`Socket::builder().host(h).port(p).connect()`). The
+// terminal `.connect()` is the SSRF sink; the chained `.host(...)` /
+// `.port(...)` calls return the receiver and carry argument taint
+// onto the chain via the engine's default Call-arg propagation, so
+// the tainted host reaches the connect sink.
+
+#include <cstdlib>
+#include <string>
+
+class Socket {
+public:
+    static Socket builder() { return Socket(); }
+    Socket& host(const std::string& h) { host_ = h; return *this; }
+    Socket& port(int p) { port_ = p; return *this; }
+    void connect() {}
+private:
+    std::string host_;
+    int port_ = 0;
+};
+
+int main() {
+    char *user_host = std::getenv("REMOTE_HOST");
+    Socket::builder().host(user_host).port(8080).connect();   // SSRF sink
+    return 0;
+}