Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/benchmark/cve_corpus/javascript/CVE-2025-64430/patched.js

@@ -0,0 +1,32 @@
+// Nyx CVE benchmark fixture (patched counterpart).
+//
+// CVE:        CVE-2025-64430
+// Project:    Parse Server (parse-community/parse-server)
+// License:    Apache-2.0  (https://github.com/parse-community/parse-server/blob/alpha/LICENSE)
+// Advisory:   https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx
+// Patched:    97763863b72689a29ad7a311dfb590c3e3c50585 src/Routers/FilesRouter.js (PR #9903)
+//
+// Patched-fix simplification: upstream removed the entire URI-backed
+// upload path (the feature "never worked and reliably crashes the
+// server" per the advisory). The `http` import and both
+// `downloadFileFromURI` / `addFileDataIfNeeded` URI branches are gone.
+// Below is the post-patch shape: only raw bytes are accepted; no
+// outbound HTTP fetch from user input is possible.
+
+const express = require('express');
+const app = express();
+app.use(express.json());
+
+const addFileDataIfNeeded = async file => {
+  return file;
+};
+
+app.post('/files/:filename', async (req, res) => {
+  if (typeof req.body !== 'object' || req.body.bytes == null) {
+    res.status(400).json({ error: 'invalid file' });
+    return;
+  }
+  const file = { _data: Buffer.from(req.body.bytes) };
+  await addFileDataIfNeeded(file);
+  res.json({ ok: true });
+});

tests/benchmark/cve_corpus/javascript/CVE-2025-64430/vulnerable.js

@@ -0,0 +1,56 @@
+// Nyx CVE benchmark fixture.
+//
+// CVE:        CVE-2025-64430
+// Project:    Parse Server (parse-community/parse-server)
+// License:    Apache-2.0  (https://github.com/parse-community/parse-server/blob/alpha/LICENSE)
+// Advisory:   https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx
+// Vulnerable: 52bfb186fc4790073ac258bb30a7c599f469471e src/Routers/FilesRouter.js:7,10-32
+//
+// Parse Server's file-upload router accepted a `Parse.File` whose
+// `_source.format === 'uri'` and silently fetched `_source.uri` server-
+// side via `http.get(uri, ...)`. An attacker passing a crafted URI in
+// the upload payload (or anywhere a `Parse.File` round-trips through
+// Cloud Code) caused the server to request arbitrary internal hosts —
+// classic SSRF.
+//
+// Trims: imports `express`, `Parse`, `Config`, `logger`, `triggers`,
+//   `Utils` (only `http` and `express` are load-bearing); class wrapper
+//   `FilesRouter`, route-mount boilerplate, getHandler/createHandler/
+//   deleteHandler bodies, master-key/anonymous-user gate, mime sniffing,
+//   trigger pipeline, file extension validation, content-type handling.
+
+const express = require('express');
+const http = require('http');
+const app = express();
+app.use(express.json());
+
+const downloadFileFromURI = uri => {
+  return new Promise((res, rej) => {
+    http
+      .get(uri, response => {
+        response.setDefaultEncoding('base64');
+        let body = `data:${response.headers['content-type']};base64,`;
+        response.on('data', data => (body += data));
+        response.on('end', () => res(body));
+      })
+      .on('error', e => {
+        rej(`Error downloading file from ${uri}: ${e.message}`);
+      });
+  });
+};
+
+const addFileDataIfNeeded = async file => {
+  if (file._source.format === 'uri') {
+    const base64 = await downloadFileFromURI(file._source.uri);
+    file._previousSave = file;
+    file._data = base64;
+    file._requestTask = null;
+  }
+  return file;
+};
+
+app.post('/files/:filename', async (req, res) => {
+  const file = { _source: req.body };
+  await addFileDataIfNeeded(file);
+  res.json({ ok: true });
+});