Proxy/redirect support for log review, FP reduction, UAE Luhn tiering, cleanup

[SNGWN]

What & why

Four improvement tracks: restricted-network access for log review, false-positive reduction, UAE compliance precision, and dead-code cleanup.

Restricted-network access (--mode logs / --mode search)

Bank networks rarely expose Kibana directly. The client now handles the three common obstacles:

• Forward proxy — new --proxy flag with HTTPS_PROXY / HTTP_PROXY env fallback and NO_PROXY host-suffix support. HTTPS targets tunnel via CONNECT; plain-HTTP targets use absolute-URI forwarding. Proxy credentials ride in the URL userinfo, are sent only as Proxy-Authorization, and are scrubbed from every banner and error message.
• Redirect following — the Kibana/ES client follows 301/302/303/307/308 chains (max 5 hops), so http→https upgrades, SSO gateways, and LB host canonicalization no longer fail opaquely. Authorization is forwarded only on same-origin hops — a cross-origin redirect target never receives the credential. Loops fail fast with the scrubbed chain in the error.
• Unverified certificates — --insecure (private CAs) applies identically through proxy tunnels: target-cert validation is enforced at the TLS layer above the CONNECT socket.

False-positive reduction

• BCR-CRYPTO-006 (timing-unsafe comparison) now matches the secret-name pattern against the comparand's terminal identifier rather than full text, skips PascalCase enum/constant members (ts.SyntaxKind.BarBarToken no longer flags on /token/), and skips presence/metadata checks (token === undefined, sig.length === 64, typeof token === 'string'). Self-scan findings: 27 → 0.
• The few genuinely self-referential matches in the scanner's own source carry inline bcr-disable suppressions with reasons, rather than weakening detectors.
• New FP fixture shapes pin the enum/presence patterns in the regression suite.

UAE log-review improvements

• LOG-PII-001 (Emirates ID) gains Luhn check-digit tiering: shape + birth-year + checksum-valid → HIGH (near-certain real EID); shape-only → still reported (recall preserved for national IDs) but MEDIUM with explicit verify wording. Descriptions now cite UAE PDPL Art. 4/5/24 and CBUAE Consumer Protection Standards.

Cleanup

• src/utils/constants.ts trimmed from 13 exports to the 2 with actual consumers — the other 11 had zero references and drifted from real detector logic.

Docs

• README: new "Restricted-network access" and "UAE compliance specifics" sections, --proxy rows in both input tables.
• CHANGELOG updated under Unreleased.

Testing

• 7 new transport tests run against real local HTTP servers: same-origin redirect with auth forwarding, cross-origin auth stripping, redirect-loop guard, proxy absolute-URI forwarding, CONNECT failure with credential scrubbing, invalid-proxy-URL rejection.
• Emirates ID Luhn tier tests (HIGH vs MEDIUM + wording).
• Full suite: 317/317 pass; tsc --noEmit clean; self-scan reports 0 findings.

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR improves log-review usability in restricted enterprise/bank networks by enhancing the Kibana/Elasticsearch client transport (proxy + redirects), reduces scanner false positives (notably BCR-CRYPTO-006), increases UAE Emirates ID detection precision via Luhn tiering, and removes dead constants.

Changes:

• Add forward-proxy support and redirect following to the Kibana/ES client, with credential scrubbing and new transport tests.
• Reduce false positives in BCR-CRYPTO-006 by using terminal-identifier matching and skipping presence/metadata comparisons; add regression fixtures.
• Add Luhn-based severity tiering to LOG-PII-001 (Emirates ID) and update docs/changelog accordingly; trim unused exports from src/utils/constants.ts.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/logRules.test.ts	Adds tests for Emirates ID Luhn tiering (HIGH vs MEDIUM).
tests/logReviewAnalyzer.test.ts	Updates EID fixture to use a Luhn-valid number for expected HIGH-severity behavior.
tests/kibanaClientTransport.test.ts	New integration-style transport tests for redirects and forward proxy behavior.
tests/fixtures/fp-regression-safe.ts	Adds FP fixtures covering enum-member and presence/metadata comparison shapes.
src/utils/constants.ts	Removes unused constant exports; keeps only actively-consumed lists.
src/poc/PocGenerator.ts	Adds inline suppression to prevent self-scanner false positives in remediation templates.
src/logs/logRules.ts	Implements Emirates ID Luhn tiering and updated PDPL/CBUAE wording.
src/logs/kibanaClient.ts	Implements proxy support, redirect following, and credential scrubbing in transport layer.
src/index.ts	Adds --proxy CLI option and env/NO_PROXY resolution logic; logs scrubbed proxy value.
src/detectors/jwtBypassDetector.ts	Adds inline suppression for self-referential pattern strings.
src/detectors/cryptoWeaknessDetector.ts	Refines timing-unsafe comparison heuristic to reduce false positives.
README.md	Documents restricted-network access and UAE specifics; adds --proxy to tables.
CHANGELOG.md	Documents new proxy/redirect behavior, FP reductions, UAE tiering, and constants cleanup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.