WebGL 2 Architectural Space Cockpit • Zero-Day SAST Linter (185+ Zero-Day Patterns & CWE Rules) • BLAKE3 Cryptographic Governance • Native MCP Server & "Zero-Shell" AI Gateway

English 🇬🇧 | Français 🇫🇷 (Version originale)

AetherScope V2 is a next-generation software engineering environment and security audit cockpit merging four foundational paradigms into a single native engine:

⚡ What is AetherScope V2?

📖 What's New in V2.2.2: GitHub-Grade Markdown Engine, Interactive Mermaid Diagrams, Syntax Highlighting & Diff, Binary Raw File API & Reading KPI Bar

🧬 What's New in V2.2.1: Zig & C#/.NET Support, Community Semgrep, SSA Dataflow, Reachable SCA & Obsidian Vault Mode

🚀 Major SAST Features in V2.1 (Production Ready)

🚀 Quick Start, CLI & Local REST API

🛡️ SAST Engine, Zero-Day Hunting & 185+ CWE Rules Catalog

🤖 Native MCP Server (aetherscope-mcp) & "Zero-Shell" AI Bridge

🔒 "Spec-Driven" Governance, EARS Contracts & BLAKE3 Seal

🏛️ Global Architecture & Cargo Workspace Structure

🎨 WebGL 2 GPU Cockpit: Membranes, Bubbles, Lasers & Layouts

🛠️ Integrated IDE Tooling, Multi-Stack Scaffolding & Export

🕹️ Keyboard Shortcuts, Compilation & Licensing

📄 License

📚 Detailed CWE Rules List (Dedicated Directory)

📖 What's New in V2.2.2: GitHub-Grade Markdown Engine, Interactive Mermaid Diagrams, Syntax Highlighting & Diff, Binary Raw File API & Reading KPI Bar

The left-side documentation inspection panel (#doc-reader-panel) has been completely overhauled in V2.2.2 to deliver a 1:1 GitHub-identical specification and reading experience while remaining 100% functional offline:

flowchart LR A["📄 Markdown / EARS Specification"] --> B["🔍 Tokenizer & Parser V2"] B --> C["📊 Mermaid Diagrams (CDN + Builtin Fallback)"] B --> D["💻 Code Blocks & Gutter GitHub Dark"] B --> E["🖼️ Images & Obsidian Transclusions (/api/raw_file)"] B --> F["📑 Interactive Table of Contents & KPI Bar"]

Loading

1. 📊 Official Mermaid Diagrams (Flowcharts, Sequences, Classes, State Machines)

Official Mermaid.js v10 Engine (CDN): Direct interactive SVG vector rendering for mermaid code blocks.

Built-in Standalone Visual Fallback: When working completely offline or before CDN initialization, an embedded visual tokenizer takes over, translating graph declarations (-->), classes, and sequences into interactive spatial CSS cards.

Dedicated Diagram Toolbar:

📋 Copy: Instant one-click copy of Mermaid raw code to clipboard.

👁️ Code / Render: Seamless toggle between rendered SVG and raw diagram source.

🔍 Fullscreen: High-definition modal zoom with backdrop blur and responsive scaling.

2. 💻 GitHub Dark Syntax Highlighting & Code Interpretation

Official GitHub Dark Theme: Token palette matching GitHub's official syntax theme (keywords #ff7b72, functions/classes #d2a8ff, literals/numbers #79c0ff, strings #a5d6ff, comments #8b949e, built-ins #ffa657).

Highlight.js CDN + Embedded Offline Regex Engine: Instant high-speed highlighting across 14+ major programming languages (Rust, Python, JavaScript, TypeScript, Bash/Shell, PowerShell, JSON, TOML, YAML, Diff, HTML, SVG, SQL, Zig, C#) even without an active internet connection.

Line Numbers (GitHub Gutter .doc-code-gutter): Clean line numbering column with unselectable numerals (user-select: none).

Surgical Copy Without Line Numbers: The 📋 Copy button copies only clean code, animating to ✅ Copied! for 2 seconds with toast notification.

Special Git Diff Formatting: diff blocks feature line-by-line GitHub highlighting (additions + in translucent green #aff5b4, deletions - in translucent red #ffdcd7, metadata @@ in cyan).

Interactive Preview for HTML & SVG: 👁️ Preview button to toggle live component rendering in an isolated viewport.

3. 🖼️ Binary Raw File Endpoint /api/raw_file & Local Images

Local Media Support: Direct rendering for relative project images (./assets/diagram.png, images/schema.svg, etc.) and remote shields.io badges.

Obsidian Wiki-Transclusions: Seamless resolution of Obsidian transclusion syntax ![[image_name.png]] routed automatically through /api/raw_file.

Automatic MIME Detection: Proper content-type headers for image/png, image/svg+xml, image/jpeg, image/webp, and text/plain.

4. 📑 Interactive Table of Contents (TOC), KPI Metrics Bar & Search

Header KPI Bar: Real-time reading time estimation (200 words/min), word count, line count, diagram count, image counter, EARS / BLAKE3 cryptographic seal indicator, and clickable absolute path.

Collapsible Hierarchical TOC: Auto-generated from markdown headings # through ###### with smooth anchor jumps (scrollToHeading).

Instant Document Search: Filter bar with occurrence highlighting and previous/next navigation (▲ / ▼).

Dynamic Panel Width Toggle: ↔️ Width button cycling the documentation panel through Standard (520px) ➔ Wide (880px) ➔ Fullscreen (95vw).

🧬 What's New in V2.2.1: Zig & C#/.NET Support, Community Semgrep, SSA Dataflow, Reachable SCA & Obsidian Vault Mode

1. 📓 Obsidian Vault Mode & Dual-Vision Cockpit (crates/obsidian-vault)

Automatic Tri-Mode Detection & Classification: Automatically classifies the scanned directory:

PureObsidianVault: Pure markdown vault (.obsidian/ folder or high density of wikilinks, 0 code) — defaults to Vault Notes view.

PureCode: Classic code project (Rust, C#, Zig, PHP, Python, etc.) — defaults to Code Architecture view.

Mixed: Hybrid directory combining source code and Obsidian knowledge base — provides both views with instant real-time toggling.

Markdown Parser & Comprehensive Obsidian Syntax (parser.rs):

Wikilinks & Aliases: [[note]], [[note|custom alias]], resolved by relative path and file stem.

Section Anchors & Block Refs: [[note#Section Title]], self-anchors [[#Title]], and block references [[note#^block-id]].

Transclusions & Media Inclusions: ![[Diagram.png]], ![[Note#Section]] generating render edges (EdgeType::Render).

Hierarchical Tags & YAML Frontmatter: Inline tags #tag, #project/roadmap, YAML metadata attributes (tags: [...], aliases: [...]) with strict masking of code blocks and CommonMark comments.

Backlinks & Ghost Notes: Automatic bidirectional degree calculation (in_degree, out_degree) and creation of «GhostNote» bubbles for uncreated reference links.

Security & Strict Confinement (confinement.rs — Zero CWE-22 Path Traversal):

PathGuard module and TargetJail: strict rejection of directory traversals (..), UNC network paths (\server\share), drive letters (C:\Windows), null bytes (\0), and symlinks pointing outside the project root.

Real-Time Dual-Vision WebGL 2 Switcher:

View switcher in the top #serverbar and Vision menu with shortcuts Alt + 1 (Code) and Alt + 2 (Vault Notes).

Smooth topology swap without page reload via POST /api/view_mode and off-thread GPU physics refresh.

Dual-Vision Standalone Export: Standalone HTML exports (aetherscope_viewer.html and docs/index.html) embed both graphs (window.AETHERSCOPE_DUAL_GRAPH) for full offline toggling.

2. ⚡ Native Zig Support (ast-scanner + 15 CWE Rules + Taint Tracking)

Zig AST Extraction & Lexer (scanner.rs, lexer.rs): Parallel parsing for struct, packed struct, extern struct, union(enum), error, pub fn, @import, and @cImport, with lexical masking of multiline strings \ and automatic truncation of test "..." {} blocks.

15 Zig SAST Rules (zig_rules.rs):

Memory & Pointers: CVE-ZIG-USE-AFTER-FREE (CWE-416), CVE-ZIG-RAW-ALLOCATOR-LEAK (CWE-401), CVE-ZIG-STACK-ADDRESS-RETURN (CWE-562), CVE-ZIG-UNINITIALIZED-MEMORY (CWE-457), CVE-ZIG-INSECURE-POINTER-CAST (CWE-843).

Arithmetic, SIMD & Compiler: CVE-ZIG-INTEGER-OVERFLOW-WRAPPING (+%/-%/*%, CWE-190), CVE-ZIG-SIMD-VECTOR-UNALIGNED-OOB (@Vector, CWE-125), CVE-ZIG-RUNTIME-SAFETY-DISABLED (@setRuntimeSafety(false), CWE-676), CVE-ZIG-UNHANDLED-ERROR-UNION (_ = fallible(), CWE-703).

C-ABI Interoperability, OS & Crypto: CVE-ZIG-BUFFER-OVERRUN-C-INTEROP (CWE-119), CVE-ZIG-UNPROTECTED-C-FORMAT-STRING (CWE-134), CVE-ZIG-COMMAND-INJECTION (std.process.Child, CWE-78), CVE-ZIG-PATH-TRAVERSAL (CWE-22), CVE-ZIG-TLS-VERIFY-DISABLED (CWE-295), CVE-ZIG-WEAK-PRNG-CRYPTO (DefaultPrng, CWE-338).

3. 🔷 Native C# / .NET 8+ Support (ast-scanner + 20 CWE Rules + Taint Tracking)

C# AST Extraction & Lexer (scanner.rs, lexer.rs): File-scoped and block namespace, class, record, struct, interface, properties, async/Task<T> methods, ASP.NET Core endpoints ([HttpGet], [HttpPost], [Route], Minimal APIs app.MapGet/MapPost), with verbatim @"..." and raw string """...""" masking.

20 C# / .NET SAST Rules (csharp_rules.rs):

Injections & RCE: CVE-CS-INSECURE-DESERIALIZATION (BinaryFormatter/TypeNameHandling, CWE-502), CVE-CS-SQL-INJECTION (SqlCommand/ExecuteSqlRaw/Dapper, CWE-89), CVE-CS-COMMAND-INJECTION (Process.Start, CWE-78), CVE-CS-UNSAFE-REFLECTION-INVOKE (Type.GetType/CSharpScript, CWE-470), CVE-CS-XXE-INJECTION (CWE-611), CVE-CS-LDAP-INJECTION (CWE-90).

Web, API & ASP.NET Core: CVE-CS-SSRF-HTTPCLIENT (CWE-918), CVE-CS-XSS-RAW-HTML (Html.Raw/HtmlString, CWE-79), CVE-CS-OPEN-REDIRECT (CWE-601), CVE-CS-MASS-ASSIGNMENT (TryUpdateModelAsync, CWE-915), CVE-CS-CSRF-DISABLED ([IgnoreAntiforgeryToken], CWE-352), CVE-CS-PATH-TRAVERSAL (CWE-22), CVE-CS-SENSITIVE-ERROR-EXPOSURE (ex.StackTrace, CWE-209).

Auth, Crypto & Runtime: CVE-CS-JWT-VALIDATION-BYPASS (TokenValidationParameters, CWE-347), CVE-CS-TLS-CERT-BYPASS (DangerousAcceptAnyServerCertificateValidator, CWE-295), CVE-CS-HARDCODED-CREDENTIALS (CWE-798), CVE-CS-WEAK-CRYPTOGRAPHY (MD5/SHA1/DES/ECB, CWE-327), CVE-CS-INSECURE-RANDOM (System.Random, CWE-330), CVE-CS-REDOS-UNBOUNDED-REGEX (CWE-1333), CVE-CS-UNSAFE-STACKALLOC-OVERFLOW (stackalloc, CWE-787).

4. 🧬 Community Semgrep Rules (100% Offline, No Cloud Account Required)

22 OWASP Top 10 / CWE Top 25 Rules compiled directly into the binary (community_owasp_cwe.yaml, community_bundle.rs), active upon first startup.

On-Demand Synchronization & hot-reload in .aether/plugins/: aether-plugin-tool.exe download-semgrep-rules --output .aether/plugins aether-plugin-tool.exe download-semgrep-rules --offline aether-plugin-tool.exe import-semgrep --input ./semgrep-rules --output .aether/plugins/imported

5. 🔗 Inter-Procedural SSA Dataflow Taint Tracking

Dedicated crates/core-graph/src/dataflow/ module: exact variable versioning (SsaVar), def-use chains, inter-procedural propagation, and cycle-resistant traversals.

CWE-Specific Sanitizer Catalog (sanitizer_catalog.rs): Data filtered through sanitize(x) will not trigger a Sink alert. Unsanitized flows produce complete propagation traces.

6. 📦 Reachable Dependencies SCA (OSV.dev)

Native parsers for Cargo.lock, package-lock.json, and composer.lock (crates/security-linter/src/sca/).

OSV.dev queries with BLAKE3-signed persistent disk caching: full offline scanning capability following initial synchronization.

Cross-referencing with call graphs: only vulnerable dependencies whose functions are directly reached from an Entrypoint are flagged as reachable.

🚀 Major SAST Features in V2.1 (Production Ready)

1. Standard SARIF v2.1.0 Serializer (OASIS & GitHub Code Scanning)

Native SARIF 2.1.0 Generation: Implemented in crates/security-linter/src/sarif.rs, fully compatible with GitHub Security / Code Scanning Alerts.

Ultra-Fast CI/CD CLI:

Generate a standard SARIF report

aether-engine.exe --path . --audit-only --format sarif --output results.sarif

Block Pull Requests in < 100 ms if critical or high vulnerabilities are found

aether-engine.exe --path . --audit-only --format sarif --output results.sarif --fail-on HIGH

Turnkey GitHub Actions Workflow: Pre-configured .github/workflows/aetherscope-sarif.yml included.

2. Reachability 3D Taint-Graph (Source-to-Sink)

Reverse BFS Algorithm: High-speed graph traversal in crates/core-graph/src/reachability.rs connecting every CVE Sink to public entrypoints (SymbolKind::FormOrEndpoint) through RPC, WebSocket, and semantic call pathways.

3D WebGL 2 Visualization: 🔥 EXPLOITABLE (Source-to-Sink) badge in