scryer 0.3.0 → 1.1.1

data/lib/scryer/cli.rb

@@ -9,7 +9,7 @@ module Scryer
   # only needed for this CLI entry point, not when the gem is required
   # inside a host app.
   class CLI
-    EXTENSION_FORMATS = { ".json" => "json", ".html" => "html", ".htm" => "html", ".csv" => "csv" }.freeze
+    EXTENSION_FORMATS = { ".json" => "json", ".html" => "html", ".htm" => "html", ".csv" => "csv", ".sarif" => "sarif" }.freeze
 
     def initialize(argv, stdout: $stdout, stderr: $stderr)
       @argv = argv
@@ -21,6 +21,12 @@ module Scryer
     # found (so `scryer -o report.json` can gate CI the way `brakeman -o
     # report.json` does), 2 on a usage error.
     def run
+      # `scryer verify` is a distinct subcommand, not a flag on the normal
+      # scan — it takes its own small option set (--rule/--file/--path) that
+      # would collide with the main parser's -p/-o meanings, so it's
+      # dispatched before the main OptionParser ever sees the rest of argv.
+      return run_verify(@argv[1..]) if @argv.first == "verify"
+
       options = parse(@argv)
       return 0 if options[:exit_early]
 
@@ -50,12 +56,20 @@ module Scryer
       dependency_findings = []
       if ran_deps
         @stdout.puts "Scryer: querying OSV.dev for known-vulnerable gems (needs network)..."
-        dependency_findings = DependencyAudit.insecure_sources(root) + DependencyAudit.vulnerable_gems(root)
+        dependency_findings = DependencyAudit.insecure_sources(root) + DependencyAudit.vulnerable_gems(root) +
+                               DependencyAudit.ruby_eol_check(root) + DependencyAudit.credentials_exposure_check(root)
+      end
+
+      return save_baseline(options[:save_baseline], result, dependency_findings) if options[:save_baseline]
+
+      fixed_count = 0
+      if options[:baseline]
+        dependency_findings, fixed_count = apply_baseline(options[:baseline], result, dependency_findings)
       end
 
       if Scryer.configuration.ai_client
         @stdout.puts "Scryer: rewriting suggested fixes via the configured AI client..."
-        AiFixSuggester.enhance_result!(result)
+        AiFixSuggester.enhance_result!(result, root: root)
         AiFixSuggester.enhance_many!(dependency_findings) unless dependency_findings.empty?
       end
 
@@ -71,7 +85,8 @@ module Scryer
       outputs = options[:outputs].empty? ? default_outputs(root) : options[:outputs]
       outputs.each { |path| write_report(renderer, path) }
 
-      print_summary(result: result, dependency_findings: dependency_findings, ran_deps: ran_deps, outputs: outputs)
+      print_summary(result: result, dependency_findings: dependency_findings, ran_deps: ran_deps, outputs: outputs,
+                    renderer: renderer, fixed_count: fixed_count, baseline_path: options[:baseline])
 
       result.security_findings.empty? && dependency_findings.empty? ? 0 : 1
     rescue UsageError => e
@@ -91,23 +106,33 @@ module Scryer
 
       @stdout.puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
       vulnerable = DependencyAudit.vulnerable_gems(root)
+      ruby_eol = DependencyAudit.ruby_eol_check(root)
+      credentials_exposure = DependencyAudit.credentials_exposure_check(root)
 
-      (insecure + vulnerable).each do |f|
-        label = f.kind == "insecure_source" ? "[#{f.severity.upcase}] #{f.message}" : "[#{f.severity.upcase}] #{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}"
-        @stdout.puts label
+      (insecure + vulnerable + ruby_eol + credentials_exposure).each do |f|
+        @stdout.puts "[#{f.severity.upcase}] #{dependency_label(f)}"
         @stdout.puts "  fix: #{f.suggested_fix}"
       end
 
-      total = insecure.size + vulnerable.size
-      @stdout.puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, #{vulnerable.size} vulnerable gem)."
+      total = insecure.size + vulnerable.size + ruby_eol.size + credentials_exposure.size
+      @stdout.puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, " \
+                   "#{vulnerable.size} vulnerable gem, #{ruby_eol.size} Ruby EOL, " \
+                   "#{credentials_exposure.size} credentials exposure)."
       total.positive? ? 1 : 0
     end
 
+    def dependency_label(f)
+      return f.message if f.kind == "insecure_source"
+      return "#{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}" if f.advisory_id
+
+      "#{f.gem_name} #{f.installed_version}: #{f.title}"
+    end
+
     # The "one audit command" summary — a single scan's worth of every
     # category Scryer covers (security, performance, duplicate/smelly code,
     # dependencies), the same categories usually split across RuboCop +
     # Brakeman + bundler-audit + Reek, side by side in one box.
-    def print_summary(result:, dependency_findings:, ran_deps:, outputs:)
+    def print_summary(result:, dependency_findings:, ran_deps:, outputs:, renderer:, fixed_count: 0, baseline_path: nil)
       # "Code Quality" is the umbrella label for both duplicate-code groups
       # and rule-based style findings (e.g. frozen_string_literal) — two
       # different detectors, same broad concern, one row in the box.
@@ -123,14 +148,26 @@ module Scryer
       ]
 
       divider = "─" * 32
+      score = renderer.security_score
       @stdout.puts ""
       @stdout.puts "Scryer Audit — #{result.files_scanned} files scanned"
       @stdout.puts divider
       @stdout.puts ""
+      if baseline_path
+        @stdout.puts "Baseline: #{baseline_path} — showing new findings only " \
+                     "(#{fixed_count} fixed since baseline)."
+        @stdout.puts ""
+      end
+      clean_rate = renderer.rules_clean_rate
+      @stdout.puts "Security Score: #{score["score"]}/100 (#{score["grade"]})"
+      @stdout.puts "Checks: #{clean_rate["clean"]}/#{clean_rate["total"]} rules clean (#{clean_rate["percent"]}%)"
+      @stdout.puts ""
       rows.each { |label, count| @stdout.puts summary_row(label, count) }
       @stdout.puts divider
       @stdout.puts summary_row("Total", total)
       @stdout.puts ""
+      print_top_priorities(renderer.top_risks)
+      print_owasp_coverage(renderer.owasp_coverage)
       outputs.each { |path| @stdout.puts "#{format_for(path).upcase} report: #{path}" }
     end
 
@@ -139,6 +176,99 @@ module Scryer
       "#{label.ljust(14)}#{value.rjust(20)}"
     end
 
+    # The categories above are counted separately, but nothing else ranks
+    # across them — this is what actually backs "tells you what to fix
+    # first" rather than just splitting findings into four buckets. Same
+    # data ReportRenderer#top_risks already sorts for the HTML report.
+    def print_top_priorities(risks)
+      return if risks.empty?
+
+      @stdout.puts "Top priorities:"
+      risks.each_with_index do |r, i|
+        @stdout.puts "  #{i + 1}. [#{r[:severity]}] #{r[:category]} — #{r[:label]} (#{r[:location]})"
+      end
+      @stdout.puts ""
+    end
+
+    # Byproduct of every security rule carrying an owasp_category — see
+    # ReportRenderer#owasp_coverage. Scryer's own best-effort tagging, not an
+    # OWASP-audited mapping (documented in full in the README).
+    def print_owasp_coverage(coverage)
+      return if coverage.empty?
+
+      @stdout.puts "OWASP Top 10 (2021) coverage:"
+      coverage.each { |category, count| @stdout.puts "  #{category}: #{count} finding#{"s" unless count == 1}" }
+      @stdout.puts ""
+    end
+
+    # `scryer verify --rule RULE_ID --file PATH` — re-parses just that one
+    # file and re-runs just that one rule against it, independent of a full
+    # scan. Meant to run right after applying a fix (by hand or via an LLM)
+    # to confirm the specific finding it targeted is actually gone, without
+    # waiting on/paying for a full project scan. Deliberately narrower than
+    # "did this fix introduce a NEW finding elsewhere" — that's what a normal
+    # `scryer` run (or `--baseline`) already answers; this only answers "does
+    # the one thing I just tried to fix still fire."
+    def run_verify(argv)
+      options = {}
+
+      parser = OptionParser.new do |opts|
+        opts.banner = "Usage: scryer verify --rule RULE_ID --file PATH [--path ROOT]"
+        opts.on("--rule RULE_ID", "The rule_id to re-check (required) — see `scryer verify --list-rules`.") { |v| options[:rule] = v }
+        opts.on("--file PATH", "File to re-scan (required) — relative to --path, or absolute.") { |v| options[:file] = v }
+        opts.on("--path ROOT", "Project root PATH is relative to (default: current directory).") { |v| options[:root] = v }
+        opts.on("--list-rules", "List every known rule_id and exit.") { options[:list_rules] = true }
+        opts.on("-h", "--help", "Show this help.") { options[:exit_early] = true; @stdout.puts opts }
+      end
+
+      begin
+        parser.parse!(argv)
+      rescue OptionParser::ParseError => e
+        raise UsageError, "#{e.message}\n#{parser}"
+      end
+      return 0 if options[:exit_early]
+
+      if options[:list_rules]
+        RuleSet.all.map(&:rule_id).sort.each { |id| @stdout.puts id }
+        return 0
+      end
+
+      raise UsageError, "scryer verify needs --rule RULE_ID and --file PATH\n#{parser}" unless options[:rule] && options[:file]
+
+      rule_class = RuleSet.all.find { |r| r.rule_id == options[:rule] }
+      unless rule_class
+        raise UsageError, "unknown rule_id #{options[:rule].inspect} — run `scryer verify --list-rules` to see valid ids."
+      end
+
+      root = File.expand_path(options[:root] || Dir.pwd)
+      abs_path = File.expand_path(options[:file], root)
+      raise UsageError, "no such file: #{abs_path}" unless File.file?(abs_path)
+
+      rel_path = abs_path.sub(/\A#{Regexp.escape(root)}\/?/, "")
+      source = File.read(abs_path)
+
+      sexp = begin
+        Ripper.sexp(source)
+      rescue StandardError => e
+        raise UsageError, "#{rel_path} failed to parse: #{e.message}"
+      end
+      if sexp.nil?
+        raise UsageError, "#{rel_path} could not be parsed (a syntax error, or Ruby syntax newer " \
+                           "than this gem's Ruby runtime supports)."
+      end
+
+      findings = rule_class.new(file: rel_path, source: source, sexp: sexp).scan
+
+      if findings.empty?
+        @stdout.puts "scryer verify: #{options[:rule]} no longer fires on #{rel_path} — fix verified."
+        0
+      else
+        @stdout.puts "scryer verify: #{options[:rule]} still fires on #{rel_path} (#{findings.size} finding(s)):"
+        findings.each { |f| @stdout.puts "  line #{f.line}: #{f.message}" }
+        1
+      end
+    end
+
     # One-off OSV.dev lookup for a single gem — no Gemfile.lock, no scan,
     # no other network calls. `spec` is "name" or "name:version" (colon
     # rather than a second CLI arg, so this stays a single -o-style flag).
@@ -158,6 +288,62 @@ module Scryer
       findings.empty? ? 0 : 1
     end
 
+    # `--save-baseline PATH` is a distinct mode, same as --audit-deps/
+    # --check-gem: it captures every finding across every category (not
+    # just security — a legacy app's existing performance/style debt is
+    # just as much "not what I'm here to re-litigate today" as its security
+    # debt), writes the fingerprints, and exits without writing the normal
+    # -o reports. See Scryer::Baseline for why fingerprints, not file:line.
+    def save_baseline(path, result, dependency_findings)
+      all_findings = (result.security_findings + result.performance_findings + result.style_findings)
+                     .map(&:to_h) + dependency_findings.map(&:to_h)
+      Baseline.save(path, all_findings)
+      @stdout.puts "Scryer: saved baseline of #{all_findings.size} finding(s) to #{path}."
+      0
+    end
+
+    # Filters `result`'s finding arrays (mutated in place — Result is a
+    # plain Struct, this is the same object the caller already holds) and
+    # returns [new_dependency_findings, fixed_count] since dependency_findings
+    # is a local array in the caller, not a field this method can mutate by
+    # reference the way it can Struct fields.
+    # `fixed_count` has to be computed ONCE against the union of every
+    # category's current fingerprints, not once per category summed
+    # together — Baseline.diff's fixed_count is "baseline fingerprints not
+    # present in *this* call's findings," so calling it separately per
+    # category and summing would count every other category's
+    # still-present findings as "fixed" too (verified: this exact bug
+    # produced a nonsensical "762 fixed" on a rescan with zero changes,
+    # against a 255-finding baseline — fixed by computing fixed_count from
+    # the combined set once, while still filtering "new" per category since
+    # that part only checks baseline membership, which is fine to do
+    # separately).
+    def apply_baseline(path, result, dependency_findings)
+      baseline_fingerprints = Baseline.load(path)
+
+      security_hashes = result.security_findings.map(&:to_h)
+      performance_hashes = result.performance_findings.map(&:to_h)
+      style_hashes = result.style_findings.map(&:to_h)
+      dependency_hashes = dependency_findings.map(&:to_h)
+
+      all_current_fingerprints = Baseline.fingerprints(security_hashes + performance_hashes + style_hashes + dependency_hashes)
+      fixed_count = (baseline_fingerprints - all_current_fingerprints.to_set).size
+
+      result.security_findings = filter_new(result.security_findings, security_hashes, baseline_fingerprints)
+      result.performance_findings = filter_new(result.performance_findings, performance_hashes, baseline_fingerprints)
+      result.style_findings = filter_new(result.style_findings, style_hashes, baseline_fingerprints)
+      filtered_deps = filter_new(dependency_findings, dependency_hashes, baseline_fingerprints)
+
+      [filtered_deps, fixed_count]
+    rescue Baseline::LoadError => e
+      raise UsageError, e.message
+    end
+
+    def filter_new(objects, hashes, baseline_fingerprints)
+      fingerprints = Baseline.fingerprints(hashes)
+      objects.each_with_index.reject { |_, i| baseline_fingerprints.include?(fingerprints[i]) }.map(&:first)
+    end
+
     def parse(argv)
       options = { outputs: [] }
 
@@ -165,7 +351,7 @@ module Scryer
         opts.banner = "Usage: scryer [options]"
         opts.on("-o PATH", "--output PATH",
                 "Write a report to PATH (repeatable). Format is inferred from the " \
-                "extension: .json, .html, or .csv.") { |v| options[:outputs] << v }
+                "extension: .json, .html, .csv, or .sarif.") { |v| options[:outputs] << v }
         opts.on("-p PATH", "--path PATH", "Root directory to scan (default: current directory).") { |v| options[:path] = v }
         opts.on("-r PATH", "--require PATH",
                 "Require a Ruby file before scanning (repeatable) — the file can call " \
@@ -178,6 +364,17 @@ module Scryer
                 "insecure git/http sources (offline), instead of running the normal static scan. " \
                 "Exits non-zero if anything is found, so this can gate CI the same way " \
                 "`bundle-audit check` does.") { options[:audit_deps] = true }
+        opts.on("--save-baseline PATH",
+                "Run the normal scan, save every finding's fingerprint to PATH, then exit — no " \
+                "reports written. A later `scryer --baseline PATH` scan reports only findings " \
+                "new since this snapshot, so an app with existing security debt can gate CI on " \
+                "new issues without being forced to fix everything on day one.") { |v| options[:save_baseline] = v }
+        opts.on("--baseline PATH",
+                "Compare this scan against a baseline saved by --save-baseline: every report " \
+                "(-o files, console summary, exit code) reflects only findings new since PATH " \
+                "was saved. Fingerprints ignore line number (rule + file + offending code), so " \
+                "an unrelated edit elsewhere in the file won't make an existing finding look " \
+                "new.") { |v| options[:baseline] = v }
         opts.on("--no-deps",
                 "Skip the dependency audit (OSV.dev vulnerable gems + insecure git/http sources) " \
                 "that otherwise runs as part of every normal scan. Use this for a fast, fully " \
@@ -212,6 +409,7 @@ module Scryer
       content = case format
                 when "json" then renderer.as_json
                 when "csv" then renderer.as_csv
+                when "sarif" then renderer.as_sarif
                 else renderer.as_html
                 end
 

data/lib/scryer/dependency_audit.rb

@@ -1,4 +1,5 @@
 require "json"
+require "date"
 
 module Scryer
   # Dependency vulnerability + supply-chain-hygiene checks for Gemfile.lock —
@@ -55,15 +56,35 @@ module Scryer
       "LOW" => "info"
     }.freeze
 
+    # Ruby's own published maintenance-branch EOL dates
+    # (ruby-lang.org/en/downloads/branches/) — these are announced years in
+    # advance and essentially never move, unlike a CVE feed, so this is a
+    # one-time/occasional-update cost rather than an ongoing sync burden.
+    # Update when a new branch's EOL is announced, or an older branch not
+    # listed here needs adding.
+    RUBY_EOL_DATES = {
+      "2.5" => Date.new(2021, 3, 31),
+      "2.6" => Date.new(2022, 3, 31),
+      "2.7" => Date.new(2023, 3, 31),
+      "3.0" => Date.new(2024, 3, 31),
+      "3.1" => Date.new(2025, 3, 31),
+      "3.2" => Date.new(2026, 3, 31),
+      "3.3" => Date.new(2027, 3, 31),
+      "3.4" => Date.new(2028, 3, 31)
+    }.freeze
+
     class << self
-      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} }, git_or_path_sources: [...] }`.
-      # `source` is "gem", "git", or "path" — taken from which top-level
-      # block (GEM/GIT/PATH) the spec's `specs:` list appeared under.
+      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} },
+      # git_or_path_sources: [...], ruby_version: "3.3.3" | nil }`. `source`
+      # is "gem", "git", or "path" — taken from which top-level block
+      # (GEM/GIT/PATH) the spec's `specs:` list appeared under.
       def parse_lockfile(path)
         gems = {}
         git_or_path_sources = []
+        ruby_version = nil
 
-        current_block = nil # "gem" | "git" | "path" | other section name
+        current_block = nil # "gem" | "git" | "path" | nil (other section)
+        current_section = nil # PLATFORMS | DEPENDENCIES | BUNDLED WITH | RUBY VERSION | nil
         current_remote = nil
         in_specs = false
 
@@ -71,10 +92,12 @@ module Scryer
           case line
           when /\A(GEM|GIT|PATH)\s*\z/
             current_block = Regexp.last_match(1).downcase
+            current_section = nil
             current_remote = nil
             in_specs = false
           when /\A(PLATFORMS|DEPENDENCIES|BUNDLED WITH|RUBY VERSION)\s*\z/
             current_block = nil
+            current_section = Regexp.last_match(1)
             in_specs = false
           when /\A {2}remote:\s*(\S+)\s*\z/
             current_remote = Regexp.last_match(1)
@@ -90,10 +113,46 @@ module Scryer
             # in pathological Gemfiles; last one wins, consistent with how
             # Bundler itself resolves a single spec per gem name.
             gems[name] = { version: version, source: current_block }
+          when /\A\s*ruby\s+(\S+)\s*\z/
+            ruby_version = Regexp.last_match(1) if current_section == "RUBY VERSION"
           end
         end
 
-        { gems: gems, git_or_path_sources: git_or_path_sources }
+        { gems: gems, git_or_path_sources: git_or_path_sources, ruby_version: ruby_version }
+      end
+
+      # Offline. Flags the Ruby version pinned in Gemfile.lock's RUBY
+      # VERSION section if its minor series is past end-of-life — after that
+      # date Ruby publishes no more security patches for it, for any issue,
+      # so this is a real gap even with every gem otherwise up to date.
+      # Returns [] if no version is pinned, or its series isn't one
+      # RUBY_EOL_DATES knows about (never guessed as "fine" by omission).
+      def ruby_eol_check(root)
+        lockfile = File.join(root, "Gemfile.lock")
+        return [] unless File.exist?(lockfile)
+
+        ruby_version = parse_lockfile(lockfile)[:ruby_version]
+        return [] unless ruby_version
+
+        series = ruby_version[/\A\d+\.\d+/]
+        eol_date = series && RUBY_EOL_DATES[series]
+        return [] unless eol_date && Date.today > eol_date
+
+        [
+          Finding.new(
+            kind: "ruby_eol",
+            gem_name: "Ruby",
+            installed_version: ruby_version,
+            severity: "critical",
+            title: "Ruby #{series} is end-of-life",
+            url: "https://www.ruby-lang.org/en/downloads/branches/",
+            patched_versions: [],
+            message: "Ruby #{ruby_version} (#{series} series) reached end-of-life on " \
+                      "#{eol_date} — no security patches are published for it anymore, for any issue.",
+            suggested_fix: "Upgrade to a Ruby version still receiving security maintenance — see " \
+                            "https://www.ruby-lang.org/en/downloads/branches/ for current status."
+          )
+        ]
       end
 
       # Offline. Flags GIT/PATH sources recorded with an unencrypted remote
@@ -160,6 +219,41 @@ module Scryer
         findings
       end
 
+      # Offline. Flags `config/master.key` (the key that decrypts Rails
+      # encrypted credentials, config/credentials.yml.enc) if it exists on
+      # disk and .gitignore doesn't exclude it — Rails generates it
+      # gitignored by default (`/config/master.key`), but that line is easy
+      # to lose (a merge, a from-scratch .gitignore, copying the file into a
+      # repo that never had the Rails default). If this file is ever
+      # committed, anyone with repo access — including git history, even
+      # after a later removal — can decrypt every credential in
+      # config/credentials.yml.enc.
+      def credentials_exposure_check(root)
+        master_key_path = File.join(root, "config", "master.key")
+        return [] unless File.exist?(master_key_path)
+        return [] if master_key_gitignored?(root)
+
+        [
+          Finding.new(
+            kind: "credentials_exposure",
+            gem_name: "Rails",
+            severity: "critical",
+            title: "config/master.key is present and not gitignored",
+            url: "https://guides.rubyonrails.org/security.html",
+            patched_versions: [],
+            message: "config/master.key exists in this app, but .gitignore doesn't exclude it " \
+                      "(checked for both `/config/master.key` and `config/master.key`) — if this " \
+                      "file is ever committed, anyone with repository access, including git " \
+                      "history even after a later removal, can decrypt every credential in " \
+                      "config/credentials.yml.enc.",
+            suggested_fix: "Add `/config/master.key` to .gitignore immediately. If this key was " \
+                            "ever actually committed to git history, treat every credential in " \
+                            "config/credentials.yml.enc as compromised: rotate them and regenerate " \
+                            "the master key (delete both files, then `bin/rails credentials:edit`)."
+          )
+        ]
+      end
+
       # Needs network. One-off OSV.dev lookup for a single gem, independent
       # of any Gemfile.lock — backs `scryer --check-gem NAME[:VERSION]`.
       # With a version, only vulnerabilities affecting that exact version
@@ -171,6 +265,15 @@ module Scryer
 
       private
 
+      def master_key_gitignored?(root)
+        gitignore_path = File.join(root, ".gitignore")
+        return false unless File.exist?(gitignore_path)
+
+        File.foreach(gitignore_path).any? do |line|
+          line.strip.match?(%r{\A/?config/master\.key\z})
+        end
+      end
+
       def query_osv(name, version = nil)
         require "net/http"
         require "uri"

data/lib/scryer/finding.rb

@@ -7,11 +7,17 @@ module Scryer
     :rule_id,        # e.g. "sql_injection"
     :category,       # "security" | "performance" | "duplication"
     :severity,       # "critical" | "warning" | "info"
+    :confidence,     # "high" | "medium" | "low" — see Rule.confidence
+    :cwe,            # e.g. "CWE-89", or nil for non-security rules
+    :owasp_category, # e.g. "A03:2021-Injection", or nil for non-security rules
     :file,           # relative path
     :line,           # integer line number (1-indexed) or nil
     :code_snippet,   # the offending source line, stripped
     :message,        # human-readable description of the issue
     :suggested_fix,  # human-readable explanation + example patch
+    :fix_verified,   # true/false/nil — see Scryer::FixVerifier; nil unless
+                     # an ai_client is configured AND the AI's reply had a
+                     # verifiable AFTER: block, not "no fix exists"
     keyword_init: true
   ) do
     def to_h

data/lib/scryer/fix_verifier.rb

@@ -0,0 +1,82 @@
+require "ripper"
+
+module Scryer
+  # Best-effort verification that an AI-rewritten suggested_fix actually
+  # clears the finding it was generated for — "AI-verified remediation" in
+  # the sense of "Scryer independently re-checked this," not in the sense of
+  # a human review being unnecessary (suggested_fix is still never
+  # auto-applied to a real file; see AiFixSuggester's own header comment).
+  #
+  # How: AiFixSuggester's prompt (see static_prompt_for) asks the model to
+  # end its reply with a fenced "AFTER:" code block containing a drop-in
+  # replacement for the single offending source line. This class extracts
+  # that block, substitutes it for that one line in an in-memory copy of the
+  # file (nothing is ever written to disk), re-parses the result, and
+  # re-runs *only the one rule that flagged this finding* against it. If
+  # that rule no longer fires anywhere in the modified file, the fix is
+  # marked verified.
+  #
+  # Deliberately narrow, same spirit as `scryer verify` (the CLI command
+  # this shares its core logic with): this confirms the ONE finding it
+  # targeted is gone, not that the fix is otherwise correct, idiomatic, or
+  # free of introducing a different problem — a full rescan (or `scryer
+  # verify` again with a different --rule) answers that.
+  #
+  # Returns true (rule no longer fires), false (attempted but the rule still
+  # fires, or the rewritten line doesn't even parse), or nil (verification
+  # wasn't attempted at all — no AFTER: block in the AI's reply, the
+  # original file isn't readable, or this isn't a rule-backed Finding to
+  # begin with). nil is deliberately distinct from false: it means "we don't
+  # know," not "we checked and it's still broken."
+  module FixVerifier
+    module_function
+
+    AFTER_BLOCK = /AFTER:\s*```\w*\n(.*?)\n?```/m.freeze
+
+    def verify(finding:, root:)
+      return nil unless finding.is_a?(Scryer::Finding)
+      return nil unless finding.line && finding.rule_id
+
+      after_snippet = extract_after_snippet(finding.suggested_fix)
+      return nil unless after_snippet
+
+      abs_path = File.join(root, finding.file.to_s)
+      return nil unless File.file?(abs_path)
+
+      lines = File.read(abs_path).lines
+      return nil unless finding.line.between?(1, lines.size)
+
+      modified_source = apply_line_replacement(lines, finding.line, after_snippet)
+
+      sexp = begin
+        Ripper.sexp(modified_source)
+      rescue StandardError
+        nil
+      end
+      return false if sexp.nil? # the rewritten line doesn't even parse — not a usable fix
+
+      rule_class = Scryer::RuleSet.all.find { |r| r.rule_id == finding.rule_id }
+      return nil unless rule_class
+
+      remaining = rule_class.new(file: finding.file, source: modified_source, sexp: sexp).scan
+      remaining.none? { |f| f.rule_id == finding.rule_id }
+    rescue StandardError
+      nil
+    end
+
+    def extract_after_snippet(suggested_fix)
+      match = AFTER_BLOCK.match(suggested_fix.to_s)
+      return nil unless match
+
+      content = match[1].to_s
+      content.strip.empty? ? nil : content
+    end
+
+    def apply_line_replacement(lines, line_number, replacement)
+      replacement_text = replacement.end_with?("\n") ? replacement : "#{replacement}\n"
+      modified = lines.dup
+      modified[line_number - 1] = replacement_text
+      modified.join
+    end
+  end
+end

data/lib/scryer/minitest.rb

@@ -0,0 +1,48 @@
+# Opt-in Minitest integration — require this file yourself (e.g. `require
+# "scryer/minitest"` in test_helper.rb) rather than it loading automatically
+# with the gem; same reasoning as lib/scryer/rspec.rb (Minitest is never a
+# Scryer runtime dependency, and this file's assertions only make sense once
+# the host app's own test framework is already loaded).
+#
+# Mix Scryer::MinitestAssertions into a Minitest::Test (or
+# ActiveSupport::TestCase, which is one) to assert this app's own security
+# scan stays clean as part of its normal test suite:
+#
+#   class SecurityTest < ActiveSupport::TestCase
+#     include Scryer::MinitestAssertions
+#
+#     test "no critical findings" do
+#       assert_no_critical_scryer_findings(Scryer.scan(root: Rails.root.to_s))
+#     end
+#
+#     test "the mass-assignment bug fixed in PR #123 doesn't come back" do
+#       assert_no_scryer_findings_for(Scryer.scan(root: Rails.root.to_s), "mass_assignment")
+#     end
+#   end
+module Scryer
+  module MinitestAssertions
+    # Only security findings — style/performance findings aren't a security
+    # regression, same scoping as the RSpec have_no_critical_findings matcher.
+    def assert_no_critical_scryer_findings(result, msg = nil)
+      criticals = result.security_findings.select { |f| f.severity == "critical" }
+      default_msg = -> {
+        lines = criticals.map { |f| "  - #{f.rule_id} at #{f.file}:#{f.line} — #{f.message}" }
+        "expected no critical security findings, but got #{criticals.size}:\n#{lines.join("\n")}"
+      }
+      assert criticals.empty?, msg || default_msg.call
+    end
+
+    # Checks all three categories (security/performance/style) — a rule
+    # regressing is worth catching regardless of which category it's filed
+    # under, unlike assert_no_critical_scryer_findings above.
+    def assert_no_scryer_findings_for(result, rule_id, msg = nil)
+      matches = (result.security_findings + result.performance_findings + result.style_findings)
+                .select { |f| f.rule_id == rule_id.to_s }
+      default_msg = -> {
+        lines = matches.map { |f| "  - #{f.file}:#{f.line} — #{f.message}" }
+        "expected no findings for rule #{rule_id.inspect}, but got #{matches.size}:\n#{lines.join("\n")}"
+      }
+      assert matches.empty?, msg || default_msg.call
+    end
+  end
+end