scryer 1.0.0 → 1.1.1

data/lib/generators/scryer/templates/scryer_initializer.rb

@@ -14,6 +14,21 @@ Scryer.configure do |c|
   # where checkouts often land in detached-HEAD state). Leave blank to use
   # the actual checked-out branch:
   # c.branch = ENV["CI_COMMIT_BRANCH"]
+
+  # Silence a specific rule by rule_id (repeatable) — a known false positive
+  # on this codebase, or a check that doesn't apply here. Prefer this over
+  # deleting/editing the rule itself; run `bin/rails scryer:report` once and
+  # check tmp/scryer_report.html's "Checks performed" section for the full
+  # list of rule_ids:
+  # c.skip_rules = %w[idor]
+
+  # Any object/Proc responding to #call(prompt) (or #complete(prompt)) that
+  # returns a String — opts into rewriting every finding's suggested_fix
+  # against its actual code via that LLM. Off by default: no network calls,
+  # no provider assumed. See the README's "AI-assisted fix suggestions" and
+  # "AI-verified remediation" sections for what this does and how the
+  # (optional) re-scan-to-confirm-the-fix-works verification works:
+  # c.ai_client = ->(prompt) { MyLlmClient.complete(prompt) }
 end
 
 # Runtime query watcher (N+1 / unused eager loading — see README's "Runtime

data/lib/scryer/ai_fix_suggester.rb

@@ -25,11 +25,20 @@ module Scryer
       # (client raises, times out, returns nothing usable) is swallowed and
       # the finding's original suggested_fix is left as-is — an LLM call
       # failing should never break a scan.
-      def enhance!(finding, client: Scryer.configuration.ai_client)
+      #
+      # `root`, when given (and only for a Scryer::Finding — see
+      # FixVerifier), triggers a follow-up verification pass: re-read the
+      # actual file from disk, substitute the AI's suggested replacement for
+      # the one offending line, and re-run just this finding's own rule
+      # against the result. Sets finding.fix_verified to true/false/nil (see
+      # Finding#fix_verified) — never raises, same failure-swallowing
+      # philosophy as the AI call itself.
+      def enhance!(finding, client: Scryer.configuration.ai_client, root: nil)
         return finding unless client
 
         reply = call_client(client, prompt_for(finding))
         finding.suggested_fix = reply.strip unless blank?(reply)
+        finding.fix_verified = FixVerifier.verify(finding: finding, root: root) if root
         finding
       rescue StandardError
         finding
@@ -40,10 +49,14 @@ module Scryer
       # (network-bound work, same pattern as
       # DependencyAudit.vulnerable_gems) so a large finding count doesn't
       # mean one-request-at-a-time. No-op if no client is configured —
-      # callers don't need to check first.
-      def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4)
+      # callers don't need to check first. Pass `root` (the project root
+      # `finding.file` is relative to) to also run fix verification — see
+      # `enhance!`; omit it to skip verification entirely (e.g. when the
+      # caller has no meaningful root, or doesn't want the extra re-parse
+      # work).
+      def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4, root: nil)
         enhance_many!(result.security_findings + result.performance_findings + result.style_findings,
-                      client: client, concurrency: concurrency)
+                      client: client, concurrency: concurrency, root: root)
         result
       end
 
@@ -51,8 +64,9 @@ module Scryer
       # Scryer::DependencyAudit::Finding objects, which aren't attached to a
       # Scanner::Result. Works on any mix of Finding/DependencyAudit::Finding
       # (prompt_for below dispatches on which one it got). No-op if no client
-      # is configured.
-      def enhance_many!(findings, client: Scryer.configuration.ai_client, concurrency: 4)
+      # is configured. `root` is ignored for DependencyAudit::Finding objects
+      # (FixVerifier only handles rule-backed Finding — see its guard clause).
+      def enhance_many!(findings, client: Scryer.configuration.ai_client, concurrency: 4, root: nil)
         return findings unless client
 
         queue = Queue.new
@@ -68,7 +82,7 @@ module Scryer
               end
               break unless finding
 
-              enhance!(finding, client: client)
+              enhance!(finding, client: client, root: root)
             end
           end
         end
@@ -107,8 +121,14 @@ module Scryer
 
           Generic guidance for this rule: #{finding.suggested_fix}
 
-          Reply with a short explanation (1-3 sentences) followed by a before/after code
-          example using the actual snippet above. Do not restate the issue description.
+          Reply with a short explanation (1-3 sentences), then a fenced code block showing the
+          fix in context if that's useful, and finally — as the very last thing in your reply,
+          exactly once — a line reading "AFTER:" followed by a fenced code block containing ONLY
+          the corrected replacement for the single offending line shown above (line
+          #{finding.line}), nothing else in that block (no surrounding context lines, no
+          comments about the change). This exact "AFTER:" block is parsed automatically to
+          verify the fix actually resolves the finding, so it must be a valid, direct drop-in
+          replacement for that one line. Do not restate the issue description.
         PROMPT
       end
 

data/lib/scryer/ast.rb

@@ -91,6 +91,32 @@ module Scryer
       node[1] if node[0].is_a?(Symbol) && %i[@ident @const @kw @op].include?(node[0])
     end
 
+    # The full dotted name from a class/module's own name node — the second
+    # element of a `[:class, name_node, superclass, body]` sexp. A plain
+    # `class Foo` parses name_node as `[:const_ref, [:@const, "Foo", pos]]`;
+    # a namespaced `class Admin::PostsController` parses it as a
+    # `:const_path_ref` chain instead (verified via `Ripper.sexp` —
+    # `Api::V1::UsersController` nests two levels deep: `[:const_path_ref,
+    # [:const_path_ref, [:var_ref, [:@const,"Api"]], [:@const,"V1"]],
+    # [:@const,"UsersController"]]`). Several rules used to check only the
+    # `:const_ref` shape (`node[1][1]` via `ident_text`), so a namespaced
+    # controller's class name silently came back nil and the whole class was
+    # never examined — a real false-negative gap, not a minor edge case,
+    # given how common namespacing (admin areas, API versions) is in real
+    # Rails apps. Returns e.g. "Admin::PostsController" so a plain
+    # `.end_with?("Controller")` check still works the same either way.
+    def class_name(node)
+      if tagged?(node, :const_ref)
+        ident_text(node[1])
+      elsif tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+        node[1][1]
+      elsif tagged?(node, :const_path_ref)
+        left = class_name(node[1])
+        right = ident_text(node[2])
+        [left, right].compact.join("::")
+      end
+    end
+
     # Given a [:method_add_arg, call_node, args_node] or [:command, ident, args_node]
     # node, return the flattened list of top-level argument sexp nodes (best effort —
     # walks through the [:arg_paren, [:args_add_block, [args...], block]] wrapping).

data/lib/scryer/authorization_watcher.rb

@@ -0,0 +1,156 @@
+module Scryer
+  # Runtime companion to the static `idor`/`missing_authorization`/
+  # `missing_policy_scope` rules — those can only ever say "no call to a
+  # known authorization method is visible anywhere in this controller's
+  # source," which is exactly as wrong as it sounds whenever the real check
+  # happens somewhere the static AST walk can't see (a shared base
+  # controller, a concern, a class-level macro whose effect isn't visible by
+  # name). This watcher answers a narrower but much more reliable question
+  # instead: for *this actual request*, did Pundit's `authorize`/
+  # `policy_scope` or CanCanCan's `authorize!` genuinely get called?
+  #
+  # How: both libraries already track this themselves, for their own
+  # `verify_authorized`/`check_authorization` after_action helpers —
+  # `Pundit::Authorization#pundit_policy_authorized?`/`#pundit_policy_scoped?`
+  # (public API, `@_pundit_policy_authorized`/`@_pundit_policy_scoped` under
+  # the hood) and CanCanCan's `@_authorized` ivar (set by `authorize!` and by
+  # `skip_authorization_check`; verified by reading both gems' actual source,
+  # `pundit-2.5.2/lib/pundit/authorization.rb` and
+  # `cancancan-3.6.1/lib/cancan/controller_additions.rb` — not guessed). This
+  # class registers one more `after_action`, alongside those, that checks the
+  # same flags and reports when a write action completed with neither set.
+  #
+  # Deliberately Pundit/CanCanCan-only, same scope as the static rules this
+  # complements: with neither gem loaded, `enable!` still runs but every
+  # request is silently skipped (see `authorization_library_present?`) — an
+  # app with fully custom, non-object-level authorization (a single
+  # `before_action :require_admin!`, say) gets no findings and no false
+  # positives here, rather than a flood of "unauthorized" reports for a
+  # pattern this watcher has no way to recognize as intentional.
+  #
+  # Deliberately narrower than "check every action": only create/update/
+  # destroy (or any POST/PUT/PATCH/DELETE), matching MissingAuthorizationRule
+  # exactly — and only requests that actually completed (status < 400).
+  # Read-scoping gaps (an unscoped `index` — see MissingPolicyScopeRule) are
+  # NOT covered here; verifying "was the returned data correctly scoped" at
+  # runtime, rather than "was a method called," is a materially different
+  # and harder check this class doesn't attempt.
+  class AuthorizationWatcher
+    Finding = Struct.new(:kind, :message, :controller, :action, :method, :path, :suggested_fix, keyword_init: true) do
+      def to_h
+        super.transform_keys(&:to_s)
+      end
+    end
+
+    WRITE_ACTIONS = %w[create update destroy].freeze
+    WRITE_METHODS = %w[POST PUT PATCH DELETE].freeze
+
+    class << self
+      # Turns the watcher on for the life of the process. Idempotent — safe
+      # to call more than once (later calls are no-ops). No Rack middleware
+      # to install, unlike QueryWatcher: a Rails controller instance is
+      # already fresh per request, so there's no shared/leaking state to
+      # scope — the `after_action` below just runs once per completed
+      # action.
+      def enable!(logger: nil)
+        return if @enabled
+
+        @logger = logger || default_logger
+        @findings = []
+        @enabled = true
+
+        # Covers both API-only and normal Rails apps without special-casing
+        # either: ActionController::Base and ActionController::API are
+        # sibling classes (neither inherits from the other — verified via
+        # `ActionController::API.ancestors.include?(ActionController::Base)
+        # #=> false`), but Rails' own actionpack source calls
+        # `ActiveSupport.run_load_hooks(:action_controller, self)` from
+        # *both* action_controller/base.rb and action_controller/api.rb, so
+        # this block runs once per base class and `install_hook` ends up
+        # registering the after_action on both. Confirmed with a real
+        # ActionController::API + Pundit integration test, not assumed.
+        ActiveSupport.on_load(:action_controller) { Scryer::AuthorizationWatcher.send(:install_hook, self) }
+      end
+
+      def enabled?
+        !!@enabled
+      end
+
+      # Every finding recorded so far this process — inspect, log, or feed
+      # into your own alerting. Not reset automatically; call `clear!`
+      # yourself (e.g. between test examples, or on a timer) if you don't
+      # want it growing for the life of a long-running process.
+      def findings
+        @findings ||= []
+      end
+
+      def clear!
+        @findings = []
+      end
+
+      private
+
+      def default_logger
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        else
+          require "logger"
+          Logger.new($stdout)
+        end
+      end
+
+      def install_hook(base)
+        base.after_action { |controller| Scryer::AuthorizationWatcher.send(:check, controller) }
+      end
+
+      def check(controller)
+        return unless authorization_library_present?
+
+        action = controller.action_name.to_s
+        request = controller.request
+        return unless WRITE_ACTIONS.include?(action) || WRITE_METHODS.include?(request.method)
+
+        status = controller.response&.status
+        return unless status && status < 400 # already rejected/errored — nothing to report
+        return if authorization_evidence?(controller)
+
+        finding = Finding.new(
+          kind: "runtime_missing_authorization",
+          message: "#{controller.class}##{action} completed a #{request.method} request " \
+                    "(status #{status}) with no authorization check actually invoked during it " \
+                    "(checked Pundit's authorize/policy_scope and CanCanCan's authorize!/" \
+                    "skip_authorization_check — neither fired).",
+          controller: controller.class.name,
+          action: action,
+          method: request.method,
+          path: request.path,
+          suggested_fix: "Add an authorization check to this action — Pundit's `authorize`/" \
+                          "`policy_scope`, or CanCanCan's `authorize!`/`load_and_authorize_resource` " \
+                          "— or call `skip_authorization`/`skip_authorization_check` explicitly if " \
+                          "this action is deliberately open to any authenticated (or anonymous) user."
+        )
+        findings << finding
+        @logger.warn("[Scryer::AuthorizationWatcher] #{finding.message}")
+      end
+
+      def authorization_library_present?
+        defined?(::Pundit::Authorization) || defined?(::CanCan::ControllerAdditions)
+      end
+
+      def authorization_evidence?(controller)
+        pundit_authorized?(controller) || cancancan_authorized?(controller)
+      end
+
+      def pundit_authorized?(controller)
+        return false unless controller.respond_to?(:pundit_policy_authorized?, true)
+
+        controller.send(:pundit_policy_authorized?) ||
+          (controller.respond_to?(:pundit_policy_scoped?, true) && controller.send(:pundit_policy_scoped?))
+      end
+
+      def cancancan_authorized?(controller)
+        controller.instance_variable_defined?(:@_authorized)
+      end
+    end
+  end
+end

data/lib/scryer/baseline.rb

@@ -0,0 +1,75 @@
+require "digest"
+require "json"
+require "set"
+
+module Scryer
+  # Baseline mode: `scryer --save-baseline FILE` snapshots the current scan's
+  # findings as a set of stable fingerprints; a later `scryer --baseline
+  # FILE` scan diffs against that snapshot and reports only *new* findings
+  # (plus how many were fixed since), instead of the same full list a legacy
+  # codebase would otherwise reproduce on every single run. This is what
+  # makes adopting Scryer on an app with real pre-existing security debt
+  # practical: gate CI on new issues only, and burn down the rest on its own
+  # schedule, instead of being forced to either fix everything on day one or
+  # turn the gate off entirely.
+  #
+  # Fingerprints are deliberately NOT tied to line number — SHA256 of
+  # (identifying fields + the offending source text/advisory), not
+  # file:line. A finding whose line shifts because of an unrelated edit
+  # earlier in the same file would otherwise look simultaneously "new" and
+  # "fixed" on every unrelated commit, which would make baseline mode
+  # useless noise instead of a real signal.
+  module Baseline
+    module_function
+
+    # `f` is a finding hash (Finding#to_h or DependencyAudit::Finding#to_h)
+    # — distinguished by "rule_id" (rule-based: security/performance/style)
+    # vs. "kind" (dependency findings, which have no rule_id at all).
+    def fingerprint(f)
+      basis =
+        if f["rule_id"]
+          [f["rule_id"], f["file"], f["code_snippet"].to_s.strip]
+        else
+          [f["kind"], f["gem_name"], f["advisory_id"], f["installed_version"]].compact
+        end
+
+      Digest::SHA256.hexdigest(basis.join("|"))[0, 16]
+    end
+
+    def fingerprints(findings)
+      findings.map { |f| fingerprint(f) }
+    end
+
+    def save(path, findings)
+      data = {
+        "scryer_version" => Scryer::VERSION,
+        "created_at" => Time.now.utc.iso8601,
+        "fingerprints" => fingerprints(findings).uniq
+      }
+      File.write(path, JSON.pretty_generate(data))
+    end
+
+    LoadError = Class.new(StandardError)
+
+    def load(path)
+      raise LoadError, "baseline file not found: #{path}" unless File.exist?(path)
+
+      data = JSON.parse(File.read(path))
+      Set.new(Array(data["fingerprints"]))
+    rescue JSON::ParserError => e
+      raise LoadError, "invalid baseline file #{path}: #{e.message}"
+    end
+
+    # Splits `findings` into [new_findings, fixed_count] against a baseline
+    # Set of fingerprints. `new_findings` is what the rest of the pipeline
+    # should treat as "the" findings from this point on (reports, exit code,
+    # top_risks, everything) — `fixed_count` is purely informational
+    # (present in the baseline, absent from this scan).
+    def diff(findings, baseline_fingerprints)
+      current = fingerprints(findings)
+      new_findings = findings.each_with_index.reject { |_, i| baseline_fingerprints.include?(current[i]) }.map(&:first)
+      fixed_count = (baseline_fingerprints - current.to_set).size
+      [new_findings, fixed_count]
+    end
+  end
+end

data/lib/scryer/cli.rb

@@ -21,6 +21,12 @@ module Scryer
     # found (so `scryer -o report.json` can gate CI the way `brakeman -o
     # report.json` does), 2 on a usage error.
     def run
+      # `scryer verify` is a distinct subcommand, not a flag on the normal
+      # scan — it takes its own small option set (--rule/--file/--path) that
+      # would collide with the main parser's -p/-o meanings, so it's
+      # dispatched before the main OptionParser ever sees the rest of argv.
+      return run_verify(@argv[1..]) if @argv.first == "verify"
+
       options = parse(@argv)
       return 0 if options[:exit_early]
 
@@ -54,9 +60,16 @@ module Scryer
                                DependencyAudit.ruby_eol_check(root) + DependencyAudit.credentials_exposure_check(root)
       end
 
+      return save_baseline(options[:save_baseline], result, dependency_findings) if options[:save_baseline]
+
+      fixed_count = 0
+      if options[:baseline]
+        dependency_findings, fixed_count = apply_baseline(options[:baseline], result, dependency_findings)
+      end
+
       if Scryer.configuration.ai_client
         @stdout.puts "Scryer: rewriting suggested fixes via the configured AI client..."
-        AiFixSuggester.enhance_result!(result)
+        AiFixSuggester.enhance_result!(result, root: root)
         AiFixSuggester.enhance_many!(dependency_findings) unless dependency_findings.empty?
       end
 
@@ -72,7 +85,8 @@ module Scryer
       outputs = options[:outputs].empty? ? default_outputs(root) : options[:outputs]
       outputs.each { |path| write_report(renderer, path) }
 
-      print_summary(result: result, dependency_findings: dependency_findings, ran_deps: ran_deps, outputs: outputs)
+      print_summary(result: result, dependency_findings: dependency_findings, ran_deps: ran_deps, outputs: outputs,
+                    renderer: renderer, fixed_count: fixed_count, baseline_path: options[:baseline])
 
       result.security_findings.empty? && dependency_findings.empty? ? 0 : 1
     rescue UsageError => e
@@ -118,7 +132,7 @@ module Scryer
     # category Scryer covers (security, performance, duplicate/smelly code,
     # dependencies), the same categories usually split across RuboCop +
     # Brakeman + bundler-audit + Reek, side by side in one box.
-    def print_summary(result:, dependency_findings:, ran_deps:, outputs:)
+    def print_summary(result:, dependency_findings:, ran_deps:, outputs:, renderer:, fixed_count: 0, baseline_path: nil)
       # "Code Quality" is the umbrella label for both duplicate-code groups
       # and rule-based style findings (e.g. frozen_string_literal) — two
       # different detectors, same broad concern, one row in the box.
@@ -134,14 +148,26 @@ module Scryer
       ]
 
       divider = "─" * 32
+      score = renderer.security_score
       @stdout.puts ""
       @stdout.puts "Scryer Audit — #{result.files_scanned} files scanned"
       @stdout.puts divider
       @stdout.puts ""
+      if baseline_path
+        @stdout.puts "Baseline: #{baseline_path} — showing new findings only " \
+                     "(#{fixed_count} fixed since baseline)."
+        @stdout.puts ""
+      end
+      clean_rate = renderer.rules_clean_rate
+      @stdout.puts "Security Score: #{score["score"]}/100 (#{score["grade"]})"
+      @stdout.puts "Checks: #{clean_rate["clean"]}/#{clean_rate["total"]} rules clean (#{clean_rate["percent"]}%)"
+      @stdout.puts ""
       rows.each { |label, count| @stdout.puts summary_row(label, count) }
       @stdout.puts divider
       @stdout.puts summary_row("Total", total)
       @stdout.puts ""
+      print_top_priorities(renderer.top_risks)
+      print_owasp_coverage(renderer.owasp_coverage)
       outputs.each { |path| @stdout.puts "#{format_for(path).upcase} report: #{path}" }
     end
 
@@ -150,6 +176,99 @@ module Scryer
       "#{label.ljust(14)}#{value.rjust(20)}"
     end
 
+    # The categories above are counted separately, but nothing else ranks
+    # across them — this is what actually backs "tells you what to fix
+    # first" rather than just splitting findings into four buckets. Same
+    # data ReportRenderer#top_risks already sorts for the HTML report.
+    def print_top_priorities(risks)
+      return if risks.empty?
+
+      @stdout.puts "Top priorities:"
+      risks.each_with_index do |r, i|
+        @stdout.puts "  #{i + 1}. [#{r[:severity]}] #{r[:category]} — #{r[:label]} (#{r[:location]})"
+      end
+      @stdout.puts ""
+    end
+
+    # Byproduct of every security rule carrying an owasp_category — see
+    # ReportRenderer#owasp_coverage. Scryer's own best-effort tagging, not an
+    # OWASP-audited mapping (documented in full in the README).
+    def print_owasp_coverage(coverage)
+      return if coverage.empty?
+
+      @stdout.puts "OWASP Top 10 (2021) coverage:"
+      coverage.each { |category, count| @stdout.puts "  #{category}: #{count} finding#{"s" unless count == 1}" }
+      @stdout.puts ""
+    end
+
+    # `scryer verify --rule RULE_ID --file PATH` — re-parses just that one
+    # file and re-runs just that one rule against it, independent of a full
+    # scan. Meant to run right after applying a fix (by hand or via an LLM)
+    # to confirm the specific finding it targeted is actually gone, without
+    # waiting on/paying for a full project scan. Deliberately narrower than
+    # "did this fix introduce a NEW finding elsewhere" — that's what a normal
+    # `scryer` run (or `--baseline`) already answers; this only answers "does
+    # the one thing I just tried to fix still fire."
+    def run_verify(argv)
+      options = {}
+
+      parser = OptionParser.new do |opts|
+        opts.banner = "Usage: scryer verify --rule RULE_ID --file PATH [--path ROOT]"
+        opts.on("--rule RULE_ID", "The rule_id to re-check (required) — see `scryer verify --list-rules`.") { |v| options[:rule] = v }
+        opts.on("--file PATH", "File to re-scan (required) — relative to --path, or absolute.") { |v| options[:file] = v }
+        opts.on("--path ROOT", "Project root PATH is relative to (default: current directory).") { |v| options[:root] = v }
+        opts.on("--list-rules", "List every known rule_id and exit.") { options[:list_rules] = true }
+        opts.on("-h", "--help", "Show this help.") { options[:exit_early] = true; @stdout.puts opts }
+      end
+
+      begin
+        parser.parse!(argv)
+      rescue OptionParser::ParseError => e
+        raise UsageError, "#{e.message}\n#{parser}"
+      end
+      return 0 if options[:exit_early]
+
+      if options[:list_rules]
+        RuleSet.all.map(&:rule_id).sort.each { |id| @stdout.puts id }
+        return 0
+      end
+
+      raise UsageError, "scryer verify needs --rule RULE_ID and --file PATH\n#{parser}" unless options[:rule] && options[:file]
+
+      rule_class = RuleSet.all.find { |r| r.rule_id == options[:rule] }
+      unless rule_class
+        raise UsageError, "unknown rule_id #{options[:rule].inspect} — run `scryer verify --list-rules` to see valid ids."
+      end
+
+      root = File.expand_path(options[:root] || Dir.pwd)
+      abs_path = File.expand_path(options[:file], root)
+      raise UsageError, "no such file: #{abs_path}" unless File.file?(abs_path)
+
+      rel_path = abs_path.sub(/\A#{Regexp.escape(root)}\/?/, "")
+      source = File.read(abs_path)
+
+      sexp = begin
+        Ripper.sexp(source)
+      rescue StandardError => e
+        raise UsageError, "#{rel_path} failed to parse: #{e.message}"
+      end
+      if sexp.nil?
+        raise UsageError, "#{rel_path} could not be parsed (a syntax error, or Ruby syntax newer " \
+                           "than this gem's Ruby runtime supports)."
+      end
+
+      findings = rule_class.new(file: rel_path, source: source, sexp: sexp).scan
+
+      if findings.empty?
+        @stdout.puts "scryer verify: #{options[:rule]} no longer fires on #{rel_path} — fix verified."
+        0
+      else
+        @stdout.puts "scryer verify: #{options[:rule]} still fires on #{rel_path} (#{findings.size} finding(s)):"
+        findings.each { |f| @stdout.puts "  line #{f.line}: #{f.message}" }
+        1
+      end
+    end
+
     # One-off OSV.dev lookup for a single gem — no Gemfile.lock, no scan,
     # no other network calls. `spec` is "name" or "name:version" (colon
     # rather than a second CLI arg, so this stays a single -o-style flag).
@@ -169,6 +288,62 @@ module Scryer
       findings.empty? ? 0 : 1
     end
 
+    # `--save-baseline PATH` is a distinct mode, same as --audit-deps/
+    # --check-gem: it captures every finding across every category (not
+    # just security — a legacy app's existing performance/style debt is
+    # just as much "not what I'm here to re-litigate today" as its security
+    # debt), writes the fingerprints, and exits without writing the normal
+    # -o reports. See Scryer::Baseline for why fingerprints, not file:line.
+    def save_baseline(path, result, dependency_findings)
+      all_findings = (result.security_findings + result.performance_findings + result.style_findings)
+                     .map(&:to_h) + dependency_findings.map(&:to_h)
+      Baseline.save(path, all_findings)
+      @stdout.puts "Scryer: saved baseline of #{all_findings.size} finding(s) to #{path}."
+      0
+    end
+
+    # Filters `result`'s finding arrays (mutated in place — Result is a
+    # plain Struct, this is the same object the caller already holds) and
+    # returns [new_dependency_findings, fixed_count] since dependency_findings
+    # is a local array in the caller, not a field this method can mutate by
+    # reference the way it can Struct fields.
+    # `fixed_count` has to be computed ONCE against the union of every
+    # category's current fingerprints, not once per category summed
+    # together — Baseline.diff's fixed_count is "baseline fingerprints not
+    # present in *this* call's findings," so calling it separately per
+    # category and summing would count every other category's
+    # still-present findings as "fixed" too (verified: this exact bug
+    # produced a nonsensical "762 fixed" on a rescan with zero changes,
+    # against a 255-finding baseline — fixed by computing fixed_count from
+    # the combined set once, while still filtering "new" per category since
+    # that part only checks baseline membership, which is fine to do
+    # separately).
+    def apply_baseline(path, result, dependency_findings)
+      baseline_fingerprints = Baseline.load(path)
+
+      security_hashes = result.security_findings.map(&:to_h)
+      performance_hashes = result.performance_findings.map(&:to_h)
+      style_hashes = result.style_findings.map(&:to_h)
+      dependency_hashes = dependency_findings.map(&:to_h)
+
+      all_current_fingerprints = Baseline.fingerprints(security_hashes + performance_hashes + style_hashes + dependency_hashes)
+      fixed_count = (baseline_fingerprints - all_current_fingerprints.to_set).size
+
+      result.security_findings = filter_new(result.security_findings, security_hashes, baseline_fingerprints)
+      result.performance_findings = filter_new(result.performance_findings, performance_hashes, baseline_fingerprints)
+      result.style_findings = filter_new(result.style_findings, style_hashes, baseline_fingerprints)
+      filtered_deps = filter_new(dependency_findings, dependency_hashes, baseline_fingerprints)
+
+      [filtered_deps, fixed_count]
+    rescue Baseline::LoadError => e
+      raise UsageError, e.message
+    end
+
+    def filter_new(objects, hashes, baseline_fingerprints)
+      fingerprints = Baseline.fingerprints(hashes)
+      objects.each_with_index.reject { |_, i| baseline_fingerprints.include?(fingerprints[i]) }.map(&:first)
+    end
+
     def parse(argv)
       options = { outputs: [] }
 
@@ -189,6 +364,17 @@ module Scryer
                 "insecure git/http sources (offline), instead of running the normal static scan. " \
                 "Exits non-zero if anything is found, so this can gate CI the same way " \
                 "`bundle-audit check` does.") { options[:audit_deps] = true }
+        opts.on("--save-baseline PATH",
+                "Run the normal scan, save every finding's fingerprint to PATH, then exit — no " \
+                "reports written. A later `scryer --baseline PATH` scan reports only findings " \
+                "new since this snapshot, so an app with existing security debt can gate CI on " \
+                "new issues without being forced to fix everything on day one.") { |v| options[:save_baseline] = v }
+        opts.on("--baseline PATH",
+                "Compare this scan against a baseline saved by --save-baseline: every report " \
+                "(-o files, console summary, exit code) reflects only findings new since PATH " \
+                "was saved. Fingerprints ignore line number (rule + file + offending code), so " \
+                "an unrelated edit elsewhere in the file won't make an existing finding look " \
+                "new.") { |v| options[:baseline] = v }
         opts.on("--no-deps",
                 "Skip the dependency audit (OSV.dev vulnerable gems + insecure git/http sources) " \
                 "that otherwise runs as part of every normal scan. Use this for a fast, fully " \

data/lib/scryer/finding.rb

@@ -7,11 +7,17 @@ module Scryer
     :rule_id,        # e.g. "sql_injection"
     :category,       # "security" | "performance" | "duplication"
     :severity,       # "critical" | "warning" | "info"
+    :confidence,     # "high" | "medium" | "low" — see Rule.confidence
+    :cwe,            # e.g. "CWE-89", or nil for non-security rules
+    :owasp_category, # e.g. "A03:2021-Injection", or nil for non-security rules
     :file,           # relative path
     :line,           # integer line number (1-indexed) or nil
     :code_snippet,   # the offending source line, stripped
     :message,        # human-readable description of the issue
     :suggested_fix,  # human-readable explanation + example patch
+    :fix_verified,   # true/false/nil — see Scryer::FixVerifier; nil unless
+                     # an ai_client is configured AND the AI's reply had a
+                     # verifiable AFTER: block, not "no fix exists"
     keyword_init: true
   ) do
     def to_h