scryer 1.0.0 → 1.1.1

data/lib/scryer/fix_verifier.rb

@@ -0,0 +1,82 @@
+require "ripper"
+
+module Scryer
+  # Best-effort verification that an AI-rewritten suggested_fix actually
+  # clears the finding it was generated for — "AI-verified remediation" in
+  # the sense of "Scryer independently re-checked this," not in the sense of
+  # a human review being unnecessary (suggested_fix is still never
+  # auto-applied to a real file; see AiFixSuggester's own header comment).
+  #
+  # How: AiFixSuggester's prompt (see static_prompt_for) asks the model to
+  # end its reply with a fenced "AFTER:" code block containing a drop-in
+  # replacement for the single offending source line. This class extracts
+  # that block, substitutes it for that one line in an in-memory copy of the
+  # file (nothing is ever written to disk), re-parses the result, and
+  # re-runs *only the one rule that flagged this finding* against it. If
+  # that rule no longer fires anywhere in the modified file, the fix is
+  # marked verified.
+  #
+  # Deliberately narrow, same spirit as `scryer verify` (the CLI command
+  # this shares its core logic with): this confirms the ONE finding it
+  # targeted is gone, not that the fix is otherwise correct, idiomatic, or
+  # free of introducing a different problem — a full rescan (or `scryer
+  # verify` again with a different --rule) answers that.
+  #
+  # Returns true (rule no longer fires), false (attempted but the rule still
+  # fires, or the rewritten line doesn't even parse), or nil (verification
+  # wasn't attempted at all — no AFTER: block in the AI's reply, the
+  # original file isn't readable, or this isn't a rule-backed Finding to
+  # begin with). nil is deliberately distinct from false: it means "we don't
+  # know," not "we checked and it's still broken."
+  module FixVerifier
+    module_function
+
+    AFTER_BLOCK = /AFTER:\s*```\w*\n(.*?)\n?```/m.freeze
+
+    def verify(finding:, root:)
+      return nil unless finding.is_a?(Scryer::Finding)
+      return nil unless finding.line && finding.rule_id
+
+      after_snippet = extract_after_snippet(finding.suggested_fix)
+      return nil unless after_snippet
+
+      abs_path = File.join(root, finding.file.to_s)
+      return nil unless File.file?(abs_path)
+
+      lines = File.read(abs_path).lines
+      return nil unless finding.line.between?(1, lines.size)
+
+      modified_source = apply_line_replacement(lines, finding.line, after_snippet)
+
+      sexp = begin
+        Ripper.sexp(modified_source)
+      rescue StandardError
+        nil
+      end
+      return false if sexp.nil? # the rewritten line doesn't even parse — not a usable fix
+
+      rule_class = Scryer::RuleSet.all.find { |r| r.rule_id == finding.rule_id }
+      return nil unless rule_class
+
+      remaining = rule_class.new(file: finding.file, source: modified_source, sexp: sexp).scan
+      remaining.none? { |f| f.rule_id == finding.rule_id }
+    rescue StandardError
+      nil
+    end
+
+    def extract_after_snippet(suggested_fix)
+      match = AFTER_BLOCK.match(suggested_fix.to_s)
+      return nil unless match
+
+      content = match[1].to_s
+      content.strip.empty? ? nil : content
+    end
+
+    def apply_line_replacement(lines, line_number, replacement)
+      replacement_text = replacement.end_with?("\n") ? replacement : "#{replacement}\n"
+      modified = lines.dup
+      modified[line_number - 1] = replacement_text
+      modified.join
+    end
+  end
+end

data/lib/scryer/minitest.rb

@@ -0,0 +1,48 @@
+# Opt-in Minitest integration — require this file yourself (e.g. `require
+# "scryer/minitest"` in test_helper.rb) rather than it loading automatically
+# with the gem; same reasoning as lib/scryer/rspec.rb (Minitest is never a
+# Scryer runtime dependency, and this file's assertions only make sense once
+# the host app's own test framework is already loaded).
+#
+# Mix Scryer::MinitestAssertions into a Minitest::Test (or
+# ActiveSupport::TestCase, which is one) to assert this app's own security
+# scan stays clean as part of its normal test suite:
+#
+#   class SecurityTest < ActiveSupport::TestCase
+#     include Scryer::MinitestAssertions
+#
+#     test "no critical findings" do
+#       assert_no_critical_scryer_findings(Scryer.scan(root: Rails.root.to_s))
+#     end
+#
+#     test "the mass-assignment bug fixed in PR #123 doesn't come back" do
+#       assert_no_scryer_findings_for(Scryer.scan(root: Rails.root.to_s), "mass_assignment")
+#     end
+#   end
+module Scryer
+  module MinitestAssertions
+    # Only security findings — style/performance findings aren't a security
+    # regression, same scoping as the RSpec have_no_critical_findings matcher.
+    def assert_no_critical_scryer_findings(result, msg = nil)
+      criticals = result.security_findings.select { |f| f.severity == "critical" }
+      default_msg = -> {
+        lines = criticals.map { |f| "  - #{f.rule_id} at #{f.file}:#{f.line} — #{f.message}" }
+        "expected no critical security findings, but got #{criticals.size}:\n#{lines.join("\n")}"
+      }
+      assert criticals.empty?, msg || default_msg.call
+    end
+
+    # Checks all three categories (security/performance/style) — a rule
+    # regressing is worth catching regardless of which category it's filed
+    # under, unlike assert_no_critical_scryer_findings above.
+    def assert_no_scryer_findings_for(result, rule_id, msg = nil)
+      matches = (result.security_findings + result.performance_findings + result.style_findings)
+                .select { |f| f.rule_id == rule_id.to_s }
+      default_msg = -> {
+        lines = matches.map { |f| "  - #{f.file}:#{f.line} — #{f.message}" }
+        "expected no findings for rule #{rule_id.inspect}, but got #{matches.size}:\n#{lines.join("\n")}"
+      }
+      assert matches.empty?, msg || default_msg.call
+    end
+  end
+end

data/lib/scryer/performance_rules/inefficient_save_loop_rule.rb

@@ -14,6 +14,7 @@ module Scryer
       self.category = "performance"
       self.default_severity = "warning"
       self.title = "Per-record save/update inside a loop"
+      self.confidence = "medium"
 
       LOOP_METHODS = %w[each each_with_index].freeze
       # Genuinely argless in normal use — a bare `:call` node, never wrapped
@@ -24,7 +25,25 @@ module Scryer
       # avoids double-counting the inner call node these wrap.
       ARG_METHODS = %w[update update! update_attribute update_attributes].freeze
 
+      # `db/seeds.rb` (and the multi-file `db/seeds/*.rb` convention Rails
+      # supports via `Rails.application.load_seed`) is a one-time, manually
+      # run setup script, not a request-handling hot path — the whole
+      # premise of this rule (per-record round-trips scale badly as load
+      # grows) doesn't apply to a script a developer runs once at setup
+      # time for a small, fixed reference dataset (roles, plans, countries,
+      # ...). Flagging `roles.each { |r| r.save! }` there is just noise, so
+      # this rule skips findings whose file is exactly this path or under
+      # this directory. Deliberately file-path-based rather than trying to
+      # infer "small dataset" from the AST (which isn't reliably knowable —
+      # a seed file can still iterate a CSV of arbitrary size), and narrow
+      # to this one well-known Rails convention rather than any file that
+      # merely "looks like a script" elsewhere in the app.
+      SEED_FILE = "db/seeds.rb"
+      SEED_DIR_PREFIX = "db/seeds/"
+
       def scan
+        return [] if seed_file?
+
         findings = []
 
         Ast.each_node(sexp) do |node|
@@ -58,6 +77,19 @@ module Scryer
 
       private
 
+      # `Scanner` builds `file` by globbing `File.join(root, dir, "**", "*.rb")`
+      # with `dir` defaulting to `"."`, so the relative path it hands rules is
+      # actually `"./db/seeds.rb"`, not `"db/seeds.rb"` — a plain `==`/
+      # `start_with?` against the un-prefixed string silently never matches
+      # against a real scan (verified: without stripping the prefix here,
+      # `db/seeds.rb` still fired in a real `Scryer::Scanner.new(root:,
+      # dirs: ["."]).call` run). Strip a leading `./` before comparing so
+      # this matches how the path actually arrives, not an assumed form.
+      def seed_file?
+        normalized = file.to_s.delete_prefix("./")
+        normalized == SEED_FILE || normalized.start_with?(SEED_DIR_PREFIX)
+      end
+
       def block_param_name(block_node)
         return nil unless Ast.tagged?(block_node, :do_block, :brace_block)
 

data/lib/scryer/performance_rules/missing_pagination_rule.rb

@@ -12,6 +12,7 @@ module Scryer
       self.category = "performance"
       self.default_severity = "warning"
       self.title = "Possible unbounded result set on an index action"
+      self.confidence = "medium"
 
       QUERY_METHODS = %w[all where].freeze
       BOUND_METHODS = %w[limit page per paginate find_each find_in_batches first take].freeze

data/lib/scryer/performance_rules/n_plus_one_query_rule.rb

@@ -21,6 +21,7 @@ module Scryer
       self.category = "performance"
       self.default_severity = "warning"
       self.title = "Possible N+1 query inside a loop"
+      self.confidence = "medium"
 
       QUERY_METHODS = %w[where all find find_by find_by! order limit].freeze
       LOOP_METHODS = %w[each map collect each_with_index].freeze

data/lib/scryer/performance_rules/unbounded_table_scan_rule.rb

@@ -14,6 +14,7 @@ module Scryer
       self.category = "performance"
       self.default_severity = "warning"
       self.title = "Full query result loaded into memory before iterating"
+      self.confidence = "medium"
 
       QUERY_METHODS = %w[all where order].freeze