scryer 1.0.0 → 1.2.0

data/lib/scryer/colorizer.rb

@@ -0,0 +1,56 @@
+module Scryer
+  # Hand-rolled ANSI color/style helper for console output — deliberately
+  # not a gem dependency (`pastel`, `colorize`, ...), consistent with
+  # Scryer's zero-runtime-dependency design (see the gemspec).
+  #
+  # Off by default whenever it would be wrong to color: piped/redirected
+  # output, `NO_COLOR` set (https://no-color.org), or a dumb terminal
+  # (`TERM=dumb`). On by default at a real terminal otherwise. An explicit
+  # `--no-color`/`--color` flag (CLI) or `SCRYER_NO_COLOR`/`SCRYER_COLOR` env
+  # var (rake) always wins over all of that, in either direction — a flag
+  # typed for this one invocation is more specific than a session-wide env
+  # var, the same precedence ripgrep/eslint use for their own --color flags.
+  module Colorizer
+    module_function
+
+    CODES = { red: 31, green: 32, yellow: 33, cyan: 36, gray: 90, bold: 1 }.freeze
+
+    # `override`: true/false forces color on/off regardless of TTY/NO_COLOR
+    # (an explicit --color/--no-color flag or SCRYER_COLOR/SCRYER_NO_COLOR
+    # env var); nil (the default) means "decide automatically."
+    def enabled?(stream = $stdout, override: nil)
+      return override unless override.nil?
+      return false unless ENV["NO_COLOR"].to_s.empty?
+      return false if ENV["TERM"] == "dumb"
+
+      stream.respond_to?(:tty?) && stream.tty?
+    end
+
+    def paint(text, *styles, stream: $stdout, override: nil)
+      return text.to_s unless enabled?(stream, override: override)
+
+      codes = styles.map { |s| CODES.fetch(s) }.join(";")
+      "\e[#{codes}m#{text}\e[0m"
+    end
+
+    def severity(text, severity, **opts)
+      case severity.to_s
+      when "critical" then paint(text, :red, :bold, **opts)
+      when "warning" then paint(text, :yellow, **opts)
+      when "info" then paint(text, :cyan, **opts)
+      else text.to_s
+      end
+    end
+
+    # A/B/C/D/F — the security score's letter grade (see
+    # ReportRenderer#security_score).
+    def grade(text, letter, **opts)
+      case letter.to_s
+      when "A", "B" then paint(text, :green, :bold, **opts)
+      when "C" then paint(text, :yellow, :bold, **opts)
+      when "D", "F" then paint(text, :red, :bold, **opts)
+      else text.to_s
+      end
+    end
+  end
+end

data/lib/scryer/dependency_fixer.rb

@@ -0,0 +1,96 @@
+require "open3"
+
+module Scryer
+  # `scryer fix --deps` — the dependency-audit analog of the rule-based
+  # `scryer fix`, and a separate small pipeline from it: a
+  # `DependencyAudit::Finding` has no `.line`/`.file`/`.rule_id` (see its
+  # Struct in dependency_audit.rb), so none of FixRunner/MechanicalFixer/
+  # FixVerifier — all built around rewriting a single source line and
+  # re-running one Ripper-based rule against it — apply here at all. This
+  # module exists for the one kind of dependency finding that has an
+  # unambiguous, mechanically-applicable fix: a gem with a published patched
+  # version to upgrade to.
+  #
+  # Only acts on `kind: "vulnerable_dependency"` findings that have at least
+  # one published patched version — DependencyAudit already leaves
+  # `patched_versions` empty when OSV has no fix yet, so there's nothing to
+  # bump to; those, along with `insecure_source` / `ruby_eol` /
+  # `credentials_exposure` findings (none of which "bundle update" can
+  # address — a source URL, a Ruby interpreter version, and a gitignore rule
+  # aren't gem versions), are always left for manual review.
+  module DependencyFixer
+    module_function
+
+    # Groups findings by gem_name (a gem can have more than one open
+    # advisory) and runs `bundle update GEM --conservative` once per gem,
+    # then re-queries OSV.dev for that one gem to confirm the bump actually
+    # cleared every advisory it had — `--conservative` tries to avoid moving
+    # anything beyond what's needed, but a version constraint elsewhere in
+    # the Gemfile can still leave a gem on an old, still-vulnerable version.
+    # This re-check is what turns "the command exited 0" into "verified,"
+    # the same verify-before-trusting discipline FixRunner/FixVerifier use
+    # for rule-based fixes — a real command actually ran and actually
+    # changed Gemfile.lock, so trusting its exit code alone isn't enough.
+    #
+    # Returns [fixed, skipped] (plain arrays of DependencyAudit::Finding).
+    # Yields (finding, status, error) to the given block as each gem is
+    # resolved — status is :fixed, :would_fix (dry_run), :error (the bundle
+    # command itself failed — `error` is its captured output), or :skipped
+    # (no patched version published, or the re-check still shows it
+    # vulnerable). `runner` and `recheck` are injectable for testing, so this
+    # is exercisable without a real Bundler process or network call.
+    def apply(findings, root:, dry_run: false, runner: method(:run_bundle_update),
+              recheck: method(:default_recheck), &on_result)
+      fixed = []
+      skipped = []
+
+      actionable, unfixable = findings.select { |f| f.kind == "vulnerable_dependency" }
+                                       .partition { |f| Array(f.patched_versions).any? }
+
+      unfixable.each do |finding|
+        skipped << finding
+        on_result&.call(finding, :skipped, nil)
+      end
+
+      actionable.group_by(&:gem_name).each_value do |gem_findings|
+        gem_name = gem_findings.first.gem_name
+
+        if dry_run
+          fixed.concat(gem_findings)
+          gem_findings.each { |f| on_result&.call(f, :would_fix, nil) }
+          next
+        end
+
+        success, output = runner.call(gem_name, root)
+
+        if !success
+          skipped.concat(gem_findings)
+          gem_findings.each { |f| on_result&.call(f, :error, output) }
+          next
+        end
+
+        if recheck.call(root, gem_name)
+          skipped.concat(gem_findings)
+          message = "bundle update #{gem_name} --conservative ran, but #{gem_name} is still flagged " \
+                    "(no resolvable fixed version given the current Gemfile constraints, or a " \
+                    "different advisory applies to the version it landed on) — check manually."
+          gem_findings.each { |f| on_result&.call(f, :skipped, message) }
+        else
+          fixed.concat(gem_findings)
+          gem_findings.each { |f| on_result&.call(f, :fixed, nil) }
+        end
+      end
+
+      [fixed, skipped]
+    end
+
+    def run_bundle_update(gem_name, root)
+      stdout, stderr, status = Open3.capture3("bundle", "update", gem_name, "--conservative", chdir: root)
+      [status.success?, status.success? ? stdout : "#{stdout}\n#{stderr}".strip]
+    end
+
+    def default_recheck(root, gem_name)
+      DependencyAudit.vulnerable_gems(root).any? { |f| f.gem_name == gem_name }
+    end
+  end
+end

data/lib/scryer/finding.rb

@@ -7,11 +7,17 @@ module Scryer
     :rule_id,        # e.g. "sql_injection"
     :category,       # "security" | "performance" | "duplication"
     :severity,       # "critical" | "warning" | "info"
+    :confidence,     # "high" | "medium" | "low" — see Rule.confidence
+    :cwe,            # e.g. "CWE-89", or nil for non-security rules
+    :owasp_category, # e.g. "A03:2021-Injection", or nil for non-security rules
     :file,           # relative path
     :line,           # integer line number (1-indexed) or nil
     :code_snippet,   # the offending source line, stripped
     :message,        # human-readable description of the issue
     :suggested_fix,  # human-readable explanation + example patch
+    :fix_verified,   # true/false/nil — see Scryer::FixVerifier; nil unless
+                     # an ai_client is configured AND the AI's reply had a
+                     # verifiable AFTER: block, not "no fix exists"
     keyword_init: true
   ) do
     def to_h

data/lib/scryer/fix_runner.rb

@@ -0,0 +1,161 @@
+require "set"
+
+module Scryer
+  # The "apply verified AI fixes to real files" loop, shared behind both
+  # `scryer fix` (CLI) and `rails scryer:fix` (rake task) — the actual
+  # file-writing logic lives here exactly once; each caller formats its own
+  # console output around it (same house style as `ScryerTasks`/`CLI`
+  # already duplicating summary-printing methods rather than sharing them —
+  # see lib/tasks/scryer.rake).
+  module FixRunner
+    module_function
+
+    # Groups by file and processes each file's findings from the highest
+    # line number down — replacing a later line first means every not-yet-
+    # processed line number earlier in the same file stays valid even when a
+    # fix's replacement spans a different number of lines than the original
+    # one. (Two distinct findings landing on the exact same line in the same
+    # file is a narrow, unhandled-further edge case — FixVerifier.apply!
+    # always re-verifies against the file's current on-disk content right
+    # before writing, so it can't silently apply a fix that no longer
+    # actually matches what's there, but the second finding on that line may
+    # end up needing a second fix pass to resolve.)
+    #
+    # Returns [fixed, skipped] — both plain arrays of Finding (a
+    # user-declined finding, when `confirm` is given, lands in `skipped`
+    # too — it was verified but deliberately not written, same bucket as
+    # "not written" for any other reason). Yields (finding, status, error)
+    # to the given block as each candidate is resolved — status is :fixed,
+    # :would_fix (dry_run), :declined (confirm said no), :ai_error (the
+    # ai_client raised — `error` is that exception; nil for every other
+    # status), :cancelled (confirm said stop — see below), or :skipped — so
+    # a caller (see CLI#print_fix_progress / ScryerTasks#print_fix_progress)
+    # can print progress as it happens instead of only a summary once
+    # everything's done. Blocks in Ruby don't enforce arity, so an existing
+    # `{ |finding, status| ... }` callback still works fine and just never
+    # sees the third arg. The block is entirely optional; omitting it
+    # changes nothing else.
+    #
+    # `confirm`, when given, is called with each independently-verified
+    # finding right before it would be written (or counted as "would fix",
+    # under dry_run) — returning false skips it without writing, and
+    # returning the symbol `:cancel` stops entirely: every remaining
+    # candidate (including the current one) is marked :cancelled without
+    # `confirm` being asked about any of them again — and, critically,
+    # without spending an AiFixSuggester call or a MechanicalFixer/
+    # FixVerifier pass on any of them either, since "cancel" means stop
+    # working, not just "don't write what's already been verified." This is
+    # the model-layer half of `scryer fix`'s per-finding "yes / skip / yes
+    # to all remaining / cancel" review; the actual prompt (reading stdin,
+    # tracking a latched "yes to all" choice across calls) lives in the
+    # caller (CLI#build_fix_confirmer / ScryerTasks) so this stays testable
+    # without a real terminal. Omitting `confirm` (the default) applies
+    # every verified fix automatically, same as before this option existed.
+    def apply(candidates, client:, root:, dry_run: false, confirm: nil, &on_result)
+      fixed = []
+      skipped = []
+      cancelled = false
+
+      candidates.group_by(&:file).each_value do |findings_in_file|
+        findings_in_file.sort_by { |f| -(f.line || 0) }.each do |finding|
+          if cancelled
+            skipped << finding
+            on_result&.call(finding, :cancelled, nil)
+            next
+          end
+
+          # An ai_client, when configured, is tried first for every rule —
+          # including the ones a mechanical fixer could also handle — so a
+          # "real developer" fix (context-aware, not just the one
+          # mechanically-derivable rewrite) is what gets written whenever
+          # AI is actually available. The deterministic mechanical fixer is
+          # the fallback: it runs whenever AI isn't configured at all,
+          # declined to produce anything usable, raised, or its rewrite
+          # didn't independently verify — same safety gate either way, so
+          # neither path is ever trusted more than the other.
+          ai_error = nil
+          AiFixSuggester.enhance!(finding, client: client, root: root, on_error: ->(_f, e) { ai_error = e }) if client
+
+          if finding.fix_verified != true
+            mechanical_fix = MechanicalFixer.suggest(finding, root: root)
+            if mechanical_fix
+              finding.suggested_fix = mechanical_fix
+              finding.fix_verified = FixVerifier.verify(finding: finding, root: root)
+            end
+          end
+
+          if finding.fix_verified != true
+            skipped << finding
+            on_result&.call(finding, ai_error ? :ai_error : :skipped, ai_error)
+            next
+          end
+
+          if confirm
+            decision = confirm.call(finding)
+            if decision == :cancel
+              cancelled = true
+              skipped << finding
+              on_result&.call(finding, :cancelled, nil)
+              next
+            elsif !decision
+              skipped << finding
+              on_result&.call(finding, :declined)
+              next
+            end
+          end
+
+          if dry_run
+            fixed << finding
+            on_result&.call(finding, :would_fix)
+          elsif FixVerifier.apply!(finding: finding, root: root)
+            fixed << finding
+            on_result&.call(finding, :fixed)
+          else
+            skipped << finding
+            on_result&.call(finding, :skipped)
+          end
+        end
+      end
+
+      [fixed, skipped]
+    end
+
+    # Best-effort short human explanation of a fix — the first couple of
+    # sentences of the AI's own reply, before its code block(s)/AFTER:
+    # marker. AiFixSuggester's prompt asks the model to lead with 1-3
+    # sentences of plain-English explanation before any code, so this is
+    # just trimming that reply down to something that reads well as a single
+    # console line, not a new source of information. Returns "" (never nil)
+    # when there's nothing usable to show.
+    def explain(suggested_fix, max_sentences: 2)
+      text = suggested_fix.to_s.strip
+      return "" if text.empty?
+
+      cut_at = [text.index("```"), text.index(/^AFTER:/m)].compact.min
+      text = text[0...cut_at] if cut_at
+      text.strip.split(/(?<=[.!?])\s+/).first(max_sentences).join(" ").strip
+    end
+
+    # Re-scans `root` and returns the subset of `fixed` that still shows up
+    # (matched by fingerprint — rule + file + offending code, not line
+    # number, since every fixed line's line number just changed) — normally
+    # empty. FixVerifier.apply! only re-checks the single rule against the
+    # single file it just edited in isolation; this is the broader,
+    # whole-project confirmation that no interaction between edits (two
+    # fixes in the same file, one fix's line-count change shifting another
+    # finding's line number) left anything still firing.
+    def verify(fixed, root:, dirs:, skip_rules:)
+      # detect_duplicates: false — only security/performance/style findings
+      # are read below; duplicate_groups are never part of `fixed`
+      # (duplicate-code groups aren't Findings — see Scanner#initialize's
+      # comment on detect_duplicates), so there's nothing to gain from that
+      # pass here.
+      rescanned = Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules, detect_duplicates: false).call
+      still_present = Baseline.fingerprints(
+        (rescanned.security_findings + rescanned.performance_findings + rescanned.style_findings).map(&:to_h)
+      ).to_set
+
+      fixed.select { |f| still_present.include?(Baseline.fingerprint(f.to_h)) }
+    end
+  end
+end

data/lib/scryer/fix_verifier.rb

@@ -0,0 +1,169 @@
+require "ripper"
+
+module Scryer
+  # Best-effort verification that an AI-rewritten suggested_fix actually
+  # clears the finding it was generated for — "AI-verified remediation" in
+  # the sense of "Scryer independently re-checked this," not in the sense of
+  # a human review being unnecessary (suggested_fix is still never
+  # auto-applied to a real file; see AiFixSuggester's own header comment).
+  #
+  # How: AiFixSuggester's prompt (see static_prompt_for) asks the model to
+  # end its reply with a fenced "AFTER:" code block containing a drop-in
+  # replacement for the single offending source line. This class extracts
+  # that block, substitutes it for that one line in an in-memory copy of the
+  # file (nothing is ever written to disk), re-parses the result, and
+  # re-runs *only the one rule that flagged this finding* against it. If
+  # that rule no longer fires anywhere in the modified file, the fix is
+  # marked verified.
+  #
+  # Deliberately narrow, same spirit as `scryer verify` (the CLI command
+  # this shares its core logic with): this confirms the ONE finding it
+  # targeted is gone, not that the fix is otherwise correct, idiomatic, or
+  # free of introducing a different problem — a full rescan (or `scryer
+  # verify` again with a different --rule) answers that.
+  #
+  # Returns true (rule no longer fires), false (attempted but the rule still
+  # fires, or the rewritten line doesn't even parse), or nil (verification
+  # wasn't attempted at all — no AFTER: block in the AI's reply, the
+  # original file isn't readable, or this isn't a rule-backed Finding to
+  # begin with). nil is deliberately distinct from false: it means "we don't
+  # know," not "we checked and it's still broken."
+  #
+  # `apply!` below is the one place in this whole gem that ever writes an
+  # AI-generated fix to a real file — and even there, only after this exact
+  # same in-memory check says the fix genuinely clears the finding. See
+  # `scryer fix` (lib/scryer/cli.rb) for the only caller; nothing else in
+  # this gem calls it, including the ai_client-enhancement path a normal
+  # scan/report run uses (AiFixSuggester#enhance!), which only ever rewrites
+  # `finding.suggested_fix` text, never touches disk.
+  module FixVerifier
+    module_function
+
+    AFTER_BLOCK = /AFTER:\s*```\w*\n(.*?)\n?```/m.freeze
+
+    def verify(finding:, root:)
+      verify_with_source(finding: finding, root: root).first
+    end
+
+    # Writes the verified fix to the real file and returns true, or returns
+    # the same false/nil `verify` would return without writing anything.
+    # Re-derives the verification (rather than trusting a `fix_verified`
+    # value computed earlier) so there's no window between "we checked" and
+    # "we wrote" where the file could have changed out from under it.
+    def apply!(finding:, root:)
+      verified, modified_source, abs_path = verify_with_source(finding: finding, root: root)
+      return verified unless verified == true
+
+      File.write(abs_path, modified_source)
+      true
+    rescue StandardError
+      nil
+    end
+
+    # [verified, modified_source, abs_path] — modified_source/abs_path are
+    # nil whenever verified isn't true (nothing for a caller to write in
+    # that case anyway).
+    def verify_with_source(finding:, root:)
+      return [nil, nil, nil] unless finding.is_a?(Scryer::Finding)
+      return [nil, nil, nil] unless finding.line && finding.rule_id
+
+      after_snippet = extract_after_snippet(finding.suggested_fix)
+      return [nil, nil, nil] unless after_snippet
+
+      abs_path = File.join(root, finding.file.to_s)
+      return [nil, nil, nil] unless File.file?(abs_path)
+
+      lines = File.read(abs_path).lines
+      return [nil, nil, nil] unless finding.line.between?(1, lines.size)
+
+      modified_source = apply_line_replacement(lines, finding.line, after_snippet)
+
+      sexp = begin
+        Ripper.sexp(modified_source)
+      rescue StandardError
+        nil
+      end
+      return [false, nil, nil] if sexp.nil? # the rewritten line doesn't even parse — not a usable fix
+
+      rule_class = Scryer::RuleSet.all.find { |r| r.rule_id == finding.rule_id }
+      return [nil, nil, nil] unless rule_class
+
+      remaining = rule_class.new(file: finding.file, source: modified_source, sexp: sexp).scan
+
+      # Matched by rule_id + code_snippet (same identity Baseline fingerprints
+      # use), NOT just rule_id — a file with two separate sql_injection
+      # findings must let each be verified independently. Checking only
+      # rule_id here would mean neither ever verifies, since fixing one line
+      # in isolation always leaves the other (still-unfixed) occurrence
+      # showing up in `remaining`.
+      target_snippet = finding.code_snippet.to_s.strip
+      rule_cleared = remaining.none? { |f| f.rule_id == finding.rule_id && f.code_snippet.to_s.strip == target_snippet }
+      verified = rule_cleared && !introduces_undefined_params_helper?(finding.code_snippet, after_snippet, modified_source)
+      verified ? [true, modified_source, abs_path] : [false, nil, nil]
+    rescue StandardError
+      [nil, nil, nil]
+    end
+
+    PARAMS_HELPER_NAME = /\b([a-z_][a-zA-Z0-9_]*_params)\b/.freeze
+
+    # A common, real failure mode found in production: mass_assignment's own
+    # suggested_fix (and the AI prompt built from it) recommends extracting a
+    # strong-parameters helper — "wrap in `order_params`, with `def
+    # order_params; params.require(...).permit(...); end`" — but `AFTER:` can
+    # only ever replace the single flagged line, never add a method
+    # definition elsewhere in the file. An AI reply that takes this approach
+    # ends up calling a helper (e.g. `create_charge_params[:account_id]`)
+    # that was never actually defined anywhere — syntactically valid Ruby, so
+    # it parses fine, and the mass_assignment rule stops firing (the line no
+    # longer references `params` directly), so this "verifies" clean by
+    # every check above... and then raises NoMethodError the moment it
+    # actually runs. Only flags a name that's *new* in this rewrite (already
+    # present in the original flagged line means it's not this fix's doing,
+    # and may well be defined in a parent class/concern this per-file check
+    # can't see) and has no matching `def` anywhere in the file. Like every
+    # other heuristic here, this can false-positive (a legitimately
+    # inherited helper looks identical to a hallucinated one from a single
+    # file's contents) — declining a fix that would have been fine is the
+    # safe direction to err in; writing one that crashes at runtime is not.
+    def introduces_undefined_params_helper?(original_line, after_snippet, full_source)
+      original_names = original_line.to_s.scan(PARAMS_HELPER_NAME).flatten
+      new_names = after_snippet.to_s.scan(PARAMS_HELPER_NAME).flatten.uniq - original_names
+
+      new_names.any? { |name| !full_source.match?(/\bdef\s+#{Regexp.escape(name)}\b/) }
+    end
+
+    def extract_after_snippet(suggested_fix)
+      match = AFTER_BLOCK.match(suggested_fix.to_s)
+      return nil unless match
+
+      content = match[1].to_s
+      content.strip.empty? ? nil : content
+    end
+
+    # An AI reply's AFTER: block is asked for "a drop-in replacement for the
+    # single offending line" — in practice, models frequently reply with
+    # that replacement flush against the left margin, dropping the original
+    # line's indentation entirely (confirmed against a real AI-generated fix
+    # in production). Ruby doesn't care, so this was never a *correctness*
+    # bug, but a fix that silently de-indents a line looks nothing like what
+    # a developer would actually commit. Restores the original line's
+    # leading whitespace onto the replacement's first line specifically —
+    # only when the replacement doesn't already start with any indentation
+    # of its own, so a reply that already got it right (or a multi-line
+    # reply whose later lines carry their own deliberate relative indent)
+    # is left alone.
+    def apply_line_replacement(lines, line_number, replacement)
+      original_indent = lines[line_number - 1].to_s[/\A[ \t]*/]
+      replacement_lines = replacement.lines
+      if replacement_lines.first && replacement_lines.first !~ /\A[ \t]/
+        replacement_lines[0] = "#{original_indent}#{replacement_lines[0]}"
+      end
+
+      replacement_text = replacement_lines.join
+      replacement_text = "#{replacement_text}\n" unless replacement_text.end_with?("\n")
+      modified = lines.dup
+      modified[line_number - 1] = replacement_text
+      modified.join
+    end
+  end
+end