scryer 1.1.1 → 1.2.1

data/lib/scryer/mechanical_fixer.rb

@@ -0,0 +1,288 @@
+require "set"
+require "ripper"
+
+module Scryer
+  # Deterministic, no-AI fixes for the narrow set of rules where the
+  # correct rewrite doesn't require judgment — there's exactly one sane
+  # answer every time, so there's nothing for an LLM to decide. Everything
+  # else (mass_assignment, idor, missing_authorization, csrf, ...) still
+  # needs an `ai_client` or a human, because the correct fix depends on
+  # things Scryer can't know statically (which params to permit, which
+  # policy to call).
+  #
+  # Produces the exact same "explanation + AFTER: fenced block" shape
+  # AiFixSuggester's prompt asks a real model for (see FixVerifier's
+  # AFTER_BLOCK regex) — so a mechanical fix flows through the *identical*
+  # verify/apply pipeline as an AI one; nothing here is trusted more than an
+  # LLM's guess would be. If a specific line doesn't match the exact shape a
+  # fixer here knows how to rewrite, `suggest` returns nil and the finding
+  # falls through to the ai_client (if configured) or manual review, same as
+  # any other unsupported case — this never guesses.
+  module MechanicalFixer
+    module_function
+
+    SUPPORTED_RULES = %w[
+      frozen_string_literal
+      sql_injection
+      force_ssl_disabled
+      insecure_cookie_serializer
+      weak_session_cookie
+      security_headers_disabled
+    ].freeze
+
+    # frozen_string_literal is mechanically fixable but, unlike the others,
+    # deliberately opt-in — a project-wide `scryer fix` sweep would
+    # otherwise touch nearly every file for a cosmetic, `info`-severity
+    # finding. See CLI#run_fix / ScryerTasks — this list is what those
+    # callers use to decide whether to ask before including a rule in an
+    # unscoped run, not something `suggest` itself gates on (explicitly
+    # requesting the rule, e.g. `--rule frozen_string_literal`, is already
+    # informed consent, so `suggest` always tries it).
+    OPT_IN_RULES = %w[frozen_string_literal].freeze
+
+    # Bang-methods and operators that mutate their receiver in place — used
+    # to detect whether freezing a file's string literals could actually
+    # break it (see fix_frozen_string_literal). Not exhaustive (this is a
+    # heuristic, not data-flow analysis), but covers the realistic cases.
+    MUTATING_METHODS = %w[
+      concat replace insert clear prepend
+      upcase! downcase! capitalize! swapcase!
+      strip! lstrip! rstrip! chomp! chop! squeeze!
+      gsub! sub! slice! delete! tr! tr_s! succ! next!
+      reverse! encode! force_encoding
+    ].freeze
+
+    def supported?(rule_id)
+      SUPPORTED_RULES.include?(rule_id)
+    end
+
+    def opt_in?(rule_id)
+      OPT_IN_RULES.include?(rule_id)
+    end
+
+    def suggest(finding, root: nil)
+      return nil unless finding.is_a?(Scryer::Finding)
+
+      case finding.rule_id
+      when "frozen_string_literal" then fix_frozen_string_literal(finding, root: root)
+      when "sql_injection" then fix_sql_injection(finding, root: root)
+      when "force_ssl_disabled" then fix_boolean_flip(finding, root, /(\bforce_ssl\s*=\s*)false\b/, "Flips `force_ssl` to `true`, restoring Rails' HTTPS enforcement.")
+      when "insecure_cookie_serializer" then fix_cookie_serializer(finding, root: root)
+      when "weak_session_cookie" then fix_weak_session_cookie(finding, root: root)
+      when "security_headers_disabled" then fix_security_headers_disabled(finding, root: root)
+      end
+    end
+
+    # finding.code_snippet is deliberately `.strip`ped by Ast.source_line
+    # (it's meant for display in a report, not for rewriting) — every fixer
+    # below needs the actual on-disk line, indentation included, or the
+    # rewritten line silently loses its original indentation. Falls back to
+    # code_snippet only when the real file can't be read (e.g. a unit test
+    # constructing a bare Finding with no root/real file on disk).
+    def raw_line(finding, root)
+      return finding.code_snippet.to_s unless root && finding.file && finding.line
+
+      abs_path = File.join(root.to_s, finding.file.to_s)
+      return finding.code_snippet.to_s unless File.file?(abs_path)
+
+      lines = File.read(abs_path).lines
+      return finding.code_snippet.to_s unless finding.line.between?(1, lines.size)
+
+      lines[finding.line - 1].to_s.chomp
+    rescue StandardError
+      finding.code_snippet.to_s
+    end
+    private_class_method :raw_line
+
+    # A magic comment is recognized by Ruby only on the very first source
+    # line, or the second if the first is a shebang — so prepending it (or
+    # inserting it right after a shebang) is always the *correct* rewrite.
+    # But "correct" isn't the same as "safe": freezing every string literal
+    # in the file breaks anything that mutates one in place (`str << x`,
+    # `str.gsub!(...)`, ...) at runtime with a FrozenError — something the
+    # frozen_string_literal rule itself has no way to see (it only checks
+    # for the magic comment's absence). Declines (nil) whenever the file
+    # can't be read/analyzed, or analysis finds a plausible in-place
+    # mutation — "analyse and fix only if no issue will arise from it".
+    def fix_frozen_string_literal(finding, root:)
+      source = read_source(finding, root)
+      return nil if source.nil? || mutates_a_string_literal?(source)
+
+      first_line = source.lines.first.to_s.chomp
+      code = if first_line.start_with?("#!")
+               "#{first_line}\n# frozen_string_literal: true\n"
+             else
+               "# frozen_string_literal: true\n\n#{first_line}"
+             end
+      wrap_after("Adds the `# frozen_string_literal: true` magic comment as the first line of the file — no in-place string mutation was found, so freezing literals here is safe.", code)
+    end
+
+    def read_source(finding, root)
+      return nil unless root && finding.file
+
+      abs_path = File.join(root.to_s, finding.file.to_s)
+      File.file?(abs_path) ? File.read(abs_path) : nil
+    rescue StandardError
+      nil
+    end
+    private_class_method :read_source
+
+    # True if `source` plausibly mutates a string literal in place, either
+    # directly (`"foo" << x`, `"foo".gsub!(...)`) or via a local variable
+    # that was assigned a string literal earlier in the file (`s = "foo"`
+    # ... `s << x`). Heuristic, not scope-aware — a variable name reused for
+    # a different value in a different method can cause a false positive
+    # (declining a fix that would actually have been fine), which is the
+    # safe direction to err in; a real Ripper parse failure is treated the
+    # same way (unable to analyze -> decline).
+    def mutates_a_string_literal?(source)
+      sexp = begin
+        Ripper.sexp(source)
+      rescue StandardError
+        nil
+      end
+      return true if sexp.nil?
+
+      literal_vars = string_literal_assigned_vars(sexp)
+
+      Ast.each_node(sexp).any? do |node|
+        shovel_onto_tracked_receiver?(node, literal_vars) ||
+          index_assign_onto_tracked_receiver?(node, literal_vars) ||
+          mutating_call_on_tracked_receiver?(node, literal_vars)
+      end
+    end
+    private_class_method :mutates_a_string_literal?
+
+    def string_literal_assigned_vars(sexp)
+      Ast.each_node(sexp).each_with_object(Set.new) do |node, vars|
+        next unless Ast.tagged?(node, :assign)
+
+        target = node[1]
+        value = node[2]
+        next unless Ast.tagged?(target, :var_field)
+        next unless Ast.tagged?(value, :string_literal)
+
+        name = Ast.ident_text(target[1])
+        vars << name if name
+      end
+    end
+    private_class_method :string_literal_assigned_vars
+
+    def shovel_onto_tracked_receiver?(node, literal_vars)
+      return false unless Ast.tagged?(node, :binary) && node[2] == :<<
+
+      tracked_receiver?(node[1], literal_vars)
+    end
+    private_class_method :shovel_onto_tracked_receiver?
+
+    def index_assign_onto_tracked_receiver?(node, literal_vars)
+      return false unless Ast.tagged?(node, :assign) && Ast.tagged?(node[1], :aref_field)
+
+      tracked_receiver?(node[1][1], literal_vars)
+    end
+    private_class_method :index_assign_onto_tracked_receiver?
+
+    def mutating_call_on_tracked_receiver?(node, literal_vars)
+      return false unless Ast.tagged?(node, :call, :command_call)
+
+      receiver_and_name = Ast.call_name(node)
+      return false unless receiver_and_name
+
+      receiver, method_name = receiver_and_name
+      return false unless MUTATING_METHODS.include?(method_name)
+
+      tracked_receiver?(receiver, literal_vars)
+    end
+    private_class_method :mutating_call_on_tracked_receiver?
+
+    def tracked_receiver?(receiver, literal_vars)
+      return true if Ast.tagged?(receiver, :string_literal)
+      return false unless Ast.tagged?(receiver, :var_ref, :vcall)
+
+      literal_vars.include?(Ast.ident_text(receiver[1]))
+    end
+    private_class_method :tracked_receiver?
+
+    # Only handles the unambiguous case: the interpolated string is the
+    # SOLE argument to the flagged call (immediately preceded by `(` and
+    # immediately followed by `)` on the same physical line) — anything
+    # else (an existing second argument, a multi-line call) is left alone
+    # rather than guessed at, since inserting a new bind parameter at the
+    # right spot in an arbitrary chained/multi-arg call isn't a one-answer
+    # problem. Quote characters directly hugging a `#{...}` (the common
+    # `"id = '#{x}'"` manual-SQL-quoting style) are consumed along with it
+    # — leaving them in place would produce `'?'`, which double-quotes the
+    # bound value and silently breaks the query while still looking
+    # "verified" (Scryer's own check only looks for interpolation, not
+    # query correctness).
+    def fix_sql_injection(finding, root:)
+      method = finding.message.to_s[/\A`(\w+)`/, 1]
+      return nil unless method
+
+      line = raw_line(finding, root)
+      m = line.match(/\A(?<pre>.*\b#{Regexp.escape(method)}\s*\(\s*)"(?<body>(?:[^"\\]|\\.)*)"\s*\)(?<rest>.*)\z/)
+      return nil unless m
+
+      exprs = []
+      new_body = m[:body].gsub(/(\\"|')?#\{([^{}]*)\}(\\"|')?/) do
+        exprs << Regexp.last_match(2).strip
+        "?"
+      end
+      return nil if exprs.empty? || new_body.include?("\#{")
+
+      code = "#{m[:pre]}\"#{new_body}\", #{exprs.join(", ")})#{m[:rest]}"
+      explanation = "Replaces the string interpolation inside the SQL string with #{exprs.size > 1 ? 'bind parameters' : 'a `?` bind parameter'}, " \
+                    "so the value#{exprs.size > 1 ? 's are' : ' is'} always sent as a query parameter rather than parsed as SQL text."
+      wrap_after(explanation, code)
+    end
+
+    def fix_boolean_flip(finding, root, pattern, explanation)
+      line = raw_line(finding, root)
+      return nil unless pattern.match?(line)
+
+      wrap_after(explanation, line.sub(pattern, '\1true'))
+    end
+
+    def fix_cookie_serializer(finding, root:)
+      line = raw_line(finding, root)
+      pattern = /(cookies_serializer\s*=\s*)(:marshal|["']marshal["'])/
+      return nil unless pattern.match?(line)
+
+      code = line.sub(pattern, '\1:json')
+      wrap_after("Switches the cookie serializer from `:marshal` to Rails' safe default, `:json`.", code)
+    end
+
+    # Appends `secure: true` (production-only) to the end of the
+    # `session_store` line — safe because this is a single command-call
+    # statement with no parens to worry about closing correctly.
+    def fix_weak_session_cookie(finding, root:)
+      line = raw_line(finding, root)
+      return nil if line.strip.empty?
+
+      code = "#{line.chomp}, secure: Rails.env.production?"
+      wrap_after("Adds `secure: true` (production only) to the session cookie options, so it's never sent over plain HTTP.", code)
+    end
+
+    # Only the plain single-header `= value` assignment shape (see
+    # SecurityHeadersRule) — a `.merge!(...)` call can disable several
+    # headers in one statement, only one of which may be the actual
+    # finding, so removing the whole line there could silently take out an
+    # unrelated, legitimate header too. Comments the line out (rather than
+    # deleting it outright) so there's a visible trace of what changed —
+    # keeping the original leading indentation so the comment lines up with
+    # its surrounding code instead of jumping to column 0.
+    def fix_security_headers_disabled(finding, root:)
+      line = raw_line(finding, root)
+      return nil if line.include?("merge!") || !line.include?("=")
+
+      indent = line[/\A[ \t]*/]
+      code = "#{indent}# #{line.strip} # removed by `scryer fix` — restores Rails' default security header"
+      wrap_after("Comments out the line disabling this security header, restoring Rails' safe default.", code)
+    end
+
+    def wrap_after(explanation, code)
+      "#{explanation}\n\nAFTER:\n```ruby\n#{code}\n```\n"
+    end
+    private_class_method :wrap_after
+  end
+end

data/lib/scryer/report_renderer.rb

@@ -106,16 +106,21 @@ module Scryer
     end
 
     # A single 0-100 number (plus a letter grade) summarizing this scan's
-    # security risk exposure — security findings and dependency findings
-    # only (performance/code-quality findings aren't security risk, so
-    # they're deliberately excluded; a slow app doesn't lower a *security*
-    # score). Deliberately NOT normalized by files-scanned or lines of code:
-    # it reflects this scan's absolute finding exposure, so it's meaningful
-    # for tracking one project's trend over time (does the next scan score
-    # higher or lower), not for comparing two differently-sized codebases
-    # against each other — a bigger app with the same finding *density* will
-    # naturally score lower here, and that's a documented limitation, not a
-    # bug.
+    # security risk exposure — security findings and dependency findings at
+    # full weight, plus performance findings at a small fraction of that
+    # weight (a slow app is a real cost, just not a *security* one, so it
+    # nudges the score rather than driving it — see SCORE_CATEGORY_WEIGHT).
+    # Code-quality findings (duplicate-code groups, frozen_string_literal)
+    # are never part of this on purpose: a `DuplicateDetector::DuplicateGroup`
+    # isn't even a `Finding` (no severity/confidence to weigh in the first
+    # place — see duplicate_detector.rb), and style findings are cosmetic,
+    # not risk. Deliberately NOT normalized by files-scanned or lines of
+    # code: it reflects this scan's absolute finding exposure, so it's
+    # meaningful for tracking one project's trend over time (does the next
+    # scan score higher or lower), not for comparing two differently-sized
+    # codebases against each other — a bigger app with the same finding
+    # *density* will naturally score lower here, and that's a documented
+    # limitation, not a bug.
     #
     # Exponential decay rather than linear subtraction from 100: a single
     # critical/high finding should visibly move the score (100 -> ~86) without
@@ -123,11 +128,24 @@ module Scryer
     # which would make the score useless for comparing "bad" against "worse."
     # weighted_penalty combines severity (the dominant factor) with
     # confidence (a low-confidence rule's finding shouldn't hurt the score as
-    # much as a high-confidence one saying the same severity) — same
-    # philosophy as SARIF's `rank` (see sarif_rank above), computed once here
-    # for a single scan-level number instead of per-result.
-    SCORE_SEVERITY_WEIGHT = { "critical" => 15, "warning" => 6, "info" => 1 }.freeze
+    # much as a high-confidence one saying the same severity) and category —
+    # same philosophy as SARIF's `rank` (see sarif_rank above), computed once
+    # here for a single scan-level number instead of per-result.
+    # "info" is deliberately far below critical/warning, not just a step
+    # down from them — an info-severity finding is closer to a cosmetic
+    # note than a real risk (see e.g. csrf_protection_disabled's
+    # narrowly-scoped-skip case), so a codebase with only info findings
+    # should barely move off 100 even with a fair number of them, rather
+    # than accumulating like a smaller warning would.
+    SCORE_SEVERITY_WEIGHT = { "critical" => 15, "warning" => 6, "info" => 0.25 }.freeze
     SCORE_CONFIDENCE_WEIGHT = { "high" => 1.0, "medium" => 0.7, "low" => 0.4 }.freeze
+    # `category` is "security" for every Scryer::Finding in security_findings
+    # and every DependencyAudit::Finding (which has no `category` field at
+    # all — `f["category"]` is nil for those, so they fall through to the
+    # 1.0 default below, same full weight as security). "performance" is the
+    # only other category ever passed into this method's `findings` — style
+    # findings and duplicate-code groups never reach here at all (see above).
+    SCORE_CATEGORY_WEIGHT = { "security" => 1.0, "performance" => 0.2 }.freeze
     SCORE_DECAY_CONSTANT = 100.0
 
     # Deliberately reads @result/@dependency_findings directly rather than
@@ -140,10 +158,14 @@ module Scryer
       # (has "confidence") and DependencyAudit::Finding (doesn't — a plain
       # Hash returns nil for a missing key rather than raising, unlike
       # calling #confidence directly on a struct that has no such member).
-      findings = (@result.security_findings + @dependency_findings).map(&:to_h)
+      # style_findings/duplicate_groups are never included — see this
+      # method's doc comment above for why.
+      findings = (@result.security_findings + @result.performance_findings + @dependency_findings).map(&:to_h)
 
       weighted_penalty = findings.sum do |f|
-        (SCORE_SEVERITY_WEIGHT[f["severity"]] || 3) * (SCORE_CONFIDENCE_WEIGHT[f["confidence"]] || 0.7)
+        (SCORE_SEVERITY_WEIGHT[f["severity"]] || 3) *
+          (SCORE_CONFIDENCE_WEIGHT[f["confidence"]] || 0.7) *
+          (SCORE_CATEGORY_WEIGHT[f["category"]] || 1.0)
       end
 
       score = (100 * Math.exp(-weighted_penalty / SCORE_DECAY_CONSTANT)).round
@@ -368,7 +390,8 @@ module Scryer
           </div>
           <div class="score-details">
             <p class="score-label">Security Score — #{score["finding_count"]} security + dependency
-              finding(s), weighted by severity and this rule's confidence. Not normalized by app
+              + performance finding(s) (performance weighted far lighter than security), weighted
+              by severity and this rule's confidence. Not normalized by app
               size — see the README for what this number does and doesn't mean.
               <strong>#{clean_rate["clean"]}/#{clean_rate["total"]}</strong> rules clean
               (#{clean_rate["percent"]}%) — a rule-level pass rate, a different (and not always
@@ -399,7 +422,16 @@ module Scryer
       sec_counts = count_by_severity(security)
       perf_counts = count_by_severity(performance)
       style_counts = count_by_severity(style)
-      total_counts = SEVERITY_ORDER.each_with_object({}) { |s, acc| acc[s] = sec_counts[s] + perf_counts[s] + style_counts[s] }
+      # Dependency findings carry a real severity (see DependencyAudit::
+      # Finding#severity) same as any other finding — previously left out of
+      # this row (rendered as a "—" placeholder) and out of the Total row's
+      # sum below, which made the Total row silently undercount relative to
+      # what a reader would expect from a row literally labeled "Total" at
+      # the bottom of this same table, and inconsistent with the executive
+      # summary's severity bars above (which do include dependency findings
+      # in their own count).
+      deps_counts = count_by_severity(dependency_findings)
+      total_counts = SEVERITY_ORDER.each_with_object({}) { |s, acc| acc[s] = sec_counts[s] + perf_counts[s] + style_counts[s] + deps_counts[s] }
 
       header = "<tr><th>Category</th>" + SEVERITY_ORDER.map { |s| "<th>#{SEVERITY_LABELS[s]}</th>" }.join + "<th>Total</th></tr>"
       # Category rows link via the same search-filter mechanism as the OWASP
@@ -411,13 +443,20 @@ module Scryer
       perf_row = summary_row("Performance", perf_counts, filter_term: "performance")
       style_row = summary_row("Style", style_counts, filter_term: "style")
       # The Total row has no single category tag to filter by (it's the sum
-      # across all three), so its per-severity cells link straight to the
+      # across all four), so its per-severity cells link straight to the
       # matching #sev-* heading instead — same anchors, same precision, as
-      # the severity distribution chart at the top of the report.
+      # the severity distribution chart at the top of the report. Same
+      # caveat that chart's own comment already notes: #sev-* only groups
+      # security/performance/style findings, so a reader following this link
+      # for a severity that's only present via a dependency finding won't
+      # see it highlighted there — still the right destination for the bulk
+      # of what's counted, and dependency findings are one section away via
+      # the Dependency audit row's own link just below.
       total_row = summary_row("Total", total_counts, css_class: "total", severity_anchors: true)
       dup_row = "<tr><th>Duplicate code</th><td colspan=\"#{SEVERITY_ORDER.size}\">—</td>" \
                 "<td><a class=\"jump-link\" href=\"#duplicates\">#{duplicate_groups.size} group(s)</a></td></tr>"
-      deps_row = "<tr><th>Dependency audit</th><td colspan=\"#{SEVERITY_ORDER.size}\">—</td>" \
+      deps_cells = SEVERITY_ORDER.map { |s| "<td>#{deps_counts[s]}</td>" }.join
+      deps_row = "<tr><th>Dependency audit</th>#{deps_cells}" \
                  "<td><a class=\"jump-link\" href=\"#dependency-audit\">#{dependency_findings.size} finding(s)</a></td></tr>"
 
       "<table class=\"summary\">#{header}#{sec_row}#{perf_row}#{style_row}#{dup_row}#{deps_row}#{total_row}</table>"

data/lib/scryer/scanner.rb

@@ -31,10 +31,19 @@ module Scryer
     # `skip_rules` silences specific checks by rule_id (e.g. a known false
     # positive on this codebase) without editing/removing the rule itself —
     # accepts strings or symbols, matched against Rule.rule_id.
-    def initialize(root:, dirs: DEFAULT_GLOB_DIRS, skip_rules: [])
+    #
+    # `detect_duplicates: false` skips duplicate-code detection entirely
+    # (method/query/cache-key extraction and the DuplicateDetector passes
+    # below) — unlike the security/performance/style rules, duplicate
+    # detection isn't a `Scryer::Rule` with its own rule_id, so `skip_rules`
+    # has no way to address it; this is its equivalent off switch. See
+    # `Scryer::Configuration#detect_duplicates` for the config-driven default
+    # every CLI/rake entry point reads before constructing a Scanner.
+    def initialize(root:, dirs: DEFAULT_GLOB_DIRS, skip_rules: [], detect_duplicates: true)
       @root = File.expand_path(root)
       @dirs = dirs
       @skip_rules = Set.new(skip_rules.map(&:to_s))
+      @detect_duplicates = detect_duplicates
     end
 
     def call
@@ -77,24 +86,28 @@ module Scryer
           bucket.concat(rule_class.new(file: rel_path, source: source, sexp: sexp).scan)
         end
 
-        if duplicate_detection_target?(rel_path)
+        if @detect_duplicates && duplicate_detection_target?(rel_path)
           all_methods.concat(MethodExtractor.extract(file: rel_path, source: source, sexp: sexp))
           all_queries.concat(QueryExtractor.extract(file: rel_path, source: source, sexp: sexp))
           all_cache_calls.concat(CacheExtractor.extract(file: rel_path, source: source, sexp: sexp))
         end
       end
 
-      # Same computed value cached under the same key from multiple call
-      # sites is normal (just reusing the cache). Only flag it when the
-      # *keys* differ too — that's either a redundant cache entry or a key
-      # that drifted out of sync with a copy-pasted sibling.
-      cache_groups = DuplicateDetector.call(all_cache_calls, threshold: CACHE_SIMILARITY_THRESHOLD, kind: "cache_duplicate")
-                                       .select { |g| g.members.map(&:cache_key).uniq.size > 1 }
-
       duplicate_groups =
-        DuplicateDetector.call(all_methods, kind: "method_duplicate") +
-        DuplicateDetector.call(all_queries, threshold: QUERY_SIMILARITY_THRESHOLD, kind: "query_duplicate") +
-        cache_groups
+        if @detect_duplicates
+          # Same computed value cached under the same key from multiple call
+          # sites is normal (just reusing the cache). Only flag it when the
+          # *keys* differ too — that's either a redundant cache entry or a
+          # key that drifted out of sync with a copy-pasted sibling.
+          cache_groups = DuplicateDetector.call(all_cache_calls, threshold: CACHE_SIMILARITY_THRESHOLD, kind: "cache_duplicate")
+                                           .select { |g| g.members.map(&:cache_key).uniq.size > 1 }
+
+          DuplicateDetector.call(all_methods, kind: "method_duplicate") +
+            DuplicateDetector.call(all_queries, threshold: QUERY_SIMILARITY_THRESHOLD, kind: "query_duplicate") +
+            cache_groups
+        else
+          []
+        end
 
       Result.new(
         security_findings: security_findings,

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "1.1.1"
+  VERSION = "1.2.1"
 end

data/lib/scryer.rb

@@ -1,4 +1,5 @@
 require "scryer/version"
+require "scryer/colorizer"
 require "scryer/ast"
 require "scryer/finding"
 require "scryer/rule_set"
@@ -13,7 +14,10 @@ require "scryer/dependency_audit"
 require "scryer/baseline"
 require "scryer/ai_client"
 require "scryer/fix_verifier"
+require "scryer/mechanical_fixer"
 require "scryer/ai_fix_suggester"
+require "scryer/fix_runner"
+require "scryer/dependency_fixer"
 
 Dir[File.join(__dir__, "scryer", "rules", "*.rb")].sort.each { |f| require f }
 Dir[File.join(__dir__, "scryer", "performance_rules", "*.rb")].sort.each { |f| require f }
@@ -39,11 +43,21 @@ module Scryer
     # default: every registered rule runs. The `scryer` executable's
     # `--skip RULE_ID` flag adds to this list for a single run rather than
     # replacing it.
-    attr_accessor :project_name, :dirs, :branch, :ai_client, :skip_rules
+    #
+    # `detect_duplicates` toggles duplicate-code detection (method/query/
+    # cache-key similarity across models, controllers, helpers, and
+    # concerns — see Scryer::DuplicateDetector) on or off. `true` by
+    # default, matching this gem's existing behavior. Duplicate detection
+    # isn't a `Scryer::Rule`, so it has no `rule_id` and `skip_rules` can't
+    # address it — set this to `false` instead (or pass `--no-duplicates` /
+    # `SCRYER_NO_DUPLICATES=1` for a single run without changing the
+    # configured default) if it's too noisy or too slow for a given project.
+    attr_accessor :project_name, :dirs, :branch, :ai_client, :skip_rules, :detect_duplicates
 
     def initialize
       @dirs = Scryer::Scanner::DEFAULT_GLOB_DIRS
       @skip_rules = []
+      @detect_duplicates = true
     end
   end
 
@@ -65,8 +79,8 @@ module Scryer
     # task aren't changed to use this (they also handle dependency auditing,
     # baselines, and report writing inline) — this is for callers that only
     # need the static-scan Result itself.
-    def scan(root:, dirs: configuration.dirs, skip_rules: configuration.skip_rules)
-      Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules).call
+    def scan(root:, dirs: configuration.dirs, skip_rules: configuration.skip_rules, detect_duplicates: configuration.detect_duplicates)
+      Scryer::Scanner.new(root: root, dirs: dirs, skip_rules: skip_rules, detect_duplicates: detect_duplicates).call
     end
   end
 end