scryer 1.2.1 → 1.3.0

data/lib/scryer/ai_fix_suggester.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # Optional, opt-in enrichment of a finding's `suggested_fix` using an
   # external LLM. Every rule already ships a generic, human-reviewable

data/lib/scryer/apm.rb

@@ -0,0 +1,458 @@
+# frozen_string_literal: true
+require "securerandom"
+
+module Scryer
+  # Runtime method-level tracing — answers "which method actually ate the
+  # time this New Relic (or any other APM) lumps into Others/Application
+  # Code". Built the same way Scryer::QueryWatcher already is: a
+  # `Module#prepend` generated per instrumented class, state kept in
+  # `Thread.current` (never a global mutable collection — concurrent
+  # requests on a multi-threaded server must never see each other's spans,
+  # the same lesson QueryWatcher's own docs call out), and zero new gem
+  # dependencies. No custom HTTP exporter of its own: when a supported APM
+  # agent/SDK is loaded (currently: the New Relic Ruby agent, or the
+  # opentelemetry-ruby SDK), spans are created through *that agent's own*
+  # public, documented API — `NewRelic::Agent::Tracer.start_segment` for
+  # New Relic, `OpenTelemetry.tracer_provider.tracer(...).start_span` for
+  # OpenTelemetry — so they nest inside that agent's own trace/transaction
+  # and ride its own already-async, already-batched, already-retried export
+  # pipeline. Either SDK is soft-detected (`defined?(...)`), never a hard
+  # gem dependency of Scryer itself — a host app that wants the
+  # `:opentelemetry` provider adds `opentelemetry-sdk` (and an exporter, e.g.
+  # `opentelemetry-exporter-otlp`) to its own Gemfile, same as it already
+  # does for `newrelic_rpm` today. This module doesn't need to (and
+  # doesn't) implement its own export queue, batching, or backoff, because
+  # it never talks to a network endpoint itself.
+  #
+  # Three things this deliberately does NOT do, all by design, not omission:
+  #   - Capture method argument values, local variables, or return values.
+  #     Only class name, method name, file:line (captured once at wrap
+  #     time, not per call), timing, and exception *class* are recorded.
+  #     See `capture_exception_messages` below for the one opt-in exception
+  #     to "no payload data ever".
+  #   - Instrument methods *inherited* from a superclass/module. Only
+  #     methods defined directly on the named class/module
+  #     (`instance_methods(false)`) are wrapped — instrumenting inherited
+  #     framework methods (ActiveRecord::Base, etc.) via a plain class-name
+  #     entry in `include` would be exactly the "sensitive framework
+  #     internals" this module is required to avoid.
+  #   - Implement :discovery or :deep_trace modes. Only :off and :selective
+  #     exist so far — see README's "Runtime method tracing" section for
+  #     what's planned vs. implemented.
+  class APM
+    # One method call. `parent_span_id` is nil for the outermost traced
+    # call in a given `.trace` block. `exception_message` is nil unless
+    # `capture_exception_messages: true` was configured AND `redact_exception_message`
+    # didn't blank it out.
+    Span = Struct.new(
+      :trace_id,
+      :span_id,
+      :parent_span_id,
+      :class_name,
+      :method_name,
+      :file,
+      :line,
+      :started_at,      # Float, Process.clock_gettime(Process::CLOCK_MONOTONIC) — for duration math
+      :wall_time,        # Time — for correlating against logs/other tools
+      :duration_ms,
+      :status,           # :ok | :error
+      :exception_class,
+      :exception_message,
+      :thread_id,
+      keyword_init: true
+    ) do
+      def to_h
+        super.transform_keys(&:to_s)
+      end
+    end
+
+    class << self
+      # Turns tracing on for the life of the process. Idempotent (later
+      # calls are no-ops) — same contract as QueryWatcher.enable!. Reads
+      # unset keyword args from Scryer.configuration.apm so
+      # `Scryer.configure { |c| c.apm.foo = ... }; Scryer::APM.enable!`
+      # works without repeating every option.
+      def enable!(
+        provider: nil,
+        instrumentation: nil,
+        include: nil,
+        exclude: nil,
+        sampling_rate: nil,
+        capture_exception_messages: nil,
+        logger: nil
+      )
+        return if @enabled
+
+        cfg = Scryer.configuration.apm
+        @provider = provider || cfg.provider || :new_relic
+        @instrumentation = instrumentation || cfg.instrumentation || :selective
+        @include = Array(include || cfg.include).map(&:to_s)
+        @exclude = Array(exclude || cfg.exclude).map(&:to_s) + DEFAULT_EXCLUDE
+        @sampling_rate = (sampling_rate || cfg.sampling_rate || 1.0).to_f.clamp(0.0, 1.0)
+        @capture_exception_messages = capture_exception_messages.nil? ? !!cfg.capture_exception_messages : capture_exception_messages
+        @logger = logger || default_logger
+        @instrumented = {} # {[class_name, method_name] => true} — dedupe guard
+        @enabled = true
+
+        case @instrumentation
+        when :off
+          # Nothing to install — enabled? is true (so .trace/.instrument
+          # calls don't raise) but no method is ever wrapped, so overhead
+          # is the cost of one `if` per call site that checks this mode,
+          # nothing more.
+        when :selective
+          @include.each { |name| instrument_by_name(name) }
+        when :discovery, :deep_trace
+          raise ArgumentError,
+                "Scryer::APM instrumentation: #{@instrumentation.inspect} is not implemented yet " \
+                "(only :off and :selective are). See README's \"Runtime method tracing\" section."
+        else
+          raise ArgumentError, "Scryer::APM instrumentation: unknown mode #{@instrumentation.inspect}"
+        end
+
+        warn_if_provider_unavailable
+      end
+
+      def enabled?
+        !!@enabled
+      end
+
+      # Test-only: undoes .enable! bookkeeping. Does NOT un-prepend already
+      #-installed modules (Ruby has no supported way to do that) — tests
+      # that need a truly clean slate use a fresh, disposable class per
+      # example instead of instrumenting a shared one twice.
+      def disable!
+        @enabled = false
+        @instrumented = {}
+        @on_span = nil
+      end
+
+      def instrumentation_mode
+        @instrumentation
+      end
+
+      # Opens a new trace scope — call this once per unit of work (an HTTP
+      # request, a Sidekiq job, a rake task). Every span created by an
+      # instrumented method call inside the block shares this trace_id and
+      # nests under whatever span is currently open on this thread, via a
+      # thread-local stack (so nested `.trace` calls — a job that itself
+      # calls another instrumented method — behave correctly: the inner
+      # scope's spans still get the outer trace_id if one is already open,
+      # rather than starting a disconnected new trace).
+      def trace(trace_id: nil)
+        return yield unless enabled? && @instrumentation != :off
+
+        already_in_trace = Thread.current[TRACE_ID_KEY]
+        Thread.current[TRACE_ID_KEY] ||= trace_id || SecureRandom.hex(16)
+        Thread.current[SAMPLED_KEY] = rand < @sampling_rate if Thread.current[SAMPLED_KEY].nil?
+        Thread.current[SPAN_STACK_KEY] ||= []
+        yield
+      ensure
+        unless already_in_trace
+          Thread.current[TRACE_ID_KEY] = nil
+          Thread.current[SAMPLED_KEY] = nil
+          Thread.current[SPAN_STACK_KEY] = nil
+        end
+      end
+
+      def current_trace_id
+        Thread.current[TRACE_ID_KEY]
+      end
+
+      def sampled?
+        !!Thread.current[SAMPLED_KEY]
+      end
+
+      # Resolves a "ClassName" or "Module::ClassName" string to a constant
+      # and instruments every method defined directly on it (public,
+      # protected, and private — visibility is preserved, see
+      # build_instrumentation_module). Silently skips (with a logged
+      # warning, not an exception — a typo in `include` shouldn't crash
+      # boot) names that don't resolve or that match `exclude`.
+      def instrument_by_name(name)
+        return if excluded?(name)
+
+        klass = Object.const_get(name)
+        methods = klass.instance_methods(false) + klass.private_instance_methods(false) +
+                  klass.protected_instance_methods(false)
+        methods.uniq.each { |m| instrument_method(klass, m) }
+      rescue NameError => e
+        @logger.warn("[Scryer::APM] include: #{name.inspect} did not resolve to a constant (#{e.message}) — skipped")
+      end
+
+      # One bad method must never take out the rest of `include` — this is
+      # the boundary between "a typo/edge case in config" and "the app
+      # fails to boot", so it catches broadly (StandardError, not just the
+      # NameError instrument_by_name's own constant-resolution guards for)
+      # and skips just this one method, logged, rather than propagating.
+      def instrument_method(klass, method_name)
+        key = [klass.name, method_name]
+        return if @instrumented[key]
+
+        original = klass.instance_method(method_name)
+        location = original.source_location
+        visibility = method_visibility(klass, method_name)
+        mod = build_instrumentation_module(klass, method_name, location, visibility)
+        klass.prepend(mod)
+        @instrumented[key] = true
+      rescue StandardError => e
+        @logger.warn("[Scryer::APM] failed to instrument #{klass}##{method_name} (#{e.class}: #{e.message}) — skipped")
+      end
+
+      def instrumented?(klass, method_name)
+        !!@instrumented[[klass.name, method_name]]
+      end
+
+      private
+
+      TRACE_ID_KEY = :scryer_apm_trace_id
+      SAMPLED_KEY = :scryer_apm_sampled
+      SPAN_STACK_KEY = :scryer_apm_span_stack
+
+      # Never instrumented even if named explicitly in `include` — Scryer's
+      # own code (would recurse into itself the moment .enable! ran), and
+      # the framework namespaces most likely to be typo'd into `include`
+      # by mistake (each is *also* excludable/addable by the host app via
+      # its own `exclude`/`include`, this is just a safe floor).
+      DEFAULT_EXCLUDE = %w[Scryer:: ActiveRecord:: ActionController:: ActionDispatch:: Rails::].freeze
+
+      def excluded?(name)
+        @exclude.any? { |pattern| name.start_with?(pattern) || name == pattern.sub(/::\z/, "") }
+      end
+
+      def method_visibility(klass, method_name)
+        return :private if klass.private_method_defined?(method_name)
+        return :protected if klass.protected_method_defined?(method_name)
+
+        :public
+      end
+
+      # One freshly-built anonymous module per (class, method) pair,
+      # `prepend`ed onto the class — the same mechanism QueryWatcher uses
+      # on ActiveRecord::QueryMethods. `*args, **kwargs, &block` + `super`
+      # forwards positional args, keyword args, and blocks correctly on
+      # every Ruby version this gem supports (>= 2.7); the wrapped method's
+      # return value and any exception it raises both pass through
+      # unchanged. `send(:private, ...)`/`protected` after `define_method`
+      # restores the original visibility, since `define_method` always
+      # defines a public method by default.
+      def build_instrumentation_module(klass, method_name, location, visibility)
+        file, line = location
+        Module.new do
+          define_method(method_name) do |*args, **kwargs, &block|
+            unless Scryer::APM.enabled? && Scryer::APM.instrumentation_mode == :selective && Scryer::APM.sampled?
+              next super(*args, **kwargs, &block)
+            end
+
+            Scryer::APM.send(:call_instrumented, self.class, method_name, file, line) do
+              super(*args, **kwargs, &block)
+            end
+          end
+          send(visibility, method_name) unless visibility == :public
+        end
+      end
+
+      # The actual per-call work: build the Span, open a New Relic segment
+      # if one's available, run the real method, close everything out
+      # (success or exception) and push/pop the thread-local span stack so
+      # nested instrumented calls get the right parent_span_id.
+      def call_instrumented(klass, method_name, file, line)
+        stack = (Thread.current[SPAN_STACK_KEY] ||= [])
+        span = Span.new(
+          trace_id: current_trace_id || (Thread.current[TRACE_ID_KEY] = SecureRandom.hex(16)),
+          span_id: SecureRandom.hex(8),
+          parent_span_id: stack.last&.span_id,
+          class_name: klass.name,
+          method_name: method_name.to_s,
+          file: file,
+          line: line,
+          started_at: Process.clock_gettime(Process::CLOCK_MONOTONIC),
+          wall_time: Time.now,
+          thread_id: Thread.current.object_id,
+          status: :ok
+        )
+        stack.push(span)
+        provider_segment = start_provider_segment(klass, method_name)
+
+        begin
+          yield
+        rescue Exception => e # rubocop-equivalent: intentional — must record then re-raise every exception class, not just StandardError
+          span.status = :error
+          span.exception_class = e.class.name
+          span.exception_message = redact_exception_message(e.message) if @capture_exception_messages
+          raise
+        ensure
+          span.duration_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - span.started_at) * 1000).round(3)
+          finish_provider_segment(provider_segment, span)
+          stack.pop
+          @on_span&.call(span)
+        end
+      end
+
+      # Dispatches to whichever provider is configured — only one provider
+      # is active per process (set once at .enable! time), so this is a
+      # simple case, not a fan-out to every provider at once.
+      def start_provider_segment(klass, method_name)
+        case @provider
+        when :new_relic then start_new_relic_segment(klass, method_name)
+        when :opentelemetry then start_open_telemetry_span(klass, method_name)
+        end
+      end
+
+      def finish_provider_segment(segment, span)
+        case @provider
+        when :new_relic then finish_new_relic_segment(segment, span)
+        when :opentelemetry then finish_open_telemetry_span(segment, span)
+        end
+      end
+
+      # `NewRelic::Agent::Tracer.start_segment`/`Segment#finish` is the
+      # agent's own public, documented API for creating a custom segment
+      # that nests under whatever transaction/segment is already open —
+      # this is how the agent's own instrumentation (and `add_method_tracer`
+      # under the hood) creates segments, so it's the supported integration
+      # path, not an undocumented mechanism. Soft-detected: if newrelic_rpm
+      # isn't loaded, or isn't inside an active transaction, this is a
+      # no-op and the instrumented method still runs normally — APM
+      # visibility is never allowed to break the app it's watching.
+      def start_new_relic_segment(klass, method_name)
+        return nil unless @provider == :new_relic && defined?(NewRelic::Agent::Tracer)
+
+        NewRelic::Agent::Tracer.start_segment(name: "Custom/#{klass.name}/#{method_name}")
+      rescue StandardError => e
+        @logger.warn("[Scryer::APM] New Relic segment start failed: #{e.message}") if @logger
+        nil
+      end
+
+      def finish_new_relic_segment(segment, span)
+        return unless segment
+
+        segment.notice_error(build_reportable_exception(span)) if span.status == :error && span.exception_class
+        segment.finish
+      rescue StandardError => e
+        @logger&.warn("[Scryer::APM] New Relic segment finish failed: #{e.message}")
+      end
+
+      # `OpenTelemetry.tracer_provider.tracer(...).start_span` + explicit
+      # `OpenTelemetry::Context.attach`/`.detach` is the SDK's own public,
+      # documented manual-span API (used whenever the block form,
+      # `Tracer#in_span`, doesn't fit — exactly this case, since
+      # call_instrumented's own begin/rescue/ensure already owns the
+      # start/finish lifecycle). `Context.attach` makes this span the
+      # "current" one so the *next* nested instrumented call's
+      # `tracer.start_span` — which defaults `with_parent:` to
+      # `Context.current` — picks it up as its parent automatically; no
+      # manual parent bookkeeping needed beyond attach/detach being
+      # correctly paired, same shape as the thread-local span stack this
+      # module already keeps for its own Span struct. Soft-detected: if
+      # the opentelemetry-sdk gem isn't loaded, this is a no-op and the
+      # instrumented method still runs normally, same contract as the New
+      # Relic path.
+      def start_open_telemetry_span(klass, method_name)
+        return nil unless @provider == :opentelemetry && defined?(OpenTelemetry::Trace)
+
+        tracer = OpenTelemetry.tracer_provider.tracer("scryer", Scryer::VERSION)
+        otel_span = tracer.start_span("#{klass.name}##{method_name}", kind: :internal)
+        token = OpenTelemetry::Context.attach(OpenTelemetry::Trace.context_with_span(otel_span))
+        [otel_span, token]
+      rescue StandardError => e
+        @logger.warn("[Scryer::APM] OpenTelemetry span start failed: #{e.message}") if @logger
+        nil
+      end
+
+      def finish_open_telemetry_span(segment, span)
+        return unless segment
+
+        otel_span, token = segment
+        if span.status == :error && span.exception_class
+          otel_span.record_exception(build_reportable_exception(span))
+          otel_span.status = OpenTelemetry::Trace::Status.error("#{span.exception_class}: #{span.exception_message || 'error'}")
+        end
+        otel_span.finish
+      rescue StandardError => e
+        @logger&.warn("[Scryer::APM] OpenTelemetry span finish failed: #{e.message}")
+      ensure
+        OpenTelemetry::Context.detach(token) if token
+      end
+
+      # NewRelic::Agent::Segment#notice_error wants a real exception object,
+      # not just a class name string — this reconstructs a minimal one
+      # carrying only what Span itself already decided to keep (never the
+      # original exception object, which could hold references to whatever
+      # arguments/state the traced method closed over).
+      def build_reportable_exception(span)
+        klass = Object.const_get(span.exception_class)
+        klass.exception(span.exception_message || span.exception_class)
+      rescue StandardError
+        StandardError.new(span.exception_class)
+      end
+
+      # Best-effort only, not exhaustive (see README limitations): masks
+      # substrings that look like tokens/secrets (long hex/base64-ish
+      # runs, email addresses) before an exception message is ever kept.
+      # Off entirely unless capture_exception_messages: true — the safer
+      # default is to keep the exception *class* only.
+      def redact_exception_message(message)
+        return nil unless message
+
+        message
+          .gsub(/[A-Za-z0-9_\-]{24,}/, "[REDACTED]")
+          .gsub(/[\w.+-]+@[\w-]+\.[a-zA-Z]{2,}/, "[REDACTED_EMAIL]")
+      end
+
+      def warn_if_provider_unavailable
+        return unless @instrumentation == :selective
+
+        case @provider
+        when :new_relic
+          return if defined?(NewRelic::Agent::Tracer)
+
+          @logger.warn(
+            "[Scryer::APM] provider: :new_relic but NewRelic::Agent isn't loaded — spans will be " \
+            "traced (available via Scryer::APM.on_span) but not exported anywhere."
+          )
+        when :opentelemetry
+          return if defined?(OpenTelemetry::Trace)
+
+          @logger.warn(
+            "[Scryer::APM] provider: :opentelemetry but the opentelemetry-sdk gem isn't loaded — " \
+            "spans will be traced (available via Scryer::APM.on_span) but not exported anywhere."
+          )
+        end
+      end
+
+      def default_logger
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        else
+          require "logger"
+          Logger.new($stdout)
+        end
+      end
+
+      public
+
+      # Registers a callback invoked with every completed Span, regardless
+      # of provider — the hook the test suite uses to assert on spans
+      # directly, and available to any host app that wants its own
+      # sink (a log line, a metrics counter) alongside/instead of New Relic.
+      def on_span(&block)
+        @on_span = block
+      end
+    end
+
+    # `use Scryer::APM::Middleware` opens one trace per request, same
+    # per-request-scoping rationale as Scryer::QueryWatcher::Middleware.
+    class Middleware
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        result = nil
+        Scryer::APM.trace { result = @app.call(env) }
+        result
+      end
+    end
+  end
+end

data/lib/scryer/ast.rb

@@ -1,4 +1,6 @@
+# frozen_string_literal: true
 require "ripper"
+require "set"
 
 module Scryer
   # Small set of helpers for walking the S-expression tree that Ripper.sexp
@@ -322,6 +324,57 @@ module Scryer
       node[1][1]
     end
 
+    # Shared by MassAssignmentRule/IdorRule/MissingPolicyScopeRule — every
+    # one of them needs "is this bare constant receiver likely an
+    # ActiveRecord model" and, until this method existed, each rule
+    # answered it with its own copy of a purely name-based guess (an exact
+    # exclusion list of stdlib/gem constants with their own `.new`/`.find`/
+    # `.where`-shaped methods). That guess had a real, reported false
+    # positive: a plain Ruby service/command object — `Server.new(params)
+    # .call`, the well-known "interactor" pattern — looks syntactically
+    # identical to `Order.new(params)`, and no fixed exclusion list can
+    # anticipate every project's own naming convention for that pattern.
+    #
+    # `known_models`/`known_non_models` (both Sets of unqualified, last-
+    # segment class names — see Scanner#call, which builds them once per
+    # scan by walking every `class X < Y` declaration across every scanned
+    # file) give this a real, Brakeman-like signal instead of a guess,
+    # whenever the receiver's class is actually declared somewhere in the
+    # project: `known_models` wins outright (a model genuinely named
+    # e.g. `Command` still gets flagged), and `known_non_models` (a class
+    # declared with literally no superclass, or with a superclass matching
+    # NON_MODEL_SUPERCLASS_PATTERN below — neither shape an ActiveRecord
+    # model ever has) excludes it outright regardless of name. Only when
+    # neither set has an answer (the class isn't declared anywhere Scryer
+    # scanned — a gem-provided constant, or `c.dirs` not covering it) does
+    # this fall back to the same purely-name-based guessing as before:
+    # NON_MODEL_RECEIVER_NAMES (stdlib/gem constants) and
+    # NON_MODEL_RECEIVER_SUFFIXES (a project's own service/command objects,
+    # covering the common "Service"/"Interactor"/etc. conventions when the
+    # class itself wasn't visible to this scan). Defaults (assume it likely
+    # *is* a model) when none of the above says otherwise — same
+    # false-positive-favoring direction as every other heuristic in this
+    # gem: a missed real mass-assignment/IDOR finding is worse than an
+    # occasional nudge to double-check a service object.
+    NON_MODEL_RECEIVER_NAMES = %w[
+      Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+      JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+      Enumerable File Dir
+    ].freeze
+
+    NON_MODEL_RECEIVER_SUFFIXES = %w[Service Server Interactor Operation Command UseCase].freeze
+
+    EMPTY_SET = Set.new.freeze
+
+    def likely_model_name?(const_name, known_models: EMPTY_SET, known_non_models: EMPTY_SET)
+      return true if known_models.include?(const_name)
+      return false if known_non_models.include?(const_name)
+      return false if NON_MODEL_RECEIVER_NAMES.include?(const_name)
+      return false if NON_MODEL_RECEIVER_SUFFIXES.any? { |suffix| const_name.end_with?(suffix) }
+
+      true
+    end
+
     # True if `node` is `params`, `params[:x]`, or contains such a reference
     # anywhere in its subtree — the shared "does this touch raw request data"
     # check behind mass assignment, IDOR, SSRF, and path traversal detection.

data/lib/scryer/authorization_watcher.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # Runtime companion to the static `idor`/`missing_authorization`/
   # `missing_policy_scope` rules — those can only ever say "no call to a

data/lib/scryer/baseline.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "digest"
 require "json"
 require "set"

data/lib/scryer/cache_extractor.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "ripper"
 
 module Scryer

data/lib/scryer/cli.rb

@@ -1,13 +1,14 @@
+# frozen_string_literal: true
 require "optparse"
 require "fileutils"
-require "shellwords"
+require "open3"
 
 module Scryer
   # Backs the `scryer` executable (see exe/scryer) — a standalone,
   # Rails-free way to run a scan, mirroring `brakeman -o report.json`.
-  # Deliberately separate from lib/scryer.rb: OptionParser/Shellwords are
-  # only needed for this CLI entry point, not when the gem is required
-  # inside a host app.
+  # Deliberately separate from lib/scryer.rb: OptionParser/Open3 are only
+  # needed for this CLI entry point, not when the gem is required inside a
+  # host app.
   class CLI
     EXTENSION_FORMATS = { ".json" => "json", ".html" => "html", ".htm" => "html", ".csv" => "csv", ".sarif" => "sarif" }.freeze
 
@@ -85,9 +86,9 @@ module Scryer
       renderer = ReportRenderer.new(
         result: result,
         project_name: options[:project_name] || File.basename(root),
-        release_label: git(root, "describe --tags --always"),
-        git_commit_sha: git(root, "rev-parse HEAD"),
-        git_branch: options[:branch] || git(root, "rev-parse --abbrev-ref HEAD"),
+        release_label: git(root, "describe", "--tags", "--always"),
+        git_commit_sha: git(root, "rev-parse", "HEAD"),
+        git_branch: options[:branch] || git(root, "rev-parse", "--abbrev-ref", "HEAD"),
         dependency_findings: dependency_findings
       )
 
@@ -192,7 +193,6 @@ module Scryer
       ]
 
       divider = paint("─" * 32, :gray)
-      score = renderer.security_score
       @stdout.puts ""
       @stdout.puts paint("Scryer Audit — #{result.files_scanned} files scanned", :bold)
       @stdout.puts divider
@@ -203,7 +203,10 @@ module Scryer
         @stdout.puts ""
       end
       clean_rate = renderer.rules_clean_rate
-      @stdout.puts "Security Score: #{score["score"]}/100 (#{paint_grade(score["grade"], score["grade"])})"
+      @stdout.puts score_row("Security Score", renderer.security_score)
+      @stdout.puts score_row("Performance Score", renderer.performance_score)
+      @stdout.puts score_row("Style Score", renderer.style_score)
+      @stdout.puts(ran_deps ? score_row("Dependency Score", renderer.dependency_score) : "#{"Dependency Score".ljust(20)}skipped (--no-deps)")
       @stdout.puts "Checks: #{clean_rate["clean"]}/#{clean_rate["total"]} rules clean (#{clean_rate["percent"]}%)"
       @stdout.puts ""
       rows.each { |label, count| @stdout.puts summary_row(label, count) }
@@ -220,6 +223,10 @@ module Scryer
       "#{label.ljust(14)}#{value.rjust(20)}"
     end
 
+    def score_row(label, score)
+      "#{label.ljust(20)}#{score["score"]}/100 (#{paint_grade(score["grade"], score["grade"])})"
+    end
+
     # The categories above are counted separately, but nothing else ranks
     # across them — this is what actually backs "tells you what to fix
     # first" rather than just splitting findings into four buckets. Same
@@ -917,8 +924,9 @@ module Scryer
       [File.join(dir, "scryer_report.json"), File.join(dir, "scryer_report.html")]
     end
 
-    def git(root, cmd)
-      output = `git -C #{Shellwords.escape(root)} #{cmd} 2>/dev/null`.strip
+    def git(root, *cmd)
+      output, = Open3.capture3("git", "-C", root, *cmd)
+      output = output.strip
       output.empty? ? nil : output
     rescue StandardError
       nil

data/lib/scryer/colorizer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # Hand-rolled ANSI color/style helper for console output — deliberately
   # not a gem dependency (`pastel`, `colorize`, ...), consistent with

data/lib/scryer/dependency_audit.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "json"
 require "date"
 

data/lib/scryer/dependency_fixer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "open3"
 
 module Scryer

data/lib/scryer/duplicate_detector.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "set"
 
 module Scryer

data/lib/scryer/finding.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Scryer
   # A single reported issue. `suggested_fix` is always a human-reviewable text
   # explanation + example patch, never something auto-applied — see the

data/lib/scryer/fix_runner.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "set"
 
 module Scryer

data/lib/scryer/fix_verifier.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "ripper"
 
 module Scryer

data/lib/scryer/mechanical_fixer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "set"
 require "ripper"
 

data/lib/scryer/method_extractor.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require "ripper"
 
 module Scryer