scryer 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1c8d4523447f9bdd1ea796fd27177efa18d6f726be6764e08aac1b18e05482b
-  data.tar.gz: de971058c3bfd42ad8ed9eabb6b633b305d1d10dc4971ea50e606fdefd573067
+  metadata.gz: 9cd7338bfd390fb74f2a1fae54f3132250ae75bd721bc1f65c42f9b80899e2e8
+  data.tar.gz: 984d8060977af0b21d2740384664350f9ee2b08e846bbdf71e3f069af40db386
 SHA512:
-  metadata.gz: 516425ec399996c7d20d20d6e8e222f188bf227cf911c401cdf514c084de22adcb9d7d15d2629cbb4cf79d0f3ef1f939058e64d24d14f0b3a3239d3922289270
-  data.tar.gz: 8c5efc1769526f6d8ed9b335a53129ac8f461156719e846d00f30e1ceae340f9b774bd83c89814689351b87c1200fb28fb5c76f4420bb4d86a296042717254d8
+  metadata.gz: 7d88896585a86b731a7d0600036f9fc4fe75195fa55d41296670e8e63834ead37f2a699f4865ebd77181802022964ece7c3634559bdc2d7699a0084f805c7feb
+  data.tar.gz: 110d568db0d07ee2cb649ba10ca18c324bb8cf073aef7fe3ca2e866c9e994ed5356d3fc88507ff22b32078cd42f74b8d2792a0c3b0857dcc183d6a5ae13b15cb

data/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.3.0] - 2026-08-11
+
+- New `scryer -r PATH`/`--require PATH` flag (repeatable): requires a Ruby file before scanning.
+  This is the standalone executable's only way to run `Scryer.configure` (set `c.ai_client`,
+  `c.skip_rules`, `c.dirs`, etc.) before a scan starts — unlike a Rails app, `scryer` has no
+  `config/initializers/` to autoload, so AI-assisted fix suggestions and other config were
+  previously unreachable outside Rails. See the README's AI-assisted fix suggestions section for
+  a full step-by-step for both the Rails and standalone paths.
+- Fixed: the HTML report rendered a finding's `suggested_fix` as one plain escaped string, so
+  Markdown from an AI-rewritten fix (`**bold**`, ```` ```fenced code``` ````) showed up as literal
+  asterisks/backticks instead of formatted text. Added a small Markdown-to-HTML renderer
+  (bold, inline code, fenced code blocks, paragraphs) used for every `suggested_fix` — static
+  template text or LLM rewrite, security/performance/style/dependency findings alike. Raw text is
+  always escaped before any tag is added, so this doesn't open an HTML/script injection path even
+  for a fully untrusted LLM response; JSON/CSV output is unaffected and still carries the original
+  raw text.
+
 ## [0.2.0] - 2026-08-11
 
 - New `style` rule category (`Scryer::RuleSet` category `"style"`, alongside `security` and
@@ -43,5 +60,6 @@ Initial release.
   actual request handling.
 - `scryer` standalone executable and `scryer:report`/`scryer:audit_dependencies` Rails rake tasks.
 
+[0.3.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.3.0
 [0.2.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.2.0
 [0.1.0]: https://github.com/ramlaxmanyadav/scryer/releases/tag/v0.1.0

data/README.md

@@ -450,24 +450,54 @@ This is the same OSV.dev client `vulnerable_gems` uses, exposed as a one-off loo
 Every rule already ships a generic, human-reviewable `suggested_fix` — that's always there and
 needs nothing configured. `Scryer::AiFixSuggester` optionally rewrites that text per finding using
 an LLM, so the suggestion is written against the finding's actual offending line instead of a
-generic template.
+generic template. This is entirely opt-in: with no client configured, `AiFixSuggester` makes zero
+network calls and every finding keeps its original `suggested_fix` — nothing below is required to
+use the rest of Scryer.
 
-**Provider-agnostic by design — bring any LLM.** Scryer doesn't depend on or assume any specific
-vendor's API or SDK (consistent with the zero-runtime-dependency design described in the gemspec).
-Configure `c.ai_client` to any object, or even a bare `Proc`/lambda, that responds to `#call(prompt)`
-(or `#complete(prompt)`) and returns the model's reply as a `String`:
+### Step by step
+
+**Inside a Rails app** — `config/initializers/scryer.rb` is autoloaded at boot, so setting
+`c.ai_client` there is picked up automatically the next time you scan:
 
 ```ruby
 # config/initializers/scryer.rb
 Scryer.configure do |c|
-  # Simplest form: any callable. Wire up whatever SDK/gem you already use —
-  # Scryer never requires one itself.
+  c.ai_client = ->(prompt) { MyLlmClient.chat(prompt) }   # any callable — see below for real examples
+end
+```
+
+```bash
+bin/rails scryer:report
+```
+
+That's the whole flow — no extra flag, no second command. Look for `Scryer: rewriting suggested
+fixes via the configured AI client...` in the task's own output, then open the report: every
+finding's `suggested_fix` is now the LLM's rewrite instead of the generic template.
+
+**Outside Rails (the `scryer` executable)** — there's no `config/initializers/` to autoload here,
+so `Scryer.configure` needs to actually run before the scan starts. That's what `-r`/`--require` is
+for: point it at a small Ruby file that calls `Scryer.configure`, and `scryer` requires it first:
+
+```ruby
+# scryer_config.rb — anywhere in your project, any filename
+Scryer.configure do |c|
   c.ai_client = ->(prompt) { MyLlmClient.chat(prompt) }
 end
 ```
 
-This is entirely opt-in: `c.ai_client` is `nil` by default, and with no client configured
-`AiFixSuggester` makes zero network calls and every finding keeps its original `suggested_fix`.
+```bash
+scryer -r ./scryer_config.rb
+```
+
+Same output, same "rewriting suggested fixes..." line, same result — `-r` is the only difference
+between the two paths, and it's required precisely because the standalone executable has nothing
+else to make `Scryer.configure` code actually run before it scans.
+
+**Provider-agnostic by design — bring any LLM.** Scryer doesn't depend on or assume any specific
+vendor's API or SDK (consistent with the zero-runtime-dependency design described in the gemspec).
+`c.ai_client` accepts any object, or even a bare `Proc`/lambda, that responds to `#call(prompt)`
+(or `#complete(prompt)`) and returns the model's reply as a `String` — the two examples above used
+a placeholder; `Scryer::AiClient` below is a ready-made adapter for a real HTTP endpoint.
 
 ### `Scryer::AiClient` — a ready-made HTTP adapter
 
@@ -508,10 +538,11 @@ a JSON body.
 
 `bin/rails scryer:report` and the `scryer` executable both check `Scryer.configuration.ai_client`
 after scanning and, if set, call `Scryer::AiFixSuggester.enhance_result!(result)` before rendering
-— one LLM call per security/performance finding, run across a small thread pool (same pattern as
-the dependency audit's OSV.dev lookups) rather than one at a time. A client that raises, times out,
-or returns nothing usable just leaves that finding's original `suggested_fix` in place — a failed
-enrichment never fails the scan.
+— one LLM call per security/performance/style finding (plus dependency findings too, if the
+dependency audit ran), run across a small thread pool (same pattern as the dependency audit's
+OSV.dev lookups) rather than one at a time. A client that raises, times out, or returns nothing
+usable just leaves that finding's original `suggested_fix` in place — a failed enrichment never
+fails the scan.
 
 ```ruby
 Scryer::AiFixSuggester.enhance!(finding)          # one Finding, in place

data/lib/scryer/cli.rb

@@ -23,6 +23,13 @@ module Scryer
     def run
       options = parse(@argv)
       return 0 if options[:exit_early]
+
+      # The standalone executable has no equivalent of a Rails app's
+      # config/initializers/scryer.rb getting autoloaded at boot — this is
+      # the only way to run Scryer.configure (set c.ai_client, c.skip_rules,
+      # c.dirs, ...) before a scan starts outside Rails.
+      Array(options[:require]).each { |path| require File.expand_path(path) }
+
       return check_gem(options[:check_gem]) if options[:check_gem]
 
       root = File.expand_path(options[:path] || Dir.pwd)
@@ -160,6 +167,12 @@ module Scryer
                 "Write a report to PATH (repeatable). Format is inferred from the " \
                 "extension: .json, .html, or .csv.") { |v| options[:outputs] << v }
         opts.on("-p PATH", "--path PATH", "Root directory to scan (default: current directory).") { |v| options[:path] = v }
+        opts.on("-r PATH", "--require PATH",
+                "Require a Ruby file before scanning (repeatable) — the file can call " \
+                "Scryer.configure to set c.ai_client, c.skip_rules, c.dirs, etc. This is the " \
+                "standalone executable's equivalent of a Rails app's config/initializers/scryer.rb " \
+                "getting autoloaded at boot; without it there's no way to configure anything " \
+                "outside Rails.") { |v| (options[:require] ||= []) << v }
         opts.on("--audit-deps",
                 "Check Gemfile.lock for known-vulnerable gems (via OSV.dev — needs network) and " \
                 "insecure git/http sources (offline), instead of running the normal static scan. " \

data/lib/scryer/report_renderer.rb

@@ -353,7 +353,7 @@ module Scryer
           </div>
           <p>#{escape(f["message"])}</p>
           #{f["code_snippet"] ? "<pre>#{escape(f["code_snippet"])}</pre>" : ""}
-          <div class="fix"><strong>Suggested fix:</strong> #{escape(f["suggested_fix"])}</div>
+          <div class="fix"><strong>Suggested fix:</strong>#{render_markdown(f["suggested_fix"])}</div>
         </div>
       ROW
     end
@@ -421,7 +421,7 @@ module Scryer
           </div>
           <p>#{escape(f["message"])}</p>
           #{patched.empty? ? "" : "<p class=\"loc\">Patched version(s): #{escape(patched.join(", "))}</p>"}
-          <div class="fix"><strong>Suggested fix:</strong> #{escape(f["suggested_fix"])}</div>
+          <div class="fix"><strong>Suggested fix:</strong>#{render_markdown(f["suggested_fix"])}</div>
         </div>
       ROW
     end
@@ -430,6 +430,48 @@ module Scryer
       text.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")
     end
 
+    CODE_FENCE = /```\w*\n?(.*?)```/m
+    BOLD = /\*\*(.+?)\*\*/
+    INLINE_CODE = /`([^`]+?)`/
+
+    # Suggested-fix text is always human-written prose, whether it came from
+    # a rule's static template (occasional inline `code`) or an LLM rewrite
+    # (often full Markdown: **bold**, ```fenced code```, paragraphs) — see
+    # AiFixSuggester's prompts, which explicitly ask for a
+    # "before/after code example". Rendering it as one plain escaped string
+    # left literal ** and ``` visible in the HTML report instead of actual
+    # formatting. This renders the handful of constructs those two sources
+    # actually produce; anything unrecognized just passes through as escaped
+    # text, same as before.
+    #
+    # Every code path here escapes raw text *before* adding any HTML tags of
+    # its own, so nothing in `text` (however untrusted — this may be verbatim
+    # LLM output) can inject markup; the only unescaped HTML is the literal
+    # tag strings this method writes itself.
+    def render_markdown(text)
+      return "" if text.nil?
+
+      html = +""
+      pos = 0
+      text.to_s.scan(CODE_FENCE) do
+        match = Regexp.last_match
+        html << render_prose(text[pos...match.begin(0)])
+        html << "<pre>#{escape(match[1].strip)}</pre>"
+        pos = match.end(0)
+      end
+      html << render_prose(text[pos..])
+      html
+    end
+
+    def render_prose(text)
+      return "" if text.nil? || text.strip.empty?
+
+      text.strip.split(/\n{2,}/).map do |paragraph|
+        formatted = escape(paragraph.strip).gsub(BOLD, '<strong>\1</strong>').gsub(INLINE_CODE, '<code>\1</code>')
+        "<p>#{formatted.gsub("\n", "<br>")}</p>"
+      end.join
+    end
+
     def static_csv_row(f)
       [
         f["category"], f["rule_id"], f["severity"],
@@ -474,7 +516,13 @@ module Scryer
       .badge.kind { background: #ede9fe; color: #5b21b6; }
       .loc { color: #64748b; font-size: 0.8rem; }
       pre { background: #0f172a; color: #e2e8f0; padding: 0.5rem 0.75rem; border-radius: 6px; overflow-x: auto; font-size: 0.8rem; }
+      code { background: #e2e8f0; color: #334155; padding: 0.1rem 0.35rem; border-radius: 4px; font-size: 0.85em; }
       .fix { background: #eef2ff; border-radius: 6px; padding: 0.5rem 0.75rem; font-size: 0.875rem; }
+      .fix > strong { display: block; margin-bottom: 0.35rem; }
+      .fix p { margin: 0 0 0.5rem; }
+      .fix p:last-child { margin-bottom: 0; }
+      .fix pre { margin: 0.5rem 0 0; }
+      .fix pre:last-child { margin-bottom: 0; }
       .dup-member { margin-top: 0.5rem; }
       .dup-member:first-child { margin-top: 0; }
       .muted { color: #94a3b8; }

data/lib/scryer/version.rb

@@ -1,3 +1,3 @@
 module Scryer
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: scryer
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Ram Laxman Yadav