scryer 0.1.0

data/lib/scryer/cli.rb

@@ -0,0 +1,193 @@
+require "optparse"
+require "fileutils"
+require "shellwords"
+
+module Scryer
+  # Backs the `scryer` executable (see exe/scryer) — a standalone,
+  # Rails-free way to run a scan, mirroring `brakeman -o report.json`.
+  # Deliberately separate from lib/scryer.rb: OptionParser/Shellwords are
+  # only needed for this CLI entry point, not when the gem is required
+  # inside a host app.
+  class CLI
+    EXTENSION_FORMATS = { ".json" => "json", ".html" => "html", ".htm" => "html", ".csv" => "csv" }.freeze
+
+    def initialize(argv, stdout: $stdout, stderr: $stderr)
+      @argv = argv
+      @stdout = stdout
+      @stderr = stderr
+    end
+
+    # Returns a process exit code: 0 if clean, 1 if security findings were
+    # found (so `scryer -o report.json` can gate CI the way `brakeman -o
+    # report.json` does), 2 on a usage error.
+    def run
+      options = parse(@argv)
+      return 0 if options[:exit_early]
+      return check_gem(options[:check_gem]) if options[:check_gem]
+
+      root = File.expand_path(options[:path] || Dir.pwd)
+      return audit_deps(root) if options[:audit_deps]
+
+      skip_rules = Scryer.configuration.skip_rules + (options[:skip] || [])
+      @stdout.puts "Scryer: skipping #{skip_rules.join(', ')}." if skip_rules.any?
+
+      result = Scanner.new(root: root, dirs: Scryer.configuration.dirs, skip_rules: skip_rules).call
+
+      dependency_findings = []
+      if options[:include_deps]
+        @stdout.puts "Scryer: checking Gemfile.lock sources (offline)..."
+        @stdout.puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
+        dependency_findings = DependencyAudit.insecure_sources(root) + DependencyAudit.vulnerable_gems(root)
+      end
+
+      if Scryer.configuration.ai_client
+        @stdout.puts "Scryer: rewriting suggested fixes via the configured AI client..."
+        AiFixSuggester.enhance_result!(result)
+        AiFixSuggester.enhance_many!(dependency_findings) unless dependency_findings.empty?
+      end
+
+      renderer = ReportRenderer.new(
+        result: result,
+        project_name: options[:project_name] || File.basename(root),
+        release_label: git(root, "describe --tags --always"),
+        git_commit_sha: git(root, "rev-parse HEAD"),
+        git_branch: options[:branch] || git(root, "rev-parse --abbrev-ref HEAD"),
+        dependency_findings: dependency_findings
+      )
+
+      outputs = options[:outputs].empty? ? default_outputs(root) : options[:outputs]
+      outputs.each { |path| write_report(renderer, path) }
+
+      @stdout.puts "Scryer: #{result.files_scanned} files scanned, " \
+                   "#{result.security_findings.size} security findings, " \
+                   "#{result.performance_findings.size} performance findings, " \
+                   "#{result.duplicate_groups.size} duplicate groups" \
+                   "#{options[:include_deps] ? ", #{dependency_findings.size} dependency findings" : ""}."
+      @stdout.puts "Report written to #{outputs.join(', ')}"
+
+      result.security_findings.empty? && dependency_findings.empty? ? 0 : 1
+    rescue UsageError => e
+      @stderr.puts "scryer: #{e.message}"
+      2
+    end
+
+    private
+
+    UsageError = Class.new(StandardError)
+
+    # Mirrors the `scryer:audit_dependencies` rake task's output/exit-code
+    # behavior, so `scryer --audit-deps` works the same outside a Rails app.
+    def audit_deps(root)
+      @stdout.puts "Scryer: checking Gemfile.lock sources (offline)..."
+      insecure = DependencyAudit.insecure_sources(root)
+
+      @stdout.puts "Scryer: querying OSV.dev for known vulnerabilities (needs network)..."
+      vulnerable = DependencyAudit.vulnerable_gems(root)
+
+      (insecure + vulnerable).each do |f|
+        label = f.kind == "insecure_source" ? "[#{f.severity.upcase}] #{f.message}" : "[#{f.severity.upcase}] #{f.gem_name} #{f.installed_version} - #{f.advisory_id}: #{f.title}"
+        @stdout.puts label
+        @stdout.puts "  fix: #{f.suggested_fix}"
+      end
+
+      total = insecure.size + vulnerable.size
+      @stdout.puts "\nScryer: #{total} dependency finding(s) (#{insecure.size} insecure source, #{vulnerable.size} vulnerable gem)."
+      total.positive? ? 1 : 0
+    end
+
+    # One-off OSV.dev lookup for a single gem — no Gemfile.lock, no scan,
+    # no other network calls. `spec` is "name" or "name:version" (colon
+    # rather than a second CLI arg, so this stays a single -o-style flag).
+    def check_gem(spec)
+      name, version = spec.split(":", 2)
+      label = version ? "#{name} #{version}" : "#{name} (all versions)"
+
+      @stdout.puts "Scryer: querying OSV.dev for #{label}..."
+      findings = DependencyAudit.check_gem(name, version)
+
+      findings.each do |f|
+        @stdout.puts "[#{f.severity.upcase}] #{f.advisory_id}: #{f.title}"
+        @stdout.puts "  fix: #{f.suggested_fix}"
+      end
+
+      @stdout.puts "\nScryer: #{findings.size} advisory(-ies) found for #{label}."
+      findings.empty? ? 0 : 1
+    end
+
+    def parse(argv)
+      options = { outputs: [] }
+
+      parser = OptionParser.new do |opts|
+        opts.banner = "Usage: scryer [options]"
+        opts.on("-o PATH", "--output PATH",
+                "Write a report to PATH (repeatable). Format is inferred from the " \
+                "extension: .json, .html, or .csv.") { |v| options[:outputs] << v }
+        opts.on("-p PATH", "--path PATH", "Root directory to scan (default: current directory).") { |v| options[:path] = v }
+        opts.on("--audit-deps",
+                "Check Gemfile.lock for known-vulnerable gems (via OSV.dev — needs network) and " \
+                "insecure git/http sources (offline), instead of running the normal static scan. " \
+                "Exits non-zero if anything is found, so this can gate CI the same way " \
+                "`bundle-audit check` does.") { options[:audit_deps] = true }
+        opts.on("--include-deps",
+                "Fold a dependency audit (same checks as --audit-deps: OSV.dev vulnerable gems + " \
+                "insecure git/http sources) into the normal report as one more section, instead " \
+                "of running it as a separate command. Combine with -o to get one HTML/JSON " \
+                "report covering static findings, duplicate code, and dependency findings " \
+                "together — and, with an AI client configured, AI-rewritten suggested fixes for " \
+                "all of them.") { options[:include_deps] = true }
+        opts.on("--skip RULE_ID",
+                "Skip a rule by rule_id (repeatable) — e.g. a known false positive on this " \
+                "codebase. Adds to c.skip_rules for this run only; doesn't affect other " \
+                "invocations.") { |v| (options[:skip] ||= []) << v }
+        opts.on("--check-gem NAME[:VERSION]",
+                "Query OSV.dev for known vulnerabilities affecting a single gem, independent of " \
+                "any Gemfile.lock or full scan/audit — instead of running the normal static " \
+                "scan. Omit :VERSION to see every advisory ever filed against the gem across " \
+                "all versions.") { |v| options[:check_gem] = v }
+        opts.on("--project-name NAME", "Project name shown in the report header.") { |v| options[:project_name] = v }
+        opts.on("--branch BRANCH", "Git branch label recorded in the report (overrides the actual checked-out branch).") { |v| options[:branch] = v }
+        opts.on("-v", "--version", "Show the Scryer version.") { options[:exit_early] = true; @stdout.puts Scryer::VERSION }
+        opts.on("-h", "--help", "Show this help.") { options[:exit_early] = true; @stdout.puts opts }
+      end
+
+      begin
+        parser.parse!(argv)
+      rescue OptionParser::ParseError => e
+        raise UsageError, "#{e.message}\n#{parser}"
+      end
+
+      options
+    end
+
+    def write_report(renderer, path)
+      format = format_for(path)
+      content = case format
+                when "json" then renderer.as_json
+                when "csv" then renderer.as_csv
+                else renderer.as_html
+                end
+
+      FileUtils.mkdir_p(File.dirname(File.expand_path(path)))
+      File.write(path, content)
+    end
+
+    def format_for(path)
+      ext = File.extname(path).downcase
+      EXTENSION_FORMATS[ext] ||
+        raise(UsageError, "don't know how to write #{path} — recognized extensions are " \
+                           "#{EXTENSION_FORMATS.keys.join(', ')}.")
+    end
+
+    def default_outputs(root)
+      dir = File.join(root, "tmp")
+      [File.join(dir, "scryer_report.json"), File.join(dir, "scryer_report.html")]
+    end
+
+    def git(root, cmd)
+      output = `git -C #{Shellwords.escape(root)} #{cmd} 2>/dev/null`.strip
+      output.empty? ? nil : output
+    rescue StandardError
+      nil
+    end
+  end
+end

data/lib/scryer/dependency_audit.rb

@@ -0,0 +1,225 @@
+require "json"
+
+module Scryer
+  # Dependency vulnerability + supply-chain-hygiene checks for Gemfile.lock —
+  # the same broad goal as bundler-audit (github.com/rubysec/bundler-audit),
+  # built independently on a different data source and file parser: rather
+  # than bundler-audit's local clone of the ruby-advisory-db git repo, this
+  # queries OSV.dev's public API (osv.dev — Google's Open Source
+  # Vulnerabilities database, covering RubyGems among other ecosystems) live,
+  # per gem+version, and parses Gemfile.lock with a small hand-rolled reader
+  # (see .parse_lockfile) rather than depending on the `bundler` library, so
+  # the check works the same whether or not this run happens to be under
+  # Bundler. No bundler-audit source was read or copied to build this — see
+  # the README's "Dependency audit" section for the conceptual write-up this
+  # was built from.
+  #
+  # Two independent checks, callable separately:
+  #   - .insecure_sources(root)   — offline, parses Gemfile.lock's GIT/PATH
+  #     blocks for unencrypted (`git://`, `http://`) remotes.
+  #   - .vulnerable_gems(root)    — needs network: looks up every
+  #     RubyGems-sourced gem (not git/path — see why below) in OSV.dev.
+  #
+  # Unlike the static Ripper scan, this needs a live network connection for
+  # the vulnerability lookup — so it's not part of the default `scryer`/
+  # `scryer:report` run; call it explicitly (`scryer:audit_dependencies`,
+  # or `scryer --audit-deps`) when you want it, same as bundler-audit is a
+  # separate command from your test suite.
+  class DependencyAudit
+    Finding = Struct.new(
+      :kind,             # "vulnerable_dependency" | "insecure_source"
+      :gem_name,
+      :installed_version,
+      :severity,         # "critical" | "warning" | "info"
+      :advisory_id,
+      :title,
+      :url,
+      :patched_versions,
+      :message,
+      :suggested_fix,
+      keyword_init: true
+    ) do
+      def to_h
+        super.transform_keys(&:to_s)
+      end
+    end
+
+    OSV_QUERY_URL = "https://api.osv.dev/v1/query".freeze
+    ECOSYSTEM = "RubyGems".freeze
+
+    SEVERITY_BY_OSV_LEVEL = {
+      "CRITICAL" => "critical",
+      "HIGH" => "critical",
+      "MODERATE" => "warning",
+      "MEDIUM" => "warning",
+      "LOW" => "info"
+    }.freeze
+
+    class << self
+      # Parses a Gemfile.lock into `{ gems: { name => {version:, source:} }, git_or_path_sources: [...] }`.
+      # `source` is "gem", "git", or "path" — taken from which top-level
+      # block (GEM/GIT/PATH) the spec's `specs:` list appeared under.
+      def parse_lockfile(path)
+        gems = {}
+        git_or_path_sources = []
+
+        current_block = nil # "gem" | "git" | "path" | other section name
+        current_remote = nil
+        in_specs = false
+
+        File.foreach(path) do |line|
+          case line
+          when /\A(GEM|GIT|PATH)\s*\z/
+            current_block = Regexp.last_match(1).downcase
+            current_remote = nil
+            in_specs = false
+          when /\A(PLATFORMS|DEPENDENCIES|BUNDLED WITH|RUBY VERSION)\s*\z/
+            current_block = nil
+            in_specs = false
+          when /\A {2}remote:\s*(\S+)\s*\z/
+            current_remote = Regexp.last_match(1)
+            git_or_path_sources << { type: current_block, remote: current_remote } if %w[git path].include?(current_block)
+          when /\A {2}specs:\s*\z/
+            in_specs = true
+          when /\A {4}([A-Za-z0-9_.\-]+)\s+\(([^)]+)\)\s*\z/
+            next unless in_specs
+
+            name = Regexp.last_match(1)
+            version = Regexp.last_match(2)
+            # A gem can legitimately appear under more than one block only
+            # in pathological Gemfiles; last one wins, consistent with how
+            # Bundler itself resolves a single spec per gem name.
+            gems[name] = { version: version, source: current_block }
+          end
+        end
+
+        { gems: gems, git_or_path_sources: git_or_path_sources }
+      end
+
+      # Offline. Flags GIT/PATH sources recorded with an unencrypted remote
+      # (`git://` or plain `http://`) — the same supply-chain concern
+      # bundler-audit's insecure-source check targets, checked here by
+      # reading Gemfile.lock's own GIT/PATH blocks instead of the Gemfile.
+      def insecure_sources(root)
+        lockfile = File.join(root, "Gemfile.lock")
+        return [] unless File.exist?(lockfile)
+
+        parsed = parse_lockfile(lockfile)
+        parsed[:git_or_path_sources].filter_map do |src|
+          next unless src[:remote] =~ %r{\A(git|http)://}
+
+          Finding.new(
+            kind: "insecure_source",
+            gem_name: nil,
+            severity: "warning",
+            message: "Gemfile.lock has a #{src[:type]} source over an unencrypted transport: #{src[:remote]}",
+            suggested_fix: "Point this source at an https:// URL instead — an unencrypted git:// or " \
+                            "http:// remote can be tampered with in transit (classic supply-chain risk)."
+          )
+        end
+      end
+
+      # Needs network. One OSV.dev query per RubyGems-sourced gem in the
+      # lockfile (git/path-sourced gems are skipped — their version string
+      # doesn't necessarily correspond to the same code as the published gem
+      # of that name, so checking them against RubyGems advisories could
+      # misattribute or miss vulnerabilities). `http_client` is injectable
+      # for testing; defaults to a real Net::HTTP call. A real lockfile can
+      # easily have 200-300+ gems, and this is a network call per gem, so
+      # lookups run across a small stdlib-only thread pool (`concurrency`)
+      # rather than one gem at a time.
+      def vulnerable_gems(root, http_client: method(:query_osv), concurrency: 8)
+        lockfile = File.join(root, "Gemfile.lock")
+        return [] unless File.exist?(lockfile)
+
+        parsed = parse_lockfile(lockfile)
+        targets = parsed[:gems].select { |_, info| info[:source] == "gem" }.to_a
+
+        queue = Queue.new
+        targets.each { |pair| queue << pair }
+        results = Queue.new
+
+        workers = Array.new([concurrency, targets.size].min) do
+          Thread.new do
+            loop do
+              name, info = begin
+                queue.pop(true)
+              rescue ThreadError
+                nil
+              end
+              break unless name
+
+              http_client.call(name, info[:version]).each { |v| results << finding_for(name, info[:version], v) }
+            end
+          end
+        end
+        workers.each(&:join)
+
+        findings = []
+        findings << results.pop(true) until results.empty?
+        findings
+      end
+
+      # Needs network. One-off OSV.dev lookup for a single gem, independent
+      # of any Gemfile.lock — backs `scryer --check-gem NAME[:VERSION]`.
+      # With a version, only vulnerabilities affecting that exact version
+      # are returned (same filtering as vulnerable_gems); omit it to see
+      # every advisory ever filed against the gem, across all versions.
+      def check_gem(name, version = nil)
+        query_osv(name, version).map { |v| finding_for(name, version, v) }
+      end
+
+      private
+
+      def query_osv(name, version = nil)
+        require "net/http"
+        require "uri"
+
+        uri = URI(OSV_QUERY_URL)
+        package_query = { package: { name: name, ecosystem: ECOSYSTEM } }
+        package_query[:version] = version if version
+        body = JSON.generate(package_query)
+
+        response = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 5, read_timeout: 10) do |http|
+          http.post(uri.path, body, "Content-Type" => "application/json")
+        end
+
+        return [] unless response.is_a?(Net::HTTPSuccess)
+
+        (JSON.parse(response.body)["vulns"] || [])
+      rescue StandardError
+        # A single gem's lookup failing (network hiccup, rate limit) shouldn't
+        # abort the whole audit — it just means that one gem wasn't checked.
+        []
+      end
+
+      def finding_for(gem_name, installed_version, vuln)
+        level = vuln.dig("database_specific", "severity")
+        fixed_versions = fixed_versions_for(vuln, gem_name)
+
+        Finding.new(
+          kind: "vulnerable_dependency",
+          gem_name: gem_name,
+          installed_version: installed_version,
+          severity: SEVERITY_BY_OSV_LEVEL[level.to_s.upcase] || "warning",
+          advisory_id: vuln["id"],
+          title: vuln["summary"] || vuln["id"],
+          url: (vuln["references"] || []).map { |r| r["url"] }.find { |u| u&.start_with?("http") },
+          patched_versions: fixed_versions,
+          message: "#{gem_name}#{installed_version ? " #{installed_version}" : ""} is affected by " \
+                   "#{vuln["id"]}#{vuln["summary"] ? ": #{vuln["summary"]}" : ""}",
+          suggested_fix: fixed_versions.empty? ? "No fixed version is published yet for #{vuln["id"]} — track the advisory for updates." : "Upgrade #{gem_name} to #{fixed_versions.join(" or ")} (or later)."
+        )
+      end
+
+      def fixed_versions_for(vuln, gem_name)
+        (vuln["affected"] || [])
+          .select { |a| a.dig("package", "name") == gem_name }
+          .flat_map { |a| a["ranges"] || [] }
+          .flat_map { |r| r["events"] || [] }
+          .filter_map { |e| e["fixed"] }
+          .uniq
+      end
+    end
+  end
+end

data/lib/scryer/duplicate_detector.rb

@@ -0,0 +1,103 @@
+require "set"
+
+module Scryer
+  # Token-normalized near-duplicate detection across methods (see
+  # MethodExtractor for how a method's token stream is built and normalized —
+  # identifiers/literals become placeholders, keywords/operators stay literal,
+  # so a copy-pasted method with renamed variables still looks "the same
+  # shape" while structurally different code doesn't).
+  #
+  # Approach: build a shingle set (sliding-window n-grams of the normalized
+  # token stream) per method, then compare methods pairwise via Jaccard
+  # similarity of their shingle sets, bucketing by token-count first so we
+  # don't bother comparing a 15-token method against a 200-token one. This is
+  # simpler than MinHash and fully correct (no approximation error) — fine
+  # for the method counts a typical Rails app has; a MinHash-based
+  # approximation would only be worth the complexity at codebases far larger
+  # than this tool is likely to run against in one pass.
+  class DuplicateDetector
+    # A smaller shingle size is less disrupted by a single inserted/removed
+    # token (common in near-duplicates that were copy-pasted then tweaked) —
+    # each inserted token only breaks SHINGLE_SIZE consecutive shingles
+    # rather than a larger fraction of the total set, at some cost in
+    # precision (shorter shingles are individually less distinctive).
+    SHINGLE_SIZE = 3
+    SIMILARITY_THRESHOLD = 0.6
+    SIZE_BUCKET_RATIO = 0.4 # only compare methods whose token counts are within +/-40% of each other
+
+    # `kind` just gets stamped onto every group this run produces — lets
+    # Scanner run this same algorithm separately over methods, query chains,
+    # and cached values, and have each result self-identify in the report
+    # (see QueryExtractor/CacheExtractor, whose output feeds this same class).
+    DuplicateGroup = Struct.new(:kind, :similarity, :members, keyword_init: true)
+
+    def self.call(methods, threshold: SIMILARITY_THRESHOLD, kind: "method_duplicate")
+      new(methods, threshold: threshold, kind: kind).call
+    end
+
+    def initialize(methods, threshold: SIMILARITY_THRESHOLD, kind: "method_duplicate")
+      @threshold = threshold
+      @kind = kind
+      @methods = methods.map { |m| Entry.new(m, shingles(m.token_stream)) }
+    end
+
+    def call
+      groups = []
+      seen_pairs = 0
+
+      @methods.combination(2).each do |a, b|
+        next unless size_compatible?(a, b)
+
+        seen_pairs += 1
+        sim = jaccard(a.shingles, b.shingles)
+        next if sim < @threshold
+
+        merge_or_add(groups, a, b, sim)
+      end
+
+      groups
+    end
+
+    private
+
+    Entry = Struct.new(:info, :shingles)
+
+    def size_compatible?(a, b)
+      la = a.info.token_stream.size
+      lb = b.info.token_stream.size
+      return true if la == lb
+
+      smaller, larger = [la, lb].sort
+      smaller >= larger * SIZE_BUCKET_RATIO
+    end
+
+    def shingles(tokens)
+      return Set.new([tokens.join("|")]) if tokens.size < SHINGLE_SIZE
+
+      tokens.each_cons(SHINGLE_SIZE).map { |window| window.join("|") }.to_set
+    end
+
+    def jaccard(a, b)
+      return 0.0 if a.empty? || b.empty?
+
+      intersection = (a & b).size.to_f
+      union = (a | b).size.to_f
+      union.zero? ? 0.0 : intersection / union
+    end
+
+    # Union-find-lite: if either method is already in a group, add the other
+    # to that group (keeping the group's similarity as the min pairwise
+    # similarity seen); otherwise start a new group.
+    def merge_or_add(groups, a, b, sim)
+      existing = groups.find { |g| g.members.include?(a.info) || g.members.include?(b.info) }
+
+      if existing
+        existing.members << a.info unless existing.members.include?(a.info)
+        existing.members << b.info unless existing.members.include?(b.info)
+        existing.similarity = [existing.similarity, sim].min
+      else
+        groups << DuplicateGroup.new(kind: @kind, similarity: sim, members: [a.info, b.info])
+      end
+    end
+  end
+end

data/lib/scryer/finding.rb

@@ -0,0 +1,21 @@
+module Scryer
+  # A single reported issue. `suggested_fix` is always a human-reviewable text
+  # explanation + example patch, never something auto-applied — see the
+  # gem's README for why (a rewritten line that changes behavior needs a
+  # human's judgment, especially for security-sensitive code).
+  Finding = Struct.new(
+    :rule_id,        # e.g. "sql_injection"
+    :category,       # "security" | "performance" | "duplication"
+    :severity,       # "critical" | "warning" | "info"
+    :file,           # relative path
+    :line,           # integer line number (1-indexed) or nil
+    :code_snippet,   # the offending source line, stripped
+    :message,        # human-readable description of the issue
+    :suggested_fix,  # human-readable explanation + example patch
+    keyword_init: true
+  ) do
+    def to_h
+      super.transform_keys(&:to_s)
+    end
+  end
+end

data/lib/scryer/method_extractor.rb

@@ -0,0 +1,55 @@
+require "ripper"
+
+module Scryer
+  # Extracts each `def`/`def self.x` method from a parsed file as a
+  # MethodInfo (name, file, start/end line, source text) by walking the
+  # Ripper sexp tree for :def and :defs nodes. Sexp nodes don't carry an
+  # explicit end line, so we find it by locating the matching top-level
+  # statement boundary: the next sibling's start line minus one, or the
+  # bodystmt's last statement's line if there's no next sibling, with a
+  # fallback that scans forward for the line containing a bare "end" if
+  # neither is available. In practice, we don't need exact end lines for
+  # duplicate detection — the token stream (not the source substring) is
+  # what actually gets compared, so we lex from the method's body sexp's own
+  # descendants (whose positions we DO have precisely) rather than fragile
+  # source-line slicing.
+  MethodInfo = Struct.new(:name, :file, :start_line, :end_line, :token_stream, :source_snippet, keyword_init: true)
+
+  module MethodExtractor
+    module_function
+
+    def extract(file:, source:, sexp:)
+      methods = []
+
+      Ast.each_node(sexp) do |node|
+        next unless Ast.tagged?(node, :def, :defs)
+
+        name_node = node[0] == :defs ? node[3] : node[1]
+        name = Ast.ident_text(name_node) || "?"
+        body_node = node.last
+
+        positions = Ast.each_node(body_node).filter_map { |n| Ast.position_of(n) }
+        next if positions.empty? # empty method body (e.g. `def foo; end`) — nothing to compare
+
+        start_line = Ast.line_of(name_node) || positions.map(&:first).min
+        end_line = positions.map(&:first).max
+
+        tokens = Ast.normalized_tokens(body_node)
+        next if tokens.size < MIN_TOKENS
+
+        methods << MethodInfo.new(
+          name: name,
+          file: file,
+          start_line: start_line,
+          end_line: end_line,
+          token_stream: tokens,
+          source_snippet: source.lines[(start_line - 1)...[end_line, source.lines.size].min]&.join
+        )
+      end
+
+      methods
+    end
+
+    MIN_TOKENS = 12 # skip trivial one-liners — not worth flagging as "duplicated"
+  end
+end