txray 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f735a624f2fabb3ab9d3b2133c2b7793d6c836e730a6d71a3a5d21217f49e3d9
+  data.tar.gz: c76ae3d2e4aa426361fc0b2a834c76d5e33e910af92e541eaecacbe80ea462e9
+SHA512:
+  metadata.gz: a10c45fade77e209f9c5bdc85bcb4453629ad9a2acf63d0067ff16a5a958512a6e4c31f9e1e54aedb60660e9c021d2513fe17b990aeb254ca607347138b73135
+  data.tar.gz: 27f2cdcd1bfaceb62be8ebc3ffedca7f90cf53104fc1f25a79af81ef48051d7e8e2d71649d354a184207ca4c7f347c4316fdd6a6795a1ea57442e5b68a35871d

data/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 0.1.0
+
+- Static transaction analysis over explicit transactions, row and advisory locks, save callbacks, custom validations and migrations.
+- Follows callbacks, concerns, service objects, `delegate` targets and `define_method` bodies across files.
+- Tracks clients held in local variables, instance variables, constants and memoized readers.
+- Text, json, sarif and github reporters, inline `# txray:disable` directives and configurable severities.
+- Optional runtime guard with per-transaction attribution, an ignore API and a newline delimited JSON event log.
+- `txray watch`, a live terminal monitor for transactions, durations and findings.

data/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Theo Wecker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,274 @@
+# txray
+
+Static analysis that finds slow work hidden inside database transactions, plus a runtime guard and a live terminal monitor for what static analysis cannot see.
+
+A transaction holds a connection and every row lock it has taken until it commits. Anything slow that happens in between (an HTTP request, a Stripe call, an SMTP delivery, a subprocess, a loop over a collection) extends that hold, and every writer queued behind those locks waits with it. The worst cases are the ones nobody wrote on purpose: an `after_create` callback three method calls away from a payment API.
+
+txray parses your application with [Prism](https://github.com/ruby/prism) and follows callbacks, concerns, service objects and helper methods to find that work. It never boots your app and never runs your code, so it reports problems on paths your test suite has never executed.
+
+```
+app/models/order.rb
+  13:5  high   external-service-in-transaction
+    External service call `Stripe::PaymentIntent.create(amount: total_cents)` runs inside the `after_create :settle` callback
+      via Order#charge_card (app/models/order.rb:12)
+    Third party clients hold the connection and the row locks for their full round trip. Call them after commit.
+```
+
+## Install
+
+```ruby
+group :development, :test do
+  gem "txray", require: false
+end
+```
+
+```sh
+bundle exec txray
+```
+
+It exits non zero when it finds something, so it drops straight into CI.
+
+## What counts as a transaction
+
+txray does not only look for `transaction do`:
+
+| Scope | Example |
+| --- | --- |
+| Explicit blocks | `Order.transaction { ... }`, `ActiveRecord::Base.transaction { ... }` |
+| Row and advisory locks | `order.with_lock { ... }`, `with_advisory_lock { ... }`, any method that calls `lock!` |
+| Callbacks that run inside the save transaction | `before_save`, `after_create`, `around_update`, `after_destroy`, `after_touch`, `before_commit` |
+| Custom validations | `validate :vat_number_is_real`, `validate { ... }` |
+| Migrations | `change`, `up` and `down` in an `ActiveRecord::Migration`, unless it calls `disable_ddl_transaction!` |
+
+`after_commit`, `after_create_commit`, `after_rollback` and the rest of the commit callbacks run outside the transaction, so txray deliberately leaves them alone. That distinction is the whole point: moving a call from `after_create` to `after_commit` is usually the fix.
+
+Two of these are easy to forget. Validations run inside the transaction `save` opens, so an API call in a custom validator holds the connection exactly like one in `before_save` (the `geocoder` gem's own README suggests `after_validation :geocode`, which is a network call inside your save transaction). And a migration body runs in a DDL transaction, so a data backfill that loops over a large table holds it for the length of the backfill.
+
+## What it looks for
+
+| Rule | Severity |
+| --- | --- |
+| `http-in-transaction` | high |
+| `external-service-in-transaction` | high |
+| `mail-in-transaction` | high |
+| `shell-in-transaction` | high |
+| `sleep-in-transaction` | high |
+| `job-enqueue-in-transaction` | medium |
+| `broadcast-in-transaction` | medium |
+| `upload-in-transaction` | medium |
+| `iteration-in-transaction` | medium |
+| `blocking-io-in-transaction` | medium |
+| `cache-in-transaction` | low |
+| `dynamic-dispatch-in-transaction` | low |
+
+`bundle exec txray --rules` prints the list with the suggested fix for each.
+
+## Following the call
+
+The interesting offenders are rarely in the transaction block itself:
+
+```ruby
+class Order < ApplicationRecord
+  include Notifiable
+
+  after_create :settle
+
+  def settle
+    charge_card
+    notify_downstream
+  end
+
+  def charge_card
+    Stripe::PaymentIntent.create(amount: total_cents)
+  end
+end
+```
+
+txray resolves `after_create :settle` to `Order#settle`, follows `charge_card` into the same class and `notify_downstream` into the `Notifiable` concern in another file, and reports both calls with the path it took to reach them.
+
+It follows bare calls in the same class, `self.` calls into class methods, `Constant.method` calls into another class, and `Constant.new(...).method` into a service object. A transaction that only says `Checkout.new(order).call` is still traced to the Stripe call three files away. `--depth` controls how far it follows (three levels by default).
+
+## Clients held in variables
+
+Most real client calls never name a risky constant:
+
+```ruby
+class Gateway
+  def charge(order)
+    ApplicationRecord.transaction { client.post("/charges", order.to_json) }
+  end
+
+  def client = @client ||= Faraday.new(url: ENV["API"])
+end
+```
+
+Building a client marks the binding rather than reporting it, and a call on a marked binding is the offense. txray tracks clients through local variables, instance variables, constants, memoized reader methods and `delegate` targets, and reports the request (`client.post`) rather than the harmless construction. Chained calls like `Twilio::REST::Client.new(sid, token).messages.create(...)` are reported once, at the outermost call.
+
+Add your own wrappers with `external_clients` in the config and they are treated the same way.
+
+## Metaprogramming
+
+txray resolves what it can and is explicit about what it cannot:
+
+- `send`/`public_send` with a symbol literal is followed like a direct call
+- methods built with `define_method` are indexed and followed
+- callbacks registered from a concern's `included do` block resolve, including when the method lives on the host class
+- `delegate :charge, to: :gateway` follows through to the target
+
+When the target genuinely cannot be resolved (`send("#{provider}_charge")`), txray reports `dynamic-dispatch-in-transaction` at low severity rather than passing silently, so the blind spot is visible instead of invisible.
+
+What static analysis cannot see: a client passed in as an argument, dispatch through `method_missing`, and work buried inside a gem. That is what the runtime guard is for.
+
+## Configuration
+
+```sh
+bundle exec txray --init
+```
+
+`.txray.yml` is discovered by walking up from the working directory, so it keeps working from subdirectories and from an editor integration.
+
+```yaml
+include:
+  - app
+  - lib
+  - db/migrate
+exclude:
+  - spec
+  - test
+  - vendor
+max_depth: 3
+fail_level: low
+disabled_rules:
+  - cache-in-transaction
+severities:
+  broadcast-in-transaction: high
+external_clients:
+  - InternalApi
+  - LegacySoapClient
+runtime:
+  enabled: false
+  threshold_ms: 250
+  on_violation: log
+  log_path: tmp/txray.ndjson
+  ignore:
+    - LegacyImporter
+```
+
+Exclusions apply to the path below the root being scanned, so `vendor` means the vendor directory in your project, not any directory named vendor anywhere above it.
+
+### Inline suppression
+
+```ruby
+def charge = Faraday.post(url) # txray:disable
+
+# txray:disable http-in-transaction
+Faraday.post(url)
+```
+
+A bare `# txray:disable` disables every rule on that line; naming rules disables only those. The comment works on the offending line or the line directly above it.
+
+## Command line
+
+```
+Usage: txray [options] [paths]
+       txray watch [options]
+
+    -f, --format FORMAT   text, json, sarif or github (default: text)
+    -c, --config PATH     path to a .txray.yml file
+        --fail-level      low, medium, high or none (default: low)
+        --only RULES      report only these rule ids
+        --except RULES    skip these rule ids
+        --depth N         how far to follow method calls (default: 3)
+        --rules           list every rule and exit
+        --init            write a default .txray.yml
+        --file PATH       watch: event log written by the runtime guard
+        --threshold MS    watch: slow transaction threshold
+        --from-start      watch: replay the existing log first
+```
+
+## CI
+
+```yaml
+- name: Scan for slow transactions
+  run: bundle exec txray --format github
+```
+
+`--format github` writes inline annotations on the pull request. `--format sarif` uploads to GitHub code scanning:
+
+```yaml
+- run: bundle exec txray --format sarif > txray.sarif || true
+- uses: github/codeql-action/upload-sarif@v3
+  with:
+    sarif_file: txray.sarif
+```
+
+## Runtime guard
+
+Static analysis cannot see through metaprogramming, gem internals or a client handed in as an argument. The optional runtime guard catches what is left, from inside a running application:
+
+```yaml
+runtime:
+  enabled: true
+  threshold_ms: 250
+  on_violation: raise
+```
+
+It reports a transaction that stays open past the threshold, a job enqueued while a transaction is open, mail delivered while a transaction is open, and any `Net::HTTP` request made while a transaction is open (which covers Faraday, HTTParty, RestClient, Octokit and everything else built on it). Each finding is attributed to the transaction that was open, with the duration of the offending call and the application frame that caused it. `on_violation: log` warns, `raise` fails loudly. Run it as `raise` in test and `log` in development.
+
+Known-good work can be excused:
+
+```ruby
+Txray::Runtime.ignore do
+  LegacyImporter.run!
+end
+```
+
+`ignore` in the config takes patterns matched against the message and source of each finding. `Txray::Runtime.uninstall` tears the guard back down, which test suites need when they install it per example.
+
+## Live monitor
+
+The guard writes newline delimited JSON to `runtime.log_path`. `txray watch` tails it and renders what your application is doing right now:
+
+```
+  txray watching tmp/txray.ndjson  00:04:12
+
+  transactions    142 seen   9 slow   4 with findings
+  duration        p50 12ms   p95 240ms   max 1.84s
+                  ▁▁▂▁▁▁▁▁▁▂▁▁▁▁▁▅▁▁▁▁▁▂▁▁▁▁▁▁▁▁▂█
+
+  LIVE
+  14:02:11              1.84s  x  app/models/order.rb:31 settle
+                          | http-in-transaction POST api.stripe.com/v1/charges (1.61s)
+                          | mail-in-transaction ReceiptMailer delivered mail (180ms)
+  14:02:10               268ms  !  app/services/checkout.rb:12 call
+  14:02:09                11ms  .  app/models/photo.rb:8 save
+
+  HOTSPOTS
+    3x  http-in-transaction              app/models/order.rb:34
+    1x  job-enqueue-in-transaction       app/models/photo.rb:8
+
+  ctrl-c to stop
+```
+
+Findings are grouped under the transaction that produced them, so you see the transaction that took 1.84 seconds and the two calls that account for most of it. Ctrl-C prints a summary of the session. Piped to a file or another process it emits the raw event stream instead of the dashboard, so `txray watch | jq` works.
+
+The log is append only with an exclusive lock per write, so several Puma workers and Sidekiq processes can share one file.
+
+## How this differs from what already exists
+
+[isolator](https://github.com/palkan/isolator) detects the same class of problem at runtime, so it only sees code your tests actually execute. txray answers the same question statically: no boot, no database, no coverage requirement, and it works on a cold checkout of a codebase you have never run. Its runtime guard then covers the rest, and adds transaction duration and a live view, which isolator does not do. The two compose well. Nothing in `rubocop-rails` covers this.
+
+## Roadmap
+
+The rule registry is keyed by category so the transaction rules are the first family rather than the only one. Planned: query rules (N+1 shapes in views and loops, `count` where `size` would do, unbounded `all` loads, missing `includes`), schema rules (unindexed foreign keys and filtered columns), and job rules (Active Record objects passed as job arguments).
+
+## Development
+
+```sh
+bin/setup
+bundle exec rake
+```
+
+## License
+
+MIT

data/Rakefile

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "rspec/core/rake_task"
+require "rubocop/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]

data/exe/txray

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "txray"
+
+exit Txray::CLI.start(ARGV)

data/lib/txray/analyzer.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module Txray
+  class Analyzer
+    def initialize(index:, clients:, config:)
+      @index = index
+      @clients = clients
+      @config = config
+      @classifier = Classifier.new(config)
+      @scope_finder = ScopeFinder.new(index)
+    end
+
+    def call(source)
+      offenses = {}
+      @scope_finder.call(source).each do |scope|
+        walk = Walk.new(scope: scope, suppressed: Set.new, visited: Set.new)
+        explore(scope.body, scope.namespace, scope.source, walk, 0, []) do |offense|
+          current = offenses[offense.key]
+          offenses[offense.key] = offense if current.nil? || offense.trace.size < current.trace.size
+        end
+      end
+      offenses.values
+    end
+
+    private
+
+    Walk = Struct.new(:scope, :suppressed, :visited, keyword_init: true)
+    Context = Struct.new(:namespace, :path, keyword_init: true)
+
+    def explore(node, namespace, source, walk, depth, trace, &emit)
+      NodeHelpers.each_node(node) do |current|
+        report(current, namespace, source, walk, trace, &emit)
+        follow(current, namespace, walk, depth, trace, &emit) if current.is_a?(Prism::CallNode)
+      end
+    end
+
+    def report(node, namespace, source, walk, trace, &emit)
+      return if walk.suppressed.include?(node.object_id)
+
+      rule_id = rule_for(node, namespace, source)
+      return unless rule_id && @config.rule_enabled?(rule_id)
+      return if source.disabled?(node.location.start_line, rule_id)
+
+      suppress_receivers(node, walk)
+      emit.call(Offense.new(rule: @config.rule(rule_id), path: source.path, line: node.location.start_line,
+                            column: node.location.start_column + 1, snippet: NodeHelpers.snippet(node),
+                            scope: walk.scope, trace: trace))
+    end
+
+    def rule_for(node, namespace, source)
+      @classifier.call(node) || client_rule(node, namespace, source) ||
+        (@classifier.iteration?(node) ? "iteration-in-transaction" : nil)
+    end
+
+    def client_rule(node, namespace, source)
+      return nil unless node.is_a?(Prism::CallNode)
+      return @clients.delegated_kind(namespace, node.name) if node.receiver.nil?
+
+      @clients.kind_of(node.receiver, Context.new(namespace: namespace, path: source.path))
+    end
+
+    def suppress_receivers(node, walk)
+      receiver = node.receiver if node.is_a?(Prism::CallNode)
+      while receiver.is_a?(Prism::CallNode)
+        walk.suppressed << receiver.object_id
+        receiver = receiver.receiver
+      end
+    end
+
+    def follow(call, namespace, walk, depth, trace, &)
+      return unless depth < @config.max_depth
+
+      entry = resolve(call, namespace)
+      return if entry.nil? || entry.node.body.nil?
+      return unless walk.visited.add?([ entry.namespace, entry.name ])
+
+      frame = Frame.new(label: entry.label, path: entry.path, line: entry.line)
+      explore(entry.node.body, entry.namespace, entry.source, walk, depth + 1, trace + [ frame ], &)
+    end
+
+    def resolve(call, namespace)
+      name = dispatched_name(call)
+      return nil if name.nil?
+
+      case call.receiver
+      when nil then @index.lookup(namespace, name)
+      when Prism::SelfNode then @index.lookup(namespace, name, singleton: true) || @index.lookup(namespace, name)
+      when Prism::ConstantReadNode, Prism::ConstantPathNode
+        @index.lookup(NodeHelpers.constant_name(call.receiver), name, singleton: true)
+      when Prism::CallNode then resolve_instance(call, name)
+      end
+    end
+
+    def dispatched_name(call)
+      return call.name unless Catalog::DISPATCH_METHODS.include?(call.name)
+
+      argument = NodeHelpers.positional_arguments(call).first
+      argument.unescaped.to_sym if argument.is_a?(Prism::SymbolNode)
+    end
+
+    def resolve_instance(call, name)
+      receiver = call.receiver
+      return unless receiver.name == :new
+
+      owner = NodeHelpers.constant_name(receiver.receiver)
+      owner && @index.lookup(owner, name)
+    end
+  end
+end

data/lib/txray/catalog.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Txray
+  module Catalog
+    HTTP_NAMESPACES = %w[
+      Net::HTTP Net::HTTPS Net::SMTP Net::IMAP Net::POP3 Net::FTP Net::SSH Net::SFTP Net::Telnet
+      Faraday HTTParty RestClient Excon Typhoeus HTTPX HTTPClient HTTP Curl Patron Mechanize Down
+      Savon GraphQL::Client OpenURI Socket TCPSocket UDPSocket
+    ].freeze
+
+    SERVICE_NAMESPACES = %w[
+      Stripe Braintree PayPal Recurly Chargebee Coinbase Plaid Adyen Square
+      Aws AWS Azure Google GoogleDrive Firebase Cloudinary Imgix
+      Twilio SendGrid Mailgun Postmark Mailchimp Customerio Intercom Zendesk Front
+      Slack Discordrb Octokit Gitlab Shopify Salesforce Hubspot Airtable Notion
+      Algolia Elasticsearch OpenSearch Meilisearch Typesense Searchkick Sunspot
+      Geocoder Mapbox LaunchDarkly Fog Vonage Nexmo Resend Pay Auth0 Okta Clerk
+      Pusher Ably Segment Mixpanel Amplitude Posthog
+      OpenAI Anthropic Gemini Replicate Pinecone RubyLLM Ollama Langchain
+      Onfido Persona Checkr Twitter Linkedin Zoom
+    ].freeze
+
+    CACHE_NAMESPACES = %w[Redis Dalli Memcached MemCache].freeze
+
+    SHELL_METHODS = %i[system spawn exec fork popen popen2 popen3 capture2 capture2e capture3 pipeline].freeze
+    SHELL_NAMESPACES = %w[Open3 Process Kernel IO PTY].freeze
+
+    MAIL_METHODS = %i[deliver_now deliver_now!].freeze
+
+    SEARCH_METHODS = %i[reindex reindex! geocode reverse_geocode].freeze
+
+    BROADCAST_METHODS = %i[
+      broadcast_to broadcast_replace_to broadcast_update_to broadcast_append_to broadcast_prepend_to
+      broadcast_remove_to broadcast_before_to broadcast_after_to broadcast_action_to broadcast_render_to
+      broadcast_refresh_to broadcast_replace broadcast_update broadcast_append broadcast_prepend
+    ].freeze
+
+    DISPATCH_METHODS = %i[send public_send __send__ try try!].freeze
+
+    CONSTRUCTOR_METHODS = %i[new client connection build configure resource service session].freeze
+
+    ENQUEUE_METHODS = %i[
+      perform_later deliver_later deliver_later! perform_async perform_in perform_at
+      enqueue enqueue_at broadcast_later broadcast_later_to
+    ].freeze
+
+    ATTACHMENT_METHODS = %i[attach purge purge_later analyze processed].freeze
+
+    ITERATOR_METHODS = %i[
+      each each_with_object each_with_index each_slice each_entry map flat_map
+      find_each find_in_batches in_batches collect select filter reject sum times upto downto
+    ].freeze
+
+    PERSISTENCE_METHODS = %i[
+      save save! update update! update_attribute update_column update_columns
+      create create! destroy destroy! delete touch increment! decrement! toggle!
+      insert insert! insert_all insert_all! upsert upsert_all
+      find find_by find_by! where pluck exists? reload lock! first last count
+    ].freeze
+
+    MEDIA_NAMESPACES = %w[
+      CSV Tempfile Zip Rubyzip Prawn WickedPdf Grover Ferrum Roo Axlsx Caxlsx Spreadsheet
+      MiniMagick ImageProcessing Vips Magick RMagick FFMPEG Streamio Shrine
+    ].freeze
+
+    FILE_NAMESPACES = %w[File IO Pathname FileUtils].freeze
+    FILE_METHODS = %i[read write open binread binwrite readlines foreach copy_stream cp mv rm_rf].freeze
+
+    CALLBACKS = %i[
+      before_commit
+      before_validation after_validation
+      before_save around_save after_save
+      before_create around_create after_create
+      before_update around_update after_update
+      before_destroy around_destroy after_destroy
+      after_touch
+    ].freeze
+
+    MIGRATION_METHODS = %i[change up down].freeze
+
+    module_function
+
+    def namespaced?(constant, namespaces)
+      return false if constant.nil?
+
+      namespaces.any? { |namespace| constant == namespace || constant.start_with?("#{namespace}::") }
+    end
+  end
+end

data/lib/txray/classifier.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module Txray
+  class Classifier
+    def initialize(config)
+      @config = config
+      @clients = Catalog::SERVICE_NAMESPACES + config.external_clients
+    end
+
+    def call(node)
+      return "shell-in-transaction" if node.is_a?(Prism::XStringNode)
+      return nil unless node.is_a?(Prism::CallNode)
+
+      name = node.name
+      constant = NodeHelpers.constant_name(node.receiver)
+
+      return "shell-in-transaction" if shell?(node, name, constant)
+      return "sleep-in-transaction" if blocking?(node, name, constant)
+      return "mail-in-transaction" if Catalog::MAIL_METHODS.include?(name)
+      return "job-enqueue-in-transaction" if enqueue?(name, constant)
+      return "broadcast-in-transaction" if broadcast?(node, name)
+      return "upload-in-transaction" if Catalog::ATTACHMENT_METHODS.include?(name)
+      return "external-service-in-transaction" if Catalog::SEARCH_METHODS.include?(name)
+      return "dynamic-dispatch-in-transaction" if unresolvable_dispatch?(node, name)
+      return "cache-in-transaction" if rails_cache?(node)
+      return nil if constructor?(node, name)
+
+      constant_rule(constant) || implicit_http(name, constant)
+    end
+
+    def constant_rule(constant)
+      return nil if constant.nil?
+      return "http-in-transaction" if Catalog.namespaced?(constant, Catalog::HTTP_NAMESPACES)
+      return "cache-in-transaction" if Catalog.namespaced?(constant, Catalog::CACHE_NAMESPACES)
+      return "blocking-io-in-transaction" if Catalog.namespaced?(constant, Catalog::MEDIA_NAMESPACES)
+      return "external-service-in-transaction" if Catalog.namespaced?(constant, @clients)
+
+      nil
+    end
+
+    def iteration?(node)
+      return false unless node.is_a?(Prism::CallNode) && node.block && Catalog::ITERATOR_METHODS.include?(node.name)
+
+      NodeHelpers.each_node(NodeHelpers.block_body(node)) do |child|
+        return true if child.is_a?(Prism::CallNode) && Catalog::PERSISTENCE_METHODS.include?(child.name)
+      end
+      false
+    end
+
+    def constructor?(node, name = node.name)
+      Catalog::CONSTRUCTOR_METHODS.include?(name) && !constant_rule(NodeHelpers.constant_name(node.receiver)).nil?
+    end
+
+    private
+
+    def implicit_http(name, constant)
+      return "http-in-transaction" if name == :open && %w[URI OpenURI Kernel].include?(constant)
+      return "blocking-io-in-transaction" if file_io?(name, constant)
+
+      nil
+    end
+
+    def file_io?(name, constant)
+      Catalog::FILE_NAMESPACES.include?(constant) && Catalog::FILE_METHODS.include?(name)
+    end
+
+    def shell?(node, name, constant)
+      return false unless Catalog::SHELL_METHODS.include?(name)
+
+      node.receiver.nil? || Catalog.namespaced?(constant, Catalog::SHELL_NAMESPACES)
+    end
+
+    def blocking?(node, name, constant)
+      return true if name == :sleep && (node.receiver.nil? || constant == "Kernel")
+
+      name == :timeout && constant == "Timeout"
+    end
+
+    def enqueue?(name, constant)
+      return true if Catalog::ENQUEUE_METHODS.include?(name)
+
+      name == :push && constant == "Sidekiq::Client"
+    end
+
+    def broadcast?(node, name)
+      return true if Catalog::BROADCAST_METHODS.include?(name)
+
+      name == :broadcast && NodeHelpers.receiver_name(node).to_s.start_with?("ActionCable")
+    end
+
+    def unresolvable_dispatch?(node, name)
+      return false unless Catalog::DISPATCH_METHODS.include?(name)
+
+      argument = NodeHelpers.positional_arguments(node).first
+      !argument.nil? && !argument.is_a?(Prism::SymbolNode)
+    end
+
+    def rails_cache?(node)
+      NodeHelpers.receiver_name(node).to_s.start_with?("Rails.cache", "$redis", "@redis")
+    end
+  end
+end