@rigour-labs/core 4.1.1 → 4.2.1

package/dist/gates/hallucinated-imports-lang.d.ts

@@ -9,8 +9,19 @@ export declare function loadRubyGems(cwd: string): Set<string>;
 export declare function checkCSharpImports(content: string, file: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function hasCsprojFile(cwd: string): boolean;
 export declare function loadNuGetPackages(cwd: string): Set<string>;
+/**
+ * Search for .csproj files by walking up from the C# file's directory.
+ * Monorepo support: a C# file in tests/csharp/MyProject/ needs to find .csproj
+ * in that directory, not just the project root.
+ */
+export declare function loadNuGetPackagesForFile(file: string, cwd: string): Set<string>;
 export declare function checkRustImports(content: string, file: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function loadCargoDeps(cwd: string): Set<string>;
 export declare function checkJavaKotlinImports(content: string, file: string, ext: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function loadJavaDeps(cwd: string): Set<string>;
+/**
+ * Search for build.gradle/pom.xml by walking up from the Java/Kotlin file's directory.
+ * Monorepo support: a Java file in sdks/sandbox/java/ needs to find build.gradle there.
+ */
+export declare function loadJavaDepsForFile(file: string, cwd: string): Set<string>;
 export declare function loadPackageJson(cwd: string): Promise<any>;

package/dist/gates/hallucinated-imports-lang.js

@@ -8,18 +8,30 @@ import { isGoStdlib, isRubyStdlib, isDotNetFramework, isRustStdCrate, isJavaStdl
 export function checkGoImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
     let inImportBlock = false;
-    // Try to read go.mod for the module path
-    const goModPath = path.join(cwd, 'go.mod');
+    // Find go.mod by walking up from the Go file's directory (monorepo support).
+    // A monorepo may have go.mod in subdirectories like kubernetes/go.mod, server/go.mod, etc.
     let modulePath = null;
-    try {
-        if (fs.pathExistsSync(goModPath)) {
-            const goMod = fs.readFileSync(goModPath, 'utf-8');
-            const moduleMatch = goMod.match(/^module\s+(\S+)/m);
-            if (moduleMatch)
-                modulePath = moduleMatch[1];
+    const fileAbsDir = path.dirname(path.resolve(cwd, file));
+    const rootDir = path.resolve(cwd);
+    let searchDir = fileAbsDir;
+    while (searchDir.startsWith(rootDir) || searchDir === rootDir) {
+        const goModPath = path.join(searchDir, 'go.mod');
+        try {
+            if (fs.pathExistsSync(goModPath)) {
+                const goMod = fs.readFileSync(goModPath, 'utf-8');
+                const moduleMatch = goMod.match(/^module\s+(\S+)/m);
+                if (moduleMatch) {
+                    modulePath = moduleMatch[1];
+                    break;
+                }
+            }
         }
+        catch { /* skip */ }
+        const parent = path.dirname(searchDir);
+        if (parent === searchDir)
+            break;
+        searchDir = parent;
     }
-    catch { /* no go.mod — skip project-relative checks entirely */ }
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
         // Detect import block: import ( ... )
@@ -150,7 +162,8 @@ export function loadRubyGems(cwd) {
 }
 export function checkCSharpImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
-    const nugetPackages = loadNuGetPackages(cwd);
+    // Search for .csproj in file's directory and parent dirs (monorepo support)
+    const nugetPackages = loadNuGetPackagesForFile(file, cwd);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
         // Match: using Namespace; and using static Namespace.Class;
@@ -178,7 +191,7 @@ export function checkCSharpImports(content, file, cwd, projectFiles, hallucinate
         // Only flag if we have .csproj context (proves this is a real .NET project)
         if (!hasMatch && namespace.includes('.') && nugetPackages.size >= 0) {
             // Check if we actually have .csproj context (a real .NET project)
-            const hasCsproj = hasCsprojFile(cwd);
+            const hasCsproj = nugetPackages.size > 0 || hasCsprojFile(cwd);
             if (hasCsproj) {
                 hallucinated.push({
                     file, line: i + 1, importPath: namespace, type: 'csharp',
@@ -220,6 +233,26 @@ export function loadNuGetPackages(cwd) {
     catch { /* no .csproj */ }
     return packages;
 }
+/**
+ * Search for .csproj files by walking up from the C# file's directory.
+ * Monorepo support: a C# file in tests/csharp/MyProject/ needs to find .csproj
+ * in that directory, not just the project root.
+ */
+export function loadNuGetPackagesForFile(file, cwd) {
+    const allPackages = new Set();
+    const rootDir = path.resolve(cwd);
+    let searchDir = path.dirname(path.resolve(cwd, file));
+    while (searchDir.startsWith(rootDir) || searchDir === rootDir) {
+        const pkgs = loadNuGetPackages(searchDir);
+        for (const p of pkgs)
+            allPackages.add(p);
+        const parent = path.dirname(searchDir);
+        if (parent === searchDir)
+            break;
+        searchDir = parent;
+    }
+    return allPackages;
+}
 export function checkRustImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
     const cargoDeps = loadCargoDeps(cwd);
@@ -290,7 +323,8 @@ export function loadCargoDeps(cwd) {
 }
 export function checkJavaKotlinImports(content, file, ext, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
-    const buildDeps = loadJavaDeps(cwd);
+    // Search for build.gradle/pom.xml by walking up from the file's directory (monorepo support)
+    const buildDeps = loadJavaDepsForFile(file, cwd);
     const isKotlin = ext === '.kt';
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
@@ -362,6 +396,25 @@ export function loadJavaDeps(cwd) {
     catch { /* no build files */ }
     return deps;
 }
+/**
+ * Search for build.gradle/pom.xml by walking up from the Java/Kotlin file's directory.
+ * Monorepo support: a Java file in sdks/sandbox/java/ needs to find build.gradle there.
+ */
+export function loadJavaDepsForFile(file, cwd) {
+    const allDeps = new Set();
+    const rootDir = path.resolve(cwd);
+    let searchDir = path.dirname(path.resolve(cwd, file));
+    while (searchDir.startsWith(rootDir) || searchDir === rootDir) {
+        const deps = loadJavaDeps(searchDir);
+        for (const d of deps)
+            allDeps.add(d);
+        const parent = path.dirname(searchDir);
+        if (parent === searchDir)
+            break;
+        searchDir = parent;
+    }
+    return allDeps;
+}
 export async function loadPackageJson(cwd) {
     try {
         const pkgPath = path.join(cwd, 'package.json');

package/dist/gates/hallucinated-imports.d.ts

@@ -49,6 +49,16 @@ export declare class HallucinatedImportsGate extends Gate {
     private loadTsPathConfig;
     private readLooseJson;
     private checkPyImports;
+    /**
+     * Find Python source roots (directories that are on sys.path) by looking at
+     * pyproject.toml, setup.cfg, or common patterns like src/ layouts.
+     */
+    private findPythonSourceRoots;
+    /**
+     * Load installed Python package names from pyproject.toml dependencies,
+     * requirements.txt, setup.cfg, or Pipfile.
+     */
+    private loadPythonInstalledPackages;
     private resolveRelativeImport;
     private extractPackageName;
     private shouldIgnore;

package/dist/gates/hallucinated-imports.js

@@ -341,6 +341,9 @@ export class HallucinatedImportsGate extends Gate {
     }
     async checkPyImports(content, file, cwd, projectFiles, hallucinated) {
         const lines = content.split('\n');
+        // Lazily resolve Python source roots and installed packages for this project
+        const pySourceRoots = await this.findPythonSourceRoots(cwd, projectFiles);
+        const pyInstalledPkgs = await this.loadPythonInstalledPackages(cwd);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i].trim();
             // Match: from X import Y, import X
@@ -354,13 +357,35 @@ export class HallucinatedImportsGate extends Gate {
                 continue;
             // Check if it's a relative project import
             if (modulePath.startsWith('.')) {
-                // Relative Python import
-                const pyFile = modulePath.replace(/\./g, '/') + '.py';
-                const pyInit = modulePath.replace(/\./g, '/') + '/__init__.py';
-                const fileDir = path.dirname(file);
-                const resolved1 = path.join(fileDir, pyFile).replace(/\\/g, '/');
-                const resolved2 = path.join(fileDir, pyInit).replace(/\\/g, '/');
-                if (!projectFiles.has(resolved1) && !projectFiles.has(resolved2)) {
+                // Python relative import: count leading dots to determine traversal depth.
+                // N dots = go up (N-1) package levels from the file's directory.
+                //   from .types import X      → 1 dot = current package (0 levels up)
+                //   from ..types import X     → 2 dots = parent package (1 level up)
+                //   from ...client import X   → 3 dots = grandparent package (2 levels up)
+                const dotMatch = modulePath.match(/^(\.+)/);
+                const dotCount = dotMatch ? dotMatch[1].length : 0;
+                const moduleRest = modulePath.slice(dotCount); // e.g. 'client', 'types', 'models.permission', or '' for bare dots
+                // Walk up (dotCount - 1) directories from the file's directory
+                let baseDir = path.dirname(file);
+                for (let level = 1; level < dotCount; level++) {
+                    const parent = path.dirname(baseDir);
+                    if (parent === baseDir)
+                        break; // at root
+                    baseDir = parent;
+                }
+                // If moduleRest is empty (e.g. `from . import X`), we're just referencing the package directory.
+                // The imported names come from the `import` clause, not the module path — skip validation
+                // since bare-dot package references are almost never hallucinated.
+                if (!moduleRest)
+                    continue;
+                // Resolve remaining module path within the target directory
+                const moduleParts = moduleRest.replace(/\./g, '/');
+                const candidateBase = path.join(baseDir, moduleParts).replace(/\\/g, '/');
+                const candidates = [
+                    candidateBase + '.py',
+                    candidateBase + '/__init__.py',
+                ];
+                if (!candidates.some(c => projectFiles.has(c))) {
                     hallucinated.push({
                         file, line: i + 1, importPath: modulePath, type: 'python',
                         reason: `Relative module '${modulePath}' not found in project`,
@@ -368,33 +393,193 @@ export class HallucinatedImportsGate extends Gate {
                 }
             }
             else {
-                // Absolute import — check if it's a project module
+                // Absolute import — check if it's a project module or installed package
                 const topLevel = modulePath.split('.')[0];
-                const pyFile = topLevel + '.py';
-                const pyInit = topLevel + '/__init__.py';
-                // If it matches a project file, it's a local import — verify it exists
-                const isLocalModule = projectFiles.has(pyFile) || projectFiles.has(pyInit) ||
-                    [...projectFiles].some(f => f.startsWith(topLevel + '/'));
-                // If not local and not stdlib, we can't easily verify pip packages
-                // without a requirements.txt or pyproject.toml check
-                if (isLocalModule) {
+                // Check if this is an installed package (from pyproject.toml, requirements.txt, etc.)
+                if (pyInstalledPkgs.has(topLevel) || pyInstalledPkgs.has(topLevel.replace(/_/g, '-'))) {
+                    continue; // Known installed package — skip
+                }
+                // Check if it's a local module (searching across all Python source roots)
+                let foundLocal = false;
+                const searchRoots = ['', ...pySourceRoots]; // '' = project root
+                for (const root of searchRoots) {
+                    const prefix = root ? root + '/' : '';
+                    const pyFile = prefix + topLevel + '.py';
+                    const pyInit = prefix + topLevel + '/__init__.py';
+                    const dirPrefix = prefix + topLevel + '/';
+                    const isLocalModule = projectFiles.has(pyFile) || projectFiles.has(pyInit) ||
+                        [...projectFiles].some(f => f.startsWith(dirPrefix));
+                    if (!isLocalModule)
+                        continue;
+                    foundLocal = true;
                     // It's referencing a local module — verify the full path
-                    const fullModulePath = modulePath.replace(/\./g, '/');
+                    const fullModulePath = prefix + modulePath.replace(/\./g, '/');
                     const candidates = [
                         fullModulePath + '.py',
                         fullModulePath + '/__init__.py',
                     ];
                     const exists = candidates.some(c => projectFiles.has(c));
-                    if (!exists && modulePath.includes('.')) {
+                    if (exists)
+                        break; // Found it — no issue
+                    if (modulePath.includes('.')) {
                         // Only flag deep module paths that partially resolve
                         hallucinated.push({
                             file, line: i + 1, importPath: modulePath, type: 'python',
                             reason: `Module '${modulePath}' partially resolves but target not found`,
                         });
                     }
+                    break;
+                }
+                // If not local and not stdlib and not installed, we can't easily verify
+                // — skip silently rather than risk false positives
+            }
+        }
+    }
+    /**
+     * Find Python source roots (directories that are on sys.path) by looking at
+     * pyproject.toml, setup.cfg, or common patterns like src/ layouts.
+     */
+    async findPythonSourceRoots(cwd, projectFiles) {
+        const roots = [];
+        // Check pyproject.toml for package-dir or src layout hints
+        const pyprojectPath = path.join(cwd, 'pyproject.toml');
+        if (await fs.pathExists(pyprojectPath)) {
+            try {
+                const content = await fs.readFile(pyprojectPath, 'utf-8');
+                // Match [tool.setuptools.packages.find] where = ["src"] or similar
+                const whereMatch = content.match(/where\s*=\s*\[\s*"([^"]+)"\s*\]/);
+                if (whereMatch) {
+                    roots.push(whereMatch[1]);
+                }
+                // Match package-dir patterns
+                const pkgDirMatch = content.match(/package-dir\s*=\s*\{\s*""\s*:\s*"([^"]+)"\s*\}/);
+                if (pkgDirMatch) {
+                    roots.push(pkgDirMatch[1]);
+                }
+            }
+            catch { /* skip */ }
+        }
+        // Common source root patterns
+        const commonSrcDirs = ['src', 'lib', 'app'];
+        for (const dir of commonSrcDirs) {
+            if ([...projectFiles].some(f => f.startsWith(dir + '/') && f.endsWith('.py'))) {
+                if (!roots.includes(dir)) {
+                    roots.push(dir);
+                }
+            }
+        }
+        // Also scan for directories containing __init__.py that aren't at root level
+        // (e.g. sdks/sandbox/python/src/ as a source root)
+        const pyprojectFiles = [...projectFiles].filter(f => f.endsWith('/pyproject.toml') || f === 'pyproject.toml');
+        for (const pf of pyprojectFiles) {
+            const pfDir = path.dirname(pf);
+            if (pfDir === '.')
+                continue;
+            // Check if this pyproject.toml has a src/ dir
+            const srcDir = pfDir + '/src';
+            if ([...projectFiles].some(f => f.startsWith(srcDir + '/') && f.endsWith('.py'))) {
+                if (!roots.includes(srcDir)) {
+                    roots.push(srcDir);
+                }
+            }
+        }
+        return roots;
+    }
+    /**
+     * Load installed Python package names from pyproject.toml dependencies,
+     * requirements.txt, setup.cfg, or Pipfile.
+     */
+    async loadPythonInstalledPackages(cwd) {
+        const packages = new Set();
+        // Helper to normalize package names (PEP 503: lowercase, replace [-_.] with -)
+        const normalize = (name) => name.toLowerCase().replace(/[-_.]+/g, '-');
+        // Check pyproject.toml
+        const pyprojectPath = path.join(cwd, 'pyproject.toml');
+        if (await fs.pathExists(pyprojectPath)) {
+            try {
+                const content = await fs.readFile(pyprojectPath, 'utf-8');
+                // Match dependencies = ["fastapi>=0.100", "kubernetes", ...]
+                const depsMatch = content.match(/dependencies\s*=\s*\[([\s\S]*?)\]/g);
+                if (depsMatch) {
+                    for (const block of depsMatch) {
+                        const pkgs = block.match(/"([^">=<!\s\[]+)/g);
+                        if (pkgs) {
+                            for (const pkg of pkgs) {
+                                const name = pkg.replace(/^"/, '').split(/[>=<!\[]/)[0].trim();
+                                if (name && name !== 'dependencies') {
+                                    packages.add(normalize(name));
+                                    // Also add the import name (replace - with _)
+                                    packages.add(name.replace(/-/g, '_').toLowerCase());
+                                }
+                            }
+                        }
+                    }
+                }
+                // optional-dependencies
+                const optDepsMatch = content.match(/optional-dependencies\s*\]([\s\S]*?)(?:\n\[|\n$)/);
+                if (optDepsMatch) {
+                    const pkgs = optDepsMatch[1].match(/"([^">=<!\s\[]+)/g);
+                    if (pkgs) {
+                        for (const pkg of pkgs) {
+                            const name = pkg.replace(/^"/, '').split(/[>=<!\[]/)[0].trim();
+                            if (name) {
+                                packages.add(normalize(name));
+                                packages.add(name.replace(/-/g, '_').toLowerCase());
+                            }
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // Check requirements*.txt files
+        const reqFiles = ['requirements.txt', 'requirements-dev.txt', 'requirements_dev.txt'];
+        for (const reqFile of reqFiles) {
+            const reqPath = path.join(cwd, reqFile);
+            if (await fs.pathExists(reqPath)) {
+                try {
+                    const content = await fs.readFile(reqPath, 'utf-8');
+                    for (const line of content.split('\n')) {
+                        const trimmed = line.trim();
+                        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('-'))
+                            continue;
+                        const name = trimmed.split(/[>=<!\[;@\s]/)[0].trim();
+                        if (name) {
+                            packages.add(normalize(name));
+                            packages.add(name.replace(/-/g, '_').toLowerCase());
+                        }
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        // Also scan subdirectories for pyproject.toml (monorepo support)
+        const subPyprojects = ['server/pyproject.toml', 'api/pyproject.toml', 'backend/pyproject.toml'];
+        for (const sub of subPyprojects) {
+            const subPath = path.join(cwd, sub);
+            if (await fs.pathExists(subPath)) {
+                try {
+                    const content = await fs.readFile(subPath, 'utf-8');
+                    const depsMatch = content.match(/dependencies\s*=\s*\[([\s\S]*?)\]/g);
+                    if (depsMatch) {
+                        for (const block of depsMatch) {
+                            const pkgs = block.match(/"([^">=<!\s\[]+)/g);
+                            if (pkgs) {
+                                for (const pkg of pkgs) {
+                                    const name = pkg.replace(/^"/, '').split(/[>=<!\[]/)[0].trim();
+                                    if (name && name !== 'dependencies') {
+                                        packages.add(normalize(name));
+                                        packages.add(name.replace(/-/g, '_').toLowerCase());
+                                    }
+                                }
+                            }
+                        }
+                    }
                 }
+                catch { /* skip */ }
             }
         }
+        return packages;
     }
     resolveRelativeImport(fromFile, importPath, projectFiles) {
         const dir = path.dirname(fromFile);

package/dist/gates/phantom-apis.d.ts

@@ -43,6 +43,13 @@ export declare class PhantomApisGate extends Gate {
     protected get provenance(): Provenance;
     run(context: GateContext): Promise<Failure[]>;
     private shouldSkipFile;
+    /**
+     * Strip string literal contents from a line to prevent matching code-in-strings.
+     * Replaces the content inside quotes with spaces, preserving the quotes themselves.
+     * This prevents false positives when e.g. a Java test passes Python code as a string
+     * to a code interpreter sandbox.
+     */
+    private stripStringLiterals;
     /**
      * Node.js stdlib method verification.
      * For each known module, we maintain the actual exported methods.
@@ -71,9 +78,19 @@ export declare class PhantomApisGate extends Gate {
      */
     private checkCSharpPhantomApis;
     /**
-     * Java/Kotlin phantom API detection — pattern-based.
+     * Java phantom API detection — pattern-based.
      * AI hallucinates Python/JS-style APIs on JDK classes.
+     * Strips string literal contents to avoid matching code-in-strings
+     * (e.g. Java test passing Python code `print('hello')` to a sandbox).
      */
     private checkJavaPhantomApis;
+    /**
+     * Kotlin phantom API detection — uses a SUBSET of Java rules.
+     * Kotlin has different syntax than Java, so rules must be filtered:
+     *   - print() IS valid Kotlin (kotlin.io.print)
+     *   - var x: Type = IS valid Kotlin syntax
+     *   - Most other Java patterns (includes, slice, arrow syntax) still apply
+     */
+    private checkKotlinPhantomApis;
     private escapeRegex;
 }

package/dist/gates/phantom-apis.js

@@ -73,9 +73,12 @@ export class PhantomApisGate extends Gate {
                 else if (ext === '.cs' && this.config.check_csharp) {
                     this.checkCSharpPhantomApis(content, file, phantoms);
                 }
-                else if ((ext === '.java' || ext === '.kt') && this.config.check_java) {
+                else if (ext === '.java' && this.config.check_java) {
                     this.checkJavaPhantomApis(content, file, phantoms);
                 }
+                else if (ext === '.kt' && this.config.check_java) {
+                    this.checkKotlinPhantomApis(content, file, phantoms);
+                }
             }
             catch { /* skip unreadable files */ }
         }
@@ -99,7 +102,33 @@ export class PhantomApisGate extends Gate {
             normalized.includes('/__tests__/') ||
             normalized.endsWith('/phantom-apis-data.ts') ||
             /\.test\.[^.]+$/i.test(normalized) ||
-            /\.spec\.[^.]+$/i.test(normalized));
+            /\.spec\.[^.]+$/i.test(normalized) ||
+            // Additional test file patterns (Python, Go, Java)
+            /\/tests\//.test(`/${normalized}`) ||
+            /\/test\//.test(`/${normalized}`) ||
+            /_test\.go$/i.test(normalized) ||
+            /(?:^|\/)test_[^/]+\.py$/i.test(normalized) ||
+            /(?:^|\/)conftest\.py$/i.test(normalized) ||
+            /\/e2e\//.test(`/${normalized}`) ||
+            /E2E/i.test(path.basename(normalized)));
+    }
+    /**
+     * Strip string literal contents from a line to prevent matching code-in-strings.
+     * Replaces the content inside quotes with spaces, preserving the quotes themselves.
+     * This prevents false positives when e.g. a Java test passes Python code as a string
+     * to a code interpreter sandbox.
+     */
+    stripStringLiterals(line) {
+        // Replace content inside triple-quoted strings (Python/Kotlin)
+        let result = line.replace(/"""[\s\S]*?"""/g, '""""""');
+        result = result.replace(/'''[\s\S]*?'''/g, "''''''");
+        // Replace content inside regular double-quoted strings (handles escaped quotes)
+        result = result.replace(/"(?:\\.|[^"\\])*"/g, '""');
+        // Replace content inside single-quoted strings
+        result = result.replace(/'(?:\\.|[^'\\])*'/g, "''");
+        // Replace content inside backtick strings (JS/TS template literals)
+        result = result.replace(/`(?:\\.|[^`\\])*`/g, '``');
+        return result;
     }
     /**
      * Node.js stdlib method verification.
@@ -127,7 +156,7 @@ export class PhantomApisGate extends Gate {
             return;
         // Scan for method calls on imported modules
         for (let i = 0; i < lines.length; i++) {
-            const line = this.stripJsCommentLine(lines[i]);
+            const line = this.stripStringLiterals(this.stripJsCommentLine(lines[i]));
             if (!line)
                 continue;
             for (const [alias, moduleName] of moduleAliases) {
@@ -185,7 +214,7 @@ export class PhantomApisGate extends Gate {
         if (moduleAliases.size === 0)
             return;
         for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
+            const line = this.stripStringLiterals(lines[i]);
             for (const [alias, moduleName] of moduleAliases) {
                 const callPattern = new RegExp(`\\b${this.escapeRegex(alias)}\\.(\\w+)\\s*\\(`, 'g');
                 let match;
@@ -252,7 +281,7 @@ export class PhantomApisGate extends Gate {
     checkGoPhantomApis(content, file, phantoms) {
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
+            const line = this.stripStringLiterals(lines[i]);
             for (const rule of GO_PHANTOM_RULES) {
                 if (rule.pattern.test(line)) {
                     phantoms.push({
@@ -271,7 +300,7 @@ export class PhantomApisGate extends Gate {
     checkCSharpPhantomApis(content, file, phantoms) {
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
+            const line = this.stripStringLiterals(lines[i]);
             for (const rule of CSHARP_PHANTOM_RULES) {
                 if (rule.pattern.test(line)) {
                     phantoms.push({
@@ -284,13 +313,15 @@ export class PhantomApisGate extends Gate {
         }
     }
     /**
-     * Java/Kotlin phantom API detection — pattern-based.
+     * Java phantom API detection — pattern-based.
      * AI hallucinates Python/JS-style APIs on JDK classes.
+     * Strips string literal contents to avoid matching code-in-strings
+     * (e.g. Java test passing Python code `print('hello')` to a sandbox).
      */
     checkJavaPhantomApis(content, file, phantoms) {
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
+            const line = this.stripStringLiterals(lines[i]);
             for (const rule of JAVA_PHANTOM_RULES) {
                 if (rule.pattern.test(line)) {
                     phantoms.push({
@@ -302,6 +333,35 @@ export class PhantomApisGate extends Gate {
             }
         }
     }
+    /**
+     * Kotlin phantom API detection — uses a SUBSET of Java rules.
+     * Kotlin has different syntax than Java, so rules must be filtered:
+     *   - print() IS valid Kotlin (kotlin.io.print)
+     *   - var x: Type = IS valid Kotlin syntax
+     *   - Most other Java patterns (includes, slice, arrow syntax) still apply
+     */
+    checkKotlinPhantomApis(content, file, phantoms) {
+        // Rules that are NOT applicable to Kotlin (valid Kotlin syntax)
+        const kotlinExclude = new Set([
+            'print()', // kotlin.io.print() is real
+            'var x: Type =', // Kotlin explicitly supports typed var/val declarations
+        ]);
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = this.stripStringLiterals(lines[i]);
+            for (const rule of JAVA_PHANTOM_RULES) {
+                if (kotlinExclude.has(rule.phantom))
+                    continue;
+                if (rule.pattern.test(line)) {
+                    phantoms.push({
+                        file, line: i + 1,
+                        module: rule.module, method: rule.phantom,
+                        reason: `'${rule.phantom}' does not exist in Kotlin. ${rule.suggestion}`,
+                    });
+                }
+            }
+        }
+    }
     escapeRegex(s) {
         return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     }