@rigour-labs/core 4.2.0 → 4.2.2

package/dist/deep/verifier.test.js

@@ -441,26 +441,147 @@ describe('Verifier', () => {
             expect(result).toHaveLength(0);
         });
     });
-    // ── Confidence-based categories ──
-    describe('confidence-based verification', () => {
-        const confidenceCategories = [
-            'dry_violation', 'feature_envy', 'architecture',
-            'naming_convention', 'dead_code', 'performance',
-        ];
-        for (const category of confidenceCategories) {
-            it(`should accept ${category} with confidence >= 0.3`, () => {
-                const findings = [makeFinding({ category, confidence: 0.5 })];
-                const facts = [makeFileFacts()];
-                const result = verifyFindings(findings, facts);
-                expect(result).toHaveLength(1);
-            });
-            it(`should reject ${category} with low confidence`, () => {
-                const findings = [makeFinding({ category, confidence: 0.1 })];
-                const facts = [makeFileFacts()];
-                const result = verifyFindings(findings, facts);
-                expect(result).toHaveLength(0);
-            });
-        }
+    // ── Structurally-verified categories ──
+    // After verifier hardening, these categories use entity names, cross-file
+    // checks, or raised confidence floors — not just confidence >= 0.3.
+    describe('structurally-verified categories', () => {
+        // Tier 1: Entity-name required — accepts when entity name matches
+        it('should accept feature_envy when entity name exists in file', () => {
+            const findings = [makeFinding({
+                    category: 'feature_envy',
+                    description: 'The processData function accesses too many external modules',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject feature_envy with no entity name and low confidence', () => {
+            const findings = [makeFinding({
+                    category: 'feature_envy',
+                    description: 'Some function accesses external modules',
+                    confidence: 0.3,
+                })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0); // No entity name → needs confidence >= 0.6
+        });
+        // Tier 2: dead_code — needs entity unreferenced externally
+        it('should accept dead_code when entity is unreferenced', () => {
+            const findings = [makeFinding({
+                    category: 'dead_code',
+                    description: 'processData is never called',
+                    confidence: 0.5,
+                })];
+            // Only one file — processData can't be imported by other files
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject dead_code when entity is imported by another file', () => {
+            const findings = [makeFinding({
+                    category: 'dead_code',
+                    description: 'processData is never called',
+                    confidence: 0.9,
+                })];
+            const facts = [
+                makeFileFacts(),
+                makeFileFacts({
+                    path: 'src/consumer.ts',
+                    imports: ['./service', 'processData'], // References the entity
+                }),
+            ];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0); // Entity is referenced — not dead code
+        });
+        // Tier 2: naming_convention — checks actual language rules
+        it('should accept naming_convention when name violates rules', () => {
+            const findings = [makeFinding({
+                    category: 'naming_convention',
+                    file: 'pkg/utils.go',
+                    description: 'get_user_name uses snake_case instead of MixedCaps',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts({
+                    path: 'pkg/utils.go',
+                    language: 'go',
+                    functions: [{
+                            name: 'get_user_name',
+                            lineStart: 10, lineEnd: 30, lineCount: 20,
+                            paramCount: 1, params: ['id'],
+                            maxNesting: 1, hasReturn: true, isAsync: false, isExported: false,
+                        }],
+                })];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+            expect(result[0].verified).toBe(true);
+        });
+        it('should reject naming_convention when name follows rules', () => {
+            const findings = [makeFinding({
+                    category: 'naming_convention',
+                    description: 'processData naming issue',
+                    confidence: 0.8,
+                })];
+            const facts = [makeFileFacts()]; // processData is camelCase — correct for TS
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0); // Name follows conventions → FP
+        });
+        // Tier 2: performance — needs non-trivial function
+        it('should accept performance when function is substantial', () => {
+            const findings = [makeFinding({
+                    category: 'performance',
+                    description: 'processData has O(n²) complexity',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts()]; // processData is 70 lines
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        // Tier 3: dry_violation — needs cross-file similarity
+        it('should accept dry_violation when similar function exists in another file', () => {
+            const findings = [makeFinding({
+                    category: 'dry_violation',
+                    description: 'processData is duplicated across files',
+                    confidence: 0.5,
+                })];
+            const facts = [
+                makeFileFacts(),
+                makeFileFacts({
+                    path: 'src/other.ts',
+                    functions: [{
+                            name: 'processData', // Same name = similar
+                            lineStart: 10, lineEnd: 80, lineCount: 70,
+                            paramCount: 5, params: ['a', 'b', 'c', 'd', 'e'],
+                            maxNesting: 3, hasReturn: true, isAsync: true, isExported: true,
+                        }],
+                }),
+            ];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject dry_violation when no similar function exists', () => {
+            const findings = [makeFinding({
+                    category: 'dry_violation',
+                    description: 'processData is duplicated',
+                    confidence: 0.5,
+                })];
+            const facts = [makeFileFacts()]; // Only one file — no cross-file match
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0);
+        });
+        // Tier 4: Confidence floor raised to 0.5
+        it('should accept architecture with confidence >= 0.5', () => {
+            const findings = [makeFinding({ category: 'architecture', confidence: 0.6 })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(1);
+        });
+        it('should reject architecture with confidence < 0.5', () => {
+            const findings = [makeFinding({ category: 'architecture', confidence: 0.4 })];
+            const facts = [makeFileFacts()];
+            const result = verifyFindings(findings, facts);
+            expect(result).toHaveLength(0);
+        });
     });
     // ── Resource leak (Go-specific) ──
     describe('resource leak verification', () => {
@@ -502,13 +623,13 @@ describe('Verifier', () => {
                 makeFinding({ category: 'god_function', file: 'nonexistent.ts' }), // Should fail (no file)
                 makeFinding({ category: 'long_file' }), // Should fail (300 lines, need >300)
                 makeFinding({ category: 'magic_number' }), // Should fail (no magicNumbers set)
-                makeFinding({ category: 'dry_violation', confidence: 0.1 }), // Should fail (low confidence)
-                makeFinding({ category: 'dry_violation', confidence: 0.5 }), // Should pass
+                makeFinding({ category: 'architecture', confidence: 0.1 }), // Should fail (below 0.5 floor)
+                makeFinding({ category: 'architecture', confidence: 0.6 }), // Should pass (above 0.5 floor)
             ];
             const facts = [makeFileFacts()];
             const result = verifyFindings(findings, facts);
             const verified = result.filter(r => r.verified);
-            expect(verified.length).toBeGreaterThanOrEqual(2); // god_class, dry_violation(0.5)
+            expect(verified.length).toBeGreaterThanOrEqual(2); // god_class, architecture(0.6)
         });
     });
 });

package/dist/gates/hallucinated-imports-lang.d.ts

@@ -9,8 +9,19 @@ export declare function loadRubyGems(cwd: string): Set<string>;
 export declare function checkCSharpImports(content: string, file: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function hasCsprojFile(cwd: string): boolean;
 export declare function loadNuGetPackages(cwd: string): Set<string>;
+/**
+ * Search for .csproj files by walking up from the C# file's directory.
+ * Monorepo support: a C# file in tests/csharp/MyProject/ needs to find .csproj
+ * in that directory, not just the project root.
+ */
+export declare function loadNuGetPackagesForFile(file: string, cwd: string): Set<string>;
 export declare function checkRustImports(content: string, file: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function loadCargoDeps(cwd: string): Set<string>;
 export declare function checkJavaKotlinImports(content: string, file: string, ext: string, cwd: string, projectFiles: Set<string>, hallucinated: HallucinatedImport[]): void;
 export declare function loadJavaDeps(cwd: string): Set<string>;
+/**
+ * Search for build.gradle/pom.xml by walking up from the Java/Kotlin file's directory.
+ * Monorepo support: a Java file in sdks/sandbox/java/ needs to find build.gradle there.
+ */
+export declare function loadJavaDepsForFile(file: string, cwd: string): Set<string>;
 export declare function loadPackageJson(cwd: string): Promise<any>;

package/dist/gates/hallucinated-imports-lang.js

@@ -8,18 +8,30 @@ import { isGoStdlib, isRubyStdlib, isDotNetFramework, isRustStdCrate, isJavaStdl
 export function checkGoImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
     let inImportBlock = false;
-    // Try to read go.mod for the module path
-    const goModPath = path.join(cwd, 'go.mod');
+    // Find go.mod by walking up from the Go file's directory (monorepo support).
+    // A monorepo may have go.mod in subdirectories like kubernetes/go.mod, server/go.mod, etc.
     let modulePath = null;
-    try {
-        if (fs.pathExistsSync(goModPath)) {
-            const goMod = fs.readFileSync(goModPath, 'utf-8');
-            const moduleMatch = goMod.match(/^module\s+(\S+)/m);
-            if (moduleMatch)
-                modulePath = moduleMatch[1];
+    const fileAbsDir = path.dirname(path.resolve(cwd, file));
+    const rootDir = path.resolve(cwd);
+    let searchDir = fileAbsDir;
+    while (searchDir.startsWith(rootDir) || searchDir === rootDir) {
+        const goModPath = path.join(searchDir, 'go.mod');
+        try {
+            if (fs.pathExistsSync(goModPath)) {
+                const goMod = fs.readFileSync(goModPath, 'utf-8');
+                const moduleMatch = goMod.match(/^module\s+(\S+)/m);
+                if (moduleMatch) {
+                    modulePath = moduleMatch[1];
+                    break;
+                }
+            }
         }
+        catch { /* skip */ }
+        const parent = path.dirname(searchDir);
+        if (parent === searchDir)
+            break;
+        searchDir = parent;
     }
-    catch { /* no go.mod — skip project-relative checks entirely */ }
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
         // Detect import block: import ( ... )
@@ -150,7 +162,8 @@ export function loadRubyGems(cwd) {
 }
 export function checkCSharpImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
-    const nugetPackages = loadNuGetPackages(cwd);
+    // Search for .csproj in file's directory and parent dirs (monorepo support)
+    const nugetPackages = loadNuGetPackagesForFile(file, cwd);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
         // Match: using Namespace; and using static Namespace.Class;
@@ -178,7 +191,7 @@ export function checkCSharpImports(content, file, cwd, projectFiles, hallucinate
         // Only flag if we have .csproj context (proves this is a real .NET project)
         if (!hasMatch && namespace.includes('.') && nugetPackages.size >= 0) {
             // Check if we actually have .csproj context (a real .NET project)
-            const hasCsproj = hasCsprojFile(cwd);
+            const hasCsproj = nugetPackages.size > 0 || hasCsprojFile(cwd);
             if (hasCsproj) {
                 hallucinated.push({
                     file, line: i + 1, importPath: namespace, type: 'csharp',
@@ -220,6 +233,26 @@ export function loadNuGetPackages(cwd) {
     catch { /* no .csproj */ }
     return packages;
 }
+/**
+ * Search for .csproj files by walking up from the C# file's directory.
+ * Monorepo support: a C# file in tests/csharp/MyProject/ needs to find .csproj
+ * in that directory, not just the project root.
+ */
+export function loadNuGetPackagesForFile(file, cwd) {
+    const allPackages = new Set();
+    const rootDir = path.resolve(cwd);
+    let searchDir = path.dirname(path.resolve(cwd, file));
+    while (searchDir.startsWith(rootDir) || searchDir === rootDir) {
+        const pkgs = loadNuGetPackages(searchDir);
+        for (const p of pkgs)
+            allPackages.add(p);
+        const parent = path.dirname(searchDir);
+        if (parent === searchDir)
+            break;
+        searchDir = parent;
+    }
+    return allPackages;
+}
 export function checkRustImports(content, file, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
     const cargoDeps = loadCargoDeps(cwd);
@@ -290,7 +323,8 @@ export function loadCargoDeps(cwd) {
 }
 export function checkJavaKotlinImports(content, file, ext, cwd, projectFiles, hallucinated) {
     const lines = content.split('\n');
-    const buildDeps = loadJavaDeps(cwd);
+    // Search for build.gradle/pom.xml by walking up from the file's directory (monorepo support)
+    const buildDeps = loadJavaDepsForFile(file, cwd);
     const isKotlin = ext === '.kt';
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i].trim();
@@ -362,6 +396,25 @@ export function loadJavaDeps(cwd) {
     catch { /* no build files */ }
     return deps;
 }
+/**
+ * Search for build.gradle/pom.xml by walking up from the Java/Kotlin file's directory.
+ * Monorepo support: a Java file in sdks/sandbox/java/ needs to find build.gradle there.
+ */
+export function loadJavaDepsForFile(file, cwd) {
+    const allDeps = new Set();
+    const rootDir = path.resolve(cwd);
+    let searchDir = path.dirname(path.resolve(cwd, file));
+    while (searchDir.startsWith(rootDir) || searchDir === rootDir) {
+        const deps = loadJavaDeps(searchDir);
+        for (const d of deps)
+            allDeps.add(d);
+        const parent = path.dirname(searchDir);
+        if (parent === searchDir)
+            break;
+        searchDir = parent;
+    }
+    return allDeps;
+}
 export async function loadPackageJson(cwd) {
     try {
         const pkgPath = path.join(cwd, 'package.json');

package/dist/gates/hallucinated-imports.d.ts

@@ -49,6 +49,16 @@ export declare class HallucinatedImportsGate extends Gate {
     private loadTsPathConfig;
     private readLooseJson;
     private checkPyImports;
+    /**
+     * Find Python source roots (directories that are on sys.path) by looking at
+     * pyproject.toml, setup.cfg, or common patterns like src/ layouts.
+     */
+    private findPythonSourceRoots;
+    /**
+     * Load installed Python package names from pyproject.toml dependencies,
+     * requirements.txt, setup.cfg, or Pipfile.
+     */
+    private loadPythonInstalledPackages;
     private resolveRelativeImport;
     private extractPackageName;
     private shouldIgnore;

package/dist/gates/hallucinated-imports.js

@@ -341,6 +341,9 @@ export class HallucinatedImportsGate extends Gate {
     }
     async checkPyImports(content, file, cwd, projectFiles, hallucinated) {
         const lines = content.split('\n');
+        // Lazily resolve Python source roots and installed packages for this project
+        const pySourceRoots = await this.findPythonSourceRoots(cwd, projectFiles);
+        const pyInstalledPkgs = await this.loadPythonInstalledPackages(cwd);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i].trim();
             // Match: from X import Y, import X
@@ -354,13 +357,35 @@ export class HallucinatedImportsGate extends Gate {
                 continue;
             // Check if it's a relative project import
             if (modulePath.startsWith('.')) {
-                // Relative Python import
-                const pyFile = modulePath.replace(/\./g, '/') + '.py';
-                const pyInit = modulePath.replace(/\./g, '/') + '/__init__.py';
-                const fileDir = path.dirname(file);
-                const resolved1 = path.join(fileDir, pyFile).replace(/\\/g, '/');
-                const resolved2 = path.join(fileDir, pyInit).replace(/\\/g, '/');
-                if (!projectFiles.has(resolved1) && !projectFiles.has(resolved2)) {
+                // Python relative import: count leading dots to determine traversal depth.
+                // N dots = go up (N-1) package levels from the file's directory.
+                //   from .types import X      → 1 dot = current package (0 levels up)
+                //   from ..types import X     → 2 dots = parent package (1 level up)
+                //   from ...client import X   → 3 dots = grandparent package (2 levels up)
+                const dotMatch = modulePath.match(/^(\.+)/);
+                const dotCount = dotMatch ? dotMatch[1].length : 0;
+                const moduleRest = modulePath.slice(dotCount); // e.g. 'client', 'types', 'models.permission', or '' for bare dots
+                // Walk up (dotCount - 1) directories from the file's directory
+                let baseDir = path.dirname(file);
+                for (let level = 1; level < dotCount; level++) {
+                    const parent = path.dirname(baseDir);
+                    if (parent === baseDir)
+                        break; // at root
+                    baseDir = parent;
+                }
+                // If moduleRest is empty (e.g. `from . import X`), we're just referencing the package directory.
+                // The imported names come from the `import` clause, not the module path — skip validation
+                // since bare-dot package references are almost never hallucinated.
+                if (!moduleRest)
+                    continue;
+                // Resolve remaining module path within the target directory
+                const moduleParts = moduleRest.replace(/\./g, '/');
+                const candidateBase = path.join(baseDir, moduleParts).replace(/\\/g, '/');
+                const candidates = [
+                    candidateBase + '.py',
+                    candidateBase + '/__init__.py',
+                ];
+                if (!candidates.some(c => projectFiles.has(c))) {
                     hallucinated.push({
                         file, line: i + 1, importPath: modulePath, type: 'python',
                         reason: `Relative module '${modulePath}' not found in project`,
@@ -368,33 +393,193 @@ export class HallucinatedImportsGate extends Gate {
                 }
             }
             else {
-                // Absolute import — check if it's a project module
+                // Absolute import — check if it's a project module or installed package
                 const topLevel = modulePath.split('.')[0];
-                const pyFile = topLevel + '.py';
-                const pyInit = topLevel + '/__init__.py';
-                // If it matches a project file, it's a local import — verify it exists
-                const isLocalModule = projectFiles.has(pyFile) || projectFiles.has(pyInit) ||
-                    [...projectFiles].some(f => f.startsWith(topLevel + '/'));
-                // If not local and not stdlib, we can't easily verify pip packages
-                // without a requirements.txt or pyproject.toml check
-                if (isLocalModule) {
+                // Check if this is an installed package (from pyproject.toml, requirements.txt, etc.)
+                if (pyInstalledPkgs.has(topLevel) || pyInstalledPkgs.has(topLevel.replace(/_/g, '-'))) {
+                    continue; // Known installed package — skip
+                }
+                // Check if it's a local module (searching across all Python source roots)
+                let foundLocal = false;
+                const searchRoots = ['', ...pySourceRoots]; // '' = project root
+                for (const root of searchRoots) {
+                    const prefix = root ? root + '/' : '';
+                    const pyFile = prefix + topLevel + '.py';
+                    const pyInit = prefix + topLevel + '/__init__.py';
+                    const dirPrefix = prefix + topLevel + '/';
+                    const isLocalModule = projectFiles.has(pyFile) || projectFiles.has(pyInit) ||
+                        [...projectFiles].some(f => f.startsWith(dirPrefix));
+                    if (!isLocalModule)
+                        continue;
+                    foundLocal = true;
                     // It's referencing a local module — verify the full path
-                    const fullModulePath = modulePath.replace(/\./g, '/');
+                    const fullModulePath = prefix + modulePath.replace(/\./g, '/');
                     const candidates = [
                         fullModulePath + '.py',
                         fullModulePath + '/__init__.py',
                     ];
                     const exists = candidates.some(c => projectFiles.has(c));
-                    if (!exists && modulePath.includes('.')) {
+                    if (exists)
+                        break; // Found it — no issue
+                    if (modulePath.includes('.')) {
                         // Only flag deep module paths that partially resolve
                         hallucinated.push({
                             file, line: i + 1, importPath: modulePath, type: 'python',
                             reason: `Module '${modulePath}' partially resolves but target not found`,
                         });
                     }
+                    break;
+                }
+                // If not local and not stdlib and not installed, we can't easily verify
+                // — skip silently rather than risk false positives
+            }
+        }
+    }
+    /**
+     * Find Python source roots (directories that are on sys.path) by looking at
+     * pyproject.toml, setup.cfg, or common patterns like src/ layouts.
+     */
+    async findPythonSourceRoots(cwd, projectFiles) {
+        const roots = [];
+        // Check pyproject.toml for package-dir or src layout hints
+        const pyprojectPath = path.join(cwd, 'pyproject.toml');
+        if (await fs.pathExists(pyprojectPath)) {
+            try {
+                const content = await fs.readFile(pyprojectPath, 'utf-8');
+                // Match [tool.setuptools.packages.find] where = ["src"] or similar
+                const whereMatch = content.match(/where\s*=\s*\[\s*"([^"]+)"\s*\]/);
+                if (whereMatch) {
+                    roots.push(whereMatch[1]);
+                }
+                // Match package-dir patterns
+                const pkgDirMatch = content.match(/package-dir\s*=\s*\{\s*""\s*:\s*"([^"]+)"\s*\}/);
+                if (pkgDirMatch) {
+                    roots.push(pkgDirMatch[1]);
+                }
+            }
+            catch { /* skip */ }
+        }
+        // Common source root patterns
+        const commonSrcDirs = ['src', 'lib', 'app'];
+        for (const dir of commonSrcDirs) {
+            if ([...projectFiles].some(f => f.startsWith(dir + '/') && f.endsWith('.py'))) {
+                if (!roots.includes(dir)) {
+                    roots.push(dir);
+                }
+            }
+        }
+        // Also scan for directories containing __init__.py that aren't at root level
+        // (e.g. sdks/sandbox/python/src/ as a source root)
+        const pyprojectFiles = [...projectFiles].filter(f => f.endsWith('/pyproject.toml') || f === 'pyproject.toml');
+        for (const pf of pyprojectFiles) {
+            const pfDir = path.dirname(pf);
+            if (pfDir === '.')
+                continue;
+            // Check if this pyproject.toml has a src/ dir
+            const srcDir = pfDir + '/src';
+            if ([...projectFiles].some(f => f.startsWith(srcDir + '/') && f.endsWith('.py'))) {
+                if (!roots.includes(srcDir)) {
+                    roots.push(srcDir);
+                }
+            }
+        }
+        return roots;
+    }
+    /**
+     * Load installed Python package names from pyproject.toml dependencies,
+     * requirements.txt, setup.cfg, or Pipfile.
+     */
+    async loadPythonInstalledPackages(cwd) {
+        const packages = new Set();
+        // Helper to normalize package names (PEP 503: lowercase, replace [-_.] with -)
+        const normalize = (name) => name.toLowerCase().replace(/[-_.]+/g, '-');
+        // Check pyproject.toml
+        const pyprojectPath = path.join(cwd, 'pyproject.toml');
+        if (await fs.pathExists(pyprojectPath)) {
+            try {
+                const content = await fs.readFile(pyprojectPath, 'utf-8');
+                // Match dependencies = ["fastapi>=0.100", "kubernetes", ...]
+                const depsMatch = content.match(/dependencies\s*=\s*\[([\s\S]*?)\]/g);
+                if (depsMatch) {
+                    for (const block of depsMatch) {
+                        const pkgs = block.match(/"([^">=<!\s\[]+)/g);
+                        if (pkgs) {
+                            for (const pkg of pkgs) {
+                                const name = pkg.replace(/^"/, '').split(/[>=<!\[]/)[0].trim();
+                                if (name && name !== 'dependencies') {
+                                    packages.add(normalize(name));
+                                    // Also add the import name (replace - with _)
+                                    packages.add(name.replace(/-/g, '_').toLowerCase());
+                                }
+                            }
+                        }
+                    }
+                }
+                // optional-dependencies
+                const optDepsMatch = content.match(/optional-dependencies\s*\]([\s\S]*?)(?:\n\[|\n$)/);
+                if (optDepsMatch) {
+                    const pkgs = optDepsMatch[1].match(/"([^">=<!\s\[]+)/g);
+                    if (pkgs) {
+                        for (const pkg of pkgs) {
+                            const name = pkg.replace(/^"/, '').split(/[>=<!\[]/)[0].trim();
+                            if (name) {
+                                packages.add(normalize(name));
+                                packages.add(name.replace(/-/g, '_').toLowerCase());
+                            }
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // Check requirements*.txt files
+        const reqFiles = ['requirements.txt', 'requirements-dev.txt', 'requirements_dev.txt'];
+        for (const reqFile of reqFiles) {
+            const reqPath = path.join(cwd, reqFile);
+            if (await fs.pathExists(reqPath)) {
+                try {
+                    const content = await fs.readFile(reqPath, 'utf-8');
+                    for (const line of content.split('\n')) {
+                        const trimmed = line.trim();
+                        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('-'))
+                            continue;
+                        const name = trimmed.split(/[>=<!\[;@\s]/)[0].trim();
+                        if (name) {
+                            packages.add(normalize(name));
+                            packages.add(name.replace(/-/g, '_').toLowerCase());
+                        }
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        // Also scan subdirectories for pyproject.toml (monorepo support)
+        const subPyprojects = ['server/pyproject.toml', 'api/pyproject.toml', 'backend/pyproject.toml'];
+        for (const sub of subPyprojects) {
+            const subPath = path.join(cwd, sub);
+            if (await fs.pathExists(subPath)) {
+                try {
+                    const content = await fs.readFile(subPath, 'utf-8');
+                    const depsMatch = content.match(/dependencies\s*=\s*\[([\s\S]*?)\]/g);
+                    if (depsMatch) {
+                        for (const block of depsMatch) {
+                            const pkgs = block.match(/"([^">=<!\s\[]+)/g);
+                            if (pkgs) {
+                                for (const pkg of pkgs) {
+                                    const name = pkg.replace(/^"/, '').split(/[>=<!\[]/)[0].trim();
+                                    if (name && name !== 'dependencies') {
+                                        packages.add(normalize(name));
+                                        packages.add(name.replace(/-/g, '_').toLowerCase());
+                                    }
+                                }
+                            }
+                        }
+                    }
                 }
+                catch { /* skip */ }
             }
         }
+        return packages;
     }
     resolveRelativeImport(fromFile, importPath, projectFiles) {
         const dir = path.dirname(fromFile);

package/dist/gates/phantom-apis.d.ts

@@ -43,6 +43,13 @@ export declare class PhantomApisGate extends Gate {
     protected get provenance(): Provenance;
     run(context: GateContext): Promise<Failure[]>;
     private shouldSkipFile;
+    /**
+     * Strip string literal contents from a line to prevent matching code-in-strings.
+     * Replaces the content inside quotes with spaces, preserving the quotes themselves.
+     * This prevents false positives when e.g. a Java test passes Python code as a string
+     * to a code interpreter sandbox.
+     */
+    private stripStringLiterals;
     /**
      * Node.js stdlib method verification.
      * For each known module, we maintain the actual exported methods.
@@ -71,9 +78,19 @@ export declare class PhantomApisGate extends Gate {
      */
     private checkCSharpPhantomApis;
     /**
-     * Java/Kotlin phantom API detection — pattern-based.
+     * Java phantom API detection — pattern-based.
      * AI hallucinates Python/JS-style APIs on JDK classes.
+     * Strips string literal contents to avoid matching code-in-strings
+     * (e.g. Java test passing Python code `print('hello')` to a sandbox).
      */
     private checkJavaPhantomApis;
+    /**
+     * Kotlin phantom API detection — uses a SUBSET of Java rules.
+     * Kotlin has different syntax than Java, so rules must be filtered:
+     *   - print() IS valid Kotlin (kotlin.io.print)
+     *   - var x: Type = IS valid Kotlin syntax
+     *   - Most other Java patterns (includes, slice, arrow syntax) still apply
+     */
+    private checkKotlinPhantomApis;
     private escapeRegex;
 }