thuban 0.3.1 → 0.3.3

package/packages/scanner/ghost-code-detector.js

@@ -65,12 +65,16 @@ class GhostCodeDetector {
         continue;
       }
 
+      // Strip comments and strings before counting references to avoid false negatives
+      // from functions that appear only in commented-out code
+      const strippedContent = this._stripCommentsAndStrings(content);
+
       for (const fn of functions) {
         if (fn.name.length < 3) continue; // Skip very short names (likely false positives)
 
         // Count how many times this function name appears (excluding its definition)
         const regex = new RegExp(`\\b${this._escapeRegex(fn.name)}\\b`, 'g');
-        const matches = content.match(regex);
+        const matches = strippedContent.match(regex);
         if (matches) {
           const relPath = path.relative(this.rootPath, file);
           // Subtract 1 if this is the file where it's defined (the definition itself)
@@ -119,7 +123,7 @@ class GhostCodeDetector {
   _extractFunction(line, lineIndex, lines) {
     const trimmed = line.trim();
 
-    // function name(
+    // JavaScript/TypeScript: function name(
     let match = trimmed.match(/^(?:async\s+)?function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\(/);
     if (match) {
       return {
@@ -130,7 +134,7 @@ class GhostCodeDetector {
       };
     }
 
-    // const name = (async) function
+    // JavaScript/TypeScript: const name = (async) function
     match = trimmed.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:async\s+)?function/);
     if (match) {
       return {
@@ -141,7 +145,7 @@ class GhostCodeDetector {
       };
     }
 
-    // const name = (...) =>
+    // JavaScript/TypeScript: const name = (...) =>
     match = trimmed.match(/^(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:async\s+)?\(?/);
     if (match && (trimmed.includes('=>') || (lineIndex + 1 < lines.length && lines[lineIndex + 1].includes('=>')))) {
       return {
@@ -152,7 +156,51 @@ class GhostCodeDetector {
       };
     }
 
-    // class method: name(
+    // Kotlin: fun functionName(
+    match = trimmed.match(/^(?:private\s+|public\s+|internal\s+|protected\s+)?(?:suspend\s+)?fun\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(<]/);
+    if (match) {
+      return {
+        name: match[1],
+        type: 'kotlin-fun',
+        isExport: !trimmed.startsWith('private'),
+        isLifecycle: this._isLifecycle(match[1]),
+      };
+    }
+
+    // Rust: fn function_name(
+    match = trimmed.match(/^(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?fn\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*[(<]/);
+    if (match) {
+      return {
+        name: match[1],
+        type: 'rust-fn',
+        isExport: /^pub/.test(trimmed),
+        isLifecycle: this._isLifecycle(match[1]),
+      };
+    }
+
+    // PHP: function functionName( or public/private/protected function functionName(
+    match = trimmed.match(/^(?:(?:public|private|protected|static)\s+)*function\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/);
+    if (match) {
+      return {
+        name: match[1],
+        type: 'php-function',
+        isExport: !/private/.test(trimmed),
+        isLifecycle: this._isLifecycle(match[1]),
+      };
+    }
+
+    // Ruby: def method_name or def self.method_name
+    match = trimmed.match(/^def\s+(?:self\.)?([a-zA-Z_][a-zA-Z0-9_?!]*)\s*[(\s]?/);
+    if (match) {
+      return {
+        name: match[1],
+        type: 'ruby-def',
+        isExport: !match[1].startsWith('_'),
+        isLifecycle: this._isLifecycle(match[1]),
+      };
+    }
+
+    // Class method: name(
     match = trimmed.match(/^(?:async\s+)?([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)\s*{/);
     if (match && !['if', 'for', 'while', 'switch', 'catch', 'constructor', 'render', 'toString'].includes(match[1])) {
       return {
@@ -177,6 +225,7 @@ class GhostCodeDetector {
 
   _isLifecycle(name) {
     const lifecycle = [
+      // JS/TS lifecycle
       'constructor', 'render', 'componentDidMount', 'componentWillUnmount',
       'componentDidUpdate', 'shouldComponentUpdate', 'getSnapshotBeforeUpdate',
       'getDerivedStateFromProps', 'useEffect', 'useState', 'useMemo',
@@ -184,6 +233,15 @@ class GhostCodeDetector {
       'setup', 'teardown', 'beforeEach', 'afterEach', 'beforeAll', 'afterAll',
       'init', 'destroy', 'configure', 'bootstrap', 'main',
       'get', 'set', 'post', 'put', 'delete', 'patch', 'handle',
+      // Kotlin/Java lifecycle
+      'onCreate', 'onStart', 'onResume', 'onPause', 'onStop', 'onDestroy',
+      'onCreateView', 'onViewCreated', 'onDestroyView', 'hashCode', 'equals',
+      // Rust lifecycle / trait methods
+      'new', 'default', 'drop', 'fmt', 'from', 'into', 'clone', 'copy',
+      // Ruby lifecycle
+      'initialize', 'to_s', 'to_str', 'inspect', 'freeze', 'dup',
+      // PHP lifecycle
+      '__construct', '__destruct', '__toString', '__get', '__set', '__call',
     ];
     return lifecycle.includes(name) || name.startsWith('_') || name.startsWith('on');
   }
@@ -221,6 +279,23 @@ class GhostCodeDetector {
   _escapeRegex(str) {
     return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   }
+
+  _stripCommentsAndStrings(content) {
+    // Replace string literals with placeholder (preserve length approximately)
+    let result = content
+      // Template literals
+      .replace(/`[^`\\]*(?:\\[\s\S][^`\\]*)*`/g, '""')
+      // Double-quoted strings
+      .replace(/"[^"\\\n]*(?:\\.[^"\\\n]*)*"/g, '""')
+      // Single-quoted strings
+      .replace(/'[^'\\\n]*(?:\\.[^'\\\n]*)*'/g, "''")
+      // Block comments (JS/Java/Go/Rust/PHP/Kotlin)
+      .replace(/\/\*[\s\S]*?\*\//g, ' ')
+      // Line comments: //, #
+      .replace(/\/\/[^\n]*/g, ' ')
+      .replace(/#[^\n]*/g, ' ');
+    return result;
+  }
 }
 
 module.exports = GhostCodeDetector;

package/packages/scanner/hallucination-detector.js

@@ -73,9 +73,9 @@ class HallucinationDetector {
     this.pythonPhantomAPIs = [
       { pattern: /os\.path\.exists_sync\s*\(/, suggestion: 'Use os.path.exists() — exists_sync does not exist in Python', name: 'os.path.exists_sync', id: 'PY_HALL001' },
       { pattern: /json\.tryParse\s*\(/, suggestion: 'Use json.loads() with try/except', name: 'json.tryParse', id: 'PY_HALL002' },
-      { pattern: /list\.flatMap\s*\(/, suggestion: 'Python lists have no flatMap — use list comprehension', name: 'list.flatMap', id: 'PY_HALL003' },
-      { pattern: /dict\.merge\s*\(/, suggestion: 'Use {**dict1, **dict2} or dict1 | dict2 (3.9+)', name: 'dict.merge', id: 'PY_HALL004' },
-      { pattern: /string\.format_map\s*\((?!.*\bself\b)/, suggestion: 'str.format_map exists but is rarely correct — did you mean .format()?', name: 'string.format_map misuse', id: 'PY_HALL005' },
+      { pattern: /\w+\.flatMap\s*\(/, suggestion: 'Python lists have no flatMap — use list comprehension or itertools.chain.from_iterable()', name: 'list.flatMap', id: 'PY_HALL003' },
+      { pattern: /\w+\.merge\s*\((?!.*\bself\b)/, suggestion: 'Use {**dict1, **dict2} or dict1 | dict2 (3.9+)', name: 'dict.merge', id: 'PY_HALL004' },
+      { pattern: /\w+\.format_map\s*\(/, suggestion: 'str.format_map exists but is rarely correct — did you mean .format()?', name: 'string.format_map misuse', id: 'PY_HALL005' },
       { pattern: /from\s+collections\s+import\s+OrderedDict.*#.*maintain\s+order/i, suggestion: 'Regular dict maintains order since Python 3.7 — OrderedDict is unnecessary', name: 'Unnecessary OrderedDict', id: 'PY_HALL006' },
       { pattern: /async\s+def\s+\w+.*asyncio\.sleep\s*\(\s*0\s*\)\s*#.*yield/i, suggestion: 'asyncio.sleep(0) to yield is a code smell — review async design', name: 'asyncio.sleep(0) hack', id: 'PY_HALL007' },
       { pattern: /import\s+tensorflow\.v2/, suggestion: 'tensorflow.v2 is not a real module — use import tensorflow', name: 'tensorflow.v2', id: 'PY_HALL008' },
@@ -104,13 +104,13 @@ class HallucinationDetector {
       { pattern: /import\s+\*/, id: 'PY_SMELL007', name: 'Wildcard Import', message: 'Wildcard import — pollutes namespace, hides dependencies' },
     ];
 
-    // ─── Go phantom APIs ────────────────────────────────────
-    this.goPhantomAPIs = [
-      { pattern: /ioutil\.ReadFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.ReadFile()', name: 'ioutil.ReadFile', id: 'GO_HALL001' },
-      { pattern: /ioutil\.WriteFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.WriteFile()', name: 'ioutil.WriteFile', id: 'GO_HALL002' },
-      { pattern: /ioutil\.TempDir\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.MkdirTemp()', name: 'ioutil.TempDir', id: 'GO_HALL003' },
-      { pattern: /ioutil\.ReadAll\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use io.ReadAll()', name: 'ioutil.ReadAll', id: 'GO_HALL004' },
-      { pattern: /strings\.Title\s*\(/, suggestion: 'strings.Title deprecated in Go 1.18 — use cases.Title from golang.org/x/text', name: 'strings.Title', id: 'GO_HALL005' },
+    // ─── Go deprecated APIs (formerly labelled phantom — they exist but are removed) ─
+    this.goDeprecated = [
+      { pattern: /ioutil\.ReadFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.ReadFile()', since: 'Go 1.16', name: 'ioutil.ReadFile', id: 'GO_DEPR001' },
+      { pattern: /ioutil\.WriteFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.WriteFile()', since: 'Go 1.16', name: 'ioutil.WriteFile', id: 'GO_DEPR002' },
+      { pattern: /ioutil\.TempDir\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.MkdirTemp()', since: 'Go 1.16', name: 'ioutil.TempDir', id: 'GO_DEPR003' },
+      { pattern: /ioutil\.ReadAll\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use io.ReadAll()', since: 'Go 1.16', name: 'ioutil.ReadAll', id: 'GO_DEPR004' },
+      { pattern: /strings\.Title\s*\(/, suggestion: 'strings.Title deprecated in Go 1.18 — use cases.Title from golang.org/x/text', since: 'Go 1.18', name: 'strings.Title', id: 'GO_DEPR005' },
     ];
 
     this.goSmells = [
@@ -120,15 +120,42 @@ class HallucinationDetector {
     ];
 
     // ─── Rust phantom APIs ──────────────────────────────────
+    this.rustPhantomAPIs = [
+      { pattern: /std::fs::File::open_async\s*\(/, suggestion: 'Use tokio::fs::File::open() for async file I/O', name: 'File::open_async', id: 'RS_HALL001' },
+      { pattern: /Vec::flatten\s*\(/, suggestion: 'Use .into_iter().flatten() — Vec has no flatten() method', name: 'Vec::flatten', id: 'RS_HALL002' },
+      { pattern: /HashMap::get_or_default\s*\(/, suggestion: 'Use .get().unwrap_or(&default) or entry().or_insert()', name: 'HashMap::get_or_default', id: 'RS_HALL003' },
+      { pattern: /String::from_utf8_lossy_owned\s*\(/, suggestion: 'Use String::from_utf8_lossy().into_owned()', name: 'String::from_utf8_lossy_owned', id: 'RS_HALL004' },
+      { pattern: /\.async_iter\s*\(/, suggestion: 'Use futures::stream::iter() from the futures crate', name: '.async_iter()', id: 'RS_HALL005' },
+      { pattern: /std::net::TcpStream::connect_async\s*\(/, suggestion: 'Use tokio::net::TcpStream::connect()', name: 'TcpStream::connect_async', id: 'RS_HALL006' },
+      { pattern: /std::thread::sleep_async\s*\(/, suggestion: 'Use tokio::time::sleep() for async sleep', name: 'thread::sleep_async', id: 'RS_HALL007' },
+      { pattern: /Vec::remove_all\s*\(/, suggestion: 'Use .retain(|x| condition) or .clear()', name: 'Vec::remove_all', id: 'RS_HALL008' },
+      { pattern: /str::split_whitespace_n\s*\(/, suggestion: 'Use .splitn(n, char::is_whitespace) instead', name: 'str::split_whitespace_n', id: 'RS_HALL009' },
+      { pattern: /\.map_async\s*\(/, suggestion: 'Use futures::future::join_all() or tokio::task::spawn', name: '.map_async()', id: 'RS_HALL010' },
+    ];
+
+    this.rustDeprecated = [
+      { pattern: /std::sync::ONCE_INIT/, suggestion: 'std::sync::ONCE_INIT removed — use Once::new()', since: 'Rust 1.38', name: 'ONCE_INIT', id: 'RS_DEPR001' },
+      { pattern: /\bstd::mem::uninitialized\s*\(/, suggestion: 'std::mem::uninitialized() removed — use MaybeUninit::uninit()', since: 'Rust 1.39', name: 'mem::uninitialized', id: 'RS_DEPR002' },
+      { pattern: /\btry!\s*\(/, suggestion: 'try!() macro removed — use the ? operator', since: 'Rust 2018', name: 'try!() macro', id: 'RS_DEPR003' },
+      { pattern: /extern\s+crate\s+std\s*;/, suggestion: 'extern crate std is implicit since Rust 2018 edition', since: 'Rust 2018', name: 'extern crate std', id: 'RS_DEPR004' },
+      { pattern: /extern\s+crate\s+alloc\s*;/, suggestion: 'extern crate alloc is implicit in 2018+ edition', since: 'Rust 2018', name: 'extern crate alloc', id: 'RS_DEPR005' },
+      { pattern: /std::error::Error::cause\s*\(/, suggestion: '.cause() deprecated — use .source() instead', since: 'Rust 1.33', name: 'Error::cause()', id: 'RS_DEPR006' },
+    ];
+
     this.rustSmells = [
       { pattern: /todo!\s*\(\s*\)/, id: 'RS_SMELL001', name: 'todo! macro', message: 'todo!() macro — will panic at runtime' },
       { pattern: /unimplemented!\s*\(\s*\)/, id: 'RS_SMELL002', name: 'unimplemented! macro', message: 'unimplemented!() macro — will panic at runtime' },
       { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'RS_SMELL003', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
       { pattern: /unwrap\(\).*unwrap\(\)/, id: 'RS_SMELL004', name: 'Double Unwrap', message: 'Chained unwrap() — will panic on None/Err' },
       { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'RS_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+      { pattern: /unsafe\s*\{/, id: 'RS_SMELL006', name: 'Unsafe Block', message: 'unsafe block — verify memory safety guarantees' },
+      { pattern: /\.unwrap\(\)\s*;/, id: 'RS_SMELL007', name: 'Bare unwrap()', message: '.unwrap() will panic on None/Err — use ? or match' },
+      { pattern: /println!\s*\(\s*["'].*[Dd]ebug/, id: 'RS_SMELL008', name: 'Debug println!', message: 'Debug println! left in code — use the log crate' },
+      { pattern: /eprintln!\s*\(\s*["'].*[Dd]ebug/, id: 'RS_SMELL009', name: 'Debug eprintln!', message: 'Debug eprintln! left in code — use the log crate' },
+      { pattern: /#\[allow\(dead_code\)\]/, id: 'RS_SMELL010', name: 'Suppressed Dead Code', message: '#[allow(dead_code)] suppresses warnings — remove unused code' },
     ];
 
-    // ─── Java/C# common issues ──────────────────────────────
+    // ─── Java smells ─────────────────────────────────────────
     this.javaSmells = [
       { pattern: /System\.out\.println\s*\(.*debug/i, id: 'JAVA_SMELL001', name: 'Debug Println', message: 'Debug System.out.println — use a logger' },
       { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'JAVA_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
@@ -137,12 +164,132 @@ class HallucinationDetector {
       { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'JAVA_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
     ];
 
+    // ─── C# smells (separate from Java) ─────────────────────
+    this.csharpSmells = [
+      { pattern: /Console\.WriteLine\s*\(.*[Dd]ebug/i, id: 'CS_SMELL001', name: 'Debug WriteLine', message: 'Debug Console.WriteLine — use ILogger or Debug.Write' },
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'CS_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /throw\s+new\s+(?:NotImplementedException)\s*\(/, id: 'CS_SMELL003', name: 'Not Implemented', message: 'Stub implementation — will throw at runtime' },
+      { pattern: /catch\s*\(\s*Exception\s+\w+\s*\)\s*\{\s*\}/, id: 'CS_SMELL004', name: 'Empty Catch', message: 'Empty catch block — swallows all exceptions' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'CS_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+    ];
+
+    // ─── Kotlin phantom APIs ──────────────────────────────────
+    this.kotlinPhantomAPIs = [
+      { pattern: /\.flatMap\s*\{[^}]*\}(?!.*asSequence)/, suggestion: 'Use .flatMap { } — verify this is not confusing sequence vs list behavior', name: 'flatMap confusion', id: 'KT_HALL001' },
+      { pattern: /listOf\(\)\.stream\s*\(/, suggestion: 'Kotlin lists have no .stream() — use .asSequence() or direct collection ops', name: 'listOf().stream()', id: 'KT_HALL002' },
+      { pattern: /String\.format\s*\(/, suggestion: 'Prefer Kotlin string templates "$variable" over String.format()', name: 'String.format Java-style', id: 'KT_HALL003' },
+      { pattern: /\bObject\s*\(\s*\)/, suggestion: 'Kotlin uses Any() not Object() — or use object keyword for singletons', name: 'Object() Java-style', id: 'KT_HALL004' },
+      { pattern: /\.forEach\s*\(\s*::println\s*\)(?!.*debug)/i, suggestion: 'println is for debug output — use a logger', name: 'println via forEach', id: 'KT_HALL005' },
+      { pattern: /coroutineScope\s*\{\s*launch\s*\{[^}]*\}\s*\}(?!\s*\.join)/, suggestion: 'Unjoined coroutine in coroutineScope may cause issues — ensure structured concurrency', name: 'Unawaited launch', id: 'KT_HALL006' },
+      { pattern: /Dispatchers\.IO\s*\+\s*Dispatchers/, suggestion: 'Combining Dispatchers is not valid — use one dispatcher at a time', name: 'Combined Dispatchers', id: 'KT_HALL007' },
+      { pattern: /\.toList\(\)\.stream\(\)/, suggestion: 'Use Kotlin sequences (.asSequence()) instead of .toList().stream()', name: 'toList().stream()', id: 'KT_HALL008' },
+      { pattern: /companion object.*getInstance/i, suggestion: 'Kotlin idiom for singletons is object keyword, not companion object + getInstance()', name: 'Java-style singleton', id: 'KT_HALL009' },
+      { pattern: /lateinit var.*\?/, suggestion: 'lateinit properties cannot be nullable — remove ? or use by lazy {}', name: 'lateinit nullable', id: 'KT_HALL010' },
+    ];
+
+    this.kotlinDeprecated = [
+      { pattern: /\bapply\s+plugin:\s*['"]kotlin-android-extensions['"]/, suggestion: 'kotlin-android-extensions deprecated — use view binding or Jetpack ViewBinding', since: 'Kotlin 1.8', name: 'kotlin-android-extensions', id: 'KT_DEPR001' },
+      { pattern: /\bkotlinx\.android\.synthetic/, suggestion: 'Synthetic imports deprecated — use view binding or findViewById', since: 'Kotlin 1.8', name: 'Synthetic imports', id: 'KT_DEPR002' },
+      { pattern: /\bCoroutineScope\(EmptyCoroutineContext\)/, suggestion: 'EmptyCoroutineContext coroutine scope is error-prone — use viewModelScope or lifecycleScope', since: 'Kotlin Coroutines 1.6', name: 'EmptyCoroutineContext scope', id: 'KT_DEPR003' },
+      { pattern: /\bBuildersKt\.launch\b/, suggestion: 'Internal BuildersKt APIs are deprecated — use coroutineScope { launch {} }', since: 'Kotlin Coroutines 1.5', name: 'BuildersKt.launch', id: 'KT_DEPR004' },
+      { pattern: /\basyncLazy\s*\{/, suggestion: 'asyncLazy {} is not a standard Kotlin API — use lazy {} or async {}', since: 'Kotlin 1.6', name: 'asyncLazy', id: 'KT_DEPR005' },
+    ];
+
+    this.kotlinSmells = [
+      { pattern: /\bprintln\s*\(/, id: 'KT_SMELL001', name: 'Debug println', message: 'println() is for debug output — use a proper logger' },
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'KT_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /TODO\s*\(\s*\)/, id: 'KT_SMELL003', name: 'TODO() stub', message: 'TODO() will throw NotImplementedError at runtime' },
+      { pattern: /!!\s*\./, id: 'KT_SMELL004', name: 'Non-null assertion chain', message: '!! non-null assertion — will throw NullPointerException if null' },
+      { pattern: /\bas\s+\w+\b(?!.*\?)/, suggestion: 'Unsafe cast — prefer safe cast (as? Type) with null check', id: 'KT_SMELL005', name: 'Unsafe cast', message: 'Unsafe cast with as — will throw ClassCastException if wrong type' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'KT_SMELL006', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+      { pattern: /catch\s*\(\s*e:\s*Exception\s*\)\s*\{\s*\}/, id: 'KT_SMELL007', name: 'Empty Catch', message: 'Empty catch block — swallows all exceptions' },
+      { pattern: /throw\s+NotImplementedError\s*\(/, id: 'KT_SMELL008', name: 'Not Implemented', message: 'Stub implementation — will throw at runtime' },
+    ];
+
+    // ─── PHP phantom APIs ─────────────────────────────────────
+    this.phpPhantomAPIs = [
+      { pattern: /array_flatten\s*\(/, suggestion: 'PHP has no array_flatten() — use array_merge(...$array) or a recursive function', name: 'array_flatten', id: 'PHP_HALL001' },
+      { pattern: /str_contains_all\s*\(/, suggestion: 'PHP has no str_contains_all() — use multiple str_contains() calls', name: 'str_contains_all', id: 'PHP_HALL002' },
+      { pattern: /array_unique_values\s*\(/, suggestion: 'PHP has no array_unique_values() — use array_values(array_unique())', name: 'array_unique_values', id: 'PHP_HALL003' },
+      { pattern: /\$pdo->fetchAll\s*\(/, suggestion: 'fetchAll() is on PDOStatement not PDO — call $stmt->fetchAll()', name: 'PDO::fetchAll', id: 'PHP_HALL004' },
+      { pattern: /json_decode_safe\s*\(/, suggestion: 'PHP has no json_decode_safe() — wrap json_decode() with json_last_error() check', name: 'json_decode_safe', id: 'PHP_HALL005' },
+      { pattern: /str_replace_all\s*\(/, suggestion: 'PHP has no str_replace_all() — use str_replace() which already replaces all occurrences', name: 'str_replace_all', id: 'PHP_HALL006' },
+      { pattern: /array_map_keys\s*\(/, suggestion: 'PHP has no array_map_keys() — use array_combine(array_map(...), array_keys())', name: 'array_map_keys', id: 'PHP_HALL007' },
+      { pattern: /\$request->getJson\s*\(/, suggestion: 'Not a standard PHP function — use json_decode(file_get_contents("php://input"))', name: '$request->getJson', id: 'PHP_HALL008' },
+      { pattern: /Date::now\s*\(/, suggestion: 'PHP has no Date::now() — use new DateTime() or time()', name: 'Date::now', id: 'PHP_HALL009' },
+      { pattern: /\bawait\s+/, suggestion: 'PHP has no await keyword — use synchronous code or ReactPHP for async', name: 'await keyword', id: 'PHP_HALL010' },
+    ];
+
+    this.phpDeprecated = [
+      { pattern: /\bmysql_connect\s*\(/, suggestion: 'mysql_* functions removed in PHP 7 — use PDO or MySQLi', since: 'PHP 7.0', name: 'mysql_connect', id: 'PHP_DEPR001' },
+      { pattern: /\bmysql_query\s*\(/, suggestion: 'mysql_* functions removed in PHP 7 — use PDO or MySQLi', since: 'PHP 7.0', name: 'mysql_query', id: 'PHP_DEPR002' },
+      { pattern: /\bmysql_fetch_array\s*\(/, suggestion: 'mysql_* functions removed in PHP 7 — use PDO or MySQLi', since: 'PHP 7.0', name: 'mysql_fetch_array', id: 'PHP_DEPR003' },
+      { pattern: /\bereg\s*\(/, suggestion: 'ereg() removed in PHP 7 — use preg_match()', since: 'PHP 7.0', name: 'ereg()', id: 'PHP_DEPR004' },
+      { pattern: /\bsplit\s*\(/, suggestion: 'split() removed in PHP 7 — use preg_split() or explode()', since: 'PHP 7.0', name: 'split()', id: 'PHP_DEPR005' },
+      { pattern: /\bcreate_function\s*\(/, suggestion: 'create_function() removed in PHP 8 — use anonymous functions (closures)', since: 'PHP 8.0', name: 'create_function', id: 'PHP_DEPR006' },
+      { pattern: /\bmagic_quotes_gpc\b/, suggestion: 'magic_quotes_gpc removed in PHP 7 — sanitize inputs manually', since: 'PHP 7.0', name: 'magic_quotes_gpc', id: 'PHP_DEPR007' },
+      { pattern: /\beach\s*\(/, suggestion: 'each() deprecated in PHP 7.2, removed in PHP 8 — use foreach', since: 'PHP 8.0', name: 'each()', id: 'PHP_DEPR008' },
+      { pattern: /\bmcrypt_/, suggestion: 'mcrypt removed in PHP 7.2 — use OpenSSL functions', since: 'PHP 7.2', name: 'mcrypt functions', id: 'PHP_DEPR009' },
+    ];
+
+    this.phpSmells = [
+      { pattern: /\beval\s*\(/, id: 'PHP_SMELL001', name: 'eval() Usage', message: 'eval() is dangerous — code injection risk' },
+      { pattern: /\bextract\s*\(\s*\$_(?:GET|POST|REQUEST)/, id: 'PHP_SMELL002', name: 'extract() from superglobal', message: 'extract($_GET/_POST) — variable injection vulnerability' },
+      { pattern: /\$\$\w+/, id: 'PHP_SMELL003', name: 'Variable variable', message: 'Variable variables ($$var) — hard to trace and injection risk' },
+      { pattern: /\bshell_exec\s*\(/, id: 'PHP_SMELL004', name: 'shell_exec()', message: 'shell_exec() — remote code execution risk if input unsanitized' },
+      { pattern: /\bsystem\s*\(/, id: 'PHP_SMELL005', name: 'system()', message: 'system() — remote code execution risk if input unsanitized' },
+      { pattern: /\bpassthru\s*\(/, id: 'PHP_SMELL006', name: 'passthru()', message: 'passthru() — remote code execution risk if input unsanitized' },
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'PHP_SMELL007', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'PHP_SMELL008', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+      { pattern: /\$_(?:GET|POST|REQUEST)\[.*\].*SELECT.*\./i, id: 'PHP_SMELL009', name: 'SQL Injection Risk', message: 'User input directly in SQL string — use prepared statements' },
+      { pattern: /\bvar_dump\s*\(/, id: 'PHP_SMELL010', name: 'Debug var_dump', message: 'var_dump() is for debug only — remove before production' },
+    ];
+
+    // ─── Ruby phantom APIs ────────────────────────────────────
+    this.rubyPhantomAPIs = [
+      { pattern: /\.flatten_map\s*\{/, suggestion: 'Ruby has no .flatten_map — use .flat_map { }', name: '.flatten_map', id: 'RB_HALL001' },
+      { pattern: /Array\.of\s*\(/, suggestion: 'Ruby has no Array.of() — use Array() or []', name: 'Array.of()', id: 'RB_HALL002' },
+      { pattern: /Hash\.from_array\s*\(/, suggestion: 'Ruby has no Hash.from_array() — use array.to_h or Hash[array]', name: 'Hash.from_array', id: 'RB_HALL003' },
+      { pattern: /\.async\s*\{/, suggestion: 'Ruby has no .async {} — use Thread.new or concurrent-ruby gem', name: '.async block', id: 'RB_HALL004' },
+      { pattern: /String\.format\s*\(/, suggestion: 'Ruby has no String.format() — use string interpolation or % operator', name: 'String.format', id: 'RB_HALL005' },
+      { pattern: /\bpromise\s*\{/, suggestion: 'Ruby has no built-in promise {} — use concurrent-ruby gem or Thread', name: 'promise block', id: 'RB_HALL006' },
+      { pattern: /\.try!\s*\(/, suggestion: 'Ruby has no .try!() — use &. (safe navigation) or Rails .try()', name: '.try!()', id: 'RB_HALL007' },
+      { pattern: /JSON\.safe_parse\s*\(/, suggestion: 'Ruby has no JSON.safe_parse — use JSON.parse with rescue', name: 'JSON.safe_parse', id: 'RB_HALL008' },
+      { pattern: /ActiveRecord::Base\.execute\s*\(/, suggestion: 'ActiveRecord::Base has no .execute() — use connection.execute() or where()', name: 'Base.execute', id: 'RB_HALL009' },
+      { pattern: /\.collect_map\s*\{/, suggestion: 'Ruby has no .collect_map — use .map { }.flatten(1) or .flat_map', name: '.collect_map', id: 'RB_HALL010' },
+    ];
+
+    this.rubyDeprecated = [
+      { pattern: /\brequire\s+['"]thread['"]/, suggestion: 'require "thread" is deprecated — Thread is now built-in without require', since: 'Ruby 2.0', name: 'require "thread"', id: 'RB_DEPR001' },
+      { pattern: /\bObject#type\b|\.type\s*==/, suggestion: '.type is deprecated — use .class or .is_a?', since: 'Ruby 1.8', name: 'Object#type', id: 'RB_DEPR002' },
+      { pattern: /\bERB::Util\.html_escape\b/, suggestion: 'ERB::Util.html_escape deprecated — use CGI.escapeHTML or h() in views', since: 'Ruby 2.6', name: 'ERB::Util.html_escape', id: 'RB_DEPR003' },
+      { pattern: /\bFile\.exists\?\s*\(/, suggestion: 'File.exists? deprecated — use File.exist? (no s)', since: 'Ruby 2.2', name: 'File.exists?', id: 'RB_DEPR004' },
+      { pattern: /\bDir\.exists\?\s*\(/, suggestion: 'Dir.exists? deprecated — use Dir.exist? (no s)', since: 'Ruby 2.2', name: 'Dir.exists?', id: 'RB_DEPR005' },
+      { pattern: /\bObject#returning\b|\s+returning\s+/, suggestion: 'Object#returning removed from Rails core — use tap { |obj| }', since: 'Rails 3.0', name: 'Object#returning', id: 'RB_DEPR006' },
+    ];
+
+    this.rubySmells = [
+      { pattern: /\bputs\s+(?!STDOUT)/, id: 'RB_SMELL001', name: 'Debug puts', message: 'puts is for debug output — use Rails logger or a logging library' },
+      { pattern: /\bp\s+\w/, id: 'RB_SMELL002', name: 'Debug p()', message: 'p() is for debug output — remove before production' },
+      { pattern: /\beval\s*\(/, id: 'RB_SMELL003', name: 'eval() Usage', message: 'eval() is dangerous — code injection risk' },
+      { pattern: /\bsystem\s*\(/, id: 'RB_SMELL004', name: 'system() Shell Call', message: 'system() call — command injection risk if input unsanitized' },
+      { pattern: /`[^`]+`/, id: 'RB_SMELL005', name: 'Backtick Shell Exec', message: 'Backtick shell execution — command injection risk' },
+      { pattern: /\bexec\s*\(/, id: 'RB_SMELL006', name: 'exec() call', message: 'exec() replaces the process — ensure this is intentional' },
+      { pattern: /\brescue\s*$|\brescue\s+Exception\b/, id: 'RB_SMELL007', name: 'Bare rescue', message: 'Bare rescue catches all exceptions including fatal ones — be specific' },
+      { pattern: /["'].*#\{.*sql.*\}.*["']/i, id: 'RB_SMELL008', name: 'SQL String Interpolation', message: 'SQL built with string interpolation — use parameterized queries' },
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'RB_SMELL009', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /raise\s+NotImplementedError/, id: 'RB_SMELL010', name: 'Not Implemented', message: 'Stub implementation — will raise at runtime' },
+    ];
+
     // Language extensions mapping
     this.jsExtensions = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
     this.pyExtensions = new Set(['.py', '.pyw']);
     this.goExtensions = new Set(['.go']);
     this.rustExtensions = new Set(['.rs']);
-    this.javaExtensions = new Set(['.java', '.kt', '.cs']);
+    this.javaExtensions = new Set(['.java', '.kt']);
+    this.csharpExtensions = new Set(['.cs']);
+    this.phpExtensions = new Set(['.php']);
+    this.rubyExtensions = new Set(['.rb']);
 
     // Patterns suggesting AI-generated code with common issues
     this.aiCodeSmells = [
@@ -160,13 +307,13 @@ class HallucinationDetector {
       { pattern: /new Buffer\s*\(/, suggestion: 'Use Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()', since: 'Node 6', name: 'new Buffer()', id: 'DEPR_API001' },
       { pattern: /require\s*\(\s*['"]sys['"]\s*\)/, suggestion: 'Use require("util") — sys was removed in Node 1.0', since: 'Node 1.0', name: 'require("sys")', id: 'DEPR_API002' },
       { pattern: /fs\.exists\s*\((?!Sync)/, suggestion: 'Use fs.access() or fs.stat() — fs.exists() is deprecated', since: 'Node 1.0', name: 'fs.exists()', id: 'DEPR_API003' },
-      { pattern: /domain\.create\s*\(/, suggestion: 'Use async_hooks or try/catch — domain module is deprecated', since: 'Node 4', name: 'domain.create()', id: 'DEPR_API004' },
-      { pattern: /require\s*\(\s*['"]punycode['"]\s*\)/, suggestion: 'Use userland punycode package — built-in is deprecated', since: 'Node 7', name: 'require("punycode")', id: 'DEPR_API005' },
+      { pattern: /domain\.create\s*\(/, suggestion: 'Use async_hooks or try/catch — domain module is deprecated', since: 'Node 4', name: 'domain.create()', id: 'DEPR_API004', fixable: false },
+      { pattern: /require\s*\(\s*['"]punycode['"]\s*\)/, suggestion: 'Use userland punycode package — built-in is deprecated', since: 'Node 7', name: 'require("punycode")', id: 'DEPR_API005', fixable: false },
       { pattern: /url\.parse\s*\(/, suggestion: 'Use new URL() — url.parse() is legacy', since: 'Node 11', name: 'url.parse()', id: 'DEPR_API006' },
-      { pattern: /querystring\.(parse|stringify)\s*\(/, suggestion: 'Use URLSearchParams — querystring is legacy', since: 'Node 14', name: 'querystring', id: 'DEPR_API007' },
+      { pattern: /querystring\.(parse|stringify)\s*\(/, suggestion: 'Use URLSearchParams — querystring is legacy', since: 'Node 14', name: 'querystring', id: 'DEPR_API007', fixable: false },
       { pattern: /util\.isArray\s*\(/, suggestion: 'Use Array.isArray() — util type checks are deprecated', since: 'Node 4', name: 'util.isArray()', id: 'DEPR_API008' },
       { pattern: /util\.isFunction\s*\(/, suggestion: 'Use typeof fn === "function"', since: 'Node 4', name: 'util.isFunction()', id: 'DEPR_API009' },
-      { pattern: /util\.pump\s*\(/, suggestion: 'Use stream.pipeline() — util.pump() was removed', since: 'Node 1.0', name: 'util.pump()', id: 'DEPR_API010' },
+      { pattern: /util\.pump\s*\(/, suggestion: 'Use stream.pipeline() — util.pump() was removed', since: 'Node 1.0', name: 'util.pump()', id: 'DEPR_API010', fixable: false },
     ];
   }
 
@@ -202,8 +349,11 @@ class HallucinationDetector {
         const isGo = this.goExtensions.has(ext);
         const isRust = this.rustExtensions.has(ext);
         const isJava = this.javaExtensions.has(ext);
+        const isCSharp = this.csharpExtensions.has(ext);
+        const isPHP = this.phpExtensions.has(ext);
+        const isRuby = this.rubyExtensions.has(ext);
 
-        if (!isJS && !isPython && !isGo && !isRust && !isJava) continue;
+        if (!isJS && !isPython && !isGo && !isRust && !isJava && !isCSharp && !isPHP && !isRuby) continue;
 
         const relPath = path.relative(this.config.rootPath, file);
 
@@ -246,13 +396,33 @@ class HallucinationDetector {
           this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.pythonPhantomAPIs, 'phantomAPIs');
           this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.pythonDeprecated, 'deprecatedAPIs');
           this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.pythonSmells);
+        } else if (isPHP) {
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.phpPhantomAPIs, 'phantomAPIs');
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.phpDeprecated, 'deprecatedAPIs');
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.phpSmells);
+        } else if (isRuby) {
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rubyPhantomAPIs, 'phantomAPIs');
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rubyDeprecated, 'deprecatedAPIs');
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.rubySmells);
         } else if (isGo) {
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.goPhantomAPIs, 'phantomAPIs');
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.goDeprecated, 'deprecatedAPIs');
           this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.goSmells);
         } else if (isRust) {
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rustPhantomAPIs, 'phantomAPIs');
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rustDeprecated, 'deprecatedAPIs');
           this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.rustSmells);
         } else if (isJava) {
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.javaSmells);
+          // Java and Kotlin share javaExtensions (.java, .kt)
+          const isKotlin = ext === '.kt';
+          if (isKotlin) {
+            this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.kotlinPhantomAPIs, 'phantomAPIs');
+            this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.kotlinDeprecated, 'deprecatedAPIs');
+            this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.kotlinSmells);
+          } else {
+            this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.javaSmells);
+          }
+        } else if (isCSharp) {
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.csharpSmells);
         }
 
       } catch (e) { /* skip unreadable */ }