thuban 0.3.3 → 0.4.0

package/packages/scanner/hallucination-detector.js

@@ -1,822 +0,0 @@
-/**
- * @thuban-dna
- * @purpose Detect AI hallucinations, phantom imports, invented APIs, and code drift
- * @module thuban
- * @layer application
- * @imports-from fs, path
- * @exports-to cli, tech-debt-analyzer, code-scanner
- * @side-effects File system reads, Console output
- * @critical-for Core differentiator — no other tool detects AI-generated code issues
- */
-
-const fs = require('fs');
-const path = require('path');
-
-class HallucinationDetector {
-  constructor(config = {}) {
-    this.config = {
-      rootPath: config.rootPath || process.cwd(),
-      ...config
-    };
-
-    // Known Node.js built-in modules
-    this.builtins = new Set([
-      'assert', 'async_hooks', 'buffer', 'child_process', 'cluster',
-      'console', 'constants', 'crypto', 'dgram', 'diagnostics_channel',
-      'dns', 'domain', 'events', 'fs', 'http', 'http2', 'https',
-      'inspector', 'module', 'net', 'os', 'path', 'perf_hooks',
-      'process', 'punycode', 'querystring', 'readline', 'repl',
-      'stream', 'string_decoder', 'sys', 'timers', 'tls', 'trace_events',
-      'tty', 'url', 'util', 'v8', 'vm', 'wasi', 'worker_threads', 'zlib',
-      'node:fs', 'node:path', 'node:os', 'node:crypto', 'node:http',
-      'node:https', 'node:events', 'node:util', 'node:stream',
-      'node:child_process', 'node:url', 'node:querystring', 'node:buffer',
-      'node:net', 'node:tls', 'node:dns', 'node:readline', 'node:zlib',
-      'node:worker_threads', 'node:cluster', 'node:vm', 'node:assert',
-      'node:timers', 'node:timers/promises', 'node:test',
-      'fs/promises', 'stream/promises', 'timers/promises', 'dns/promises',
-      'readline/promises',
-    ]);
-
-    // Common phantom packages that LLMs hallucinate
-    this.phantomPackages = new Set([
-      'node-fetch-extra', 'express-async', 'mongoose-v2',
-      'react-native-web-view', 'axios-retry-enhanced',
-      'lodash-extended', 'moment-timezone-v2', 'socket.io-extra',
-      'graphql-tools-v2', 'next-auth-v5', 'prisma-client-v2',
-      'tailwind-utils', 'react-query-v4', 'jest-extended-v2',
-    ]);
-
-    // Common hallucinated API patterns (methods that don't exist)
-    this.phantomAPIs = [
-      { pattern: /fs\.readFileAsync\s*\(/, suggestion: 'Use fs.promises.readFile() or fs.readFileSync()', name: 'fs.readFileAsync', id: 'HALL_API001' },
-      { pattern: /fs\.writeFileAsync\s*\(/, suggestion: 'Use fs.promises.writeFile() or fs.writeFileSync()', name: 'fs.writeFileAsync', id: 'HALL_API002' },
-      { pattern: /fs\.existsAsync\s*\(/, suggestion: 'Use fs.promises.access() or fs.existsSync()', name: 'fs.existsAsync', id: 'HALL_API003' },
-      { pattern: /path\.exists\s*\(/, suggestion: 'Use fs.existsSync() — path module has no exists()', name: 'path.exists', id: 'HALL_API004' },
-      { pattern: /path\.isFile\s*\(/, suggestion: 'Use fs.statSync().isFile() — path module has no isFile()', name: 'path.isFile', id: 'HALL_API005' },
-      { pattern: /path\.isDirectory\s*\(/, suggestion: 'Use fs.statSync().isDirectory()', name: 'path.isDirectory', id: 'HALL_API006' },
-      { pattern: /console\.success\s*\(/, suggestion: 'Use console.log() — console.success() does not exist', name: 'console.success', id: 'HALL_API007' },
-      { pattern: /console\.verbose\s*\(/, suggestion: 'Use console.log() or console.debug()', name: 'console.verbose', id: 'HALL_API008' },
-      { pattern: /JSON\.tryParse\s*\(/, suggestion: 'Use try/catch with JSON.parse()', name: 'JSON.tryParse', id: 'HALL_API009' },
-      { pattern: /JSON\.safeStringify\s*\(/, suggestion: 'Use JSON.stringify() with a replacer', name: 'JSON.safeStringify', id: 'HALL_API010' },
-      { pattern: /Array\.flatten\s*\(/, suggestion: 'Use Array.prototype.flat()', name: 'Array.flatten', id: 'HALL_API011' },
-      { pattern: /Object\.deepClone\s*\(/, suggestion: 'Use structuredClone() or JSON.parse(JSON.stringify())', name: 'Object.deepClone', id: 'HALL_API012' },
-      { pattern: /Object\.deepMerge\s*\(/, suggestion: 'Use a library like lodash.merge or write a custom function', name: 'Object.deepMerge', id: 'HALL_API013' },
-      { pattern: /String\.prototype\.replaceAll\s*&&.*polyfill/i, suggestion: 'replaceAll() is native since ES2021 — no polyfill needed', name: 'replaceAll polyfill', id: 'HALL_API014' },
-      { pattern: /require\s*\(\s*['"]fs\/sync['"]\s*\)/, suggestion: 'fs/sync is not a real module — use fs directly', name: 'fs/sync', id: 'HALL_API015' },
-      { pattern: /require\s*\(\s*['"]http\/server['"]\s*\)/, suggestion: 'http/server is not a real module — use http.createServer()', name: 'http/server', id: 'HALL_API016' },
-      { pattern: /process\.env\.get\s*\(/, suggestion: 'Use process.env.VAR_NAME — process.env is a plain object, not a Map', name: 'process.env.get()', id: 'HALL_API017' },
-      { pattern: /process\.exit\s*\(\s*['"]/, suggestion: 'process.exit() takes a number, not a string', name: 'process.exit(string)', id: 'HALL_API018' },
-    ];
-
-    // ─── Python phantom APIs ────────────────────────────────
-    this.pythonPhantomAPIs = [
-      { pattern: /os\.path\.exists_sync\s*\(/, suggestion: 'Use os.path.exists() — exists_sync does not exist in Python', name: 'os.path.exists_sync', id: 'PY_HALL001' },
-      { pattern: /json\.tryParse\s*\(/, suggestion: 'Use json.loads() with try/except', name: 'json.tryParse', id: 'PY_HALL002' },
-      { pattern: /\w+\.flatMap\s*\(/, suggestion: 'Python lists have no flatMap — use list comprehension or itertools.chain.from_iterable()', name: 'list.flatMap', id: 'PY_HALL003' },
-      { pattern: /\w+\.merge\s*\((?!.*\bself\b)/, suggestion: 'Use {**dict1, **dict2} or dict1 | dict2 (3.9+)', name: 'dict.merge', id: 'PY_HALL004' },
-      { pattern: /\w+\.format_map\s*\(/, suggestion: 'str.format_map exists but is rarely correct — did you mean .format()?', name: 'string.format_map misuse', id: 'PY_HALL005' },
-      { pattern: /from\s+collections\s+import\s+OrderedDict.*#.*maintain\s+order/i, suggestion: 'Regular dict maintains order since Python 3.7 — OrderedDict is unnecessary', name: 'Unnecessary OrderedDict', id: 'PY_HALL006' },
-      { pattern: /async\s+def\s+\w+.*asyncio\.sleep\s*\(\s*0\s*\)\s*#.*yield/i, suggestion: 'asyncio.sleep(0) to yield is a code smell — review async design', name: 'asyncio.sleep(0) hack', id: 'PY_HALL007' },
-      { pattern: /import\s+tensorflow\.v2/, suggestion: 'tensorflow.v2 is not a real module — use import tensorflow', name: 'tensorflow.v2', id: 'PY_HALL008' },
-      { pattern: /from\s+sklearn\.model_selection\s+import\s+train_test_split_v2/, suggestion: 'train_test_split_v2 does not exist — use train_test_split', name: 'sklearn v2 hallucination', id: 'PY_HALL009' },
-      { pattern: /requests\.async_get\s*\(/, suggestion: 'requests has no async_get — use aiohttp or httpx', name: 'requests.async_get', id: 'PY_HALL010' },
-    ];
-
-    this.pythonDeprecated = [
-      { pattern: /from\s+distutils/, suggestion: 'distutils removed in Python 3.12 — use setuptools', since: 'Python 3.12', name: 'distutils', id: 'PY_DEPR001' },
-      { pattern: /from\s+imp\s+import/, suggestion: 'imp removed in Python 3.12 — use importlib', since: 'Python 3.12', name: 'imp module', id: 'PY_DEPR002' },
-      { pattern: /asyncio\.get_event_loop\(\)/, suggestion: 'Deprecated in 3.10+ — use asyncio.run() or get_running_loop()', since: 'Python 3.10', name: 'asyncio.get_event_loop()', id: 'PY_DEPR003' },
-      { pattern: /collections\.MutableMapping/, suggestion: 'Moved to collections.abc.MutableMapping in Python 3.3+', since: 'Python 3.9', name: 'collections.MutableMapping', id: 'PY_DEPR004' },
-      { pattern: /optparse\.OptionParser/, suggestion: 'optparse deprecated since Python 3.2 — use argparse', since: 'Python 3.2', name: 'optparse', id: 'PY_DEPR005' },
-      { pattern: /cgi\.parse_header\s*\(/, suggestion: 'cgi module deprecated in Python 3.11, removed in 3.13', since: 'Python 3.11', name: 'cgi module', id: 'PY_DEPR006' },
-      { pattern: /from\s+typing\s+import\s+(List|Dict|Tuple|Set)\b/, suggestion: 'Use built-in list, dict, tuple, set for type hints (Python 3.9+)', since: 'Python 3.9', name: 'typing.List/Dict/Tuple', id: 'PY_DEPR007' },
-      { pattern: /unittest\.makeSuite\s*\(/, suggestion: 'makeSuite deprecated — use TestLoader.loadTestsFromTestCase', since: 'Python 3.11', name: 'unittest.makeSuite', id: 'PY_DEPR008' },
-    ];
-
-    this.pythonSmells = [
-      { pattern: /print\s*\(\s*f?['"]\s*debug/i, id: 'PY_SMELL001', name: 'Debug Print', message: 'Debug print statement left in code' },
-      { pattern: /except\s*:\s*$|except\s+Exception\s*:\s*\n\s*pass/m, id: 'PY_SMELL002', name: 'Bare Except', message: 'Bare except or swallowed exception — hides real errors' },
-      { pattern: /#\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'PY_SMELL003', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /raise\s+NotImplementedError\s*\(?\s*\)?/, id: 'PY_SMELL004', name: 'Not Implemented', message: 'Stub implementation — function body was not generated' },
-      { pattern: /['"]your.api.key.here['"]|['"]sk-[.]{3,}['"]/i, id: 'PY_SMELL005', name: 'Dummy Credential', message: 'Placeholder credential — will fail at runtime' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'PY_SMELL006', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-      { pattern: /import\s+\*/, id: 'PY_SMELL007', name: 'Wildcard Import', message: 'Wildcard import — pollutes namespace, hides dependencies' },
-    ];
-
-    // ─── Go deprecated APIs (formerly labelled phantom — they exist but are removed) ─
-    this.goDeprecated = [
-      { pattern: /ioutil\.ReadFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.ReadFile()', since: 'Go 1.16', name: 'ioutil.ReadFile', id: 'GO_DEPR001' },
-      { pattern: /ioutil\.WriteFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.WriteFile()', since: 'Go 1.16', name: 'ioutil.WriteFile', id: 'GO_DEPR002' },
-      { pattern: /ioutil\.TempDir\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.MkdirTemp()', since: 'Go 1.16', name: 'ioutil.TempDir', id: 'GO_DEPR003' },
-      { pattern: /ioutil\.ReadAll\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use io.ReadAll()', since: 'Go 1.16', name: 'ioutil.ReadAll', id: 'GO_DEPR004' },
-      { pattern: /strings\.Title\s*\(/, suggestion: 'strings.Title deprecated in Go 1.18 — use cases.Title from golang.org/x/text', since: 'Go 1.18', name: 'strings.Title', id: 'GO_DEPR005' },
-    ];
-
-    this.goSmells = [
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'GO_SMELL001', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /panic\s*\(\s*["']not implemented["']\s*\)/, id: 'GO_SMELL002', name: 'Panic Not Implemented', message: 'Stub implementation — will panic at runtime' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'GO_SMELL003', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-    ];
-
-    // ─── Rust phantom APIs ──────────────────────────────────
-    this.rustPhantomAPIs = [
-      { pattern: /std::fs::File::open_async\s*\(/, suggestion: 'Use tokio::fs::File::open() for async file I/O', name: 'File::open_async', id: 'RS_HALL001' },
-      { pattern: /Vec::flatten\s*\(/, suggestion: 'Use .into_iter().flatten() — Vec has no flatten() method', name: 'Vec::flatten', id: 'RS_HALL002' },
-      { pattern: /HashMap::get_or_default\s*\(/, suggestion: 'Use .get().unwrap_or(&default) or entry().or_insert()', name: 'HashMap::get_or_default', id: 'RS_HALL003' },
-      { pattern: /String::from_utf8_lossy_owned\s*\(/, suggestion: 'Use String::from_utf8_lossy().into_owned()', name: 'String::from_utf8_lossy_owned', id: 'RS_HALL004' },
-      { pattern: /\.async_iter\s*\(/, suggestion: 'Use futures::stream::iter() from the futures crate', name: '.async_iter()', id: 'RS_HALL005' },
-      { pattern: /std::net::TcpStream::connect_async\s*\(/, suggestion: 'Use tokio::net::TcpStream::connect()', name: 'TcpStream::connect_async', id: 'RS_HALL006' },
-      { pattern: /std::thread::sleep_async\s*\(/, suggestion: 'Use tokio::time::sleep() for async sleep', name: 'thread::sleep_async', id: 'RS_HALL007' },
-      { pattern: /Vec::remove_all\s*\(/, suggestion: 'Use .retain(|x| condition) or .clear()', name: 'Vec::remove_all', id: 'RS_HALL008' },
-      { pattern: /str::split_whitespace_n\s*\(/, suggestion: 'Use .splitn(n, char::is_whitespace) instead', name: 'str::split_whitespace_n', id: 'RS_HALL009' },
-      { pattern: /\.map_async\s*\(/, suggestion: 'Use futures::future::join_all() or tokio::task::spawn', name: '.map_async()', id: 'RS_HALL010' },
-    ];
-
-    this.rustDeprecated = [
-      { pattern: /std::sync::ONCE_INIT/, suggestion: 'std::sync::ONCE_INIT removed — use Once::new()', since: 'Rust 1.38', name: 'ONCE_INIT', id: 'RS_DEPR001' },
-      { pattern: /\bstd::mem::uninitialized\s*\(/, suggestion: 'std::mem::uninitialized() removed — use MaybeUninit::uninit()', since: 'Rust 1.39', name: 'mem::uninitialized', id: 'RS_DEPR002' },
-      { pattern: /\btry!\s*\(/, suggestion: 'try!() macro removed — use the ? operator', since: 'Rust 2018', name: 'try!() macro', id: 'RS_DEPR003' },
-      { pattern: /extern\s+crate\s+std\s*;/, suggestion: 'extern crate std is implicit since Rust 2018 edition', since: 'Rust 2018', name: 'extern crate std', id: 'RS_DEPR004' },
-      { pattern: /extern\s+crate\s+alloc\s*;/, suggestion: 'extern crate alloc is implicit in 2018+ edition', since: 'Rust 2018', name: 'extern crate alloc', id: 'RS_DEPR005' },
-      { pattern: /std::error::Error::cause\s*\(/, suggestion: '.cause() deprecated — use .source() instead', since: 'Rust 1.33', name: 'Error::cause()', id: 'RS_DEPR006' },
-    ];
-
-    this.rustSmells = [
-      { pattern: /todo!\s*\(\s*\)/, id: 'RS_SMELL001', name: 'todo! macro', message: 'todo!() macro — will panic at runtime' },
-      { pattern: /unimplemented!\s*\(\s*\)/, id: 'RS_SMELL002', name: 'unimplemented! macro', message: 'unimplemented!() macro — will panic at runtime' },
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'RS_SMELL003', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /unwrap\(\).*unwrap\(\)/, id: 'RS_SMELL004', name: 'Double Unwrap', message: 'Chained unwrap() — will panic on None/Err' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'RS_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-      { pattern: /unsafe\s*\{/, id: 'RS_SMELL006', name: 'Unsafe Block', message: 'unsafe block — verify memory safety guarantees' },
-      { pattern: /\.unwrap\(\)\s*;/, id: 'RS_SMELL007', name: 'Bare unwrap()', message: '.unwrap() will panic on None/Err — use ? or match' },
-      { pattern: /println!\s*\(\s*["'].*[Dd]ebug/, id: 'RS_SMELL008', name: 'Debug println!', message: 'Debug println! left in code — use the log crate' },
-      { pattern: /eprintln!\s*\(\s*["'].*[Dd]ebug/, id: 'RS_SMELL009', name: 'Debug eprintln!', message: 'Debug eprintln! left in code — use the log crate' },
-      { pattern: /#\[allow\(dead_code\)\]/, id: 'RS_SMELL010', name: 'Suppressed Dead Code', message: '#[allow(dead_code)] suppresses warnings — remove unused code' },
-    ];
-
-    // ─── Java smells ─────────────────────────────────────────
-    this.javaSmells = [
-      { pattern: /System\.out\.println\s*\(.*debug/i, id: 'JAVA_SMELL001', name: 'Debug Println', message: 'Debug System.out.println — use a logger' },
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'JAVA_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /throw\s+new\s+(?:Runtime)?Exception\s*\(\s*["']Not\s+implemented["']/i, id: 'JAVA_SMELL003', name: 'Not Implemented', message: 'Stub implementation — will throw at runtime' },
-      { pattern: /catch\s*\(\s*Exception\s+\w+\s*\)\s*\{\s*\}/, id: 'JAVA_SMELL004', name: 'Empty Catch', message: 'Empty catch block — swallows all exceptions' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'JAVA_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-    ];
-
-    // ─── C# smells (separate from Java) ─────────────────────
-    this.csharpSmells = [
-      { pattern: /Console\.WriteLine\s*\(.*[Dd]ebug/i, id: 'CS_SMELL001', name: 'Debug WriteLine', message: 'Debug Console.WriteLine — use ILogger or Debug.Write' },
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'CS_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /throw\s+new\s+(?:NotImplementedException)\s*\(/, id: 'CS_SMELL003', name: 'Not Implemented', message: 'Stub implementation — will throw at runtime' },
-      { pattern: /catch\s*\(\s*Exception\s+\w+\s*\)\s*\{\s*\}/, id: 'CS_SMELL004', name: 'Empty Catch', message: 'Empty catch block — swallows all exceptions' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'CS_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-    ];
-
-    // ─── Kotlin phantom APIs ──────────────────────────────────
-    this.kotlinPhantomAPIs = [
-      { pattern: /\.flatMap\s*\{[^}]*\}(?!.*asSequence)/, suggestion: 'Use .flatMap { } — verify this is not confusing sequence vs list behavior', name: 'flatMap confusion', id: 'KT_HALL001' },
-      { pattern: /listOf\(\)\.stream\s*\(/, suggestion: 'Kotlin lists have no .stream() — use .asSequence() or direct collection ops', name: 'listOf().stream()', id: 'KT_HALL002' },
-      { pattern: /String\.format\s*\(/, suggestion: 'Prefer Kotlin string templates "$variable" over String.format()', name: 'String.format Java-style', id: 'KT_HALL003' },
-      { pattern: /\bObject\s*\(\s*\)/, suggestion: 'Kotlin uses Any() not Object() — or use object keyword for singletons', name: 'Object() Java-style', id: 'KT_HALL004' },
-      { pattern: /\.forEach\s*\(\s*::println\s*\)(?!.*debug)/i, suggestion: 'println is for debug output — use a logger', name: 'println via forEach', id: 'KT_HALL005' },
-      { pattern: /coroutineScope\s*\{\s*launch\s*\{[^}]*\}\s*\}(?!\s*\.join)/, suggestion: 'Unjoined coroutine in coroutineScope may cause issues — ensure structured concurrency', name: 'Unawaited launch', id: 'KT_HALL006' },
-      { pattern: /Dispatchers\.IO\s*\+\s*Dispatchers/, suggestion: 'Combining Dispatchers is not valid — use one dispatcher at a time', name: 'Combined Dispatchers', id: 'KT_HALL007' },
-      { pattern: /\.toList\(\)\.stream\(\)/, suggestion: 'Use Kotlin sequences (.asSequence()) instead of .toList().stream()', name: 'toList().stream()', id: 'KT_HALL008' },
-      { pattern: /companion object.*getInstance/i, suggestion: 'Kotlin idiom for singletons is object keyword, not companion object + getInstance()', name: 'Java-style singleton', id: 'KT_HALL009' },
-      { pattern: /lateinit var.*\?/, suggestion: 'lateinit properties cannot be nullable — remove ? or use by lazy {}', name: 'lateinit nullable', id: 'KT_HALL010' },
-    ];
-
-    this.kotlinDeprecated = [
-      { pattern: /\bapply\s+plugin:\s*['"]kotlin-android-extensions['"]/, suggestion: 'kotlin-android-extensions deprecated — use view binding or Jetpack ViewBinding', since: 'Kotlin 1.8', name: 'kotlin-android-extensions', id: 'KT_DEPR001' },
-      { pattern: /\bkotlinx\.android\.synthetic/, suggestion: 'Synthetic imports deprecated — use view binding or findViewById', since: 'Kotlin 1.8', name: 'Synthetic imports', id: 'KT_DEPR002' },
-      { pattern: /\bCoroutineScope\(EmptyCoroutineContext\)/, suggestion: 'EmptyCoroutineContext coroutine scope is error-prone — use viewModelScope or lifecycleScope', since: 'Kotlin Coroutines 1.6', name: 'EmptyCoroutineContext scope', id: 'KT_DEPR003' },
-      { pattern: /\bBuildersKt\.launch\b/, suggestion: 'Internal BuildersKt APIs are deprecated — use coroutineScope { launch {} }', since: 'Kotlin Coroutines 1.5', name: 'BuildersKt.launch', id: 'KT_DEPR004' },
-      { pattern: /\basyncLazy\s*\{/, suggestion: 'asyncLazy {} is not a standard Kotlin API — use lazy {} or async {}', since: 'Kotlin 1.6', name: 'asyncLazy', id: 'KT_DEPR005' },
-    ];
-
-    this.kotlinSmells = [
-      { pattern: /\bprintln\s*\(/, id: 'KT_SMELL001', name: 'Debug println', message: 'println() is for debug output — use a proper logger' },
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'KT_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /TODO\s*\(\s*\)/, id: 'KT_SMELL003', name: 'TODO() stub', message: 'TODO() will throw NotImplementedError at runtime' },
-      { pattern: /!!\s*\./, id: 'KT_SMELL004', name: 'Non-null assertion chain', message: '!! non-null assertion — will throw NullPointerException if null' },
-      { pattern: /\bas\s+\w+\b(?!.*\?)/, suggestion: 'Unsafe cast — prefer safe cast (as? Type) with null check', id: 'KT_SMELL005', name: 'Unsafe cast', message: 'Unsafe cast with as — will throw ClassCastException if wrong type' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'KT_SMELL006', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-      { pattern: /catch\s*\(\s*e:\s*Exception\s*\)\s*\{\s*\}/, id: 'KT_SMELL007', name: 'Empty Catch', message: 'Empty catch block — swallows all exceptions' },
-      { pattern: /throw\s+NotImplementedError\s*\(/, id: 'KT_SMELL008', name: 'Not Implemented', message: 'Stub implementation — will throw at runtime' },
-    ];
-
-    // ─── PHP phantom APIs ─────────────────────────────────────
-    this.phpPhantomAPIs = [
-      { pattern: /array_flatten\s*\(/, suggestion: 'PHP has no array_flatten() — use array_merge(...$array) or a recursive function', name: 'array_flatten', id: 'PHP_HALL001' },
-      { pattern: /str_contains_all\s*\(/, suggestion: 'PHP has no str_contains_all() — use multiple str_contains() calls', name: 'str_contains_all', id: 'PHP_HALL002' },
-      { pattern: /array_unique_values\s*\(/, suggestion: 'PHP has no array_unique_values() — use array_values(array_unique())', name: 'array_unique_values', id: 'PHP_HALL003' },
-      { pattern: /\$pdo->fetchAll\s*\(/, suggestion: 'fetchAll() is on PDOStatement not PDO — call $stmt->fetchAll()', name: 'PDO::fetchAll', id: 'PHP_HALL004' },
-      { pattern: /json_decode_safe\s*\(/, suggestion: 'PHP has no json_decode_safe() — wrap json_decode() with json_last_error() check', name: 'json_decode_safe', id: 'PHP_HALL005' },
-      { pattern: /str_replace_all\s*\(/, suggestion: 'PHP has no str_replace_all() — use str_replace() which already replaces all occurrences', name: 'str_replace_all', id: 'PHP_HALL006' },
-      { pattern: /array_map_keys\s*\(/, suggestion: 'PHP has no array_map_keys() — use array_combine(array_map(...), array_keys())', name: 'array_map_keys', id: 'PHP_HALL007' },
-      { pattern: /\$request->getJson\s*\(/, suggestion: 'Not a standard PHP function — use json_decode(file_get_contents("php://input"))', name: '$request->getJson', id: 'PHP_HALL008' },
-      { pattern: /Date::now\s*\(/, suggestion: 'PHP has no Date::now() — use new DateTime() or time()', name: 'Date::now', id: 'PHP_HALL009' },
-      { pattern: /\bawait\s+/, suggestion: 'PHP has no await keyword — use synchronous code or ReactPHP for async', name: 'await keyword', id: 'PHP_HALL010' },
-    ];
-
-    this.phpDeprecated = [
-      { pattern: /\bmysql_connect\s*\(/, suggestion: 'mysql_* functions removed in PHP 7 — use PDO or MySQLi', since: 'PHP 7.0', name: 'mysql_connect', id: 'PHP_DEPR001' },
-      { pattern: /\bmysql_query\s*\(/, suggestion: 'mysql_* functions removed in PHP 7 — use PDO or MySQLi', since: 'PHP 7.0', name: 'mysql_query', id: 'PHP_DEPR002' },
-      { pattern: /\bmysql_fetch_array\s*\(/, suggestion: 'mysql_* functions removed in PHP 7 — use PDO or MySQLi', since: 'PHP 7.0', name: 'mysql_fetch_array', id: 'PHP_DEPR003' },
-      { pattern: /\bereg\s*\(/, suggestion: 'ereg() removed in PHP 7 — use preg_match()', since: 'PHP 7.0', name: 'ereg()', id: 'PHP_DEPR004' },
-      { pattern: /\bsplit\s*\(/, suggestion: 'split() removed in PHP 7 — use preg_split() or explode()', since: 'PHP 7.0', name: 'split()', id: 'PHP_DEPR005' },
-      { pattern: /\bcreate_function\s*\(/, suggestion: 'create_function() removed in PHP 8 — use anonymous functions (closures)', since: 'PHP 8.0', name: 'create_function', id: 'PHP_DEPR006' },
-      { pattern: /\bmagic_quotes_gpc\b/, suggestion: 'magic_quotes_gpc removed in PHP 7 — sanitize inputs manually', since: 'PHP 7.0', name: 'magic_quotes_gpc', id: 'PHP_DEPR007' },
-      { pattern: /\beach\s*\(/, suggestion: 'each() deprecated in PHP 7.2, removed in PHP 8 — use foreach', since: 'PHP 8.0', name: 'each()', id: 'PHP_DEPR008' },
-      { pattern: /\bmcrypt_/, suggestion: 'mcrypt removed in PHP 7.2 — use OpenSSL functions', since: 'PHP 7.2', name: 'mcrypt functions', id: 'PHP_DEPR009' },
-    ];
-
-    this.phpSmells = [
-      { pattern: /\beval\s*\(/, id: 'PHP_SMELL001', name: 'eval() Usage', message: 'eval() is dangerous — code injection risk' },
-      { pattern: /\bextract\s*\(\s*\$_(?:GET|POST|REQUEST)/, id: 'PHP_SMELL002', name: 'extract() from superglobal', message: 'extract($_GET/_POST) — variable injection vulnerability' },
-      { pattern: /\$\$\w+/, id: 'PHP_SMELL003', name: 'Variable variable', message: 'Variable variables ($$var) — hard to trace and injection risk' },
-      { pattern: /\bshell_exec\s*\(/, id: 'PHP_SMELL004', name: 'shell_exec()', message: 'shell_exec() — remote code execution risk if input unsanitized' },
-      { pattern: /\bsystem\s*\(/, id: 'PHP_SMELL005', name: 'system()', message: 'system() — remote code execution risk if input unsanitized' },
-      { pattern: /\bpassthru\s*\(/, id: 'PHP_SMELL006', name: 'passthru()', message: 'passthru() — remote code execution risk if input unsanitized' },
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'PHP_SMELL007', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'PHP_SMELL008', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-      { pattern: /\$_(?:GET|POST|REQUEST)\[.*\].*SELECT.*\./i, id: 'PHP_SMELL009', name: 'SQL Injection Risk', message: 'User input directly in SQL string — use prepared statements' },
-      { pattern: /\bvar_dump\s*\(/, id: 'PHP_SMELL010', name: 'Debug var_dump', message: 'var_dump() is for debug only — remove before production' },
-    ];
-
-    // ─── Ruby phantom APIs ────────────────────────────────────
-    this.rubyPhantomAPIs = [
-      { pattern: /\.flatten_map\s*\{/, suggestion: 'Ruby has no .flatten_map — use .flat_map { }', name: '.flatten_map', id: 'RB_HALL001' },
-      { pattern: /Array\.of\s*\(/, suggestion: 'Ruby has no Array.of() — use Array() or []', name: 'Array.of()', id: 'RB_HALL002' },
-      { pattern: /Hash\.from_array\s*\(/, suggestion: 'Ruby has no Hash.from_array() — use array.to_h or Hash[array]', name: 'Hash.from_array', id: 'RB_HALL003' },
-      { pattern: /\.async\s*\{/, suggestion: 'Ruby has no .async {} — use Thread.new or concurrent-ruby gem', name: '.async block', id: 'RB_HALL004' },
-      { pattern: /String\.format\s*\(/, suggestion: 'Ruby has no String.format() — use string interpolation or % operator', name: 'String.format', id: 'RB_HALL005' },
-      { pattern: /\bpromise\s*\{/, suggestion: 'Ruby has no built-in promise {} — use concurrent-ruby gem or Thread', name: 'promise block', id: 'RB_HALL006' },
-      { pattern: /\.try!\s*\(/, suggestion: 'Ruby has no .try!() — use &. (safe navigation) or Rails .try()', name: '.try!()', id: 'RB_HALL007' },
-      { pattern: /JSON\.safe_parse\s*\(/, suggestion: 'Ruby has no JSON.safe_parse — use JSON.parse with rescue', name: 'JSON.safe_parse', id: 'RB_HALL008' },
-      { pattern: /ActiveRecord::Base\.execute\s*\(/, suggestion: 'ActiveRecord::Base has no .execute() — use connection.execute() or where()', name: 'Base.execute', id: 'RB_HALL009' },
-      { pattern: /\.collect_map\s*\{/, suggestion: 'Ruby has no .collect_map — use .map { }.flatten(1) or .flat_map', name: '.collect_map', id: 'RB_HALL010' },
-    ];
-
-    this.rubyDeprecated = [
-      { pattern: /\brequire\s+['"]thread['"]/, suggestion: 'require "thread" is deprecated — Thread is now built-in without require', since: 'Ruby 2.0', name: 'require "thread"', id: 'RB_DEPR001' },
-      { pattern: /\bObject#type\b|\.type\s*==/, suggestion: '.type is deprecated — use .class or .is_a?', since: 'Ruby 1.8', name: 'Object#type', id: 'RB_DEPR002' },
-      { pattern: /\bERB::Util\.html_escape\b/, suggestion: 'ERB::Util.html_escape deprecated — use CGI.escapeHTML or h() in views', since: 'Ruby 2.6', name: 'ERB::Util.html_escape', id: 'RB_DEPR003' },
-      { pattern: /\bFile\.exists\?\s*\(/, suggestion: 'File.exists? deprecated — use File.exist? (no s)', since: 'Ruby 2.2', name: 'File.exists?', id: 'RB_DEPR004' },
-      { pattern: /\bDir\.exists\?\s*\(/, suggestion: 'Dir.exists? deprecated — use Dir.exist? (no s)', since: 'Ruby 2.2', name: 'Dir.exists?', id: 'RB_DEPR005' },
-      { pattern: /\bObject#returning\b|\s+returning\s+/, suggestion: 'Object#returning removed from Rails core — use tap { |obj| }', since: 'Rails 3.0', name: 'Object#returning', id: 'RB_DEPR006' },
-    ];
-
-    this.rubySmells = [
-      { pattern: /\bputs\s+(?!STDOUT)/, id: 'RB_SMELL001', name: 'Debug puts', message: 'puts is for debug output — use Rails logger or a logging library' },
-      { pattern: /\bp\s+\w/, id: 'RB_SMELL002', name: 'Debug p()', message: 'p() is for debug output — remove before production' },
-      { pattern: /\beval\s*\(/, id: 'RB_SMELL003', name: 'eval() Usage', message: 'eval() is dangerous — code injection risk' },
-      { pattern: /\bsystem\s*\(/, id: 'RB_SMELL004', name: 'system() Shell Call', message: 'system() call — command injection risk if input unsanitized' },
-      { pattern: /`[^`]+`/, id: 'RB_SMELL005', name: 'Backtick Shell Exec', message: 'Backtick shell execution — command injection risk' },
-      { pattern: /\bexec\s*\(/, id: 'RB_SMELL006', name: 'exec() call', message: 'exec() replaces the process — ensure this is intentional' },
-      { pattern: /\brescue\s*$|\brescue\s+Exception\b/, id: 'RB_SMELL007', name: 'Bare rescue', message: 'Bare rescue catches all exceptions including fatal ones — be specific' },
-      { pattern: /["'].*#\{.*sql.*\}.*["']/i, id: 'RB_SMELL008', name: 'SQL String Interpolation', message: 'SQL built with string interpolation — use parameterized queries' },
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'RB_SMELL009', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
-      { pattern: /raise\s+NotImplementedError/, id: 'RB_SMELL010', name: 'Not Implemented', message: 'Stub implementation — will raise at runtime' },
-    ];
-
-    // Language extensions mapping
-    this.jsExtensions = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
-    this.pyExtensions = new Set(['.py', '.pyw']);
-    this.goExtensions = new Set(['.go']);
-    this.rustExtensions = new Set(['.rs']);
-    this.javaExtensions = new Set(['.java', '.kt']);
-    this.csharpExtensions = new Set(['.cs']);
-    this.phpExtensions = new Set(['.php']);
-    this.rubyExtensions = new Set(['.rb']);
-
-    // Patterns suggesting AI-generated code with common issues
-    this.aiCodeSmells = [
-      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)\s*(this|here|later)/i, id: 'AI_SMELL001', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished implementation' },
-      { pattern: /throw new Error\(['"]Not implemented['"]\)/, id: 'AI_SMELL002', name: 'Not Implemented', message: 'Stub implementation — function body was not generated' },
-      { pattern: /\/\/\s*\.\.\.\s*(rest|remaining|more|other|additional)/i, id: 'AI_SMELL003', name: 'Truncated Code', message: 'AI output was truncated — code is incomplete' },
-      { pattern: /\/\/\s*(your|replace|insert|put)\s+(code|logic|implementation|api[_\s]?key)/i, id: 'AI_SMELL004', name: 'Template Placeholder', message: 'Template placeholder left in code — needs real implementation' },
-      { pattern: /['"]your-api-key-here['"]|['"]sk-[.]{3,}['"]|['"]xxx+['"]/i, id: 'AI_SMELL005', name: 'Dummy Credential', message: 'Placeholder credential — will fail at runtime' },
-      { pattern: /example\.com|test@test\.com|john@doe\.com|foo@bar\.com/i, id: 'AI_SMELL006', name: 'Example Domain', message: 'Example domain/email in production code' },
-      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'AI_SMELL007', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
-    ];
-
-    // Deprecated/removed Node.js APIs that LLMs still suggest
-    this.deprecatedAPIs = [
-      { pattern: /new Buffer\s*\(/, suggestion: 'Use Buffer.from(), Buffer.alloc(), or Buffer.allocUnsafe()', since: 'Node 6', name: 'new Buffer()', id: 'DEPR_API001' },
-      { pattern: /require\s*\(\s*['"]sys['"]\s*\)/, suggestion: 'Use require("util") — sys was removed in Node 1.0', since: 'Node 1.0', name: 'require("sys")', id: 'DEPR_API002' },
-      { pattern: /fs\.exists\s*\((?!Sync)/, suggestion: 'Use fs.access() or fs.stat() — fs.exists() is deprecated', since: 'Node 1.0', name: 'fs.exists()', id: 'DEPR_API003' },
-      { pattern: /domain\.create\s*\(/, suggestion: 'Use async_hooks or try/catch — domain module is deprecated', since: 'Node 4', name: 'domain.create()', id: 'DEPR_API004', fixable: false },
-      { pattern: /require\s*\(\s*['"]punycode['"]\s*\)/, suggestion: 'Use userland punycode package — built-in is deprecated', since: 'Node 7', name: 'require("punycode")', id: 'DEPR_API005', fixable: false },
-      { pattern: /url\.parse\s*\(/, suggestion: 'Use new URL() — url.parse() is legacy', since: 'Node 11', name: 'url.parse()', id: 'DEPR_API006' },
-      { pattern: /querystring\.(parse|stringify)\s*\(/, suggestion: 'Use URLSearchParams — querystring is legacy', since: 'Node 14', name: 'querystring', id: 'DEPR_API007', fixable: false },
-      { pattern: /util\.isArray\s*\(/, suggestion: 'Use Array.isArray() — util type checks are deprecated', since: 'Node 4', name: 'util.isArray()', id: 'DEPR_API008' },
-      { pattern: /util\.isFunction\s*\(/, suggestion: 'Use typeof fn === "function"', since: 'Node 4', name: 'util.isFunction()', id: 'DEPR_API009' },
-      { pattern: /util\.pump\s*\(/, suggestion: 'Use stream.pipeline() — util.pump() was removed', since: 'Node 1.0', name: 'util.pump()', id: 'DEPR_API010', fixable: false },
-    ];
-  }
-
-  /**
-   * Full hallucination scan across all files
-   */
-  async scan(files) {
-    const startTime = Date.now();
-    const results = {
-      phantomImports: [],
-      phantomAPIs: [],
-      aiSmells: [],
-      deprecatedAPIs: [],
-      unresolvedDeps: [],
-      stats: {
-        filesScanned: 0,
-        totalIssues: 0,
-        scanTime: 0,
-      },
-    };
-
-    // Load package.json dependencies
-    const declaredDeps = this._loadDeclaredDeps();
-
-    // Load .thubanrc.json ignore rules
-    const ignoreFiles = this._loadIgnoreRules();
-
-    for (const file of files) {
-      try {
-        const ext = path.extname(file).toLowerCase();
-        const isJS = this.jsExtensions.has(ext);
-        const isPython = this.pyExtensions.has(ext);
-        const isGo = this.goExtensions.has(ext);
-        const isRust = this.rustExtensions.has(ext);
-        const isJava = this.javaExtensions.has(ext);
-        const isCSharp = this.csharpExtensions.has(ext);
-        const isPHP = this.phpExtensions.has(ext);
-        const isRuby = this.rubyExtensions.has(ext);
-
-        if (!isJS && !isPython && !isGo && !isRust && !isJava && !isCSharp && !isPHP && !isRuby) continue;
-
-        const relPath = path.relative(this.config.rootPath, file);
-
-        // Skip files in the ignore list
-        if (ignoreFiles.some(pattern => relPath.includes(pattern) || file.includes(pattern))) continue;
-
-        const content = fs.readFileSync(file, 'utf-8');
-        const lines = content.split('\n');
-
-        // Build set of lines with thuban-ignore comments
-        const ignoredLines = new Set();
-        for (let i = 0; i < lines.length; i++) {
-          if (lines[i].includes('thuban-ignore')) {
-            ignoredLines.add(i + 1); // 1-based
-            ignoredLines.add(i + 2); // Also ignore next line
-          }
-        }
-
-        // Skip files that are pattern definition files (contain regex pattern arrays)
-        // These files define what to look for, not actual violations
-        const isPatternFile = this._isPatternDefinitionFile(content);
-
-        results.stats.filesScanned++;
-
-        // ─── Language-specific checks ──────────────────────
-        if (isJS) {
-          // 1. Phantom imports — packages that don't exist
-          this._checkPhantomImports(relPath, content, lines, declaredDeps, results, ignoredLines);
-          // 2. Phantom APIs — methods that don't exist on known objects
-          if (!isPatternFile) {
-            this._checkPhantomAPIs(relPath, content, lines, results, ignoredLines);
-          }
-          // 3. AI code smells
-          this._checkAISmells(relPath, content, lines, results, ignoredLines);
-          // 4. Deprecated APIs
-          if (!isPatternFile) {
-            this._checkDeprecatedAPIs(relPath, content, lines, results, ignoredLines);
-          }
-        } else if (isPython) {
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.pythonPhantomAPIs, 'phantomAPIs');
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.pythonDeprecated, 'deprecatedAPIs');
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.pythonSmells);
-        } else if (isPHP) {
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.phpPhantomAPIs, 'phantomAPIs');
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.phpDeprecated, 'deprecatedAPIs');
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.phpSmells);
-        } else if (isRuby) {
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rubyPhantomAPIs, 'phantomAPIs');
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rubyDeprecated, 'deprecatedAPIs');
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.rubySmells);
-        } else if (isGo) {
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.goDeprecated, 'deprecatedAPIs');
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.goSmells);
-        } else if (isRust) {
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rustPhantomAPIs, 'phantomAPIs');
-          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.rustDeprecated, 'deprecatedAPIs');
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.rustSmells);
-        } else if (isJava) {
-          // Java and Kotlin share javaExtensions (.java, .kt)
-          const isKotlin = ext === '.kt';
-          if (isKotlin) {
-            this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.kotlinPhantomAPIs, 'phantomAPIs');
-            this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.kotlinDeprecated, 'deprecatedAPIs');
-            this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.kotlinSmells);
-          } else {
-            this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.javaSmells);
-          }
-        } else if (isCSharp) {
-          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.csharpSmells);
-        }
-
-      } catch (e) { /* skip unreadable */ }
-    }
-
-    results.stats.totalIssues =
-      results.phantomImports.length +
-      results.phantomAPIs.length +
-      results.aiSmells.length +
-      results.deprecatedAPIs.length +
-      results.unresolvedDeps.length;
-
-    results.stats.scanTime = Date.now() - startTime;
-
-    return results;
-  }
-
-  /**
-   * Generic language pattern checker (for phantom APIs and deprecated APIs)
-   */
-  _checkLanguagePatterns(relPath, content, lines, results, ignoredLines, patterns, resultKey) {
-    for (let i = 0; i < lines.length; i++) {
-      if (ignoredLines.has(i + 1)) continue;
-      const line = lines[i];
-      for (const check of patterns) {
-        if (check.pattern.test(line)) {
-          const entry = {
-            file: relPath,
-            line: i + 1,
-            name: check.name,
-            id: check.id,
-          };
-          if (check.suggestion) entry.suggestion = check.suggestion;
-          if (check.since) {
-            entry.since = check.since;
-            entry.fix = check.suggestion;
-          }
-          if (resultKey === 'deprecatedAPIs') {
-            results.deprecatedAPIs.push(entry);
-          } else {
-            results.phantomAPIs.push(entry);
-          }
-        }
-      }
-    }
-  }
-
-  /**
-   * Generic language smell checker
-   */
-  _checkLanguageSmells(relPath, content, lines, results, ignoredLines, smells) {
-    for (let i = 0; i < lines.length; i++) {
-      if (ignoredLines.has(i + 1)) continue;
-      const line = lines[i];
-      for (const smell of smells) {
-        if (smell.pattern.test(line)) {
-          results.aiSmells.push({
-            file: relPath,
-            line: i + 1,
-            id: smell.id,
-            name: smell.name,
-            message: smell.message,
-            type: 'ai_smell',
-            severity: 'medium',
-          });
-        }
-      }
-    }
-  }
-
-  /**
-   * Format results for terminal output
-   */
-  formatReport(results) {
-    const C = {
-      reset: '\x1b[0m', bold: '\x1b[1m',
-      red: '\x1b[31m', green: '\x1b[32m', yellow: '\x1b[33m',
-      cyan: '\x1b[36m', gray: '\x1b[90m', magenta: '\x1b[35m',
-    };
-
-    let output = '';
-    output += `\n${C.magenta}  ╔══════════════════════════════════════════════╗${C.reset}\n`;
-    output += `${C.magenta}  ║${C.bold}       THUBAN HALLUCINATION REPORT             ${C.reset}${C.magenta}║${C.reset}\n`;
-    output += `${C.magenta}  ╚══════════════════════════════════════════════╝${C.reset}\n\n`;
-
-    if (results.stats.totalIssues === 0) {
-      output += `  ${C.green}${C.bold}No hallucinations detected.${C.reset} ${C.gray}Clean codebase.${C.reset}\n\n`;
-      return output;
-    }
-
-    // Phantom imports
-    if (results.phantomImports.length > 0) {
-      output += `  ${C.red}${C.bold}Phantom Imports (${results.phantomImports.length})${C.reset}\n`;
-      output += `  ${C.gray}Packages that don't exist in package.json or node_modules${C.reset}\n\n`;
-      for (const item of results.phantomImports.slice(0, 10)) {
-        output += `    ${C.red}✗${C.reset} ${C.cyan}${item.file}${C.reset}:${item.line}\n`;
-        output += `      ${C.yellow}${item.module}${C.reset} ${C.gray}— ${item.reason}${C.reset}\n`;
-      }
-      if (results.phantomImports.length > 10) {
-        output += `    ${C.gray}... and ${results.phantomImports.length - 10} more${C.reset}\n`;
-      }
-      output += '\n';
-    }
-
-    // Phantom APIs
-    if (results.phantomAPIs.length > 0) {
-      output += `  ${C.red}${C.bold}Phantom APIs (${results.phantomAPIs.length})${C.reset}\n`;
-      output += `  ${C.gray}Methods/properties that don't exist on their objects${C.reset}\n\n`;
-      for (const item of results.phantomAPIs.slice(0, 10)) {
-        const ruleId = item.id ? `${C.gray}[${item.id}]${C.reset} ` : '';
-        output += `    ${C.red}✗${C.reset} ${ruleId}${C.cyan}${item.file}${C.reset}:${item.line}\n`;
-        output += `      ${C.yellow}${item.name}${C.reset} ${C.gray}— ${item.suggestion}${C.reset}\n`;
-        output += `      ${C.gray}Suppress: // thuban-ignore ${item.id || 'HALL_API'}${C.reset}\n`;
-      }
-      if (results.phantomAPIs.length > 10) {
-        output += `    ${C.gray}... and ${results.phantomAPIs.length - 10} more${C.reset}\n`;
-      }
-      output += '\n';
-    }
-
-    // AI code smells
-    if (results.aiSmells.length > 0) {
-      output += `  ${C.yellow}${C.bold}AI Code Smells (${results.aiSmells.length})${C.reset}\n`;
-      output += `  ${C.gray}Patterns typical of AI-generated code that needs review${C.reset}\n\n`;
-      for (const item of results.aiSmells.slice(0, 10)) {
-        output += `    ${C.yellow}!${C.reset} ${C.cyan}${item.file}${C.reset}:${item.line}\n`;
-        output += `      ${C.gray}${item.message}${C.reset}\n`;
-      }
-      if (results.aiSmells.length > 10) {
-        output += `    ${C.gray}... and ${results.aiSmells.length - 10} more${C.reset}\n`;
-      }
-      output += '\n';
-    }
-
-    // Deprecated APIs
-    if (results.deprecatedAPIs.length > 0) {
-      output += `  ${C.yellow}${C.bold}Deprecated APIs (${results.deprecatedAPIs.length})${C.reset}\n`;
-      output += `  ${C.gray}APIs that LLMs still suggest but are deprecated or removed${C.reset}\n\n`;
-      for (const item of results.deprecatedAPIs.slice(0, 10)) {
-        output += `    ${C.yellow}⚠${C.reset} ${C.cyan}${item.file}${C.reset}:${item.line}\n`;
-        output += `      ${C.yellow}${item.name}${C.reset} ${C.gray}(deprecated since ${item.since})${C.reset}\n`;
-        output += `      ${C.green}→${C.reset} ${C.gray}${item.suggestion}${C.reset}\n`;
-      }
-      if (results.deprecatedAPIs.length > 10) {
-        output += `    ${C.gray}... and ${results.deprecatedAPIs.length - 10} more${C.reset}\n`;
-      }
-      output += '\n';
-    }
-
-    // Summary
-    output += `  ${C.bold}Summary:${C.reset} ${C.cyan}${results.stats.filesScanned}${C.reset} files scanned, `;
-    output += `${results.stats.totalIssues > 0 ? C.red : C.green}${results.stats.totalIssues}${C.reset} hallucination issues found `;
-    output += `${C.gray}(${results.stats.scanTime}ms)${C.reset}\n\n`;
-
-    return output;
-  }
-
-  // ─── Private Methods ─────────────────────────────────────
-
-  _loadDeclaredDeps() {
-    const deps = new Set();
-    // Collect all package.json files — root + subdirectories (monorepo support)
-    this._packageJsonPaths = new Map(); // dir -> Set<dep names>
-    this._collectPackageJsonDeps(this.config.rootPath, deps, 0);
-    return deps;
-  }
-
-  /**
-   * Recursively collect deps from all package.json files in the project.
-   * Handles monorepos: workspaces, packages/*, apps/*, etc.
-   * Max depth prevents scanning into node_modules.
-   */
-  _collectPackageJsonDeps(dir, globalDeps, depth) {
-    if (depth > 5) return; // Don't go too deep
-    try {
-      const pkgPath = path.join(dir, 'package.json');
-      if (fs.existsSync(pkgPath)) {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
-        const localDeps = new Set();
-        for (const name of Object.keys(pkg.dependencies || {})) { globalDeps.add(name); localDeps.add(name); }
-        for (const name of Object.keys(pkg.devDependencies || {})) { globalDeps.add(name); localDeps.add(name); }
-        for (const name of Object.keys(pkg.peerDependencies || {})) { globalDeps.add(name); localDeps.add(name); }
-        this._packageJsonPaths.set(dir, localDeps);
-      }
-
-      // Scan subdirectories for more package.json files
-      // Skip node_modules, .git, dist, build, coverage
-      const skipDirs = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.next', '.cache', 'vendor']);
-      const entries = fs.readdirSync(dir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (entry.isDirectory() && !skipDirs.has(entry.name) && !entry.name.startsWith('.')) {
-          this._collectPackageJsonDeps(path.join(dir, entry.name), globalDeps, depth + 1);
-        }
-      }
-    } catch (e) { /* skip unreadable dirs */ }
-  }
-
-  _checkPhantomImports(relPath, content, lines, declaredDeps, results, ignoredLines = new Set()) {
-    // Match require() and import statements
-    const requireRegex = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-    const importRegex = /import\s+.*?from\s+['"]([^'"]+)['"]/g;
-    const dynamicImportRegex = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-
-    const allImportRegexes = [requireRegex, importRegex, dynamicImportRegex];
-
-    for (const regex of allImportRegexes) {
-      let match;
-      while ((match = regex.exec(content)) !== null) {
-        const moduleName = match[1];
-
-        // Skip relative imports
-        if (moduleName.startsWith('.') || moduleName.startsWith('/')) continue;
-
-        // Skip builtins
-        const baseModule = moduleName.split('/')[0];
-        if (this.builtins.has(moduleName) || this.builtins.has(baseModule)) continue;
-
-        // Skip scoped packages base
-        const scopedBase = moduleName.startsWith('@')
-          ? moduleName.split('/').slice(0, 2).join('/')
-          : baseModule;
-
-        // Check if declared in any package.json (root or workspace)
-        if (!declaredDeps.has(scopedBase)) {
-          // Check if it physically exists in any node_modules (root or nearest parent)
-          const nmExists = this._findInNodeModules(file, scopedBase);
-          if (!nmExists) {
-            // Find line number
-            const lineIdx = this._findLineNumber(content, match.index);
-
-            // Skip if on an ignored line
-            if (ignoredLines.has(lineIdx)) continue;
-
-            // Check if it's a known phantom
-            const isKnownPhantom = this.phantomPackages.has(moduleName);
-
-            results.phantomImports.push({
-              file: relPath,
-              line: lineIdx,
-              module: moduleName,
-              reason: isKnownPhantom
-                ? 'Known AI-hallucinated package — does not exist on npm'
-                : 'Not in package.json and not in node_modules',
-              severity: isKnownPhantom ? 'critical' : 'high',
-              fixable: false,
-            });
-          }
-        }
-      }
-    }
-  }
-
-  _checkPhantomAPIs(relPath, content, lines, results, ignoredLines = new Set()) {
-    for (const api of this.phantomAPIs) {
-      let match;
-      const regex = new RegExp(api.pattern.source, api.pattern.flags + (api.pattern.flags.includes('g') ? '' : 'g'));
-      while ((match = regex.exec(content)) !== null) {
-        const lineIdx = this._findLineNumber(content, match.index);
-        if (ignoredLines.has(lineIdx)) continue;
-        // Skip if inside a string literal or regex pattern (common in pattern definition files)
-        const line = lines[lineIdx - 1] || '';
-        if (this._isInsidePattern(line, match[0])) continue;
-        results.phantomAPIs.push({
-          file: relPath,
-          line: lineIdx,
-          name: api.name,
-          id: api.id,
-          suggestion: api.suggestion,
-          severity: 'high',
-          fixable: true,
-          fixAction: 'replace_phantom_api',
-        });
-      }
-    }
-  }
-
-  _checkAISmells(relPath, content, lines, results, ignoredLines = new Set()) {
-    for (const smell of this.aiCodeSmells) {
-      let match;
-      const regex = new RegExp(smell.pattern.source, smell.pattern.flags + (smell.pattern.flags.includes('g') ? '' : 'g'));
-      while ((match = regex.exec(content)) !== null) {
-        const lineIdx = this._findLineNumber(content, match.index);
-        if (ignoredLines.has(lineIdx)) continue;
-        results.aiSmells.push({
-          file: relPath,
-          line: lineIdx,
-          id: smell.id,
-          name: smell.name,
-          message: smell.message,
-          severity: 'warning',
-          code: lines[lineIdx - 1]?.trim().substring(0, 100),
-        });
-      }
-    }
-  }
-
-  _checkDeprecatedAPIs(relPath, content, lines, results, ignoredLines = new Set()) {
-    for (const api of this.deprecatedAPIs) {
-      let match;
-      const regex = new RegExp(api.pattern.source, api.pattern.flags + (api.pattern.flags.includes('g') ? '' : 'g'));
-      while ((match = regex.exec(content)) !== null) {
-        const lineIdx = this._findLineNumber(content, match.index);
-        if (ignoredLines.has(lineIdx)) continue;
-        const line = lines[lineIdx - 1] || '';
-        if (this._isInsidePattern(line, match[0])) continue;
-        results.deprecatedAPIs.push({
-          file: relPath,
-          line: lineIdx,
-          name: api.name,
-          id: api.id,
-          suggestion: api.suggestion,
-          since: api.since,
-          severity: 'warning',
-          fixable: true,
-          fixAction: 'update_deprecated_api',
-        });
-      }
-    }
-  }
-
-  _findLineNumber(content, charIndex) {
-    let line = 1;
-    for (let i = 0; i < charIndex && i < content.length; i++) {
-      if (content[i] === '\n') line++;
-    }
-    return line;
-  }
-
-  /**
-   * Detect if a file is a pattern definition file (like this detector itself)
-   * These files contain regex patterns that reference the APIs they detect
-   */
-  _isPatternDefinitionFile(content) {
-    // Count regex pattern definitions — if file has many, it's likely a detector/rule file
-    const regexPatterns = (content.match(/pattern:\s*\//g) || []).length;
-    const phantomRefs = (content.match(/phantom|hallucin/gi) || []).length;
-    return regexPatterns > 5 && phantomRefs > 2;
-  }
-
-  /**
-   * Check if a match is inside a regex pattern, string literal, or comment
-   */
-  _isInsidePattern(line, matchText) {
-    const trimmed = line.trim();
-    // Inside a regex pattern definition
-    if (/pattern:\s*\//.test(trimmed)) return true;
-    // Inside a comment
-    if (trimmed.startsWith('//') || trimmed.startsWith('*')) return true;
-    // Inside a string that's defining a name/suggestion/message
-    if (/(?:name|suggestion|message|description):\s*['"]/.test(trimmed)) return true;
-    return false;
-  }
-
-  /**
-   * Load ignore rules from .thubanrc.json
-   */
-  _loadIgnoreRules() {
-    const ignoreFiles = [];
-    try {
-      const rcPath = path.join(this.config.rootPath, '.thubanrc.json');
-      const rc = JSON.parse(fs.readFileSync(rcPath, 'utf-8'));
-      if (rc.hallucination?.ignore) {
-        ignoreFiles.push(...rc.hallucination.ignore);
-      }
-      if (rc.ignore) {
-        ignoreFiles.push(...rc.ignore);
-      }
-    } catch (e) { /* no config file */ }
-    return ignoreFiles;
-  }
-
-  /**
-   * Walk up directory tree from file location to project root,
-   * checking each node_modules directory for the package.
-   * This handles monorepos where deps are installed at workspace level.
-   */
-  _findInNodeModules(filePath, packageName) {
-    let dir = path.dirname(filePath);
-    const root = this.config.rootPath;
-
-    // Walk up from file to root, checking each node_modules
-    while (dir.length >= root.length) {
-      const nmPath = path.join(dir, 'node_modules', packageName);
-      try {
-        if (fs.existsSync(nmPath)) return true;
-      } catch (e) { /* skip */ }
-
-      const parent = path.dirname(dir);
-      if (parent === dir) break; // reached filesystem root
-      dir = parent;
-    }
-
-    return false;
-  }
-}
-
-module.exports = HallucinationDetector;