Broaden OutputValidator hallucination check to cover more file extensions (closes #8) (#153)

The backticked-path regex only matched a fixed extension allowlist, so
hallucinated references in languages and config formats outside that list
(.tf, .tfvars, .hcl, .kts, .ini, .env, lockfiles, and more) were never
considered and shipped through untouched.

Replace the fixed-alternation regex with one that captures any path-shaped
token plus its extension, then judge candidates against KNOWN_EXTENSIONS
unioned with extensions derived from the scanned project's own source files.
Add poetry.lock to the well-known basenames and drop the dead bare .env entry
so directory-qualified config/.env is flagged. Silent stripping behavior is
unchanged.

Author: acltabontabon

CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - **Provider-agnostic TUI symbols**: Renamed `AppState.ollamaStatus` to `llmProviderStatus`; renamed matching helpers in `WelcomeView` (`ollamaReady/Dot/Label/Detail` -> `llmProviderReady/Dot/Label/Detail`), `Footer` (`ollamaState` -> `llmProviderState`), and `SettingsView`. The system-check card now derives the service row label from the resolved provider's `displayName()` instead of hardcoding "Ollama". Error hints in `buildLlmErrorMessage` are driven by the resolved provider name (falling back to "the local model server") rather than hardcoding "Ollama". The `/settings` command palette description now reads "Configure LLM provider and remote standards repo" (closes #27).
 
+### Fixed
+- **Hallucinated-path detection coverage**: The generated-context cleaner now recognizes file references in languages and config formats its fixed extension allowlist previously skipped (Terraform `.tf`/`.tfvars`/`.hcl`, Kotlin script `.kts`, `.ini`, `.env`, lockfiles, and more), so invented paths like `infra/variables.tf` or `config/app.ini` are stripped instead of shipping. Recognized extensions are now unioned with those used by the scanned project's own source files, so an unusual real extension is honored without hardcoding. Directory-qualified `config/.env` references are now flagged (bare `.env` remains a convention reference) (closes #8).
+
 ### Added
 - **Project readiness view model**: `ReadinessViewMapper` turns a `ReadinessResult` plus project identity (name, path, type label) into a presentation-ready `ProjectReadinessView` - badge status, reason lines, the single recommended action, and the valid action menu. The mapper is the single place that decides which actions each status permits (deriving both the recommended action and the menu from status, never copying the evaluator's pre-set action), so the dashboard, CLI `--json`, and MCP render identical badges and actions; `PREPARE` is never offered for `UNSUPPORTED` or `IGNORED` (closes #136).
 - **Workspace configuration store**: A `WorkspaceConfigService` backed by `~/.launchpad/config.yml` is now the single source of truth for which directories Launchpad scans. It persists workspace `roots` (replace the built-in defaults when set), `additionalRoots` (appended to defaults only when `roots` is unset), an `ignored` list, scan `depth` (clamped 1-5, default 3), and a `detectGitOnly` gate (default true). `~` and `~/<subpath>` expand to absolute paths on read; an absent file means "use defaults" and a parse failure warns and falls back to defaults instead of erroring. TUI project discovery and live search now read roots/depth/ignored from the store and only surface build-roots that are also git repositories when `detectGitOnly` is on (closes #125).

src/main/java/com/acltabontabon/launchpad/ai/OutputValidator.java

@@ -19,8 +19,32 @@
 public final class OutputValidator {
 
     private static final int MIN_CONTENT_CHARS = 120;
+    // Matches any backticked, path-shaped token bearing a trailing extension.
+    // Group 1 = full ref, group 2 = extension. The fixed extension allowlist
+    // moved out of the regex into KNOWN_EXTENSIONS (plus per-project extensions
+    // derived from the scan) - see findHallucinatedRefs. The prefix requires at
+    // least one char before the final dot, so a bare `.env` token is never
+    // matched and multi-dot paths (`infra/dev.tfvars`) resolve greedily.
     private static final Pattern BACKTICKED_PATH = Pattern.compile(
-        "`([A-Za-z0-9_\\-./]+\\.(java|kt|py|ts|tsx|js|jsx|go|rs|cs|rb|swift|xml|yml|yaml|toml|json|md|properties))`");
+        "`([A-Za-z0-9_\\-./]+\\.([A-Za-z0-9]+))`");
+    // File extensions (lowercase, no dot) we recognize as real source / config
+    // formats. A backticked token whose extension is outside this set - and not
+    // present among the scanned project's own source files - is left untouched,
+    // preserving the validator's conservative bias against false positives.
+    private static final Set<String> KNOWN_EXTENSIONS = Set.of(
+        // JVM
+        "java", "kt", "kts", "gradle", "groovy", "scala",
+        // Scripting / web
+        "py", "ts", "tsx", "js", "jsx", "mjs", "cjs", "rb", "php",
+        // Systems
+        "go", "rs", "cs", "swift", "c", "h", "cpp", "hpp",
+        // Data / scripts
+        "sql", "sh", "bash",
+        // Config / markup
+        "xml", "yml", "yaml", "toml", "json", "json5", "properties",
+        "ini", "env", "conf", "cfg", "tf", "tfvars", "hcl", "lock",
+        // Docs / misc
+        "md", "txt", "imports");
     // Spring profile config convention: application-<profile>.{properties,yml,yaml}.
     // These are real files in countless Spring projects even when the scanner
     // didn't find one - the model citing them is a convention reference, not a
@@ -59,13 +83,14 @@ public CleanResult cleanHallucinations(String content, ProjectContext ctx) {
         if (content == null || content.isBlank()) return new CleanResult(content, 0);
         Set<String> sourceSet = new HashSet<>(ctx.sourceFiles());
         Set<String> basenames = buildBasenameAllowlist(ctx);
+        Set<String> extensions = buildExtensionAllowlist(ctx);
 
         var lines = content.split("\n", -1);
         var out = new StringBuilder();
         int stripped = 0;
         for (int i = 0; i < lines.length; i++) {
             var line = lines[i];
-            var hallucinated = findHallucinatedRefs(line, sourceSet, basenames);
+            var hallucinated = findHallucinatedRefs(line, sourceSet, basenames, extensions);
             if (hallucinated.isEmpty()) {
                 out.append(line);
             } else if (isBulletLine(line)) {
@@ -117,10 +142,13 @@ private static boolean isBulletLine(String line) {
         "requirements.txt", "setup.py", "pyproject.toml", "Pipfile",
         // Rust / Go / Ruby / .NET
         "Cargo.toml", "Cargo.lock", "go.mod", "go.sum",
-        "Gemfile", "Gemfile.lock", "Rakefile",
+        "Gemfile", "Gemfile.lock", "Rakefile", "poetry.lock",
         // Docker / infra
         "Dockerfile", "docker-compose.yml", "docker-compose.yaml",
-        ".gitignore", ".dockerignore", ".env", ".env.example"
+        // Note: bare ".env" is intentionally NOT allowlisted - the path regex
+        // never matches a bare dotfile token, so the entry only ever affected
+        // directory-qualified refs like `config/.env`, which we want flagged.
+        ".gitignore", ".dockerignore", ".env.example"
     );
 
     private static Set<String> buildBasenameAllowlist(ProjectContext ctx) {
@@ -134,11 +162,35 @@ private static Set<String> buildBasenameAllowlist(ProjectContext ctx) {
         return basenames;
     }
 
-    private static List<String> findHallucinatedRefs(String line, Set<String> sourceSet, Set<String> basenames) {
+    /**
+     * Recognized file extensions for this scan: the static {@link #KNOWN_EXTENSIONS}
+     * set unioned with the extensions actually present among the project's source
+     * files. The union means a project using an uncommon extension still has that
+     * extension treated as a real file type, even when it is not hardcoded.
+     */
+    private static Set<String> buildExtensionAllowlist(ProjectContext ctx) {
+        Set<String> extensions = new HashSet<>(KNOWN_EXTENSIONS);
+        for (var p : ctx.sourceFiles()) {
+            int slash = Math.max(p.lastIndexOf('/'), p.lastIndexOf('\\'));
+            String basename = slash < 0 ? p : p.substring(slash + 1);
+            int dot = basename.lastIndexOf('.');
+            if (dot >= 0 && dot < basename.length() - 1) {
+                extensions.add(basename.substring(dot + 1).toLowerCase());
+            }
+        }
+        return extensions;
+    }
+
+    private static List<String> findHallucinatedRefs(
+        String line, Set<String> sourceSet, Set<String> basenames, Set<String> extensions
+    ) {
         var hits = new ArrayList<String>();
         Matcher m = BACKTICKED_PATH.matcher(line);
         while (m.find()) {
             String ref = m.group(1);
+            // Only judge tokens whose extension we recognize as a real file
+            // type; anything else is left untouched (e.g. `e.g.`, `v1.2`).
+            if (!extensions.contains(m.group(2).toLowerCase())) continue;
             String basename = ref.contains("/") ? ref.substring(ref.lastIndexOf('/') + 1) : ref;
             if (sourceSet.contains(ref) || basenames.contains(basename)) continue;
             if (SPRING_PROFILE_CONFIG.matcher(basename).matches()) continue;

src/test/java/com/acltabontabon/launchpad/eval/OutputValidatorTest.java

@@ -3,8 +3,11 @@
 import static org.assertj.core.api.Assertions.assertThat;
 
 import com.acltabontabon.launchpad.ai.OutputValidator;
+import com.acltabontabon.launchpad.scanner.ProjectContext;
+import com.acltabontabon.launchpad.scanner.StackProfile;
 import com.acltabontabon.launchpad.springboot.scanner.ProjectScanner;
 import java.util.List;
+import java.util.Map;
 import org.junit.jupiter.api.Test;
 
 /**
@@ -69,6 +72,68 @@ void cleanHallucinationsAllowsSpringProfileConfigConvention() throws Exception {
         assertThat(clean.content()).contains("application-prod.properties");
     }
 
+    @Test
+    void cleanHallucinationsStripsInventedInfraAndConfigPaths() throws Exception {
+        var root = FixtureSupport.fixturePath("spring-boot");
+        var ctx = ProjectScanner.forTesting().scan(root.toString(), msg -> { });
+
+        // Each invented path uses an extension that the old fixed-allowlist regex
+        // never matched (.tf, .tfvars, .kts, .ini, .env). A real fixture path is
+        // mixed in to guard against over-stripping.
+        String output = """
+            Provision with `infra/variables.tf` and `infra/dev.tfvars`.
+            Release via `gradle/scripts/release.kts`; tune `config/app.ini` and `config/.env`.
+            The real service is `src/main/java/com/example/users/UserService.java`.
+            """;
+
+        var clean = validator.cleanHallucinations(output, ctx);
+        assertThat(clean.strippedCount()).isEqualTo(5);
+        assertThat(clean.content())
+            .doesNotContain("variables.tf")
+            .doesNotContain("dev.tfvars")
+            .doesNotContain("release.kts")
+            .doesNotContain("app.ini")
+            .doesNotContain("config/.env");
+        assertThat(clean.content()).contains("UserService.java");
+    }
+
+    @Test
+    void cleanHallucinationsRecognizesProjectDerivedExtensions() {
+        // `.fooext` is in no static allowlist - it is recognized only because the
+        // scanned project lists a real source file with that extension.
+        var ctx = new ProjectContext(
+            "demo", "/tmp", StackProfile.unknown(),
+            List.of("schema/model.fooext"),
+            List.of(), Map.of(), List.of(), Map.of(), List.of(), null);
+
+        String output = """
+            The schema lives in `schema/model.fooext`.
+            But `docs/missing.fooext` does not exist.
+            """;
+
+        var clean = validator.cleanHallucinations(output, ctx);
+        assertThat(clean.strippedCount()).isEqualTo(1);
+        assertThat(clean.content()).contains("schema/model.fooext");
+        assertThat(clean.content()).doesNotContain("docs/missing.fooext");
+    }
+
+    @Test
+    void cleanHallucinationsStillStripsAlreadySupportedExtensions() throws Exception {
+        // Regression guard: .go / .yaml already matched before this change.
+        var root = FixtureSupport.fixturePath("spring-boot");
+        var ctx = ProjectScanner.forTesting().scan(root.toString(), msg -> { });
+
+        String output = """
+            See `cmd/server/main.go` and `config/app.yaml` for the invented bits.
+            """;
+
+        var clean = validator.cleanHallucinations(output, ctx);
+        assertThat(clean.strippedCount()).isEqualTo(2);
+        assertThat(clean.content())
+            .doesNotContain("main.go")
+            .doesNotContain("app.yaml");
+    }
+
     @Test
     void passesWhenAllSectionsPresentAndPathsReal() throws Exception {
         var root = FixtureSupport.fixturePath("spring-boot");