[Vardhman Gupta (Kaap10)]

Description

PackageHallucinationScorer checks model-generated code for imports or requires of non-existent packages (OWASP LLM02).

In the Ruby ecosystem (PackageEcosystem.RUBY), the extraction regex previously used ([a-zA-Z0-9_-]+) and required whitespace immediately after require/gem:

PackageEcosystem.RUBY: [
    re.compile(r"^\s*require\s+['\"]([a-zA-Z0-9_-]+)['\"]", re.MULTILINE),
    re.compile(r"^\s*gem\s+['\"]([a-zA-Z0-9_-]+)['\"]", re.MULTILINE),
],

This caused two detection gaps:

1. Subpath requires: Common Ruby requires referencing gem subpaths (e.g. require 'active_support/core_ext', require 'aws-sdk-s3/resource', require 'google/cloud/storage', require 'fake_gem/core') were rejected because / was forbidden in the capture group.
2. Parenthesized method calls: require("gem_name"), require ("gem_name"), and gem("rails", "~> 7.0") failed because whitespace was strictly demanded directly following the method name.

This PR:

• Extends the Ruby extraction regexes to accept optional parentheses (?:\s*\(|\s+) and subpath specifiers [^'\"\s]+ for require, and optional parentheses for gem.
• Reduces Ruby subpath requires to their root gem names in _extract_package_references (reference.split("/", 1)[0]) and ignores local relative and absolute paths (not reference.startswith((".", "/"))), bringing Ruby to architectural parity with the JavaScript ecosystem.
• Updates module docstrings to document Ruby subpath handling.

Fixes #3692

Tests and Documentation

• Added 14 test cases in test_ruby_extracts_subpath_and_parenthesized_requires testing subpath requires, parenthesized requires, version constraints, and indentation.
• Added 11 test cases in test_ruby_ignores_relative_and_absolute_paths verifying that relative paths (./, ../), absolute paths (/), require_relative, and comments are ignored.
• Added test_ruby_scores_hallucinated_subpath_package_async verifying end-to-end scoring where known subpath packages score False and hallucinated subpath packages score True with accurate rationale and metadata.
• All 227 tests in test_package_hallucination_scorer.py pass.
• All 33 tests in test_package_hallucination.py pass.
• All 1,210 tests in tests/unit/score/regex/ pass.
• Verified style with ruff check and ruff format.

[Roman Lutz (romanlutz)]

The additional Ruby syntax support is useful, but the newly matched inputs have correctness and performance problems. The concrete cases are inline.

[Vardhman Gupta (Kaap10)]

Thanks for thorough review Roman Lutz (@romanlutz), addressed in the latest commit.

[Roman Lutz (romanlutz)]

The update addresses the explicit feature extensions, interpolation examples, Windows paths, and the original overlapping-whitespace regex. I found two additional problems in the revised implementation. This pass is source-only: the new unbounded candidate expansion keeps the execution safety hold in place, so I did not run the updated code or tests.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[Vardhman Gupta (Kaap10)]

Roman Lutz (@romanlutz), thanks for the feedback! In the latest commit, we bounded candidate expansion to 255 chars / 5 segments (with a 4,096-component performance control test) and enabled multiline parenthesized require/gem calls tested via the public score_message_async entry point. We also eliminated arbitrary underscore stripping to reject near-names like j_s_o_n and review_ghost, explicitly mapping standard Rails aliases instead. All 245 tests and type checks pass cleanly.

[Roman Lutz (romanlutz)]

i'll make a couple fixes but this looks great!