fix: treat [0] document references as out of range in AnswerBuilder

[vidigoat]

Related Issues

• None filed — bug found while reviewing the reference-extraction path; happy to open one if preferred.

Proposed Changes:

AnswerBuilder documents references as 1-based, so extracted indices are decremented by 1. When an LLM cites [0] (LLMs frequently 0-index), the extracted index becomes -1. The out-of-range guard relies on documents[idx] raising IndexError, but Python resolves documents[-1] to the last document — so the guard never fires and an unrelated document is silently attached to the answer, marked referenced=True with a bogus source_index=0:

docs = [Document(content="doc A"), Document(content="doc B"), Document(content="doc C")]
builder = AnswerBuilder(reference_pattern="\[(\d+)\]")
out = builder.run(query="q", replies=["The answer is X [0]"], documents=docs)
# before: doc C attached, referenced=True, source_index=0
# after:  no doc attached + warning "Document index '0' ... is out of range."

Expanded reference ranges starting at 0 ([0-1], expand_reference_ranges=True) hit the same hole via range(start - 1, end).

Fix: replace the try/except IndexError with an explicit bounds check (0 <= idx < len(documents)), keeping the exact same warning message and skip behaviour for all out-of-range references.

How did you test it?

• Repro script run on main (wrong doc attached) and with the fix (warning + no doc) for both [0] and [0-1].
• Two new unit tests ([0] and [0-1]-range cases), which fail on main and pass with the fix.
• Full test/components/builders/test_answer_builder.py: 32 passed.

Notes for the reviewer

• No behaviour change for valid or too-large references — only negative indices, which were previously impossible to reject.
• Aware of open PR fix: AnswerBuilder returned referenced documents in scrambled order #11953 touching the same loop for referenced-doc ordering; this change is 3 lines and easy to rebase either way.
• Disclaimer per contributing guidelines: this fix was AI-assisted; I reviewed it and ran the repro and tests locally.

Checklist

• I have read the contributors guidelines and the code of conduct.
• I have updated the related issue with new insights and changes.
• I have added unit tests and updated the docstrings.
• I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test: and added ! in case the PR includes breaking changes.
• I have documented my code.
• I have added a release note file, following the contributors guidelines.
• I have run pre-commit hooks and fixed any issue.

[vercel]

@vidigoat is attempting to deploy a commit to the deepset Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack/components/builders
answer_builder.py
Project Total

This report was generated by python-coverage-comment-action

[sjrl]

Thanks!