aboutsummaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2026-07-20test(show-command): ignore test_self over UTC-only date() timezone gapnsfisis
The shim date() renders in UTC only (no timezone database) while PHP's date() uses the system default timezone, so get_relative_time misses the "today" match and prints "this week" whenever the local date differs from the UTC date (daily 00:00-09:00 JST on this machine). Verified by running the test with and without TZ=UTC at 07:40 JST. Mark the gap with a TODO(phase-c) in the shim; fixing it needs a timezone database (a new crate), which is a user decision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(cli-tests): detail run_diagnose ignore reasonnsfisis
Measured the actual panic site: DiagnoseCommand::check_platform reaches the todo!() ob_start()/ob_get_clean() shims while capturing phpinfo(), the same root cause already recorded in tests/command/diagnose_command_test.rs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(require-command): drop input borrows before determine_requirementsnsfisis
The Ref temporaries created by input.borrow() inside the argument expressions of the determine_requirements call lived until the end of the whole call statement, so ConsoleIO::ask_question's borrow_mut() on the same shared input RefCell panicked with "RefCell already borrowed" when the command prompted for packages. Hoist the argument computations into locals so no borrow is held across the call, and un-ignore the run_require CLI test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(zip): detail why the zip-extension test stays ignorednsfisis
PHP only runs this test when the zip extension is not loaded; the Rust port has unconditional zip support, so that precondition cannot exist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(repository-manager): un-ignore test_repo_creationnsfisis
The ignore reason was stale: create_repository_by_class now dispatches every repository class this test registers, and the test passes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(github-driver): defer get_branches until tags search missesnsfisis
PHP's `?:` chain in getComposerInformation short-circuits, so getBranches() only runs when the tags search is falsy. The eager port issued an extra git/refs/heads API request that PHP never makes. Un-ignore test_public_repository_archived, which this fixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(platform-repository): name real test_library_information blockersnsfisis
The previous ignore reason blamed unmodeled extension info; the actual blockers are the TODO(plugin) stubs resource_bundle_get (returns Null, dropping lib-icu-cldr) and imagick_get_version_string (returns "", dropping lib-imagick-imagemagick), both pending dynamic method dispatch on PHP objects via the plugin RPC mechanism. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(composer-repository): un-ignore test_what_providesnsfisis
The ignore reason went stale: AliasPackage::get_source_type is implemented (delegates to alias_of) and the test passes as-is. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(semver): stop classical pattern matching 6+ digit versionsnsfisis
The regex crate parses PCRE's possessive \d{1,5}+ as a stacked repetition (?:\d{1,5})+, i.e. \d+, so date versions like 20121020 matched the classical pattern and normalized to 20121020.0.0.0 instead of falling through to the date(time) pattern like PHP. The plain \d{1,5} is equivalent to the possessive form here per the regex-porting rules. Un-ignore test_find_recommended_require_version which this had blocked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(config): drop insecure git protocol under secure-httpnsfisis
Config::get("github-protocols") ported PHP's array_search over the protocol list via a string-keyed map, but array_search_mixed returns the matched index as PhpMixed::Int, which the as_string() read never matched, so the git protocol was never removed (Config.php:447-449 removes it whenever secure-http is on). Search the list directly and read the index as an Int. Un-ignore test_update_throws_runtime_exception_if_git_command_fails which this had blocked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(config): restore PHP (int) cast for ttl and timeout valuesnsfisis
PHP's Config::get() applies an (int) cast to cache-files-ttl, cache-ttl, and the process-timeout env override (Config.php:326,367,398), so string values like '99999999' become integers. The strict PhpMixed::as_int returned None for strings, collapsing them to 0. Use the intval shim, which implements the PHP cast, and un-ignore test_cache_garbage_collection_is_called which this had blocked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(update-command): un-ignore test_interactive_tmp via assoc select choicesnsfisis
PHP's UpdateCommand::getPackagesInteractively passes $autocompleterValues keyed by package name to $io->select, so the selection resolves to package names. The port passed only the keys as a list, making select resolve to a numeric index that the update then treated as an unknown package. The old ignore reason (non-interactive terminal error) no longer applied. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(run-script-command): pass script choices as assoc array in interactnsfisis
PHP's RunScriptCommand::interact passes $options keyed by script name, so select resolves the entered value to the script name and sets it as the script argument. The port passed only the keys as a list, which made select resolve to a numeric index instead of the script name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(io): widen IOInterface::select choices to PhpMixed for assoc arraysnsfisis
PHP's IOInterface::select accepts an associative choices array whose keys are the selectable values, but the port narrowed it to Vec<String>, making key-based selection unrepresentable. Accept PhpMixed (List or Array) like PHP's array $choices; ConsoleIO already branched on both shapes internally. Also mirror PHP in the single-select array_search fallback for numeric-keyed arrays. All call sites keep their previous list-based behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(path-repository): un-ignore test_url_remains_relativensfisis
The PHP test implicitly requires the process cwd to be an ancestor of the Fixtures dir (phpunit runs inside the composer checkout); cargo runs tests from the crate manifest dir, which is not. Replicate the phpunit precondition with a drop-restoring CwdGuard chdir'ing to the __DIR__ equivalent, and serialize it (together with the only other cwd-mutating test in the repository binary, test_repository_writes_installed_php) via #[serial] so the process-global cwd cannot race. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(installation-manager): un-ignore test_add_remove_installernsfisis
Add the __add_installer test seam that registers an installer as a pre-built Rc handle, so the test can reproduce PHP's object-identity semantics (assertSame / removeInstaller) via Rc::ptr_eq; add_installer cannot serve because Rc::from(Box) reallocates, losing the caller's pointer identity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(run-script-command): detail dev-mode test ignore blockersnsfisis
Re-verified the reason: besides the missing as_any seam on EventInterface (a cross-cutting trait change over every event type), the mocked dispatchScript call expectation is also inexpressible since dispatch_script is a concrete method with no call-recording seam. Record both blockers in the ignore string and TODO(phase-d) comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(console-io): un-ignore test_write_error via setErrorOutputnsfisis
The ignore reason had rotted: ConsoleOutputInterface::set_error_output is already ported, so a BufferedOutput error sink can be injected into a real ConsoleOutput and the error-routed write read back, matching the file's convention of replacing PHPUnit mock expectations with BufferedOutput assertions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(event-dispatcher): un-ignore test_dispatcher_support_for_additional_argsnsfisis
The only missing seam was the PHP test's ReflectionMethod(getPhpExecCommand) access; add the test-only __get_php_exec_command wrapper and port the test on the existing get_listeners override and process-executor mock infrastructure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(auditor): restore instanceof ConsoleIO semantics for BufferIOnsfisis
PHP's BufferIO extends ConsoleIO, so $io instanceof ConsoleIO matches it; the port models that inheritance as composition, making the plain ConsoleIO downcast reject BufferIO and throw where PHP renders tables. Also try a BufferIO downcast and unwrap its inner ConsoleIO, which unblocks the two FORMAT_TABLE cases and un-ignores test_audit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(symfony-table): implement formatter_is_wrappablensfisis
The PHP instanceof WrappableOutputFormatterInterface check always holds here: OutputFormatter is the sole OutputFormatterInterface implementor in the port and it implements the wrappable interface, so the former todo!() can return true for every representable formatter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(installation-manager): detail test_execute ignore reasonnsfisis
Spell out why the existing __new_mock seam cannot serve: it replaces execute() wholesale (skipping the download step, ref InstallationManagerMock), while the PHP test runs the real execute() and spies only on the three per-operation methods it dispatches to. A per-method spy on the real path would be a production design change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(event-dispatcher): correct dev-mode test ignore reasonnsfisis
The old reason blamed missing mock infrastructure, but a spy against dyn AutoloadGeneratorInterface is perfectly writable. The actual blocker is that make_autoloader (PHP makeAutoloader, called from doDispatch's script branches, where setDevMode is invoked) is an intentional no-op in the port, so set_dev_mode is never reached and a spy would observe nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(completion-functional): detail test_complete ignore blockersnsfisis
Beyond the missing CommandCompletionTester harness, the PHP test's expected suggestions depend on the Composer dev checkout environment (its own composer.json/lock, installed vendor packages) and live Packagist queries, which the port cannot reproduce without a fixture environment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(event-dispatcher): un-ignore test_dispatcher_outputs_commandnsfisis
The ignore reason went stale: the getListeners override seam and a real ProcessExecutor wired to the IO already cover the PHP setup, and IOStub is the PHPUnit IOInterface-mock equivalent. IOStub now records writeError calls (writeRaw was already recorded) so the expects(once)->with(...) spies on writeError/writeRaw can be reproduced as call-list equality assertions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(git-downloader): un-ignore test_remove via FilesystemMock path seamnsfisis
The ignore reason went stale: the FilesystemMock seam added for FileDownloaderTest already intercepts removeDirectoryAsync, and the sibling fossil/hg testRemove ports use it. The seam now records the removed directories instead of a bare call count so the PHP ->with($this->equalTo($this->workingDir)) argument assertion can be reproduced faithfully. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(xdebug-handler): implement get_all_ini_files for no-PHP-runtime casensfisis
Without a PHP runtime no XdebugHandler is ever constructed, so the COMPOSER_ORIG_INIS lookup is skipped and php_ini_loaded_file() / php_ini_scanned_files() are both false; PHP would return [(string) false] = [""]. Model that directly instead of todo!(). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(diagnose-command): detail ignore reasons with the actual blockernsfisis
The tests fail before any network access: DiagnoseCommand::check_platform captures phpinfo() via ob_start()/ob_get_clean(), which are todo!() in shirabe-php-shim, so the command panics before producing output. Record that as the primary blocker alongside the live-network requirement. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(remote-filesystem): read scheme-less local paths in get_remote_contentsnsfisis
PHP's getRemoteContents calls file_get_contents unconditionally: the same stream wrapper reads file:// URLs, plain local paths and network schemes. The Rust port only handled the explicit "file" scheme, so a scheme-less local packages.json repository failed with "file could not be downloaded". Extend the local branch to empty schemes; the http(s) stub is unchanged. This clears the first blocker of the create-project functional test; its ignore reason now documents the remaining ones (live network and Glob::to_regex emitting PCRE lookaheads the regex crate cannot compile), which need a user decision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(version-guesser): un-ignore test_hg_guess_version_returns_datansfisis
The ignore reason went stale: HttpDownloader is reqwest-based now, so building it for HgDriver no longer reaches curl_multi_init() (todo!() in shirabe-php-shim::curl). Test content unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20test(zip-downloader): un-ignore test_error_messages, reason went stalensfisis
The file:// branch of RemoteFilesystem::get_remote_contents is now implemented, so the dist download reaches the ZipArchive "is not a zip archive" path the test asserts. Test content unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(validating-array-loader): un-ignore test_fund_command by fixing empty checknsfisis
validate_array judged emptiness via as_array(), which only matches PhpMixed::Array, so a non-empty PhpMixed::List (e.g. a funding array) was misjudged as empty and dropped, diverging from PHP's !count() check. Match both Array and List. The stale ignore reason on test_fund_command no longer applies: init_temp_composer injects packagist:false so no network is reached, and the downloader stack is reqwest-based (no curl shim todo!()). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20fix(process-executor): un-ignore 11 tests by implementing execute_async mock ↵nsfisis
support ProcessExecutor::execute_async's mock branch was an unimplemented todo!(), blocking every test whose code path calls it (feature-branch git diffing, system-unzip/7z fallback extraction). Implement it by: - Adding Process::__mock (mirroring the existing ZipArchive::__mock pattern) so execute_async can resolve with a fabricated, already- terminated Process instead of spawning a real subprocess. - Extracting the sync mock's expectation-matching logic into a shared ProcessExecutor::mock_match, wrapping the mock state in a RefCell so it works from execute_async's &self/&mut self receivers. - Setting error_output/capture_output from the mock branch, matching PHP's ProcessExecutorMock::executeAsync sharing doExecute with the sync path; execute_async now takes &mut self for this (safe, since the borrow only needs to live through the synchronous setup, not across the .await). - Turning a strict-mode expectation mismatch from a panic!() into a shirabe_php_shim::RuntimeException Err, mirroring PHPUnit's AssertionFailedError extending \RuntimeException: PHP call sites that catch (\RuntimeException $e) around a mocked git/hg/svn call (e.g. Git::get_mirror_default_branch, GitDriver::supports) treat a mismatch as an ordinary recoverable failure, and now so does the port. The RefMut is dropped before firing an expectation's optional callback so a re-entrant callback doesn't panic on double-borrow. Also fixes two real bugs found while porting test_private_repository_ no_interaction: GitHub::authorize_oauth and GitLab::authorize_oauth checked their domains config via PhpMixed::as_array(), which only matches the Array (map) variant, but github-domains/gitlab-domains default to PhpMixed::List, so the check always returned false and OAuth token lookup was silently skipped. Use the in_array shim instead, matching PHP's in_array() semantics. Also fix Git::run_command's "capture credentials from git remote -v" call, which used the panic- swallowing execute_args wrapper instead of a fallible execute(), so a mock mismatch there couldn't reach get_mirror_default_branch's catch. Un-ignores: - zip_downloader_test::test_system_unzip_only_{good,failed} - zip_downloader_test::test_non_windows_fallback_{good,failed} - event_dispatcher_test::test_dispatcher_outputs_error_on_failed_command - root_package_loader_test::test_feature_branch_pretty_version - version_guesser_test::test_guess_version_reads_and_respects_non_feature_branches_configuration_for_arbitrary_naming{,_regex} - version_guesser_test::test_remote_branches_are_selected - github_driver_test::test_private_repository_no_interaction (also adds the missing #[serial], since it seeds the shared Git::VERSION static that vcs_repository_test::test_load_versions depends on for real) - init_command_test::test_get_git_config, made deterministic by pointing HOME at a throwaway dir with its own .gitconfig instead of depending on the host's global git config Deduplicates the GitVersionGuard/RestoreEnv test-drop-guard idioms into tests/common/test_case.rs instead of reimplementing them per file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-19fix(root-package-loader): un-ignore 4 tests by fixing stability-flag isset() ↵nsfisis
port extract_stability_flags ported PHP's `isset($stabilityFlags[$name]) && $stabilityFlags[$name] > $stability` as `unwrap_or(i64::MAX) > stability`, so the check always short-circuited to "already more unstable" and no flag (e.g. from an explicit `*@dev` requirement) was ever recorded. Fixed using Option::is_some_and, a direct translation of PHP's isset() && ... check. Also fixes tests/common/test_case.rs's shared installation_manager() helper, which built a real InstallationManager::new instead of the __new_mock constructor (mirroring PHP's FactoryMock::createInstallationManager()), so it always had zero installers registered and wrote install-path: null into fixture installed.json files. Un-ignores test_reinstall_command, test_locally_modified_packages_from_source/ _from_dist, and test_package_still_present_error_when_no_install_flag_used — the first three were already passing (their #[ignore] reasons were stale), the last is fixed by the test_case.rs change above. Updates the #[ignore] reasons on installer_test.rs's three fixture-driven integration tests to reflect their current state: the install pipeline now runs end-to-end, but the ~189-fixture installer/ set still hits several independent, unrelated bugs/gaps that need case-by-case triage rather than a single fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-19fix(show-command): un-ignore 10 tests by fixing show-warnings typing and ↵nsfisis
repo bugs Replace the PhpMixed-based `$showWarnings` hack in VersionSelector:: findBestCandidate with a typed ShowWarnings enum (Always / Predicate), letting ShowCommand::findLatestPackage pass its real closure instead of hardcoding `true`. Fix the --no-dev branch in ShowCommand::execute, which built `repos` from an empty package list instead of sharing the same InstalledRepository as `installed_repo`. Pass repository handles instead of pre-borrowed `&dyn RepositoryInterface` refs into get_package/ generate_package_tree/add_tree to stop a RefCell double-borrow panic on --all/--locked. Add the missing CompletePackage/RootPackage set_release_date setter so the outdated sorting-by-age test can set fixture dates. Resolve OutputFormatterStyleStack::pop's empty-style todo!() via clone_box(), and fix FileDownloader's cache-GC log call to pass the VERY_VERBOSE verbosity PHP uses. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-19fix(search-command): un-ignore test_search by fixing JSON output and ↵nsfisis
abandoned propagation The json format branch ignored search results entirely and always wrote null. Encode results into the same name/description/abandoned/url shape Composer's array-backed repositories produce. Also fix ComposerRepository's RepositoryInterface::search adapter, which dropped the abandoned field from raw API results even when present.
2026-07-19fix(alias-package): stop delegating own-state accessors to aliasOfnsfisis
AliasPackage wrongly delegated several methods (id, names, unique name, pretty string, full pretty version, repository, __toString) to aliasOf, but PHP's AliasPackage inherits these from BasePackage unmodified, so they must use the alias's own state instead. This collapsed alias and aliasOf into the same SAT literal id, breaking the solver's alias-resolution rules; un-ignore the two solver tests that exposed it.
2026-07-19test(gitlab-driver): un-ignore test_get_paginated_refsnsfisis
The Preg delimiter bug the ignore reason described was already fixed.
2026-07-19feat(spdx-licenses): implement is_valid_license_string SPDX expression parsernsfisis
PHP matches the SPDX license-expression grammar with a single recursive PCRE pattern ((?(DEFINE) subpatterns plus (?&name) recursion), which the regex crate cannot express, so port it as a hand-written recursive-descent parser instead. licenseid/licenseexceptionid dictionary lookups use longest-match-first, guarded against accepting a short entry that is only a coincidental prefix of a longer identifier run (e.g. "DOC" prefixing "DocumentRef-..."), which a length-sorted greedy match alone would misparse. Un-ignores the two validating_array_loader tests that were blocked on this todo!().
2026-07-19fix(update-command): un-ignore test_update by fixing 3 real bugsnsfisis
test_update was skipped for a stale reason; running it uncovered three distinct bugs it was actually catching: - ApplicationTester::run never restored SHELL_VERBOSITY after Application::configureIO mutates it, so one dataset's -vv verbosity leaked into later runs sharing the process (Symfony's tester restores it in a finally block; the port dropped that). - Installer::do_install built its RepositorySet with a hardcoded empty temporary_constraints map instead of self.temporary_constraints, so --with never actually constrained the resolver. - BumpCommand was missing a <warning> tag pair around one of its output lines.
2026-07-19fix(test-harness): set COMPOSER_TESTS_ARE_RUNNING so interactive tests ↵nsfisis
actually run Without this, Application::do_run force-disabled interactivity whenever stdin wasn't a tty (as under cargo test), so ApplicationTester runs with set_inputs silently produced non-interactive default output instead of consuming the answers, masking real behavior as several stale #[ignore]s blaming already-implemented ProcessExecutor/Process todo!()s. Port composer/tests/bootstrap.php's env setup into a bootstrap() helper called from get_application_tester(), un-ignore the now-passing init/update command tests, and update init_command_test's expected schema-validation wording to match the jsonschema crate (already the accepted wording per 541a8b4f, not an unported gap).
2026-07-19fix(check-platform-reqs): restore raw Link column in text tablensfisis
PHP's printTable builds a 5-column row for text output, with the raw Link object (cast via __toString) as its own column separate from the formatted description string. The port had collapsed both into one column, dropping an empty column for successful checks and throwing off the rendered column widths/spacing versus real Composer output.
2026-07-18chore: rustfmtnsfisis
2026-07-18perf(installation-manager): run executeBatch operation chains concurrentlynsfisis
executeBatch now builds one future per operation — the PHP promise chain prepare -> install/update/uninstall -> cleanup -> repo->write, including the '<Op> of <pkg> failed' rejection handler covering the chain up to cleanup — and drives the whole batch through waitOnPromises()/Loop::wait, so archive extraction (the unzip subprocesses gated by ProcessExecutor's semaphore) finally overlaps across packages. Alias operations stay synchronous in the collection loop like PHP. The shared repository is threaded through the chains as RefCell<&mut dyn InstalledRepositoryInterface>: execute() wraps the incoming &mut once, and InstallerInterface::install/update/uninstall take the cell so implementations borrow it only in their synchronous head/tail, never across an await. InstallationManager's own install/update/uninstall/download/get_installer/get_install_path/ mark_for_notification move to &self (cache and notifiable_packages behind RefCell) so every chain can capture &self. WritableRepositoryInterface::write and the InstallationManagerInterface get_install_path it relies on lose their &mut manager requirement — the per-op repo->write inside the chains only reads install paths. Warm-cache create-project laravel/laravel: the package-operations phase (109 installs) drops from ~3.0-3.8s serial to ~1.9s, on par with real Composer (~2.1s) measured back-to-back; the resulting vendor tree, installed.json included, stays byte-identical to Composer's (diff -rq clean). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-18perf(installation-manager): fan out package downloads via Loop::waitnsfisis
InstallationManager::downloadAndExecuteBatch now matches PHP: every update/install operation's installer->download() promise is collected and driven concurrently through waitOnPromises()/Loop::wait instead of being awaited one package at a time. Concurrency caps stay where PHP puts them (HttpDownloader 12, ProcessExecutor 10 via their semaphores). Error semantics follow PHP too: all downloads settle before the first rejection is rethrown, rather than aborting on the first failure. To let the collected futures and the cleanup closures own their installer beyond the loop iteration that created them, the installer registry becomes Vec<Rc<dyn InstallerInterface>> and get_installer hands out clones (PHP closures capture $installer the same way), with InstallerInterface methods taking &self across the six implementors — the only genuinely mutable state was LibraryInstaller.vendor_dir (canonicalized in place), now behind a RefCell. as_plugin_installer_mut/as_binary_presence_interface lose their &mut. The cleanup_promises entries are now the real thing: the PHP closure including the getInstallationSource() guard and the installer->cleanup($opType, $package, $initialPackage) call, replacing the no-op futures (drops one TODO(phase-b) and two TODO(phase-c)). Verified against the real network: create-project laravel/laravel produces a vendor tree byte-identical to real Composer's (diff -rq clean across all 109 packages including vendor/composer). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-18refactor(downloader): take &self across the downloader hierarchynsfisis
Concurrent package operations call into the same downloader instances through Rc<RefCell<dyn DownloaderInterface>>; with &mut self methods every call holds a RefMut across its awaits, which panics with 'already mutably borrowed' the moment two operations overlap. This is groundwork for fanning out InstallationManager's download/install loops (same rework HttpDownloader/CurlDownloader already got). - DownloaderInterface/ChangeReportInterface/ArchiveDownloader/ VcsDownloader methods now take &self; as_change_report_interface returns &dyn instead of &mut dyn. - Implementors move their genuinely mutable state behind cells: FileDownloader.additional_cleanup_paths, the archive downloaders' cleanup_executed, ZipDownloader.zip_archive_object, VcsDownloaderBase.has_cleaned_changes, GitDownloader's stash/discard/ cache maps and GitUtil, SvnDownloader.cache_credentials, PerforceDownloader.perforce. FileDownloader.io gains a RefCell layer so get_local_changes can keep PHP's NullIO swap under &self. - ProcessExecutor::execute_async now returns a future that captures everything up front instead of borrowing the executor, and call sites build the future before awaiting, so no borrow on the shared executor is held while a subprocess runs. - Filesystem::remove_directory_async becomes remove_directory_async_via taking the Rc handle: the Filesystem is only borrowed for the sync head/tail, never across the rm subprocess await (sync borrow_mut users like rename/ensure_directory_exists would otherwise collide). - DownloadManager async call sites hold shared borrows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-18perf(process-executor): make execute_async genuinely concurrentnsfisis
execute_async was a serial pump: it queued a job, then drove it to completion itself via wait_id()'s blocking usleep loop before returning, so concurrent callers never overlapped even when polled together through FuturesUnordered. Rewrite it as a single &self async fn mirroring the CurlDownloader/ HttpDownloader rework: a tokio Semaphore sized by max_jobs (COMPOSER_MAX_PARALLEL_PROCESSES, PHP parity) gates admission, the child is started non-blocking, and an async 1ms sleep loop pumps is_running()/check_timeout() while yielding to the reactor so sibling jobs genuinely run in parallel. The Job table, STATUS_* lifecycle, start_job/mark_job_done/count_active_jobs/wait/wait_id all had no remaining callers and are removed. &self also lets callers hold only a shared borrow across their awaits (zip_downloader, version_guesser, filesystem via the new get_process_handle), which would otherwise panic with 'already mutably borrowed' once two async jobs overlap on the same Rc<RefCell<ProcessExecutor>>. The async mock branch no longer consumes the expectation before hitting its todo!(): the panic made that bookkeeping unobservable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-18chore(bench): pass --no-audit to create-project benchmarknsfisis
The earlier measurements documented in the perf notes were taken with --no-audit to keep the security-advisories request out of the timings, but the flag never landed in the committed script. Add it so future runs are comparable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-18perf(regex): eliminate per-call clone overhead in preg_* dispatchnsfisis
regex::Regex::clone() does not share the underlying meta engine's search-cache pool, so every fresh clone pays a ~10us warmup cost on its first use. Two changes together eliminate this across nearly all preg_* call sites: - A php_regex! macro resolves PHP-style patterns to a per-call-site &'static regex::Regex (via regex-macro's LazyLock), applied at the majority of call sites throughout the codebase. - Call sites still passing dynamic pattern strings go through PATTERN_CACHE, which now stores Arc<(Regex, bool)> and hands out Arc::clone()s instead of cloning the Regex itself. PregPattern::resolve() returns a ResolvedPattern enum (Arc or 'static reference) rather than an owned Regex, so neither path ever clones the Regex proper. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-18perf(json-file): buffer schema file reads in FileRetrievernsfisis
serde_json::from_reader issues one read() syscall per byte against an unbuffered Reader. FileRetriever passed a raw File straight through, so resolving the composer-schema.json $ref read its ~71KB contents one byte at a time (twice per require, since schema validation runs both before and during the update). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>