aboutsummaryrefslogtreecommitdiffhomepage
path: root/Cargo.lock
AgeCommit message (Collapse)Author
2026-08-16perf(php-shim): scan the phar stub token with memchrnsfisis
The stub token search compared every 18-byte window of the file case insensitively. The token starts with a byte that ASCII case folding leaves alone, so memchr can pick out the candidate offsets and leave only those to the case-insensitive compare. Over the 35 MB executable, finding the token in the embedded bundle stub drops from 2.3 ms to 0.1 ms, and a scan that finds nothing drops from 24 ms to 3.6 ms. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(symfony-finder): fail SplFileInfo::get_size on a failed statnsfisis
\SplFileInfo::getSize() throws a \RuntimeException when stat fails, and neither Symfony's subclass nor Composer's Filesystem::directorySize() catches it. Returning 0 turned an unreadable file into an empty one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(ca-bundle): resolve SSL_CERT_* the way CaBundle doesnsfisis
CaBundle::getEnvVariable() prefers $_SERVER and falls back to getenv() only under the CLI SAPI. The port read the live process environment for both SSL_CERT_FILE and SSL_CERT_DIR, skipping the snapshot entirely. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16feat(php-shim): render human-facing timestamps in the local timezonensfisis
Split date() into date_utc() and date_local(), the latter resolving the system's local timezone through the tzfile crate ($TZ, then /etc/localtime, falling back to UTC when neither is readable). The timestamps Composer renders for humans -- the GitHub OAuth token note, the GitHub API rate limit reset time, the Perforce client spec fields and the "today" check of the show command -- now go through date_local(). PHP resolves its default timezone from the date.timezone ini setting, which Shirabe does not read, so date_default_timezone_get/set have no input left to model and are dropped from the shim and its callers. The resulting difference is recorded in docs/known-incompatibilities.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15feat(php-shim): drop the modelled PHP version constantsnsfisis
The shim reported a fixed PHP 8.1.0 through PHP_VERSION, PHP_VERSION_ID, the major/minor/release triple and the PHP_WINDOWS_VERSION_* trio. Their uses split in two. Some guarded branches PHP only needs on runtimes this port cannot be: proc_get_status reports the exit status on every call, so Symfony's pre-8.3 exit-code cache has nothing to work around; hash_raw and hash_file always offer xxh3, so the sha1 fallback is unreachable; and http_get_last_response_headers is always available, so the pre-8.4 $http_response_header branch is gone. safeJunctions reads the host Windows version rather than PHP state, and joins the Windows work on hold. The rest ask about the PHP the user actually runs, and now reach the worker through a new php-rpc PhpVersion payload: the startup banner and the 7.2.5 warning, self-update's min-php filter, the ext-* recommendation in VersionSelector, the stream User-Agent, and whether PhpFileParser scans for enums. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15feat(php-rpc): embed the Composer PHP runtime in the executablensfisis
Plugins and scripts need the real `Composer\` classes and the packages Composer depends on, which so far came from a checkout found through SHIRABE_COMPOSER_PHP_DIR or a path next to the workspace. Neither exists for a distributed binary. The build script now archives those PHP sources into a phar the way Compiler.php does and the executable carries it. The worker maps it with Phar::loadPhar and reads a content-addressed sentinel back to tell a bundle it can use from one it cannot; where its PHP cannot open the phar, the bundle is unpacked once into the cache directory and autoloaded from there. SHIRABE_COMPOSER_PHP_DIR still overrides both for development. PHP locates a phar's manifest by the first __HALT_COMPILER(); token in the file, so the executable must hold no other copy of it: phar.rs builds the token at run time, and a linter keeps further literals out of the sources that reach the binary. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-11feat(signal): abort on SIGINT, SIGTERM and SIGHUP at checkpointsnsfisis
The SignalHandler port was a no-op stub, so all four of Composer's abort paths were dead code: nothing removed a half-created project, reverted composer.json, or cleaned up half-installed packages. Composer runs those handlers from pcntl callbacks, which a Rust signal handler cannot do -- it may touch nothing beyond atomics. SignalSubscription records the signal instead, and the abort runs from checkpoints on the normal call stack, where the clean-up can borrow the state it needs. That also resolves the closure-capture TODO(phase-c)s in RequireCommand and InstallationManager, and replaces exit_with_last_signal's exit(0) with the restore-and-re-raise Seld\Signal does. A subscription is live only inside the four abort regions, so elsewhere the signals keep their default disposition and kill the process at once. It is installed without SA_RESTART so a signal interrupts an interactive prompt rather than resuming the read. A signal reaches only the innermost subscription, reproducing SignalHandler's single-stack dispatch. Drop SignalRegistry, SignalableCommandInterface and the Application wiring for them: nothing in Composer reaches that path, and SignalHandler discards whatever they register. Signal handling from plugins and scripts is undefined behavior; see docs/dev/signals.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-10feat(xdebug): switch Xdebug off in the PHP workernsfisis
Composer restarts itself with Xdebug unloaded because Xdebug makes PHP several times slower. Xdebug is never loaded into this process, so what needs dealing with is the PHP worker: it is spawned with `-d xdebug.mode=off` and `XDEBUG_MODE=off` (Xdebug reads the environment variable first and lets it override every ini setting), which makes its module init return before it installs any executor, compile, error or opcode hook. Rewriting the ini files and re-executing, the way xdebug-handler does, would additionally cover Xdebug 2, which hooks unconditionally and has no equivalent setting. That is not worth its machinery here: Xdebug 2 caps out at PHP 7.4, while every PHP version Composer supports can run Xdebug 3. What remains of XdebugHandler is small enough to live beside the worker it governs, so its crate is gone and its callers inline it. isXdebugActive answers false without asking PHP whenever the worker is switched off, so a command that needs no PHP does not spawn one just for the Xdebug warning; diagnose reports what the worker measures instead, which still surfaces an Xdebug that ignores the setting. PlatformRepository has no unloaded extension to restore, since switching the mode off leaves it loaded. COMPOSER_ORIGINAL_INIS is neither written nor read: it exists so a restarted process can name the ini files it replaced, and IniHelper can report the worker's own. IniHelperTest injects through that variable, so none of its cases are ported. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(cargo): drop the now-empty shirabe-external-packages cratensfisis
Every package it held now lives in its own crate, so the umbrella crate has nothing left in it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(xdebug-handler): extract composer/xdebug_handler into the ↵nsfisis
shirabe-xdebug-handler crate Move `Composer\XdebugHandler` out of shirabe-external-packages and into its own crate, so the path is `shirabe_xdebug_handler::XdebugHandler` instead of `shirabe_external_packages::composer::xdebug_handler::XdebugHandler`. Standing alone, the stub no longer sits in a crate that shirabe-php-rpc depends on, so drop the dependency-cycle rationale from the comments that explain why callers reach for shirabe_php_rpc directly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(ca-bundle): extract composer/ca_bundle into the shirabe-ca-bundle cratensfisis
Move `Composer\CaBundle` out of shirabe-external-packages and into its own crate, so the path is `shirabe_ca_bundle::CaBundle` instead of `shirabe_external_packages::composer::ca_bundle::CaBundle`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(seld-signal): extract seld/signal into the shirabe-seld-signal cratensfisis
Move `Seld\Signal` out of shirabe-external-packages and into its own crate, so the path is `shirabe_seld_signal::SignalHandler` instead of `shirabe_external_packages::seld::signal::SignalHandler`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(seld-json-lint): extract seld/json_lint into the ↵nsfisis
shirabe-seld-json-lint crate Move `Seld\JsonLint` out of shirabe-external-packages and into its own crate, so the path is `shirabe_seld_json_lint::ParsingException` instead of `shirabe_external_packages::seld::json_lint::ParsingException`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(symfony-console): extract symfony/console into the ↵nsfisis
shirabe-symfony-console crate Move `Symfony\Component\Console` out of shirabe-external-packages and into its own crate, so the path is `shirabe_symfony_console::application::Application` instead of `shirabe_external_packages::symfony::console::application::Application`. The `delegate_to_inner!` and `delegate_command_trait_impls_to_inner!` macros move with it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(symfony-finder): extract symfony/finder into the ↵nsfisis
shirabe-symfony-finder crate Move `Symfony\Component\Finder` out of shirabe-external-packages and into its own crate, so the path is `shirabe_symfony_finder::Finder` instead of `shirabe_external_packages::symfony::finder::Finder`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(symfony-filesystem): extract symfony/filesystem into the ↵nsfisis
shirabe-symfony-filesystem crate Move `Symfony\Component\Filesystem` out of shirabe-external-packages and into its own crate, so the path is `shirabe_symfony_filesystem::Filesystem` instead of `shirabe_external_packages::symfony::filesystem::Filesystem`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(symfony-process): extract symfony/process into the ↵nsfisis
shirabe-symfony-process crate Move `Symfony\Component\Process` out of shirabe-external-packages and into its own crate, so the path is `shirabe_symfony_process::Process` instead of `shirabe_external_packages::symfony::process::Process`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(symfony-string): extract symfony/string into the ↵nsfisis
shirabe-symfony-string crate Move `Symfony\Component\String` out of shirabe-external-packages and into its own crate, so the path is `shirabe_symfony_string::ByteString` instead of `shirabe_external_packages::symfony::string::ByteString`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09refactor(pcre): extract composer/pcre into the shirabe-pcre cratensfisis
Move `Composer\Pcre` out of shirabe-external-packages and into its own crate, so the path is `shirabe_pcre::preg::Preg` instead of `shirabe_external_packages::composer::pcre::preg::Preg`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-06fix(php-rpc): carry the worker channel over a socketpairnsfisis
The transport bound an AF_UNIX path under TMPDIR and waited for the child to connect. That path has to fit in sun_path (108 bytes), so a deep TMPDIR made every worker spawn fail, and the bind(2) itself is denied under a sandbox. The parent now keeps one end of a socketpair and installs the other on descriptor 3 before exec, which the worker opens as php://fd/3. The pair is connected from the start, so the accept poll and its ten-second deadline are gone; a child that dies before reading surfaces as EOF on the first call, where worker_state already attaches its exit status. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-06refactor(spdx-licenses): return a dedicated type from getLicenseByIdentifiernsfisis
PHP hands back a positional array, so every caller had to reach into a PhpMixed list by index and fall back to a default when an element was missing or the wrong variant -- fallbacks that could never fire, since the list shape is fixed. LicenseMetadata names the four elements and makes the accesses total. This also drops the crate's last use of PhpMixed, and with it the dependency on shirabe-php-shim. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-03feat(php-rpc): rework the RPC channel into the tagged plugin protocolnsfisis
Replace the name\0arg framing with the plugin wire protocol: tagged frames with corr_id multiplexing, a MAX_FRAME_LEN bound, a thread-ID based reentrant SessionLock, and the PluginValue codec (encoder plus the first recursive decoder, iterative with a 512-level depth cap). Float formatting is ported from php-src into shirabe-php-src so the encoder is byte-compatible with serialize() under serialize_precision=-1, which the spawned worker now pins. The worker gains a standing dispatch loop, CallRustMethod reentrancy, hand-written Event proxy stubs, and explicit-error answers for everything not implemented yet. The public query API (get_php_version and friends) is unchanged and now rides the new protocol; the codec is verified against real PHP by roundtrip oracle tests covering floats, non-UTF-8 bytes and deep nesting. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-02feat(php-shim): implement syscall-backed functions via the nix cratensfisis
Several shim functions were left as todo!() because the standard library exposes no equivalent and no syscall crate was available. Adding nix unblocks them: - proc_open now wires descriptors beyond stderr, creating the pipe itself and installing the child end with dup2(2) from pre_exec - proc_terminate and posix_kill deliver arbitrary signals via kill(2) - get_current_user reports the owner of the running executable - php_uname answers every mode from uname(2) instead of only "s" and "r" It also closes gaps that were previously approximated: - fstat stats the stdio streams and pipes rather than reporting failure - touch stamps mtime/atime on an existing path, including directories - is_writable/is_executable use access(2) instead of permission bits - umask falls back to the read-modify-write umask(2) off Linux The hand-written repr(C) structs and extern "C" declarations for getpwuid, utime, statvfs, fcntl and select are replaced by their nix wrappers, which in turn lets disk_free_space drop its Linux-only cfg. cli_set_process_title, setproctitle and the pcntl_signal pair stay as todo!(): the first two need access to the process's own argv block, and the latter two depend on the signal-handling subsystem rather than on sigaction(2) itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-01feat(php-shim): implement Phar/PharData and the zlib/bzip2 functionsnsfisis
Adopt the tar, flate2, and bzip2 crates to fill in the phar.rs and compress.rs todos: PharData tar/zip reading, building, and whole-archive compression, plus a native .phar reader that follows the php.net file-format manual and verifies hash-based signatures. Callers now propagate the constructor/extract errors PHP throws, and fwrite accepts byte strings so gzread no longer needs lossy UTF-8. The native .phar writing API stays todo!() (no call sites; Composer's Compiler is not ported) and OPENSSL phar signatures are accepted unverified (TODO(phase-c)). This unblocks Tar::getComposerJson and the tar/phar/gzip downloaders; tar_test (7), artifact_repository_test (2), and phar_archiver_test zip (1) are un-ignored. The archive command itself still panics because ArchiveManager::archive always generates glob excludes whose look-ahead regexes the regex crate cannot compile; converting those patterns to regex-compatible ones is a separate, still-undecided work item. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-01feat(php-src): add a BSD-licensed crate for php-src derived codensfisis
The audit in .ken/php-shim-copying.md judged 14 functions in shirabe-php-shim (plus php_wordwrap in shirabe-external-packages) to be line-by-line transcriptions or structural imitations of php-src. PHP's relicensing to 3-clause BSD makes keeping them legal, but the boundary between BSD-derived and MIT code was invisible in the source tree. Moving them into their own crate puts the license into the build metadata (so NOTICE generation follows the binary), makes a reverse dependency a compile error, and encodes the origin in the module path, which mirrors php-src's ext tree. Each function records its origin in a fixed-format doc comment, and a new php_src_derivation_boundary linter fails if `php-src` appears in any Rust source outside the crate. Public paths under shirabe_php_shim:: are unchanged: functions that are themselves derived are re-exported with `pub use`, and the wrappers that only validate arguments stay on the MIT side. This also resolves the duplicate wordwrap implementation. shirabe_php_shim::wordwrap was todo!(), so SymfonyStyle::block panicked, while shirabe-external-packages carried its own copy. Both now go through the single port, verified against real PHP on 13 cases covering multi-character breaks and cut. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-26feat(diagnose-command): query the real PHP runtime in one RPC callnsfisis
diagnose used to read hardcoded shim stubs, so it described a fictional runtime: OPENSSL_VERSION_NUMBER was always 0 and tripped the TLSv1.1/1.2 check, PHP_BINARY and OPENSSL_VERSION_TEXT were empty, and the extension, function and ini probes answered from a fixed table. The PHP worker gained a `diagnose` entry that returns every fact the command needs as one PHP array, cached in a OnceLock so the several call sites share a single round trip. Reading it back needed array support in the serialize() parser, which in turn lets get_loaded_extensions and get_all_ini_files return real lists instead of comma-joined strings. Also fixes the openssl_version message, which dropped strstr()'s before_needle argument during the port, and check_connectivity's allow_url_fopen test, which did not follow PHP string truthiness. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-25feat(tracing): init tracing subscriber from $SHIRABE_TRACINGnsfisis
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-18perf(regex): eliminate per-call clone overhead in preg_* dispatchnsfisis
regex::Regex::clone() does not share the underlying meta engine's search-cache pool, so every fresh clone pays a ~10us warmup cost on its first use. Two changes together eliminate this across nearly all preg_* call sites: - A php_regex! macro resolves PHP-style patterns to a per-call-site &'static regex::Regex (via regex-macro's LazyLock), applied at the majority of call sites throughout the codebase. - Call sites still passing dynamic pattern strings go through PATTERN_CACHE, which now stores Arc<(Regex, bool)> and hands out Arc::clone()s instead of cloning the Regex itself. PregPattern::resolve() returns a ResolvedPattern enum (Arc or 'static reference) rather than an owned Regex, so neither path ever clones the Regex proper. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-17refactor(loop): drive wait() promises concurrently via FuturesUnorderednsfisis
Loop::wait already had the target signature and a TODO(phase-c-promise) marker noting it drove promises serially; swap the for-loop for FuturesUnordered so all promises are polled together instead of one at a time, keeping the "remember only the first error" semantics. This adds the first real use of the futures dependency (already present in Cargo.toml/Cargo.lock from earlier prep work, now finally consumed), so those lockfile/manifest changes land in this commit. Real overlap still doesn't happen yet: each promise (HttpDownloader::add/ add_copy etc.) resolves through a blocking bridge (curl_runtime()/ sync_executor::block_on) that fully occupies the thread until it settles, so this is groundwork for once a single top-level Runtime replaces those bridges. Updated the TODO(phase-c-promise) comment to reflect that.
2026-07-04fix(php-rpc): panic on RPC failure instead of silently swallowing itnsfisis
Worker spawn failure, socket I/O errors, and unparseable responses used to fall back to plausible-looking defaults (empty string, false, None), making real failures indistinguishable from legitimate PHP-side results. Panicking is not the final design, but replaces silent data corruption with a loud failure until proper error propagation is implemented.
2026-07-02feat(php-rpc): implement Runtime::has_constant/get_constant via php-rpcnsfisis
Runtime::hasConstant/getConstant need a real PHP interpreter's defined()/ constant() to answer platform requirement checks (e.g. PHP_ZTS, PHP_INT_SIZE), which the shim can't provide since Rust constants aren't queryable by string. Extend shirabe-php-rpc's protocol to carry one string argument and return the full PHP scalar range, add defined/constant dispatch entries to the worker, and wire Runtime and get_php_version/get_php_binary onto them.
2026-07-01feat(php-rpc): query real PHP version and binary for --versionnsfisis
Add a minimal shirabe-php-rpc crate that spawns the system PHP as a child process and asks it for runtime information over a Unix domain socket, then use it to fill the `--version` PHP line with the real \PHP_VERSION and \PHP_BINARY instead of fixed placeholder values. See docs/dev/php-rpc.md for the design and scope. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-29feat(php-shim): implement DirectoryIterator in fs shimnsfisis
Give DirectoryIteratorEntry a backing path (mirroring RecursiveIteratorFileInfo) and make directory_iterator enumerate entries, returning Result to match PHP DirectoryIterator's UnexpectedValueException on an unopenable directory. Wire the new Result through DumpCompletionCommand's get_supported_shells. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-28fix(http): avoid nested tokio runtime panic in download pathnsfisis
The CurlDownloader owned a tokio runtime and block_on'd reqwest from its sync tick(), while the repository/installer/downloader sync bridges each created another Runtime and block_on'd async fns that reach that leaf. Driving one Runtime::block_on from within another panics with "Cannot start a runtime from within a runtime", hit by `require` when fetching p2 metadata. Switch CurlDownloader to a blocking reqwest client (its own internal thread, never nested) and replace the per-call Runtime::new().block_on bridges with a no-reactor sync_executor::block_on helper. No awaited future parks on a reactor once the only async I/O is blocking, so the helper can be nested freely. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-27test: add mockall cratensfisis
2026-06-26feat(http): reimplement CurlDownloader on reqwest; port 15 more testsnsfisis
Replace the libcurl-shim CurlDownloader with a reqwest+tokio implementation per the .ken sketch, resolving the construction panic that blocked command tests (mock path via __new_mock is untouched). Port remote_filesystem (7), hg/svn driver (4), zip_archiver/git_exclude_filter (4) tests. Fix hg/svn/git_exclude regex-delimiter and svn result-propagation porting bugs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25feat(external-packages,shim): implement impl todos across componentsnsfisis
Port seld/jsonlint JsonParser (+hand-written Lexer), unblocking 10 json_file parse-error tests verified byte-for-byte against PHP. Implement Symfony Finder SplFileInfo, executable finders, String classes (byte/code-point/unicode), ZipArchive shim (via the zip crate), SPDX license validation, and shim date/stream functions. Genuinely-blocked sites (reflection, PHP runtime constants, non-UTF-8 transcoding, recursive PCRE) stay todo!() with reasons. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25feat(json): validate JSON schema via the jsonschema cratensfisis
Replace the todo!() json_schema::Validator stub with the jsonschema crate. Errors are surfaced as 'property : message'; the message wording follows the jsonschema crate and is *not* justinrainbow-compatible. Port the ComposerSchemaTest and JsonFileTest schema cases to the new wording (noted per test). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-24refactor(crates): split metadata-minifier and spdx-licenses into own cratesnsfisis
Move MetadataMinifier and SpdxLicenses out of shirabe-external-packages into dedicated shirabe-metadata-minifier and shirabe-spdx-licenses crates, updating all import sites accordingly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-22test(cli): serialize cli_tests via serial_testnsfisis
Replace the hand-rolled `SERIAL` mutex guarding process-global env access with serial_test's `#[serial]` attribute on each test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-21feat(php-shim): implement hash, hash_raw, hash_filensfisis
Support md5, sha1, sha256, and xxh3 algorithms. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-21feat(php-shim): implement http_build_query via serde_urlencodednsfisis
2026-06-20feat(php-shim): implement parse_url and filter_var URL/boolean filtersnsfisis
Back parse_url/parse_url_all with reqwest::Url and add the FILTER_VALIDATE_URL and FILTER_VALIDATE_BOOLEAN arms to filter_var, so Config::prohibit_url_by_config no longer hits todo!(). reqwest::Url is not a byte-for-byte port of PHP's parser; the divergences are noted with TODO(phase-c). Switch the scheme in_array in prohibit_url_by_config to strict: the needle is a string-or-null and the haystack holds only non-numeric string literals, so loose and strict comparison are provably equivalent here, avoiding a dependency on PHP loose `==` semantics. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-20feat(finder): implement Finder traversal and filter pipelinensfisis
Replace the todo!() stubs with an inline port of symfony/finder's searchInDirectory() pipeline, materializing entries as PathBuf in place of SplFileInfo. Also port Glob::toRegex, needed for glob name patterns. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-20test(cli): add more smoke testsnsfisis
2026-06-20feat(command): implement --help outputnsfisis
2026-06-14feat(php-shim): implement random_int/random_bytes with fastrandnsfisis
PHP's random_int/random_bytes are cryptographically secure, but Composer does not rely on that property, so a non-cryptographic PRNG suffices. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14refactor(pcre): drop PcreExceptionnsfisis
Composer never feeds a pattern that fails to compile at runtime, so a preg_*() failure is a programming error rather than a recoverable condition. Replace the PcreException path with a panic. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-12feat(php-shim): implement runtime functions to run --versionnsfisis
Replace todo!() stubs reached on the `composer --version` path so the command runs without panicking and exits cleanly: - introspection (function_exists, class_exists, extension_loaded, defined) via white-lists modeling a standard Linux PHP CLI - type casts: php_to_string/strval, php_truthy/boolval, substr, byte_at, explode, strtr_array - config/env: error_reporting, ini_get, date_default_timezone_*, server_get/server_contains_key, php_uname("s") - IO: turn PhpResource into an enum (Stdin/Stdout/Stderr/File) and implement fwrite/fflush/stream_isatty/php_fopen resource helpers - shutdown/exit: register_shutdown_function + run_shutdown_functions, exit, error_get_last - preg_match_all_offset_capture via the regex crate; the formatter pattern drops PCRE possessive quantifiers (original kept in a comment with a TODO) proc_open reports unavailable for now (TODO(phase-c)); terminal-size and tty detection fall back to defaults. sprintf calls on this path are rewritten with format!(). OutputFormatterStyleInterface gains clone_box to return shared styles. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-09feat(datetime): resolve datetime TODOsnsfisis
Introduce shim functions and constants, replacing the ad-hoc chrono format strings and parse helpers used as phase-b placeholders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>