aboutsummaryrefslogtreecommitdiffhomepage
path: root/crates/shirabe
AgeCommit message (Collapse)Author
2026-08-18refactor(pcre): hand back the match instead of copying it outnsfisis
Preg::match4 and Preg::replace_callback gave callers a PregMatchedGroups: an IndexMap rebuilt from the match with an owned String per group, plus a second String for a named group's name key. That is the copy PregMatches shed when it started wrapping regex::Captures, reinstated one layer up -- and nearly every regex call in the tree goes through Preg rather than the shim's preg_* directly, so almost nothing saw the borrow. PregMatchedGroups existed only to drop the null (unmatched) groups the old PregMatches held as Option<String> values. PregMatches::get reports a non-participating group as None on its own, so the two read alike and the type collapses into it. Call sites still reach groups through get(&CaptureKey::ByIndex(N)); what changes is that the value arrives as a &str borrowed from the subject, which the signatures now carry as a lifetime. Three places needed the borrow reckoned with rather than a mechanical rewrite: PhpFileCleaner::clean and Problem::get_messages read their groups out before mutating what the match borrows, and Git::get_authentication_failure names the lifetime of its url argument, which the result borrows instead of self. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18refactor(preg): back PregMatches with regex::Capturesnsfisis
PregMatches was an IndexMap of owned Strings copied out of the match, so every preg_match2/preg_replace_callback call allocated a String per capture group (twice over for a named group) whether or not the caller read it. It now wraps the regex::Captures itself, held alongside the pattern it came from so groups stay reachable by both their named and their numbered form, and hands out &str borrowed from the subject. The subject's lifetime becomes a parameter of the type. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(pcre): return the Preg $matches instead of filling an out-paramnsfisis
`Composer\Pcre\Preg` fills `$matches` through a by-ref parameter, and the port mirrored that with a `&mut` (or `Option<&mut>`) out-param plus a bool or count return. Callers had to declare an empty map one line ahead of the call, and the type never said the map is only meaningful when the call matched. Return the matches instead: - match3/match4/is_match3/is_match4 -> Option<PregMatchedGroups> - is_match_named -> Option<PregNamedGroups> - match_all2/is_match_all -> PregMatchesAll - is_match_all_with_offsets3 -> PregMatchesAllWithOffsets Nothing is lost: the bool is `Option::is_some()`, and the occurrence count is the length of any one column of a PREG_PATTERN_ORDER map, now spelled `PregMatchesAll::occurrence_count()`. is_match() still answers the bool question directly for callers that want no groups. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(preg): return the preg_* $matches instead of filling an out-paramnsfisis
PHP fills `$matches` through a by-ref parameter, which the port mirrored with a `&mut` out-param plus a bool or count return. Every caller then had to declare an empty binding one line ahead of the call, and nothing in the type said the binding is only meaningful when the call succeeded. Return the matches instead: preg_match() and preg_match2() hand back an Option, and the three preg_match_all* functions hand back the collection they used to fill. The occurrence count the two map-shaped preg_match_all* functions used to return is the length of any one of the map's columns, so it is not lost -- Preg::match_all() and friends derive it via occurrence_count(). preg_replace2() keeps its `count: Option<&mut usize>`: that one is not derivable from the replaced string, and callers that do not want it pay nothing for passing None. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(preg): report unmatched groups as null throughoutnsfisis
The shim carried two reporting modes for the preg_* $matches maps: PHP's default (trailing unmatched groups dropped, interior ones ""), and the PREG_UNMATCHED_AS_NULL form, picked by calling a *_unmatched_as_null() variant. The regex crate hands out Option<Match>, which maps onto the null form directly, and no caller distinguished a dropped group from a null one -- preg_match() and preg_match_all2() already reported nulls unconditionally. Keep only the null form; the shim API no longer mirrors PHP's flag set, which is intended. Preg::is_match_with_indexed_captures() modelled PHP's "unset" as a truncated Vec<String>, and now returns Vec<Option<String>>. That is what Composer actually does: Preg::isMatch() always sets PREG_UNMATCHED_AS_NULL, and its callers test groups with `!== null`. preg_match_all(), preg_match_all_set_order() and preg_split_delim_capture() still hand back Vec<String> and keep the "" form. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(preg): wrap the preg_* $matches maps in newtypesnsfisis
The five IndexMap shapes that the preg_* functions and Preg fill in are now distinct types generated by preg_match_map!, so a matches map no longer interchanges with any other map of the same key and value type. Index<usize> is kept alongside Index<&Q> because call sites such as config_command and event_dispatcher reach for a group by its position in the map rather than by its capture key.
2026-08-17refactor(preg): split the PREG_UNMATCHED_AS_NULL preg_* by flagnsfisis
preg_match2() and preg_match_all_offset_capture() each become a pair over a shared private impl, and their flags arguments are gone: no caller passed anything but 0 or PREG_UNMATCHED_AS_NULL. Preg::match5()/is_match5() lose their own flags argument for the same reason -- both call sites passed 0, and the value had nowhere left to go -- so they are renumbered to match4()/is_match4(). PREG_UNMATCHED_AS_NULL itself is now unreferenced. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17fix(platform): expand the %VAR% form in expand_path()nsfisis
The alternation that stands in for the original conditional subpattern reports the branch it did not take as an empty string, so `dvar` was always present and won over `pvar`, leaving %VAR% unexpanded. `\w+` cannot capture an empty string, so an empty branch means it did not participate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17fix(no-proxy-pattern): drop empty entries when splitting NO_PROXYnsfisis
The PHP splits with PREG_SPLIT_NO_EMPTY, but the port dropped that flag, so a leading separator in NO_PROXY kept an empty first entry. That made "empty($hostNames) || '*' === $hostNames[0]" false for values such as " *", turning "bypass the proxy for every host" into "use the proxy for every host". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(preg): replace Preg::split*() with shim preg_split*()nsfisis
preg_split2()'s limit was always -1 and its flags were always either 0 or PREG_SPLIT_DELIM_CAPTURE alone, so both arguments are gone: the shim now exposes preg_split() and preg_split_delim_capture() over a shared preg_split_impl(). That leaves Preg::split()/split4() as bare pass-throughs, so callers use the shim functions directly and the wrappers are dropped along with the now-unreferenced PREG_SPLIT_* constants. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(preg): drop Option wrapper from matches arg of match_all*()nsfisis
Every caller of Preg::match_all3()/is_match_all3() passed Some(&mut _), so the argument is now a plain &mut. Preg::match_all() keeps the no-captures form with a local throwaway map, and the arity suffixes are renumbered accordingly (match_all2(), is_match_all()). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17fix(pcre): preserve unmatched groups in Preg::match_all*()nsfisis
PHP's Preg::matchAll() and matchAllWithOffsets() always set PREG_UNMATCHED_AS_NULL, so a non-participating group is `null` and its offset is -1. The Rust wrappers collapsed those to "" and 0, so callers could not tell a group that did not participate from one that matched an empty string at offset 0, and the offset value matched no PHP mode at all. Hand the shim's representation through unchanged and let each caller mirror what the PHP original does with it: `isset()` and `(string)` casts stay lenient, while `assert(is_string(...))` and the *StrictGroups() variants become `expect()`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17refactor(preg): drop unused args of preg_match_all_offset_capture2()nsfisis
The sole caller, Preg::match_all_with_offsets5(), always passed flags=0 and offset=0, so PREG_UNMATCHED_AS_NULL is now unconditional and the subject is scanned from the beginning. That method is only reached from Preg::match_all_with_offsets(), so it is no longer public either. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(preg): make preg_grep() return an iteratornsfisis
Callers had to build a temporary Vec<&str> at every call site to satisfy the &[&str] parameter. Taking IntoIterator and yielding the matched items lets them pass owned or borrowed strings directly. The flags variant and PREG_GREP_INVERT go away with it: no caller passes flags, and Composer's Preg::grep() has no such parameter either.
2026-08-16refactor(preg): import preg_*() instead of qualifying themnsfisis
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16test: correct stale #[ignore] reasonsnsfisis
Running the ignored tests shows several reasons naming a blocker the test never reaches. The plugin hooks in all_functional_test do run, and what stops both cases is the worker's Composer\InstalledVersions; class_loader_test stops at include_file, not class_exists; auth_helper_test's wrapper is ported and the blocker is trigger_error; composerRequire is ported as __shirabe_composer_require. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(tests): share the PHP worker helpers with the plugin binarynsfisis
plugin_installer_test.rs carried its own copy of php_runtime_available, lock_php_worker and load_composer_php_runtime, and the other ten files in the binary imported them from there. The bodies matched tests/common/php_worker.rs, so include that instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(autoload): expand the dirsep placeholder in target-dir patternsnsfisis
AutoloadGenerator.php builds the target-dir pattern by quoting the path with a <dirsep> marker in place of the separators, then replacing the quoted marker with [\\/]. The port kept that shape, but preg_quote() here deliberately leaves < and > alone so the regex crate does not read \< as a word boundary, so the replacement never matched and the pattern came out as the literal {^Main<dirsep>Foo<dirsep>}. A root package's target-dir was therefore never stripped from files, classmap or exclude-from-classmap, and dumping one failed outright. Split on the separators and quote each segment instead, so the marker never passes through preg_quote() at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(php-shim): fail RecursiveIteratorFileInfo::get_size on a failed statnsfisis
This is the type Filesystem::directory_size() actually iterates, and it swallowed a failed stat as 0 the same way. PHP's iterator yields \SplFileInfo there, so raise the same \RuntimeException it would. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(env): route Shirabe's own env reads through the shimnsfisis
These sites have no PHP counterpart to mirror, so they read std::env directly. Going through the shim's getenv() keeps every environment read in one place and lets a lint forbid the direct form. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(proxy-manager): read proxy settings from $_SERVERnsfisis
ProxyManager::initProxyData() reads $_SERVER[$name], a startup snapshot, while the port read the live process environment. A putenv() issued after startup changed the proxy the port picked but not the one PHP would pick. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(factory): detect XDG from $_SERVERnsfisis
Factory::useXdg() enumerates array_keys($_SERVER). The port enumerated the live process environment instead, so a COMPOSER_HOME resolved against keys the PHP side never sees. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(php-shim): accept negative offsets in substr_replacensfisis
The signature took usize, so PHP's negative $start and $length, which count from the end of the string, could not be expressed. Take i64 and an optional length, and apply PHP's clamping rules. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16feat(plugin): proxy Composer\Util\Filesystem into the plugin workernsfisis
The class was shadowed by a guard, so a plugin doing `new Filesystem()` got an explicit error. It is classified rust-proxy and plugin-constructible and the Rust port is complete, so listing it as a stub target and answering its public surface from the entity is all it takes. The constructor rejects a caller-supplied ProcessExecutor: that class has no proxy stub, so the argument could only be a second instance the Rust side never sees. findShortestPath re-checks its arguments at the boundary because the port panics where PHP throws, and a panic would take the process down instead of reaching the plugin's catch block. phpstan/extension-installer matches upstream Composer byte for byte again.
2026-08-16feat(php-rpc): replay Rust-side env writes into the PHP workernsfisis
The worker is a long-lived child holding the environment it was handed at spawn, so `@putenv`, the bin dir the event dispatcher prepends to PATH, and COMPOSER_DEV_MODE never reached the PHP code running in it. The shim now journals every write to the three storages PHP exposes, and the outermost rpc_call replays the entries the worker has not seen yet through __shirabe_sync_env. Replaying the writes rather than pushing a whole snapshot keeps the worker's own $_SERVER entries intact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16feat(plugin): guard Rust-owned classes the worker has no proxy fornsfisis
The worker's autoloader fell through to the real Composer source for every Rust-owned FQCN without a proxy stub, so plugin code doing `new Filesystem()` or subclassing `LibraryInstaller` silently ran on a second instance the Rust side never sees. An unimplemented part of the plugin API has to fail with an explicit error naming it, not quietly work on a disconnected copy. The stub generator now emits a guard class for each of those FQCNs: the real declaration, hierarchy and constants, with every constructor and method raising an explicit error. References satisfied by the declaration alone (`instanceof`, `X::class`, `Link::TYPE_REQUIRE`) keep working. Two FQCNs stay resolvable to the real class, each listed with the worker-side mechanism that makes a natively constructed instance correct. The error had nowhere to go: `Installer::run` dropped the `Result` of both `dispatch_script` calls, so an exception from a listener ended in exit 0. Both propagate now, the way the exception does upstream. Three real-plugin E2E comparisons stop at a guard and are ignored, each naming the class it needs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(php-shim): split json_decode into assoc and obj variantsnsfisis
The assoc flag was always a literal at every call site, so the boolean carried no information the function name could not. json_decode_assoc and json_decode_obj make the resulting PhpMixed shape visible at the call site. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16fix(config): stringify cache-files-maxsize like PHP's (string) castnsfisis
Config::get() resolves cache-files-maxsize by matching the stored value against a size regex. The port read that value with as_string(), which yields None for anything that is not a string, where PHP casts with (string). create-project feeds Config::all() back through Config::merge(), so the second read finds the byte count the first read produced rather than the original "300MiB". as_string() then yields an empty string, the regex fails, and the resulting RuntimeException is swallowed by Config::get(), which maps Err to null. FileDownloader turns that null into a zero max size via .as_int().unwrap_or(0), and Cache::gc() deletes every file in the download cache because the total always exceeds zero. Apply the same cast on the path branch, the other site where Config.php writes (string). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(php-shim): give fstat and lstat a typed FileStat resultnsfisis
fstat and lstat now return Option<FileStat> instead of a PhpMixed array, so Platform::is_tty and Filesystem::is_junction read `mode` as a field. The array carried each of the 13 values twice — once under its numeric index and once under its name — which no caller relied on, and building it spelled the field list out four times. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(php-shim): give posix_getpwuid a typed PasswdEntry resultnsfisis
posix_getpwuid now returns Option<PasswdEntry> instead of a PhpMixed array, so Platform reads the field it wants rather than digging through the map. posix_getuid and posix_geteuid return u32, matching the uid PasswdEntry is looked up by. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(php-shim): give parse_url a typed UrlComponents resultnsfisis
parse_url now returns Option<UrlComponents> instead of a PhpMixed array, and the component-selecting overload with the PHP_URL_* constants is gone: callers read the field they want. Two call sites change behaviour as a result, both towards PHP: * CurlDownloader::handle_redirect tested scheme and host with is_null(), so an unparsable Location header (PhpMixed::Bool(false)) counted as an absolute URL. PHP's truthiness test sends it to the relative-path branch. * Url::get_origin appended a literal port 0, which PHP treats as falsy and leaves off. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(style): type SymfonyStyle messages as strings and cellsnsfisis
SymfonyStyle modelled PHP's string|array message parameters, its array of listing elements and its table headers/rows as PhpMixed, then normalised and stringified them at every entry point. Take &[String] for the message and listing parameters, Vec<Cell>/Vec<Row> for table (matching the horizontal_table signature) and Vec<String> for the choice options, so the is_array/is_iterable normalisation and the php_string helper both go away. PhpMixed stays where PHP is genuinely mixed: the question answers returned by ask/ask_hidden/choice, their validators, choice's string|int|null default, and the progress_iterate elements. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor(io): take &str in ConsoleIO write and sanitizensfisis
doWrite, doOverwrite and sanitize accept PHP's string|list<string>, which this port modelled as PhpMixed. Every call site inside ConsoleIO passes a single string, so take &str and return String instead, dropping the (array) casts and the to_string_list helper. Auditor is the only caller that passed a list: it builds table rows, whose cells must stay separate, so it now sanitizes each cell. select() likewise sanitizes each choice while projecting them into the keyed form. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16test(event-dispatcher): run PHPUnit-class listeners in the PHP workernsfisis
The listeners of five tests are methods of `Composer\Test\EventDispatcher\EventDispatcherTest`, which the worker could not load because the class extends `PHPUnit\Framework\TestCase` and phpunit is not part of the Composer runtime bundle. An empty stand-in for that base class is enough: a parent class only has to exist at declaration time, and method bodies and type declarations resolve lazily. The upstream file is then required into the worker unchanged, so the listener bodies and their `__DIR__` stay what Composer ships. The two assertions those bodies call are the only PHPUnit members the stand-in has to implement. `remove_listener` now compares a handle for an object the worker really holds instead of a hand-written one, and `create_composer_instance` wires the collaborators the autoloader-rebuild path reaches for, as the PHP helper does. Two tests stay ignored for a different reason: `Platform::put_env` writes only the Shirabe process environment, while the listeners read `getenv()` inside the long-lived worker. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16refactor: narrow pub(crate) items to privatensfisis
Porting mapped every PHP `protected` member onto `pub(crate)`, which is wider than nearly all of them need. Each item demoted here is reached only from the module that defines it, so the crate-wide visibility conveyed nothing. Every `pub(crate)` that survives has at least one reader in another module of the same crate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-16feat(php-shim): render human-facing timestamps in the local timezonensfisis
Split date() into date_utc() and date_local(), the latter resolving the system's local timezone through the tzfile crate ($TZ, then /etc/localtime, falling back to UTC when neither is readable). The timestamps Composer renders for humans -- the GitHub OAuth token note, the GitHub API rate limit reset time, the Perforce client spec fields and the "today" check of the show command -- now go through date_local(). PHP resolves its default timezone from the date.timezone ini setting, which Shirabe does not read, so date_default_timezone_get/set have no input left to model and are dropped from the shim and its callers. The resulting difference is recorded in docs/known-incompatibilities.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15refactor(php-shim): drop the unused opendir directory handlensfisis
PhpDirHandle recorded the opened path and nothing else, and its only caller asked just whether the open had succeeded. A resource type that has to gain readdir and closedir before it means anything is worse than the std::fs::read_dir call it wraps, so Filesystem::isReadable now makes that call directly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15feat(cli): report Shirabe's own identity instead of Composer'snsfisis
The binary called itself Composer everywhere: the application name, the logo, --version, about, and every warning that talks about the running program. Prompts to file a bug also pointed at Composer's issue tracker. Add SHIRABE_VERSION and SHIRABE_RELEASE_DATE next to the Composer version constants and report those, naming the Composer version this port tracks alongside them. Composer::VERSION and getVersion() are untouched, so the composer platform package, composer-runtime-api and the HTTP User-Agent keep the value plugins and package repositories expect. build.rs stamps the release date with the UTC date of the HEAD commit, the way Composer's Compiler fills in @release_date@ when building the phar. It now also fails the build when git cannot be read, instead of letting COMPOSER_DEV_WARNING_TIME fall back to the tagged-release value and suppress the outdated-build warning forever. Messages about the Composer ecosystem keep their wording. Two of them are pinned by upstream installer fixtures (Rule's "cannot be modified by Composer" and SolverProblemsException's "you can run Composer with") and stay as they are so those fixtures can keep being used verbatim. The e2e list comparison against upstream Composer now skips the banner, which cannot match by design, and compares everything below it as before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15feat(php-shim): drop the modelled PHP version constantsnsfisis
The shim reported a fixed PHP 8.1.0 through PHP_VERSION, PHP_VERSION_ID, the major/minor/release triple and the PHP_WINDOWS_VERSION_* trio. Their uses split in two. Some guarded branches PHP only needs on runtimes this port cannot be: proc_get_status reports the exit status on every call, so Symfony's pre-8.3 exit-code cache has nothing to work around; hash_raw and hash_file always offer xxh3, so the sha1 fallback is unreachable; and http_get_last_response_headers is always available, so the pre-8.4 $http_response_header branch is gone. safeJunctions reads the host Windows version rather than PHP state, and joins the Windows work on hold. The rest ask about the PHP the user actually runs, and now reach the worker through a new php-rpc PhpVersion payload: the startup banner and the 7.2.5 warning, self-update's min-php filter, the ext-* recommendation in VersionSelector, the stream User-Agent, and whether PhpFileParser scans for enums. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15refactor(php-shim): take only the data argument in http_build_querynsfisis
`http_build_query` ignores `numeric_prefix` because a string-keyed slice never holds an integer key, and every caller passes `"&"` as the separator. Drop both parameters and hard-code the separator. Callers that pass a map of scalar literals to `http_build_query_mixed` no longer need to build an `IndexMap<String, PhpMixed>` for it, so move them to the slice form. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15fix(composer-repository): encode the security advisory POST body as PHP doesnsfisis
`http_build_query(['packages' => array_keys($packageConstraintMap)])` maps a single array value, so the body PHP sends is `packages%5B0%5D=a&packages%5B1%5D=b`. The port flattened the array into repeated `packages=<name>` pairs, losing the indices, and passed `"&"` as the numeric prefix and `"="` as the argument separator, joining every pair with `=`. Build the query from a `packages` key holding the name list and hand it to `http_build_query_mixed`, which walks the nested value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15fix(php-rpc): unpack the runtime bundle under the cache dirnsfisis
A worker whose PHP cannot read the bundle out of the executable gets it from an unpacked copy, which went to a directory derived from XDG_CACHE_HOME alone. That ignored COMPOSER_CACHE_DIR, COMPOSER_HOME and the cache-dir setting, and put the files outside the directory clear-cache and the platform conventions cover. The callers now pass Composer's configured cache directory down to base_path(). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15feat(diagnose): audit the Composer runtime the executable carriesnsfisis
checkComposerAudit reported success instead of auditing anything, because the binary ships no vendor/composer/installed.json on disk. It reads the one in the embedded Composer PHP runtime now, and Composer's warning for a missing installed.json is back. Only that file leaves the bundle, into a temporary directory that goes away with the handle; the runtime is unpacked whole only for a worker that cannot read the bundle in place. Phar::extractTo's $files argument selects it, which the shim ignored so far. SHIRABE_COMPOSER_PHP_DIR moves into composer_runtime, so the worker and a reader on the Rust side resolve the runtime through the same branch. DiagnoseCommandTest::testCmdSuccess is ignored: packagist has advisories against composer/composer 2.9.7, the version Composer::VERSION reports, so diagnose exits 1 where the test expects 0. Upstream Composer 2.9.7 reports the same advisories. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-15feat(php-rpc): embed the Composer PHP runtime in the executablensfisis
Plugins and scripts need the real `Composer\` classes and the packages Composer depends on, which so far came from a checkout found through SHIRABE_COMPOSER_PHP_DIR or a path next to the workspace. Neither exists for a distributed binary. The build script now archives those PHP sources into a phar the way Compiler.php does and the executable carries it. The worker maps it with Phar::loadPhar and reads a content-addressed sentinel back to tell a bundle it can use from one it cannot; where its PHP cannot open the phar, the bundle is unpacked once into the cache directory and autoloaded from there. SHIRABE_COMPOSER_PHP_DIR still overrides both for development. PHP locates a phar's manifest by the first __HALT_COMPILER(); token in the file, so the executable must hold no other copy of it: phar.rs builds the token at run time, and a linter keeps further literals out of the sources that reach the binary. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-12test(installed-versions): verify the PHP class the worker loadsnsfisis
InstalledVersions has no Rust port, so the skeletons left behind asserted nothing about compatibility. The tests now require the Composer checkout's vendor/autoload.php into the PHP worker and drive the real class there, which puts $selfDir, the registered ClassLoader and Composer\Semver\VersionParser in the same state as the upstream PHPUnit run. The upstream setUp reflection and the installed_relative.php require stay in PHP; the expected values are Rust. The class Composer's own vendor directory autoloads and the one FilesystemRepository::write dumps from include_str! are separate files, so an added test asserts they hold the same bytes. FilesystemRepositoryTest::testSafelyLoadInstalledVersions moves to the worker too, against the php/stubs FilesystemRepository, whose safelyLoadInstalledVersions runs the PCRE recursive grammar natively. The shared worker helpers live in tests/common/php_worker.rs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-12test: drop stale #[ignore]s and rewrite the run-script reasonsnsfisis
Measuring every ignored test with `cargo test --workspace --no-fail-fast -- --ignored` turned up 11 that pass today; their reasons named todo!()s and gaps that have since been implemented. The two run_script_command_test cases still fail, but not for the reason given: the user's Command class is imported and executed, and what is missing is only a way to observe it, since PhpCommandProxy::run forwards the run to the worker-side console application. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-12fix(command): port ScriptAliasCommand's ignoreValidationErrors() callnsfisis
The command's own definition covers only --dev/--no-dev and the args array, so any other application-level option reaching it (as when GlobalCommand re-parses `--no-interaction=1` out of ArrayInput's stringification) aborted the run with "does not accept a value". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-12docs(todo): retag TODO markers by root causensfisis
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-11chore(php-shim): drop the HHVM_VERSION constantnsfisis
The constant was None and defined("HHVM_VERSION") reports it undefined, so every branch guarded by it was dead: shirabe is a Rust binary and never runs on HHVM. HhvmDetector keeps probing for an `hhvm` binary in PATH, which is what actually produces the hhvm platform package. Two of the dropped branches ask about the PHP runtime that consumes the result rather than about shirabe itself -- the class loader's Hack file lookup and the class map parser's enum scanning -- so both get a TODO(php-runtime) marker.
2026-08-11chore(php-shim): drop the substring predicate portsnsfisis
str_contains(), str_starts_with() and str_ends_with() were thin wrappers over the str methods of the same semantics. Call sites now use contains()/starts_with()/ends_with() directly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>