Fix JSON correctness and package metadata discovery - #14
Closed
binaryfire wants to merge 15 commits into
Closed
Conversation
Treat the public depth argument as a maximum number of nested containers and translate it to PHP's distinct decode and validation depth unit. Preserve caller flags, forward throwing behavior to Jsonable values, use json_validate for predicates, and align framework response test readers with the shared contract. Add boundary, native-error, and flag-forwarding coverage.
Raise native decode depths where Collections consumes JSON produced at the framework's 512-container limit. Keep the dependency direction intact rather than coupling Collections back to Support. Cover collection decoding, Jsonable item serialization, and Arr conversion at the supported boundary and one level beyond it.
Use PHP's native 513 decode depth in both filesystem JSON readers so documents written with 512 nested containers remain readable. Retain the existing flags-controlled error behavior and missing-file contract, with regressions for maximum depth, overflow, malformed input, and throwing mode.
Route Composer file reads and writes through the shared JSON contract so maximum-depth metadata can be read after it is written. Encode before inspecting file mode or replacing bytes, ensuring over-depth or otherwise invalid callback results fail without changing the original file. Cover the supported boundary and byte-for-byte failure preservation.
Align maintenance data, HTTP request and response payloads, JSON sessions, XML normalization, and Inertia test data with the shared nesting contract. Values encoded at 512 nested containers now decode through their owning boundary, while one-level-over values fail at encoding or validation instead of becoming null or unrelated type errors. Existing output shapes and non-throwing session recovery remain unchanged.
Move the serialized-closure command to Concurrency and centralize response-envelope decoding, remote exception reconstruction, binary result handling, and malformed transport errors in SerializedClosureResult. Delegate ProcessDriver and Testbench process results to the shared decoder, declare their direct package dependencies, and move the command, fixture, and process tests to the owning package. Preserve raw non-closure output and transport-specific encoding behavior.
Route request JSON casts and both validator execution paths through the shared JSON contract, removing the unused request encoder and the dead PHP-version fallback. Malformed, empty, and over-depth JSON strings now fail consistently in interpreted and compiled validation before array, collection, object, or JSON casting. Correct the public example and cover the normal validated form-request path.
Give Eloquent's codec matching write and read depth limits, keep contextual model errors for failed encodes, and validate decoded shapes before constructing first-party JSON class casts. Use the existing JSON attribute encoder for path assignments and let valid values replace malformed readable originals without swallowing decryption failures. Cover primitive, encrypted, enum, collection, fluent, data-object, custom codec, and cross-engine repair behavior.
Enable native throwing JSON encoding in base, MySQL, MariaDB, PostgreSQL, and SQLite binding preparation so recursion, non-finite values, and depth failures cannot reach query execution as false. Keep each grammar's existing encoding flags and binding shapes, tighten an adjacent PostgreSQL comparison, and exercise the protected preparation methods directly across all supported grammar families.
Make database show and table commands raise the native JSON error at serialization time instead of passing false into Symfony output. Add focused probes for valid output and non-finite metadata so command rendering preserves its existing format while failures retain their real cause.
Store entries through one readable codec, purge only top-level fields that exceed the entry envelope, and keep exception visibility updates and replacement inserts atomic in deterministic family order. Normalize diagnostic objects with fail-loud encoding, parse application responses once, and unify client request and response masking before size checks. Structured JSON and form bodies can no longer fall through to raw storage with configured secrets, while opaque and explicit text payload behavior remains unchanged. Cover maximum-depth storage, field recovery, failure ordering, exception family state, updates, structured and raw redaction, response parsing, and watcher normalization.
Distinguish missing Composer metadata from malformed or structurally invalid metadata during framework and Testbench package discovery. Validate package names, versions, and extra.hypervel containers only when they are consumed, preserving wildcard and package-specific ignore semantics. Share focused package-name and Hypervel-extra readers without adding a parser abstraction, keep protected formatting parity, and fail before publishing a replacement manifest. Cover root and installed metadata, ignored packages, cache preservation, test-state registration, and subprocess startup diagnostics.
Record the final depth, storage, redaction, Eloquent repair, serialized transport, and package metadata contracts implemented by this branch. Include the verified native JSON behavior, ownership boundaries, anti-overengineering constraints, file map, testing matrix, performance expectations, compatibility notes, and primary references needed to maintain the changes.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughThis change centralizes JSON depth and error handling across Hypervel. It updates framework, Eloquent, Telescope, concurrency, validation, and package discovery paths. It adds boundary and failure tests for JSON handling, serialized closures, redaction, and Composer metadata. ChangesJSON contract and framework round trips
Eloquent JSON casts and database encoding
Serialized closure result ownership
Telescope JSON handling
Package metadata validation
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Request
participant Json
participant Validation
participant Telescope
Request->>Json: decode bounded JSON payload
Json->>Validation: validate JSON structure and depth
Validation-->>Request: accept or reject input
Request->>Telescope: record structured request and response data
Telescope->>Json: encode masked payload
Json-->>Telescope: encoded content or JSON exception
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
Greptile SummaryThis PR standardizes framework-owned JSON nesting and failure behavior while tightening serialized concurrency results, Eloquent JSON handling, Telescope storage/redaction, and Composer package discovery.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| src/support/src/Json.php | Defines the shared nested-container contract, preserves caller flags, and translates decode/validation depth to native PHP units. |
| src/concurrency/src/SerializedClosureResult.php | Centralizes serialized result envelope validation, remote exception reconstruction, binary decoding, and guarded unserialization. |
| src/database/src/Eloquent/Casts/Json.php | Aligns default Eloquent encode/decode depths while preserving custom codec and empty-string conventions. |
| src/database/src/Eloquent/Concerns/HasAttributes.php | Reuses contextual JSON encoding for path writes and permits valid assignments to replace malformed readable originals. |
| src/telescope/src/Storage/DatabaseEntriesRepository.php | Adds field-level depth recovery and transactional exception visibility replacement without hiding non-depth failures. |
| src/telescope/src/Watchers/ClientRequestWatcher.php | Masks structured payloads before sizing and purges malformed declared JSON rather than retaining raw secrets. |
| src/foundation/src/PackageManifest.php | Distinguishes missing metadata from malformed consumed structures and provides path-specific discovery failures. |
| src/testbench/src/Foundation/PackageManifest.php | Applies the same focused package metadata checks to Testbench root-package discovery. |
| src/validation/src/PlanExecutor.php | Uses the shared JSON validation depth contract in the compiled validator path. |
| src/foundation/src/Http/Traits/HasCasts.php | Routes request JSON casts through throwing shared decoding so malformed inputs fail consistently. |
Reviews (2): Last reviewed commit: "fix(concurrency): validate transported e..." | Re-trigger Greptile
Read both subprocess output streams when asserting native PHP failures and reporting unexpected manifest-build exits. PHP routes displayed fatal errors according to its runtime configuration: the CI image writes them to stdout while local logging also supplies stderr. Keep the test focused on the nonzero exit, useful diagnostic, and absent manifest rather than a php.ini-dependent stream. Update the implementation plan to match.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (4)
src/concurrency/src/SerializedClosureResult.php (2)
76-83: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConfirm the trust boundary for
unserialize.Static analysis flags
unserializeon line 77 as deserialization of untrusted data. The value comes from the child process envelope, so the input is trusted only while process stdout is framework-controlled.allowed_classescannot be restricted here, because concurrent tasks legitimately return objects. Document the trust assumption in the class docblock so future callers do not pass external output intodecode().🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/concurrency/src/SerializedClosureResult.php` around lines 76 - 83, Document the trust boundary for unserialize in the SerializedClosureResult class docblock: decode() must receive only framework-controlled child-process envelope output, not external or user-provided data. Explicitly note that concurrent task results may contain objects and therefore allowed_classes cannot be restricted; leave the existing decode logic unchanged.Source: Linters/SAST tools
43-65: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winValidate the exception class before you instantiate it.
Line 55 instantiates any class name found in the envelope, with envelope-supplied arguments. If the class is not a
Throwable, the constructor still runs, and only then does line 60 reject the object. Constructors of unrelated classes can have side effects.Check the class name first. This also removes the need for the post-construction
instanceofcheck.🛡️ Proposed guard
$exceptionClass = $payload['exception'] ?? RuntimeException::class; $message = $payload['message'] ?? 'Serialized closure execution failed.'; $parameters = $payload['parameters'] ?? ['message' => $message]; + if (! is_a($exceptionClass, Throwable::class, true)) { + throw new RuntimeException($message); + } + try { $exception = new $exceptionClass(...$parameters); } catch (Throwable $constructionException) { throw new RuntimeException($message, previous: $constructionException); } - - if (! $exception instanceof Throwable) { - throw new RuntimeException($message); - } throw $exception;Note:
tests/Concurrency/SerializedClosureResultTest.phplines 207-234 assert that a missing class produces a non-null previous exception, and thatstdClassproduces aRuntimeExceptionwith the transported message. With this guard, both cases take theis_abranch and carry no previous exception. UpdatetestItContainsUnavailableExceptionClassesDuringReconstructionaccordingly if you apply the change.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/concurrency/src/SerializedClosureResult.php` around lines 43 - 65, Validate the envelope’s exception class with is_a(..., Throwable::class, true) before constructing it in SerializedClosureResult; for invalid or unavailable classes, throw RuntimeException with the transported message and do not instantiate them. Remove the post-construction instanceof check, and update testItContainsUnavailableExceptionClassesDuringReconstruction to expect no previous exception for missing classes and stdClass.Source: Linters/SAST tools
tests/Concurrency/SerializedClosureResultTest.php (2)
244-260: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a rejection test for parameters that exceed the transport depth.
The suite proves that 510 containers reconstruct. It does not prove that the decoder rejects a deeper envelope. Add a case with 511 containers to lock the boundary at the decoder, matching
testItDegradesExceptionParametersBeyondTheTransportDepthintests/Concurrency/Console/InvokeSerializedClosureCommandTest.php.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/Concurrency/SerializedClosureResultTest.php` around lines 244 - 260, Add a test alongside testItReconstructsTheMaximumExceptionParameterDepth using nestedValue(511), then assert decodePayload rejects or degrades the exception parameters according to the existing transport-depth behavior, matching testItDegradesExceptionParametersBeyondTheTransportDepth. Keep the 510-container reconstruction test unchanged to lock the boundary.
47-66: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueMove
$this->fail()outside the matchingtryblocks.PHPUnit\Framework\AssertionFailedErrorextendsRuntimeException, so handlers that catchRuntimeExceptionorExceptionswallow the failure and report misleading diagnostics. Apply this to all listed blocks except lines 146-164, whosecatch (ErrorException)does not catch PHPUnit assertion failures.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/Concurrency/SerializedClosureResultTest.php` around lines 47 - 66, Move each $this->fail() call outside the try blocks that catch RuntimeException or Exception in SerializedClosureResultTest::testItRejectsInvalidResponseEnvelopes and the listed blocks in InvokeSerializedClosureCommandTest.php (lines 231-237); retain the existing catch assertions, and make no change to lines 146-164 because ErrorException does not catch PHPUnit assertion failures.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/database/src/Eloquent/Casts/AsArrayObject.php`:
- Around line 35-41: Translate JsonException during persistence encoding into
JsonEncodingException::forAttribute using the exception message, replacing
ineffective false-result checks. Apply this in AsArrayObject.php#L35-L41,
AsCollection.php#L65-L71, AsDataObject.php#L61-L67,
AsEncryptedArrayObject.php#L37-L43 before encryption,
AsEncryptedCollection.php#L67-L73 before encryption, and
AsEnumArrayObject.php#L69-L75; preserve each cast’s existing persistence flow
after successful encoding.
In `@src/foundation/src/Http/Traits/HasCasts.php`:
- Around line 388-390: Restore the protected asJson helper in the HasCasts trait
and implement it by delegating to Json::encode, preserving the existing
protected extension surface for classes using the trait.
In `@src/telescope/src/Storage/DatabaseEntriesRepository.php`:
- Around line 183-214: The occurrence count and row construction currently
happen before the transaction, allowing concurrent stores to use the same count.
Move the per-family counting and row construction into the transaction in the
repository method containing countExceptionOccurences, and acquire family locks
in deterministic order before counting so concurrent stores serialize correctly
while preserving existing display-flag updates and inserts; add a regression
test covering concurrent stores for one family.
In `@tests/Testing/TestResponseTest.php`:
- Around line 493-505: Update
testDumpDecodesJsonAsObjectsAndPreservesInvalidBytes to capture the previous
VarDumper handler returned by VarDumper::setHandler before installing the test
callback, then restore that captured handler in the finally block instead of
setting it to null.
---
Nitpick comments:
In `@src/concurrency/src/SerializedClosureResult.php`:
- Around line 76-83: Document the trust boundary for unserialize in the
SerializedClosureResult class docblock: decode() must receive only
framework-controlled child-process envelope output, not external or
user-provided data. Explicitly note that concurrent task results may contain
objects and therefore allowed_classes cannot be restricted; leave the existing
decode logic unchanged.
- Around line 43-65: Validate the envelope’s exception class with is_a(...,
Throwable::class, true) before constructing it in SerializedClosureResult; for
invalid or unavailable classes, throw RuntimeException with the transported
message and do not instantiate them. Remove the post-construction instanceof
check, and update testItContainsUnavailableExceptionClassesDuringReconstruction
to expect no previous exception for missing classes and stdClass.
In `@tests/Concurrency/SerializedClosureResultTest.php`:
- Around line 244-260: Add a test alongside
testItReconstructsTheMaximumExceptionParameterDepth using nestedValue(511), then
assert decodePayload rejects or degrades the exception parameters according to
the existing transport-depth behavior, matching
testItDegradesExceptionParametersBeyondTheTransportDepth. Keep the 510-container
reconstruction test unchanged to lock the boundary.
- Around line 47-66: Move each $this->fail() call outside the try blocks that
catch RuntimeException or Exception in
SerializedClosureResultTest::testItRejectsInvalidResponseEnvelopes and the
listed blocks in InvokeSerializedClosureCommandTest.php (lines 231-237); retain
the existing catch assertions, and make no change to lines 146-164 because
ErrorException does not catch PHPUnit assertion failures.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4a913411-c432-4c95-90a0-2f14a189dea2
📒 Files selected for processing (96)
docs/plans/2026-08-11-0932-json-correctness-and-package-metadata.mdsrc/collections/src/Arr.phpsrc/collections/src/Traits/EnumeratesValues.phpsrc/concurrency/composer.jsonsrc/concurrency/src/Console/InvokeSerializedClosureCommand.phpsrc/concurrency/src/ProcessDriver.phpsrc/concurrency/src/SerializedClosureResult.phpsrc/database/src/Console/ShowCommand.phpsrc/database/src/Console/TableCommand.phpsrc/database/src/Eloquent/Casts/AsArrayObject.phpsrc/database/src/Eloquent/Casts/AsCollection.phpsrc/database/src/Eloquent/Casts/AsDataObject.phpsrc/database/src/Eloquent/Casts/AsEncryptedArrayObject.phpsrc/database/src/Eloquent/Casts/AsEncryptedCollection.phpsrc/database/src/Eloquent/Casts/AsEnumArrayObject.phpsrc/database/src/Eloquent/Casts/AsEnumCollection.phpsrc/database/src/Eloquent/Casts/AsFluent.phpsrc/database/src/Eloquent/Casts/Json.phpsrc/database/src/Eloquent/Concerns/HasAttributes.phpsrc/database/src/Query/Grammars/Grammar.phpsrc/database/src/Query/Grammars/MySqlGrammar.phpsrc/database/src/Query/Grammars/PostgresGrammar.phpsrc/database/src/Query/Grammars/SQLiteGrammar.phpsrc/docs/validation.mdsrc/filesystem/src/Filesystem.phpsrc/filesystem/src/FilesystemAdapter.phpsrc/foundation/src/FileBasedMaintenanceMode.phpsrc/foundation/src/Http/Traits/HasCasts.phpsrc/foundation/src/PackageManifest.phpsrc/foundation/src/Providers/FoundationServiceProvider.phpsrc/http/src/Client/Request.phpsrc/http/src/JsonResponse.phpsrc/inertia/src/Testing/AssertableInertia.phpsrc/session/src/Store.phpsrc/support/src/Composer.phpsrc/support/src/Json.phpsrc/support/src/Str.phpsrc/support/src/Xml.phpsrc/telescope/src/ExtractProperties.phpsrc/telescope/src/Storage/DatabaseEntriesRepository.phpsrc/telescope/src/Watchers/ClientRequestWatcher.phpsrc/telescope/src/Watchers/EventWatcher.phpsrc/telescope/src/Watchers/ModelWatcher.phpsrc/telescope/src/Watchers/RequestWatcher.phpsrc/testbench/composer.jsonsrc/testbench/src/Foundation/PackageManifest.phpsrc/testbench/src/Foundation/Process/ProcessResult.phpsrc/testing/src/AssertableJsonString.phpsrc/testing/src/TestResponse.phpsrc/validation/src/Concerns/ValidatesAttributes.phpsrc/validation/src/PlanExecutor.phptests/Concurrency/ConcurrencyTest.phptests/Concurrency/Console/InvokeSerializedClosureCommandTest.phptests/Concurrency/Fixtures/ConcurrentProcessExceptionFixtures.phptests/Concurrency/PackageMetadataTest.phptests/Concurrency/SerializedClosureResultTest.phptests/Database/DatabaseConsoleJsonTest.phptests/Database/DatabaseEloquentJsonCastTest.phptests/Database/DatabaseMariaDbQueryGrammarTest.phptests/Database/DatabaseMySqlQueryGrammarTest.phptests/Database/DatabasePostgresQueryGrammarTest.phptests/Database/DatabaseQueryGrammarTest.phptests/Database/DatabaseSQLiteQueryGrammarTest.phptests/Filesystem/FilesystemAdapterTest.phptests/Filesystem/FilesystemTest.phptests/Foundation/FoundationFileBasedMaintenanceModeTest.phptests/Foundation/FoundationPackageManifestTest.phptests/Foundation/Http/CustomCastingTest.phptests/Http/HttpClientTest.phptests/Http/HttpJsonResponseTest.phptests/Inertia/Testing/AssertableInertiaTest.phptests/Integration/Database/EloquentModelEncryptedCastingTest.phptests/Integration/Database/EloquentModelJsonCastingTest.phptests/Session/SessionStoreTest.phptests/Support/ComposerFileTest.phptests/Support/JsonTest.phptests/Support/SupportArrTest.phptests/Support/SupportCollectionTest.phptests/Support/SupportStrTest.phptests/Support/SupportStringableTest.phptests/Support/XmlTest.phptests/Telescope/ExtractPropertiesTest.phptests/Telescope/Storage/DatabaseEntriesRepositoryTest.phptests/Telescope/Watchers/ClientRequestWatcherTest.phptests/Telescope/Watchers/EventWatcherTest.phptests/Telescope/Watchers/ModelWatcherTest.phptests/Telescope/Watchers/RequestWatchersTest.phptests/Testbench/Foundation/Fixtures/PackageManifest/build-manifest.phptests/Testbench/Foundation/PackageManifestPackageTesterTest.phptests/Testbench/Foundation/PackageManifestTest.phptests/Testbench/Foundation/Process/ProcessResultTest.phptests/Testbench/PackageMetadataTest.phptests/Testing/PHPUnit/TestStateRegistrarsTest.phptests/Testing/TestResponseTest.phptests/Validation/ValidationPlanExecutorTest.phptests/Validation/ValidationValidatorTest.php
Document the framework-only trust boundary for serialized closure responses and validate that a transported exception class is an available Throwable before invoking its constructor. Preserve the remote message while retaining class-resolution and constructor failures as the previous exception for useful diagnostics. Make the transport regression tests immune to PHPUnit assertion interception, prove that non-Throwable constructors are never called, and keep combined Testbench subprocess diagnostics separated by a newline. Record the accepted Telescope occurrence-count race and why moving a non-locking count into the existing transaction would not serialize writers. The full formatter, static analysis, parallel suite, Testbench contract suite, dogfood checks, and targeted review tests are green.
Collaborator
Author
|
@coderabbitai I reviewed all four inline findings and all four nitpicks against the current source, producers, consumers, and test lifecycle. Changes pushed:
No change was made for the remaining suggestions:
There were no outside-of-diff findings. The full repository checks and focused regression tests are green. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== PR review comments ==='
gh api repos/hypervel/components-backup/pulls/14/comments --paginate \
--jq '.[] | {path, line, body, user: .user.login}' || true
echo '=== Changed files related to reported follow-up ==='
git diff --name-only HEAD^ HEAD | rg '^(src/concurrency/|src/telescope/|tests/Concurrency/|tests/Telescope/|docs/)'
echo '=== Relevant source outlines ==='
for f in \
src/concurrency/src/SerializedClosureResult.php \
src/concurrency/src/ProcessDriver.php \
src/telescope/src/Storage/DatabaseEntriesRepository.php \
tests/Concurrency/SerializedClosureResultTest.php \
tests/Concurrency/ConcurrencyTest.php; do
if [ -f "$f" ]; then
echo "--- $f"
ast-grep outline "$f" --items all || true
fi
done
echo '=== Targeted reported-change references ==='
rg -n -C 5 \
'Throwable|previous|constructor|stdout|stderr|occurrence|serialize|trust boundary|shared subprocess|catch \(Throwable|catch \(\\Throwable' \
src/concurrency src/telescope tests/Concurrency tests/Telescope docs \
|| trueLength of output: 201597 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== Review comments: compact ==='
gh api repos/hypervel/components-backup/pulls/14/comments --paginate \
--jq '.[] | "\(.id)\t\(.path):\(.line // 0)\t\(.user.login)\t\(.body | gsub("\n"; " "))"' \
| head -200
echo '=== Files changed in current PR ==='
gh pr view 14 --repo hypervel/components-backup --json files \
--jq '.files[].path' \
| rg '^(src/(concurrency|telescope)/|tests/(Concurrency|Telescope)/|docs/)'
echo '=== SerializedClosureResult ==='
sed -n '1,240p' src/concurrency/src/SerializedClosureResult.php
echo '=== Concurrency command and process driver ==='
sed -n '1,260p' src/concurrency/src/Console/InvokeSerializedClosureCommand.php
sed -n '1,220p' src/concurrency/src/ProcessDriver.php
echo '=== Relevant concurrency test declarations and assertions ==='
rg -n -C 6 \
'constructor|side.effect|Throwable|previous|stdout|stderr|catch \(|SerializedClosureResult' \
tests/Concurrency -g '*.php'
echo '=== Telescope occurrence-count implementation and documentation ==='
rg -n -C 8 \
'occurrence|count\(|transaction|race|serializ|lock' \
src/telescope/src/Storage/DatabaseEntriesRepository.php \
tests/Telescope/Storage/DatabaseEntriesRepositoryTest.php \
docs -g '*.php' -g '*.md' \
-g '!**/dist/**'Length of output: 201776 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== Serialized closure decoder ==='
cat -n src/concurrency/src/SerializedClosureResult.php | sed -n '1,220p'
echo '=== Serialized closure command ==='
cat -n src/concurrency/src/Console/InvokeSerializedClosureCommand.php | sed -n '1,240p'
echo '=== Process driver ==='
cat -n src/concurrency/src/ProcessDriver.php | sed -n '1,200p'
echo '=== Decoder test methods and local fixtures ==='
rg -n -A 28 -B 5 \
'function test.*(Throwable|Constructor|constructor|Output|Output.*Stream|Diagnostics)|class .*Exception|function __construct|catch \(' \
tests/Concurrency/SerializedClosureResultTest.php \
tests/Concurrency/ConcurrencyTest.php
echo '=== PR-specific Telescope decision record ==='
fd '2026-08-11-0932-json-correctness-and-package-metadata\.md$' docs/plans \
-x sh -c 'echo "--- $1"; rg -n -C 6 "occurrence|race|serializ|lock" "$1"' sh {}Length of output: 82808
The concurrency decoder now documents its framework-only trust boundary. It validates a transported class as a
The Telescope decision record accurately describes the accepted occurrence-count race. A plain count inside the current transaction would not serialize concurrent writers. Exact serialization would require unsupported cross-engine locking or a dedicated lock owner. The declined suggestions are consistent with the Eloquent codec contract, Laravel API scope, transport-depth boundary, authoritative VarDumper cleanup, and the repository documentation rule. No further change is required. ✏️ Learnings added
If you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! You are interacting with an AI system. |
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR makes JSON nesting and failure behavior consistent across framework-owned storage, transport, validation, diagnostics, and package discovery.
The main rule is simple: a value accepted at Hypervel's public maximum of 512 nested containers must remain readable by the matching framework boundary. PHP uses different depth units for encoding and decoding, so a value encoded with depth 512 requires native decode depth 513. Several framework paths used 512 for both and could turn valid data into null, false, an empty result, or an unrelated type error.
This change defines that contract once in Support Json and applies it only where Hypervel owns both sides of the round trip. External input and protocol-specific readers keep their existing contracts.
What changed
Shared JSON behavior
Concurrency transport
Request validation
Eloquent and database boundaries
Telescope
Package discovery
Compatibility and cost
Public and protected Laravel-style surfaces are preserved. Explicit native depth arguments on APIs that already expose native PHP semantics remain native. Eloquent custom codecs, stored empty-string handling, filesystem flags, session recovery, raw process output, and opaque Telescope payload behavior remain intact.
Normal JSON reads add one branch and integer increment. Telescope storage still encodes once on success; field-by-field recovery runs only after a depth error. Structured payloads still mask and encode once. The exception transaction is limited to exception chunks. The change adds no cache, registry, retry loop, container lookup, worker state, or general successful-path preflight.
Malformed package metadata now fails loudly by design. Missing metadata remains supported.
Testing
The branch includes focused regressions for every changed boundary, including depth limits, native flags and errors, Eloquent custom and encrypted casts, repair behavior, query grammars, Telescope storage and redaction, serialized closure envelopes, and package discovery.
Verification includes the full Components fix pipeline, Testbench and dogfood suites, focused package suites, and the SQLite, PostgreSQL, MySQL, and MariaDB integration matrices.
Summary by CodeRabbit
New Features
Bug Fixes