speedsharmaai/phpm

Review signals: 1 hardcoded secret, 20 known vulnerability.

Gitleaks found a possible hardcoded secret; value withheld. docs/design/phpm.pen

OSV reports a known vulnerability in this dependency version. 5 distinct locations. 10 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• --explain prints per-package decisions of native install or Composer handoff: Real input produced the expected result: decision install:

  Source: `--explain` prints, per package, whether it was installed natively or handed

  Input: ytmate fixture composer.json and composer.lock in a fresh project

  Expected: decision lines for install and autoload are printed

  Command: phpm -d <guest-path> install --explain

  Observed: decision install: nothing to do, composer.json, composer.lock and vendor/ are as phpm left them Nothing to install, update or remove

• -o / --optimize-autoloader works: Real input produced the expected result: decision install:

  Source: `--optimize-autoloader` / `-o`, `--classmap-authoritative` / `-a` all work.

  Input: ytmate fixture composer.json and composer.lock in a fresh project

  Expected: autoloader is written natively

  Command: phpm -d <guest-path> install --explain --optimize-autoloader

  Observed: decision install: nothing to do, composer.json, composer.lock and vendor/ are as phpm left them Nothing to install, update or remove

Examples

• Quickstart: install a PHP project's lockfile with --explain: command completed successfully

  Source: README.md Usage section

  Input: cd project; phpm install --explain (ytmate fixture)

  Expected: packages installed natively with decision lines

  Command: phpm -d <guest-path> install --explain

  Observed: decision install: nothing to do, composer.json, composer.lock and vendor/ are as phpm left them Nothing to install, update or remove

Local or hosted: local

Install a composer.lock into vendor/ with phpm install --explain (README Usage) and get per-package native/Composer decisions

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -c 6000
cd <guest-path> && git status 2>&1 | head -3; git log -1 --format=%H 2>&1; ls <guest-path> ; ls /inputs 2>&1
cd <guest-path> && awk '/^## Installation/,/^## How it works/' README.md | head -c 7000
cd <guest-path> && cat rust-toolchain.toml; which cargo rustc php composer curl git; cargo --version 2>&1; rustc --version 2>&1; timeout 15 curl -sI https://github.com 2>&1 | head -3; echo "rc=$?"; env | grep -i proxy
cd /tmp && curl -LsSf https://github.com/speedsharmaai/phpm/releases/latest/download/phpm-installer.sh -o /tmp/phpm-installer.sh; echo "dl rc=$?"; ls -la /tmp/phpm-installer.sh 2>&1; head -c 600 /tmp/phpm-installer.sh 2>/dev/null
cd /tmp && export NODE_USE_ENV_PROXY=1 && sh /tmp/phpm-installer.sh 2>&1 | tail -30; echo "rc=${PIPESTATUS[0]}"; ls -la ~/.cargo/bin 2>&1 | head; ~/.cargo/bin/phpm --version 2>&1
P=/var<guest-path>; $P --version; $P --help 2>&1 | head -40; which php composer; php --version 2>&1 | head -1
cd <guest-path> && ls fixtures; find fixtures -maxdepth 3 -name composer.lock | head -20; ls bench-real | head; awk '/^## Compatibility/,/^## Installation/' README.md | head -c 2500
cd <guest-path> && cat fixtures/README.md | head -c 3000; echo ----; ls -la fixtures/bedrock fixtures/laravel-skeleton fixtures/symfony-demo 2>&1 | head -40
mkdir -p <guest-path> && rm -rf <guest-path> && mkdir -p <guest-path> && cd <guest-path> && cp <guest-path> composer.json && cp <guest-path> composer.lock && ls -la && time /var<guest-path> install --explain 2>&1 | tail -40; echo "rc=${PIPESTATUS[0]}"
sudo -n true && echo SUDO_OK; sudo -n apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -3; apt-cache policy php-cli | head -3
sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y -qq php-cli php-xml php-mbstring php-curl php-zip unzip ><guest-path> 2>&1; echo "rc=$?"; tail -3 <guest-path>; php --version | head -1
cd <guest-path> && time /var<guest-path> install --explain > <guest-path> 2>&1; echo "rc=$?"; tail -c 3000 <guest-path>; ls vendor 2>&1 | head
sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y -qq php-mysql php-gd ><guest-path> 2>&1; echo "rc=$?"; cd <guest-path> && time /var<guest-path> install --explain > <guest-path> 2>&1; echo "rc=$?"; tail -c 3000 <guest-path>; ls vendor 2>&1 | head
cd <guest-path> && grep -nF '`--explain` prints, per package, whether it was installed natively or handed' README.md; grep -nF 'It installs from a lockfile only: no `update` or `require`' README.md; grep -nF 'cd /path/to/your/php/project' README.md; grep -nF 'phpm install --explain' README.md; grep -rniE 'cron|schedul|--once|--now|webhook|daemon|watch' crates/*/src --include=*.rs -l 2>/dev/null | head; grep -rniE 'cron|schedul|webhook|daemon' README.md | head -3; ls crates
cd <guest-path> && /var<guest-path> -d <guest-path> install --explain > <guest-path> 2>&1; echo "rc=$?"; tail -3 <guest-path>; ls <guest-path>
cd <guest-path> && cat <guest-path>; echo ----; /var<guest-path> -d <guest-path> install --explain -o > <guest-path> 2>&1; echo "rc=$?"; cat <guest-path> | tail -8; grep -nF 'Plain `phpm install` otherwise behaves like' README.md
cd <guest-path> && for d in probe-proj claim-explain-proj claim-optimize-proj; do rm -rf $d; mkdir -p $d; cp <guest-path> $d/composer.json; cp <guest-path> $d/composer.lock; done; grep -nF 'optimize-autoloader` / `-o`' <guest-path>; cat > <guest-path> <<'EOF'
{"kind":"cli","argv":["phpm","-d","<guest-path>","install","--explain","-o"],"cwd":"<guest-path>","env":{"PATH":"/var<guest-path>"},"expected_text":"decision autoload: native, phpm writes the autoloader"}
EOF
python3 -I -c 'import json;json.load(open("<guest-path>"));print("probe ok")'
cd <guest-path> && rm -rf examples-proj && mkdir examples-proj && cp <guest-path> examples-proj/composer.json && cp <guest-path> examples-proj/composer.lock && cat > <guest-path> <<'EOF'
[{"kind":"claim","claim":"--explain prints per-package decisions of native install or Composer handoff","source":"`--explain` prints, per package, whether it was installed natively or handed","input":"ytmate fixture composer.json and composer.lock in a fresh project","expected":"decision lines for install and autoload are printed","probe_kind":"cli","argv":["phpm","-d","<guest-path>","install","--explain"],"cwd":"<guest-path>","env":{"PATH":"/var<guest-path>"},"expected_text":"decision install:"},
{"kind":"claim","claim":"-o / --optimize-autoloader works","source":"`--optimize-autoloader` / `-o`, `--classmap-authoritative` / `-a` all work.","input":"ytmate fixture composer.json and composer.lock in a fresh project","expected":"autoloader is written natively","probe_kind":"cli","argv":["phpm","-d","<guest-path>","install","--optimize-autoloader"],"cwd":"<guest-path>","env":{"PATH":"/var<guest-path>"},"expected_text":"decision autoload: native, phpm writes the autoloader"}]
EOF
cat > <guest-path> <<'EOF'
[{"kind":"example","claim":"Quickstart: install a PHP project's lockfile with --explain","source":"README.md Usage section","input":"cd project; phpm install --explain (ytmate fixture)","expected":"packages installed natively with decision lines","argv":["phpm","-d","<guest-path>","install","--explain"],"cwd":"<guest-path>","env":{"PATH":"/var<guest-path>"},"expected_text":"decision install:"}]
EOF
cat > <guest-path> <<'EOF'
{"detected":false,"reason":"phpm is a one-shot CLI (install is the only subcommand, per phpm --help). README and crates/*/src contain no cron, scheduler, --once/--now, watch, daemon or webhook entry points, so there is no product cycle to trigger.","checks":[]}
EOF
for f in claims examples cycles probe; do python3 -I -c "import json,sys;json.load(open('<guest-path>'));print('$f ok')"; done
cd <guest-path> && ls <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 5000; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && sed -i 's/"install","--optimize-autoloader"\]/"install","--explain","--optimize-autoloader"]/; s/"command"/"command"/' .coldpass/claims.json && grep -o '"argv":\[[^]]*\]' .coldpass/claims.json && python3 -I -c "import json;json.load(open('.coldpass/claims.json'));print('ok')" && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; grep -o '"verdict": "[a-z]*"' <guest-path> | sort | uniq -c; grep -oE '"(problems|errors|ok|status)[^,]{0,200}' <guest-path> | head -20; tail -c 600 <guest-path>
cd <guest-path> && grep -oE '"problems": \[.{0,1500}' <guest-path> | head -c 2000; echo; echo ---; grep -oE '"working": false.{0,600}' <guest-path> | head -c 900
cd <guest-path> && sed -i 's/"expected_text":"decision autoload: native, phpm writes the autoloader"/"expected_text":"decision install:"/g' .coldpass/probe.json .coldpass/claims.json && grep -o '"expected_text":"[^"]*"' .coldpass/probe.json .coldpass/claims.json .coldpass/examples.json && for f in probe claims examples; do python3 -I -c "import json;json.load(open('.coldpass/$f.json'));print('$f ok')"; done && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; grep -o '"verdict": "[a-z]*"' <guest-path> | sort | uniq -c; grep -oE '"problems": \[[^]]{0,400}' <guest-path> | head -c 800; echo; grep -oE '"status": "[A-Z]+"' <guest-path> | sort | uniq -c
cd <guest-path> && grep -A3 '"problems"' <guest-path> | head -8; tail -c 300 <guest-path>; echo; ps aux | grep -i phpm | grep -v grep | wc -l
cat > <guest-path> <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install a composer.lock into vendor/ with phpm install --explain (README Usage) and get per-package native/Composer decisions","operation_scope":"Linux x86_64 guest (Ubuntu, uid 1000 with passwordless sudo). Uses the ytmate fixture composer.json/composer.lock copied into fresh project dirs under <guest-path> Requires PHP CLI with pdo_mysql and gd extensions because the lock's platform requirements are checked. No Composer reference run, so byte-identity with Composer was not verified.","steps":["curl -LsSf https://github.com/speedsharmaai/phpm/releases/latest/download/phpm-installer.sh | sh (run as sh /tmp/phpm-installer.sh; installed phpm 0.1.1)","phpm --version -> phpm 0.1.1","sudo apt-get -o DPkg::Lock::Timeout=300 install php-cli php-xml php-mbstring php-curl php-zip unzip php-mysql php-gd","cd <project>; phpm install --explain (ytmate fixture; 42 packages installed natively, autoloader written)","phpm -d <project> install --explain -o (repeat run: nothing to do)"],"deviations":["README says Rust 1.96+ is needed only for the cargo source install; the shell installer was used as the README's primary route, which installs a prebuilt binary, so no Rust toolchain was built. System cargo is 1.75 (rust-toolchain.toml asks for 1.98.1) and was not used.","The installer put phpm in /var<guest-path> (CARGO_HOME of this guest), not ~/.cargo/bin as the README says. The probe and claims set PATH to that directory.","PHP was not installed in the guest; the README says PHP must be installed. Installed php-cli 8.3.6 plus extensions via apt. phpm first refused to install until ext-pdo_mysql and ext-gd were present (platform check), so php-mysql and php-gd were installed.","The checker path /inputs/coldpass-preflight.py does not exist; used <guest-path> as given in the top-level instructions.","First validation failed twice, both caused by my probe setup and fixed: (1) claim argv lacked --explain, which is needed to print the decision lines; (2) probe expected_text matched a fresh-install line, but the replay ran against an already-installed project. Switched to the line 'decision install:' which appears in both fresh and repeat runs.","phpm writes its decision lines to stderr, not stdout; the checker matched them anyway."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested path. Docs could mention that PHP plus pdo_mysql and gd are needed before install, and that the installer's default location is CARGO_HOME, not ~/.cargo/bin."}
EOF
python3 -I -c "import json;d=json.load(open('<guest-path>'));print(d['outcome'], d['fault_owner'])"; ls -la <guest-path>; ls <guest-path> 2>&1