fix: bounded config fixes for the PHP CI gates (#49)

Keeps the library **PHP** (defensive PHP-security tooling — we protect
PHP devs). Config-only, PHP-native fixes for the failing gates:

**(a) PHPUnit — undefined aegis_* functions.** Added `autoload.files`
for `src/WordPress/Adapter.php` (PSR-4 only autoloads classes, never
free functions). Also moved the ~20 `aegis_*` helpers from
`PhpAegis\WordPress` into the **global** namespace: they are
WordPress-style globals invoked unqualified (`aegis_html(...)`) and
depend on PHP's global-function fallback — while namespaced they were
unresolvable from the test namespaces (`PhpAegis\Tests\*`). `use`
imports retained so the underlying class refs (`Sanitizer::html`, etc.)
still resolve.

**(b) composer.lock — NOT included.** Cannot be generated without a
Composer runtime in this environment; deliberately not fabricated. Needs
`composer install` / `composer update` to commit.

**(c) PHP-CS-Fixer exit 16 (invalid v3 config).** Removed bogus
`no_eval` (no such fixer exists) and renamed `no_unneeded_curly_braces`
→ `no_unneeded_braces` (renamed in php-cs-fixer 3.x).

**(d) Security Pattern Check false positives.** Added `\b` word
boundaries so `curl_exec()` no longer matches `\bexec\(`, and anchored
the backtick check (plus a quoted-string exclusion) so the library's own
escaped backtick character inside its Turtle/URI validators isn't
flagged. Verified: zero matches on `src/` now, while a bare `exec(` is
still caught.

**(e) PHPStan L9 — NOT attempted here** (out of scope per the request).
No baseline added: generating an accurate `phpstan-baseline.neon`
requires running PHPStan (no PHP runtime here), and
`reportUnmatchedIgnoredErrors: true` would fail on a fabricated/stale
baseline. Remains for a PHP-runtime follow-up if L9 surfaces genuine
strict errors.

Verified statically (no PHP runtime in env): `composer.json` is valid
JSON; the new security-pattern regexes match nothing in `src/` yet still
flag a bare `exec(`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/php-lint.yml

@@ -177,17 +177,25 @@ jobs:
         run: |
           FOUND=0
 
-          # Dangerous execution functions
-          DANGEROUS=$(grep -rEn 'eval\s*\(|exec\s*\(|system\s*\(|passthru\s*\(|shell_exec\s*\(|proc_open\s*\(|popen\s*\(' \
+          # Dangerous execution functions.
+          # Word boundaries (\b) are required so legitimate functions whose
+          # names merely END in a dangerous token are not flagged, e.g.
+          # curl_exec() (HTTP, not command execution) must NOT match \bexec\(.
+          DANGEROUS=$(grep -rEn '\beval\s*\(|\bexec\s*\(|\bsystem\s*\(|\bpassthru\s*\(|\bshell_exec\s*\(|\bproc_open\s*\(|\bpopen\s*\(' \
             --include="*.php" src/ 2>/dev/null || true)
           if [ -n "$DANGEROUS" ]; then
             echo "::error::Dangerous execution functions found:"
             echo "$DANGEROUS"
             FOUND=1
           fi
 
-          # Backtick execution
-          BACKTICKS=$(grep -rEn '`[^`]*\$' --include="*.php" src/ 2>/dev/null || true)
+          # Backtick (shell) execution with variable interpolation.
+          # Anchor on the OPENING backtick of a shell-exec operator, then drop
+          # lines where the backtick is a literal character inside a quoted
+          # string/regex (this security library escapes the backtick char in
+          # its Turtle/URI validators, which is legitimate, not shell exec).
+          BACKTICKS=$(grep -rEn '(=|\(|\breturn\b|\becho\b)\s*`[^`]*\$[^`]*`' --include="*.php" src/ 2>/dev/null \
+            | grep -vE "['\"][^'\"]*\`" || true)
           if [ -n "$BACKTICKS" ]; then
             echo "::error::Backtick execution with variables found:"
             echo "$BACKTICKS"

.php-cs-fixer.dist.php

@@ -71,7 +71,7 @@
 
         // Control structures
         'no_unneeded_control_parentheses' => true,
-        'no_unneeded_curly_braces' => true,
+        'no_unneeded_braces' => true,
         'yoda_style' => [
             'equal' => false,
             'identical' => false,
@@ -205,7 +205,6 @@
         ],
 
         // Security-conscious rules
-        'no_eval' => true,  // Warn about eval() usage
         'random_api_migration' => true,  // Use random_int/random_bytes
         'native_function_invocation' => [
             'include' => ['@compiler_optimized'],

composer.json

@@ -41,7 +41,10 @@
     "autoload": {
         "psr-4": {
             "PhpAegis\\": "src/"
-        }
+        },
+        "files": [
+            "src/WordPress/Adapter.php"
+        ]
     },
     "autoload-dev": {
         "psr-4": {

src/WordPress/Adapter.php

@@ -7,7 +7,11 @@
 
 declare(strict_types=1);
 
-namespace PhpAegis\WordPress;
+// NOTE: These WordPress-style helpers live in the GLOBAL namespace on purpose,
+// mirroring WordPress's own global functions (esc_html(), esc_attr(), ...).
+// Callers invoke them unqualified (aegis_html(...)) and rely on PHP's global
+// function fallback, so they must not be namespaced. The `use` imports below
+// keep the underlying class references (Sanitizer::html, etc.) resolvable.
 
 use PhpAegis\Validator;
 use PhpAegis\Sanitizer;