Address review comments - refactor and fix path bug

- Remove get_mu_plugin_list() wrapper, use get_mu_plugins() directly
- Rename get_plugin_slug_from_header() to get_plugin_slug_from_path() and remove unused parameter
- Extract version retrieval into get_plugin_version_for_verification() method
- Fix critical bug: create check_mu_file_checksum() to properly handle WPMU_PLUGIN_DIR paths

Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com>

Author: Copilot

src/Checksum_Plugin_Command.php

@@ -156,10 +156,10 @@ public function __invoke( $args, $assoc_args ) {
 		// Process must-use plugins if not excluded.
 		$mu_plugins = array();
 		if ( ! $exclude_mu ) {
-			$mu_plugins = $this->get_mu_plugin_list();
+			$mu_plugins = get_mu_plugins();
 
 			foreach ( $mu_plugins as $mu_file => $mu_plugin ) {
-				$plugin_name = $this->get_plugin_slug_from_header( $mu_file, $mu_plugin );
+				$plugin_name = $this->get_plugin_slug_from_path( $mu_file );
 
 				if ( in_array( $plugin_name, $exclude_list, true ) ) {
 					++$skips;
@@ -309,6 +309,33 @@ private function check_file_checksum( $path, $checksums ) {
 		return in_array( $md5, (array) $checksums['md5'], true );
 	}
 
+	/**
+	 * Checks the integrity of a single MU plugin file by comparing it to the
+	 * officially provided checksum.
+	 *
+	 * @param string $path      Relative path to the MU plugin file to check the
+	 *                          integrity of.
+	 * @param array  $checksums Array of provided checksums to compare against.
+	 *
+	 * @return bool|string
+	 */
+	private function check_mu_file_checksum( $path, $checksums ) {
+		if ( $this->supports_sha256()
+			&& array_key_exists( 'sha256', $checksums )
+		) {
+			$sha256 = $this->get_sha256( WPMU_PLUGIN_DIR . '/' . $path );
+			return in_array( $sha256, (array) $checksums['sha256'], true );
+		}
+
+		if ( ! array_key_exists( 'md5', $checksums ) ) {
+			return 'No matching checksum algorithm found';
+		}
+
+		$md5 = $this->get_md5( WPMU_PLUGIN_DIR . '/' . $path );
+
+		return in_array( $md5, (array) $checksums['md5'], true );
+	}
+
 	/**
 	 * Checks whether the current environment supports 256-bit SHA-2.
 	 *
@@ -384,37 +411,43 @@ private function is_soft_change_file( $file ) {
 	}
 
 	/**
-	 * Gets the list of all must-use plugins.
+	 * Extracts the plugin slug from the plugin file path.
+	 *
+	 * For MU plugins that are actually standard plugins moved to mu-plugins folder,
+	 * we extract the plugin slug from the file path to look up checksums.
 	 *
-	 * @return array Array of MU plugins with their file path as key.
+	 * @param string $plugin_file Path to the plugin file.
+	 *
+	 * @return string Plugin slug.
 	 */
-	private function get_mu_plugin_list() {
-		if ( ! function_exists( 'get_mu_plugins' ) ) {
-			return array();
+	private function get_plugin_slug_from_path( $plugin_file ) {
+		// If it's in a subdirectory, use the directory name as slug.
+		if ( false !== strpos( $plugin_file, '/' ) ) {
+			return dirname( $plugin_file );
 		}
 
-		return get_mu_plugins();
+		// For single files, extract the slug from the filename.
+		return basename( $plugin_file, '.php' );
 	}
 
 	/**
-	 * Extracts the plugin slug from the plugin header data.
+	 * Gets the version for a plugin from its header data or the version argument.
 	 *
-	 * For MU plugins that are actually standard plugins moved to mu-plugins folder,
-	 * we try to extract the plugin slug to look up checksums.
+	 * @param string $version_arg Version argument from command line.
+	 * @param array  $plugin_data Plugin header data.
 	 *
-	 * @param string $mu_file   Path to the MU plugin file.
-	 * @param array  $mu_plugin Plugin header data.
-	 *
-	 * @return string Plugin slug.
+	 * @return string|false Plugin version, or false if not found.
 	 */
-	private function get_plugin_slug_from_header( $mu_file, $mu_plugin ) {
-		// If it's in a subdirectory, use the directory name as slug.
-		if ( false !== strpos( $mu_file, '/' ) ) {
-			return dirname( $mu_file );
+	private function get_plugin_version_for_verification( $version_arg, $plugin_data ) {
+		if ( ! empty( $version_arg ) ) {
+			return $version_arg;
 		}
 
-		// For single files, extract the slug from the filename.
-		return basename( $mu_file, '.php' );
+		if ( ! empty( $plugin_data['Version'] ) ) {
+			return $plugin_data['Version'];
+		}
+
+		return false;
 	}
 
 	/**
@@ -432,14 +465,9 @@ private function verify_mu_plugin( $mu_file, $mu_plugin, $plugin_name, $version_
 		$is_single_file = false === strpos( $mu_file, '/' );
 
 		// Get version from the plugin header.
-		$version = '';
-		if ( ! empty( $version_arg ) ) {
-			$version = $version_arg;
-		} elseif ( ! empty( $mu_plugin['Version'] ) ) {
-			$version = $mu_plugin['Version'];
-		}
+		$version = $this->get_plugin_version_for_verification( $version_arg, $mu_plugin );
 
-		if ( empty( $version ) ) {
+		if ( false === $version ) {
 			WP_CLI::warning( "Could not retrieve the version for must-use plugin {$plugin_name}, skipping." );
 			++$skips;
 			return;
@@ -485,11 +513,10 @@ private function verify_mu_plugin( $mu_file, $mu_plugin, $plugin_name, $version_
 				continue;
 			}
 
-			$absolute_path = $is_single_file
-				? WPMU_PLUGIN_DIR . '/' . $file
-				: WPMU_PLUGIN_DIR . '/' . dirname( $mu_file ) . '/' . $file;
+			// Build the relative path for MU plugins.
+			$relative_path = $is_single_file ? $file : dirname( $mu_file ) . '/' . $file;
 
-			$result = $this->check_file_checksum( $absolute_path, $checksums[ $file ] );
+			$result = $this->check_mu_file_checksum( $relative_path, $checksums[ $file ] );
 			if ( true !== $result ) {
 				$this->add_error( $plugin_name, $file, is_string( $result ) ? $result : 'Checksum does not match' );
 			}