Add first-party PHPStan analysis for Hypervel by binaryfire · Pull Request #740 · hypervel/components

binaryfire · 2026-11-11T08:52:33Z

This adds hypervel/phpstan, a first-party port of Larastan for Hypervel. It replaces the separate Database, Foundation, Head and Scout extensions with one package for applications and reusable packages.

PHPStan needs more than PHP declarations to understand framework code. A model's properties come from its schema and casts; a facade's methods come from its bound service; a query's result depends on its model, builder and collection. This package supplies that information and adds checks for Hypervel's coroutine and long-running worker behavior.

The diff also includes framework fixes exposed by the improved analysis. Those changes are described separately below. Much of the remaining diff is the ported type fixtures, rules, stubs, regression coverage and source PHPDoc needed to make the analysis useful.

Analysis

Eloquent: infer properties from migrations, schema dumps, casts and accessors; preserve custom builders, collections, scopes and relationship types; type eager-loading callbacks by their relationship; follow factory selection and single-model versus collection results. Check column names, relationships, appended attributes and dispatch constructor arguments.
Framework services: resolve container bindings, facade targets, boot-registered macros, configured authentication guards and user models, filesystem and concurrency drivers, console arguments and options, views and translations. Forwarded calls retain their target signatures and return behavior.
Helpers and collections: infer array lookups, pulled keys, collection construction and narrowing, higher-order messages, conditional helpers, validated input and model serialization shapes. Restore fluent $this declarations where methods return the same object.
Queue safety: check model serialization, batch requirements, unique-job settings and dispatch inside transactions. Transaction checks account for the selected queue connection, after-commit settings, database queues and the transactional outbox.
Coroutine and worker safety: report cancellation handling that loses a carried cancellation, child coroutines started inside transactions, request data retained by shared services, execution-time static/configuration writes and unbounded request-keyed caches.
Authoring guidance: recommend attributed scopes and model/queue settings, array validation rules, testable sleeps and equivalent query operations. Existing runtime APIs remain supported. Checks have configuration switches, and automatic fixes are limited to changes whose behavior can be preserved.

The package also includes PHPStan's deprecation rules and requires a reason for each ignored diagnostic. It uses stable hypervel.* identifiers while retaining PHPStan's own identifiers.

Application and package behavior

The extension boots the application to discover its registrations. Packages use their Testbench application and testbench.yaml. Composer root and vendor discovery work under PHPStan's PHAR and across Testbench's temporary application copies.

Configuration values are inferred from source expressions, rather than frozen to the machine's environment. Application analysis includes merged package defaults. In package mode, merged package defaults do not become fixed facts about every consuming application; those reads retain the getter's declared type. Framework and workbench configuration remain typed.

Schema inference uses hypervel/schema-parser and reads migrations without executing them or connecting to a database. It follows connection selection and migration connections, preserves uncertainty for unsupported SQL or dynamic migration code, and reports unusable dumps when model analysis needs them. The schema parser now exposes the impact of SQL on existing relations and PostgreSQL types so affected facts can be invalidated without discarding unrelated schema information.

Driver inference uses declared creator return types instead of constructing backend connections. An interface-typed value retains the interface's contract; it does not acquire implementation-specific methods merely because one implementation is currently bound.

Result caching

The extension uses PHPStan's result cache and dependency APIs. Results depend on the source and runtime inputs that supplied their types: configuration, schemas, model and job metadata, relevant class declarations, boot files, environment reads and view names. Testbench copies are tracked through their stable source paths where their contents match.

Dependencies are kept narrow where possible. Editing a leaf file does not invalidate every boot-derived result, and unchanged warm runs reuse cached analysis. Changes to shared boot inputs still invalidate their consumers. Migration cache fingerprints include content so edits within one filesystem timestamp interval cannot silently reuse an old schema.

Framework fixes

Preserve cancellation through exception translation, cleanup and stored-failure handling across database, Redis, cache, filesystem, HTTP, gRPC, queue and other execution paths. A cleanup failure carrying cancellation must not let canceled work continue as an ordinary failure.
Complete HTTP, scheduler, queue, view, Scout and gRPC observations when work is canceled. OpenTelemetry and Sentry finish spans and release state while preserving known outcomes; they do not invent successful completion for work that never finished. New cancellation events expose the outcome needed by listeners.
Preserve inherited private properties and backed property values during job/model serialization without invoking property hooks. Apply the same complete property metadata to Horizon tags and Telescope extraction.
Respect fresh controller lifetimes instead of retaining their instances on routes. Keep factory eager-loading suppression local to the coroutine and honor the model's collection class.
Apply chain defaults without overriding job attributes, retain selected connections when partial queue fakes forward to real dispatch, and validate every job in batch chains.
Preserve request input values and JSON request state, correct helper and collection return contracts, and retain model serialization behavior for enums and attributed accessors.
Accept trait-only authenticated users in Verified events while continuing to accept users implementing only MustVerifyEmail. Explicit verification no longer fails solely because the authenticated user uses the verification trait without implementing that interface.
Correct schema dumping through migrations_connection, SQLite JSON number handling, pruned Reverb connection event types and textarea form validation arguments.

Package manifests also declare directly used dependencies and require the patched Symfony components included in this branch.

Adoption and compatibility

New Hypervel applications include hypervel/phpstan and phpstan/extension-installer. Both the Hypervel extension and the deprecation rules load automatically; no manual includes are needed. Run composer analyse as usual.

Existing applications and packages can install the package with:

composer require --dev hypervel/phpstan

The package requires PHPStan 2.3.5 or later. Package analysis also requires hypervel/testbench as a development dependency. Analysis boots Hypervel and therefore needs its normal Swoole runtime setup.

Existing projects using phpstan/extension-installer also load both extensions automatically. Only projects configuring PHPStan without the installer need manual includes. In those projects, replace the removed per-component extension includes with:

includes:
    - vendor/hypervel/phpstan/extension.neon
    - vendor/phpstan/phpstan-deprecation-rules/rules.neon

Deprecation reporting can be disabled through the normal include or extension-installer configuration.

Larastan-owned ignore identifiers move from larastan.* to hypervel.*; rules.modelAppends becomes hypervel.modelAppends. Remove the unsupported checkOctaneCompatibility, generalizeEnvReturnType and redisDriver parameters, along with ignores for Octane and deferred-provider diagnostics. Retained settings keep their names, but several defaults are stricter. Existing code can therefore produce additional diagnostics without losing its runtime APIs.

Some typing boundaries remain deliberate. Collections retain Laravel's covariant value type. Attribute getter/setter callbacks are treated as read-only by analysis after construction. PHPStan limitations around fixed-type custom collections and deprecations reached through proxies are documented. On PHPStan 2.3.5, the first warm run can revisit a small set of files because of internal stub-path normalization; subsequent unchanged runs reuse their results.

The new Static Analysis page covers setup, configuration, inferred types, diagnostics, fixes, legitimate exceptions and cache behavior. Related framework documentation and the Laravel porting guide are updated alongside it.

Validation

Formatting and PHPStan analysis pass for framework source, type fixtures and the application skeleton. The analyzer's rule, inference and integration tests cover application and Testbench boot, supported forwarding behavior, configuration/schema changes and diagnostic boundaries. Targeted framework regressions cover the runtime changes above, including coroutine isolation and cancellation completion.

Cache regressions compare warm results with cold analysis after relevant edits and verify reuse for unchanged application and package runs. Representative consumer checks exercised the package configuration boundary and integrations. Documentation examples, configuration defaults, identifiers and links were checked against the implementation.

Note

Add first-party `hypervel/phpstan` package with framework-wide type inference and rules

Adds a new PHPStan extension package under src/phpstan with return-type, method, property, collector, and rule extensions covering models, collections, facades, helpers, queues, config, validation, and coroutine cancellation
The package boots a Hypervel application or Testbench application in its bootstrap, enabling analysis driven by real configuration, bindings, migrations, and schema dumps
Removes per-package PHPStan extension includes and moves analysis to the central extension in phpstan.neon.dist; adds a dedicated PHPUnit config for the PHPStan test suite
Alongside the analysis work, this PR unifies coroutine cancellation handling across the framework: exception selection uses Coroutine::preferCancellation(), cancellation detection uses Coroutine::causedByCancellation() (including wrapped cancellations), and canceled queue/job/request/scheduler operations now emit cancellation events and complete telemetry spans without recording spurious failures
Other user-facing fixes: SerializesModels now serializes parent private properties by declaring class using ClassMetadataCache::allProperties() with raw get/set accessors, Arr::pluck accepts integer keys, and Factory::createMany/makeMany return the model's custom collection type
Behavioral Change: per-package PHPStan extension includes are removed from composer manifests; JobAttempted gains a canceled flag so canceled attempts are no longer reported as successful; env() calls in test/teardown code are replaced with Env::get()

^{Macroscope summarized c458a86.}

Check the env helpers, app_id and Env static readers by resolved identity. Permit actual application, framework, package and publishable config sources while rejecting sibling directories that only share a prefix. Preserve trait diagnostics and editor-file mapping, and keep the rule enabled for framework analysis. Disable authoring policy only in the dedicated source-type assertion harness. Validation: environment-policy rule fixtures, main and type-fixture PHPStan analyses, and the complete analyzer suite pass.

Record the settled configuration typing, environment policy, loader behavior and regression requirements. Remove completed work from the remaining-file checklist. Make independent audits of the completed code, remaining design and authoring guidance the next step before further porting or audit-driven implementation. Retain the outstanding shared result-cache and consumer integration work. Validation: reviewed documentation against the completed checkpoint and checked whitespace.

Honor configuration file return annotations independently of always-true PHPDoc checks. Make incompatible typed-getter diagnostics explain which call throws and how to correct the configuration or getter. Update the rule expectations and configuration-resolution fixture to verify the approved analysis contract. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Correct collection key, callback, pluck and combination types across eager and lazy collections. Accept integer pluck paths, matching the supported data lookup behavior instead of throwing on Collection::pluck(0, 1). Keep runtime implementations and Laravel extension points intact. Extend the collection type fixtures and integer-key runtime regression coverage. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Describe Benchmark results, Str replacement arrays and reflection class-name lists according to their actual runtime behavior. Remove the redundant reflection filter without changing the returned names. Update the existing utility type fixtures and add focused benchmark inference coverage. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Preserve Optional's wrapped value type and exclude null from the optional callback input. Describe higher-order condition state and the nullable/void callback behavior of conditional helpers without changing their runtime APIs. Align request enum defaults and generated facade annotations with lazy default evaluation. Update the support and request type fixtures. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Resolve collection proxy results from the collection's own method signatures, preserving keys, lazy collections and callback return types. Add Optional and Conditionable forwarding with accurate argument-count behavior and preserved callback-owned static types. Share focused proxy reflections that respect member visibility, reference semantics and deprecation metadata. Cover proxy access failures, nullable Optional callbacks and supported fluent chains in the existing analyzer harness. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Infer Arr::get and Arr::pull values, defaults and supported array mutations through the real dot-key lookup semantics. Report definitely missing keys while respecting explicit defaults and custom delegated implementations. Add type and diagnostic fixtures for nested keys, optional shapes, numeric keys and overridden get or forget methods. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Port collection construction and narrowing against Hypervel's actual generic contracts. Reuse public array_filter inference for callback narrowing, preserving declaration fallbacks for custom methods, unresolved templates and unsupported receiver shapes. Register the helper and collection type fixtures in the analyzer harness, including Arrayable construction, key preservation and whereNotNull boundaries. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Replace the combined factory-helper extension with the tracked per-helper extensions and a shared argument-count concern. Preserve explicit-null and unpacked-call behavior for response, validator and view factories. Infer literal shapes in one pass without optional-key power-set expansion, preserve value closure semantics, and document the inherited no-argument str proxy limitation. Keep helper stubs only where source declarations are insufficient. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Port the value and with diagnostics with resolved function identity and named-argument handling. Preserve invalid callbacks and argument evaluation when deciding whether an automatic replacement is safe. Build replacements from the fixer's own AST to avoid corrupting files containing imported new expressions and multiple fixes. Cover namespaces, unsafe discarded arguments and replacement output in the rule fixtures. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Port the unnecessary toArray diagnostic for collections whose items require no conversion. Respect custom collection implementations and delegated map or all behavior before recommending a replacement. Keep focused rule fixtures for ordinary values, Arrayable items and overridden conversion methods. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Use all where source item types prove that no Arrayable conversion occurs, and remove value calls that cannot invoke a Closure. Remove obsolete local suppressions now covered by the shared proxy inference. Preserve the existing consumer behavior and runtime API contracts across foundation, database, process, routing, pagination, support and view code. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Use direct collection items where conversion is unnecessary in the affected integration packages. Remove stale forwarding suppressions now resolved by the package's higher-order and Optional typing. Keep the integrations' runtime behavior unchanged, including enum/scalar values, repository results and captured event or job data. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Add the canonical Static Analysis page with preferred patterns, actionable diagnostics, supported exceptions and application/Testbench inference boundaries. Link it from framework navigation, the package README and concise contributor guidance. Record the approved generic-proxy deprecation limitation and remaining port, macro-precedence, stale-ignore and cache verification work. Preserve the final contributor-guidance review requirement. Validation: php-cs-fixer, root/types/skeleton PHPStan, 782 analyzer tests and targeted runtime suites passed for the combined checkpoint.

Pass the integer returned by FILTER_VALIDATE_INT to mb_str_split so numeric string lengths retain Laravel's behavior under strict types. Describe offset-capture tuples without changing the runtime API or ordinary string results. Extend the existing chunk regression and add focused Stringable type fixtures. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Port the upstream bleeding-edge type and integration harnesses using the existing PHPStan test infrastructure. Cover key renumbering, empty-collection inference and incompatible mutations. Retain Laravel's existing covariant value contract, record incompatible value-widening expectations, and verify key widening independently. Correct Eloquent flatMap's expected base-collection result. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Remove obsolete fluent-builder, relation-return and nested-set method ignores exposed by the current analyzer. Collapse the former inline-comment-split condition without changing its expression. Keep runtime behavior and generic declarations intact; future unmatched suppressions will now be reported by the root configuration. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Remove obsolete guard-method and dynamic request-property suppressions in authentication, session and workbench consumers. Keep all supported authentication flows and Request property access unchanged. The shared analyzer now handles these paths without the local suppressions. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Remove unmatched line suppressions around container calls and response processing in the MCP package. Explain why the transport contract keeps its undeclared native return type: implementations use response and void return declarations. No transport or request handling behavior changes. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Remove unmatched ignores from lock records, native scalar coercion, coroutine state, feature callbacks, Redis adapters and Telescope request options. Preserve the runtime implementations and their guards. Current analysis and dependency stubs cover these sites without the obsolete suppressions. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Remove the root override that hid unmatched ignores after auditing the affected source. Delete the obsolete nested-set, generic-model and void-callback global patterns. Retain the existing covariance policy with an accurate explanation of its wider-reference mutation tradeoff, rather than attributing it to missing runtime generics. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Document preserved Laravel collection covariance, its mutation tradeoff and the explicit element-contract remedy for bleeding-edge literal inference. Record the difference from Larastan's invariant stubs. Update the plan and remaining-file checklist for completed bleeding-edge and root ignore work, preserving the model-property fixture dependency and private-consumer migration audit. Validation: formatter, root/targeted PHPStan, types and skeleton analysis, 814 analyzer tests and the targeted Stringable runtime suite passed for the combined checkpoint.

Replace the one-file-at-a-time restriction with the owner-approved wording for coherent changes. Require dependent edits to be sequenced and affected behavior to be reviewed across files before the change is considered finished.

Centralize creator-method selection in Manager::getCreatorMethod() and reject names that normalize to createDriver itself. Preserve registered custom creators and the existing unsupported-driver diagnostics. Reuse the selector in ImageManager and SentinelManager so their prechecks and fallback behavior agree with actual creation. Cover empty and punctuation-only names and registered creators. Validation: the combined checkpoint passed formatting, root PHPStan, type fixtures, 969 analyzer tests and the affected Support, Image, Sentinel, Socialite, Hashing, Notifications, JWT, Session, Slack, Reverb and foundation provider runtime checks.

Share forwarding variant construction, pass argument values rather than caller references, and bind static returns to the target class. Preserve the target method metadata through static forwarding. Port method/property tag and mixin lookup with specialization-aware caches. Cover generic mixins whose methods and properties differ between template arguments. Validation: the combined checkpoint passed formatting, root PHPStan, type fixtures, 969 analyzer tests and the affected Support, Image, Sentinel, Socialite, Hashing, Notifications, JWT, Session, Slack, Reverb and foundation provider runtime checks.

Read the selected driver's declared type from the bound manager and registered creators instead of constructing backend drivers. Respect overridden dispatch methods, custom creators, inaccessible methods and incompatible already-created drivers. Cache by generic specialization and use the effective bound subclass for discovery. Keep forwarding instance-only and give maintenance-mode drivers their shared contract mixin. Cover these boundaries with focused manager fixtures. Validation: the combined checkpoint passed formatting, root PHPStan, type fixtures, 969 analyzer tests and the affected Support, Image, Sentinel, Socialite, Hashing, Notifications, JWT, Session, Slack, Reverb and foundation provider runtime checks.

Port callable macro reflection with explicit tag precedence, invokable support and Optional macro precedence. Keep interface declarations honest and preserve Request validation exceptions separately from tag-based signatures. Infer Auth macro forwarding from configured guard types, requiring a public callable method across possible guards. Preserve native/macro unions, instance-only manager calls and overridden call handlers. Register fixture macros and remove the obsolete validation-catch suppression. Validation: the combined checkpoint passed formatting, root PHPStan, type fixtures, 969 analyzer tests and the affected Support, Image, Sentinel, Socialite, Hashing, Notifications, JWT, Session, Slack, Reverb and foundation provider runtime checks.

Port facade root and Storage method discovery with preserved visibility and target-bound signatures. Replace generated facade method tags with mixins where underlying generic and conditional signatures carry more information. Add the declarations needed for stub validation and applicable facade/fake fixtures. Describe the HTTP factory's synchronous PendingRequest mixin accurately and remove cache-facade suppressions made obsolete by forwarding. Validation: the combined checkpoint passed formatting, root PHPStan, type fixtures, 969 analyzer tests and the affected Support, Image, Sentinel, Socialite, Hashing, Notifications, JWT, Session, Slack, Reverb and foundation provider runtime checks.

Reuse container binding resolution for factory-returning helper branches, including response, view, validator, URL and logger. Preserve ordinary return branches and conditional unions for nullable or unpacked calls. Memoize resolved factories in their extensions without granting implementation methods to arbitrary interface values. Cover concrete factory macros, named arguments and nullable helper inputs. Validation: the combined checkpoint passed formatting, root PHPStan, type fixtures, 969 analyzer tests and the affected Support, Image, Sentinel, Socialite, Hashing, Notifications, JWT, Session, Slack, Reverb and foundation provider runtime checks.

binaryfire · 2026-11-11T18:10:09Z

@cubic-ai-dev review

cubic-dev-ai · 2026-11-11T18:10:16Z

@cubic-ai-dev review

@binaryfire I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 2053 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

View guided diff | Turn on auto-fix | Re-trigger cubic}

PDO can fetch a nullable column as an empty string under NULL_TO_STRING. Eloquent decodes that value as null for array, JSON and object casts, so their inferred read types must retain null. Apply the exception to the fetched column rather than the write target so case-converted attribute names keep the correct nullability. Keep other casts and write types unchanged. Cover fetch modes, renamed attributes and cast-name normalization, and document the inference rule. Validated with the affected model property and cast tests, model cast parsing and general type tests, static analysis and formatting.

Class declaration dependencies can attach unrelated files depending on the order PHPStan workers encounter classes. Comparing file counts across the first and later provider edits made this test fail intermittently in CI. Use one analysis process for this test and take the baseline after a warm-up edit removes incidental cold-run dependencies. Retain the exact count comparison so adding dependencies for classes without macros still fails the test. Other cache tests retain their parallel execution. Validated with repeated runs under the CI CPU limit and locally, the complete runtime-input dependency test file, and a probe that restores the unwanted dependency tracking. Static analysis and formatting also pass.

binaryfire · 2026-11-11T18:55:38Z

@macroscope-app review

macroscopeapp · 2026-11-11T18:55:55Z

Review started; results will appear in the PR checks.

Treat trait-selected migration connections and column chains using Fluent attribute mutators as unknown. Keep foreign-key mutations separate from column facts. If any schema dump cannot be interpreted, discard its owner’s other dump facts while retaining diagnostics and allowing later migrations to rebuild facts. Accept resource writes for binary columns across PDO drivers. Stop recursive PostgreSQL domain resolution and avoid treating an ambiguous unqualified domain base as a concrete type after later definitions shadow it. Preserve qualified bases and ordinary single-schema resolution. Bump the migration cache format so existing cached schemas cannot retain the old interpretation. Add focused coverage for trait aliases, mutator receiver changes, dump order, stream inputs and domain resolution. Validated with the analyzer suite, static analysis and formatting.

Resolve newQuery and newModelQuery separately so a custom query override reaches model forwarding and relationships without changing unscoped queries, existence callbacks or collection toQuery results. Reuse the existing late-resolvable builder type with an internal model-query mode, preserving generic bindings and cache identity. Type nested where callbacks from the model query factory using declarations, retaining the query-builder subquery alternatives. Make relation existence methods return the builder passed to them, including wildcard model contracts. Only public native builder methods take precedence over forwarded scopes. Preserve the relation-or-builder result of applyScopes and remove the unreachable clone exception. Cover custom and delegating factories, protected method collisions, nested callbacks and relation returns. Validated with analyzer, integration, type and stub checks plus static analysis and formatting.

Follow symlinked directories when discovering views and computing their name and content dependencies. Share a cycle-safe traversal that retains distinct alias paths and the existing non-rewinding iterator behavior. Keep configuration directory traversal unchanged. Record view and translation content dependencies separately from boot inputs. Compare linked contents for runtime-copy provenance and retain configured symlink roots in stored keys so changing a link target invalidates results even when its old target remains. Normalize trailing separators without resolving links. Recognize explicit bind attributes and fully qualified Lang calls in Blade translation checks, and repeated-leaf anonymous component views in usage collection. Cover linked template edits on warm caches, aliases, cycles, root retargeting and collector behavior. Validated with the analyzer suite, affected cache and rule tests, static analysis and formatting.

Record separate query and model-query builder selection, callback types and argument-preserving relation signatures. State the supported declaration boundaries and remaining generic reflection limits. Describe trait-selected migration uncertainty, Fluent column mutations, unusable dump handling, domain resolution and binary write contracts. Update view and translation cache tracking to cover linked contents and retargeted roots, and clarify which migration argument expressions are interpreted.

Explicit boot inputs such as .env, Composer metadata and provider files were recorded under their resolved targets. Repointing a symlink left its old target unchanged, so cached analysis could retain stale bindings and diagnostics. Record the configured paths so content hashes follow their current targets. Keep both configured and resolved cache-output identities solely for excluding generated Testbench runtime files, preserving unchanged-run cache reuse. Add an application regression that repoints .env between two environment files, checks the changed warm diagnostics, and verifies the next unchanged run reanalyzes nothing. Validated with runtime-input dependency and package-mode cache tests, static analysis and formatting.

binaryfire · 2026-11-11T21:24:59Z

@greptileai review

binaryfire · 2026-11-11T21:25:10Z

@cubic-ai-dev review

cubic-dev-ai · 2026-11-11T21:25:17Z

@cubic-ai-dev review

@binaryfire I have started the AI code review. It will take a few minutes to complete.

binaryfire · 2026-11-11T21:25:21Z

@macroscope-app review

macroscopeapp · 2026-11-11T21:25:50Z

Review started; results will appear in the PR checks.

cubic-dev-ai

No issues found across 2062 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

View guided diff | Turn on auto-fix | Re-trigger cubic}

Read guards inside Blueprint callbacks from the table before queued commands run. Keep immediate or unknown changes conservative, and carry the saved table through nested Blueprint callbacks. Recognize dynamic migration and Schema method names, and inspect bounded callable arrays through the existing helper resolver. Clear morph-key assumptions for unread code without clearing them for database connection uncertainty alone. Bump the migration cache format and cover queued guards, callable dispatch, connection isolation and morph columns created after unknown calls.

…cales Tokenize the text outside PHP tags so mixed PHP and Blade control flow does not hide view or translation usages. Include registered anonymous component paths and namespaces, and compare resolved view files so aliases do not produce duplicate or false unused-view reports. Read PHP translation groups independently of JSON keys with the same name. Report invalid literal locales at their lookup locations and continue reporting other translation errors instead of failing the collected-data rule. Add regressions for registered components, mixed templates, JSON group collisions and invalid locales alongside missing keys. Skip component registration lookups when no tags are present.

…tics Explain how dynamic migration calls and stored database connections affect inferred schema facts. Document registered anonymous component recognition and the invalid translation locale identifier. Update the implementation plan with pending Blueprint guard semantics, callable handling and the remaining Nested Set builder inference limit.

Run the existing SQL invalidation regression through the DB facade, the Schema facade connection and a stored schema builder connection, with fresh schema facts for each case. Verify that the altered table becomes unknown while the unrelated table and connection remain complete. The focused schema aggregator tests and formatting checks pass.

binaryfire · 2026-11-12T03:55:50Z

@greptileai review

Connections sharing a migration owner can resolve the same unqualified table name differently. Match a pending Blueprint table by its resolved key, and use the raw-name fallback only when database and search-path resolution agree. Cover distinct MySQL databases and qualified PostgreSQL tables on different search paths. Bump the migration cache format to discard prior incorrect schema facts and update the guard contract in the plan. The schema aggregation regressions, static analysis and formatting checks pass.

Blueprint table commands run after their callback, while schema inference applies them immediately. Once a queued drop or rename removes the pending table key, guard lookups on that owner cannot safely use the current facts. Return an unknown guard result in that case and retain resolved-key matching for tables still present. Remove the raw-name and search-path fallback and its extra scope state. Cover overlapping PostgreSQL search paths and a MySQL guard on a rename target, preserving the existing cross-connection regressions. Bump the migration cache format and update the plan. Targeted tests, static analysis and formatting checks pass.

binaryfire added 30 commits November 5, 2026 06:59

docs: focus editing guidance on coherent changes

4c6616d

Replace the one-file-at-a-time restriction with the owner-approved wording for coherent changes. Require dependent edits to be sequenced and affected behavior to be reviewed across files before the change is considered finished.

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

greptile-apps Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread src/phpstan/src/Properties/ModelPropertyHelper.php Resolved

binaryfire added 2 commits November 11, 2026 18:51

macroscopeapp Bot reviewed Nov 11, 2026

View reviewed changes

binaryfire added 5 commits November 11, 2026 21:00

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

macroscopeapp Bot reviewed Nov 11, 2026

View reviewed changes

binaryfire added 4 commits November 11, 2026 22:50

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread src/phpstan/src/Properties/SchemaAggregator.php Resolved

binaryfire added 2 commits November 12, 2026 04:17

binaryfire merged commit 8477e33 into 0.4 Nov 12, 2026
53 checks passed

Conversation

binaryfire commented Nov 11, 2026 • edited by macroscopeapp Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Analysis

Application and package behavior

Result caching

Framework fixes

Adoption and compatibility

Validation

Add first-party hypervel/phpstan package with framework-wide type inference and rules

Uh oh!

binaryfire commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

binaryfire commented Nov 11, 2026

Uh oh!

macroscopeapp Bot commented Nov 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

binaryfire commented Nov 11, 2026

Uh oh!

binaryfire commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

binaryfire commented Nov 11, 2026

Uh oh!

macroscopeapp Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

binaryfire commented Nov 12, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

binaryfire commented Nov 11, 2026 •

edited by macroscopeapp Bot

Loading

Add first-party `hypervel/phpstan` package with framework-wide type inference and rules