When the same route file is registered on multiple domains (e.g.
core.test, hub.core.test, core.localhost), Laravel's route:cache
fails with "Another route has already been assigned name". Add
deduplicateRouteNames() to strip names from duplicate routes,
keeping only the first registration. Extract processViews(),
processLivewire(), and refreshRoutes() helpers to reduce
duplication across fire* methods.
Co-Authored-By: Virgil <virgil@lethean.io>
class_exists() can trigger uncatchable E_COMPILE_ERROR when autoloading
classes with method signature mismatches (e.g. Activity model vs updated
Spatie parent). Now checks file contents for '#[Scheduled' string before
attempting to load — avoids autoloading hundreds of unrelated classes.
Also fixes Activity::getChangesAttribute() return type to match the
updated Spatie parent (Collection instead of array).
Co-Authored-By: Virgil <virgil@lethean.io>
Test files inside module Tests/ directories (e.g. app/Mod/Lem/Tests/)
extend Tests\TestCase which isn't available in production without dev
dependencies. The scanner now skips /Tests/ directories and *Test.php
files, and wraps class_exists() in try/catch for defence in depth.
Co-Authored-By: Virgil <virgil@lethean.io>
- Add ALLOWED_NAMESPACES prefix allowlist to ScheduleServiceProvider
- Add ALLOWED_FREQUENCIES method allowlist (prevents arbitrary method dispatch)
- Verify Action trait on scheduled classes before dispatch
- Move try/catch inside foreach for per-action isolation
- Add empty-scan guard to ScheduleSyncCommand (prevents disabling all rows)
- Consolidate ScheduledActionScanner to single tokenisation pass
- Cast numeric frequency args via ctype_digit() in ScheduledAction
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Livewire and Alpine inject inline scripts/styles at runtime without
nonce attributes. Nonce-based CSP breaks all Livewire apps out of the
box. Change defaults:
- nonce_enabled: false (opt-in via SECURITY_CSP_NONCE_ENABLED=true)
- production env: add 'unsafe-inline' for script-src and style-src
- Add host_analytics external source (SECURITY_CSP_HOST_ANALYTICS)
Co-Authored-By: Virgil <virgil@lethean.io>
Move 8 plug contract interfaces (Authenticable, Commentable, Deletable,
Listable, MediaUploadable, Postable, Readable, Refreshable) from the
Laravel app into the framework under Core\Plug\Contract namespace. Add
register() method to Registry so extracted packages can self-register
their providers without filesystem scanning.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Go CLI commands moved to core/go-php. This repo now contains
the Laravel modular monolith framework (previously php-framework).
- Remove all Go files (now in core/go-php)
- Add PHP framework: event-driven module loading, lifecycle events
- Composer package: core/php
- core/php-framework remains as-is for backward compat
Co-Authored-By: Virgil <virgil@lethean.io>
