class_exists() can trigger uncatchable E_COMPILE_ERROR when autoloading
classes with method signature mismatches (e.g. Activity model vs updated
Spatie parent). Now checks file contents for '#[Scheduled' string before
attempting to load — avoids autoloading hundreds of unrelated classes.
Also fixes Activity::getChangesAttribute() return type to match the
updated Spatie parent (Collection instead of array).
Co-Authored-By: Virgil <virgil@lethean.io>
Test files inside module Tests/ directories (e.g. app/Mod/Lem/Tests/)
extend Tests\TestCase which isn't available in production without dev
dependencies. The scanner now skips /Tests/ directories and *Test.php
files, and wraps class_exists() in try/catch for defence in depth.
Co-Authored-By: Virgil <virgil@lethean.io>
- Add ALLOWED_NAMESPACES prefix allowlist to ScheduleServiceProvider
- Add ALLOWED_FREQUENCIES method allowlist (prevents arbitrary method dispatch)
- Verify Action trait on scheduled classes before dispatch
- Move try/catch inside foreach for per-action isolation
- Add empty-scan guard to ScheduleSyncCommand (prevents disabling all rows)
- Consolidate ScheduledActionScanner to single tokenisation pass
- Cast numeric frequency args via ctype_digit() in ScheduledAction
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Livewire and Alpine inject inline scripts/styles at runtime without
nonce attributes. Nonce-based CSP breaks all Livewire apps out of the
box. Change defaults:
- nonce_enabled: false (opt-in via SECURITY_CSP_NONCE_ENABLED=true)
- production env: add 'unsafe-inline' for script-src and style-src
- Add host_analytics external source (SECURITY_CSP_HOST_ANALYTICS)
Co-Authored-By: Virgil <virgil@lethean.io>
Go CLI commands moved to core/go-php. This repo now contains
the Laravel modular monolith framework (previously php-framework).
- Remove all Go files (now in core/go-php)
- Add PHP framework: event-driven module loading, lifecycle events
- Composer package: core/php
- core/php-framework remains as-is for backward compat
Co-Authored-By: Virgil <virgil@lethean.io>
