🐛 fix(bones): the safety fixes from the CLI audit

[gfazioli]

The fixes from an audit of the bones CLI, all reproduced before they were fixed. Nothing documented changes behaviour except where the old behaviour destroyed something.

deploy

• The destination is checked before anything is built. The plugin itself, any of its parents and any folder inside it are refused, whatever the flags. Up to 2.0.9 an existing destination was deleted after a five-second pause: php bones deploy .. removed every plugin beside this one and the plugin itself, deploy build copied the plugin into build/build/build/… until the path was too long.
• An existing folder is replaced only when it is empty or holds a previous deploy of this plugin (its main file declaring the same Plugin Name); anything else is left alone and needs the new --force. The pause is gone.

make:*

• They never overwrite an existing file; --force does, wherever it is on the line.
• The class name is validated: PHP identifiers, / between folders, no .. (../../Escaped used to write outside the folder, my-model wrote a file that does not parse).
• One generateClass() behind all of them, so Folder/Class works everywhere and the namespace follows the folder. make:provider Shop/Billing kept Shop/Billing as the class name and wrote nothing; six generators wrote into folders they never created; every one said "Created" when the write failed.
• eloquent-model.stub wrote namespace …\Models\;, which never parsed. Seven stubs gain {Path}.
• migrate:create asks for a missing name instead of a TypeError, and creates database/migrations.
• make:widget keeps the widget views it finds instead of rewriting them.

tinker

• A loop, not a recursive call from finally: it ends with exit or with its input (it used to recurse until the process died with 255).
• Every Throwable is shown. An Error used to print nothing, and the catch block ran eval() on the exception message: throw new \Exception("print 6*7;") printed 42.
• Returned values are printed and variables persist between lines.

Exit codes and shell

• Unknown command, missing class name and declined confirmations (version, rename, migrate:to-v2) exit 1, with the error on STDERR. A version nobody answered used to exit 0 having changed nothing.
• install, optimize, update and require stream through passthru() and use the status. optimize handed line() a null when composer dump-autoload wrote only to stderr, a TypeError after every make:controller in a plugin without post-autoload-dump scripts; require renamed after a failed install. The package name is escaped.

Tests

• 44 new tests in tests/Console over a shared BonesProcess helper (runs the CLI with stdin, separate stdout/stderr, a timeout): DeploySafetyTest, MakeCommandsTest, TinkerTest, ExitCodeTest. On v2.0.9, 33 of them fail (the two self-copy deploy cases were not run there: they nest 160 folders deep). composer test: 144 tests, OK.
• Live, in the local test bench plugin with this branch synced into its vendor, plus a throwaway tree for the destructive deploy cases: 11 checks, all ✗ on v2.0.9 and all ✓ here.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Three unresolved issues in src/Console/bin/bones must be addressed before approval.

Review effort: Lite
Findings: None

What changed in this PR

Hardens the bones CLI against destructive deploys, unsafe generation, tinker failures, and incorrect exit statuses.

Changes:

• Adds deploy safety, validation, overwrite protection, and process-based regression tests.
• Centralizes class generation and updates namespaces in stubs.
• Improves tinker behavior and shell command status handling.

Unresolved findings remain in src/Console/bin/bones: EOF input can cause a TypeError (critical, 2 votes), standalone optimize may exit successfully after Composer failure (moderate, 1 vote), and widget --force does not overwrite existing views (moderate, 1 vote).

File	Summary
tests/​Support/​BonesProcess.php	Provides isolated CLI process testing.
tests/​Console/​TinkerTest.php	Tests tinker behavior.
tests/​Console/​MakeCommandsTest.php	Tests generators and migrations.
tests/​Console/​ExitCodeTest.php	Tests exit codes and stderr handling.
tests/​Console/​DeploySafetyTest.php	Tests destructive deploy prevention.
src/​Console/​stubs/​widget.stub	Updates widget generation behavior.
src/​Console/​stubs/​shortcode.stub	Adds folder-aware namespace support.
src/​Console/​stubs/​schedule.stub	Adds folder-aware namespace support.
src/​Console/​stubs/​provider.stub	Adds folder-aware namespace support.
src/​Console/​stubs/​eloquent-model.stub	Fixes model namespace generation.
src/​Console/​stubs/​ctt.stub	Adds folder-aware namespace support.
src/​Console/​stubs/​cpt.stub	Adds folder-aware namespace support.
src/​Console/​stubs/​ajax.stub	Adds folder-aware namespace support.
src/​Console/​bin/​bones	Implements the CLI safety and behavior fixes; unresolved findings remain.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gfazioli]

Review round 1, all in 9ededc9:

• Codex, P1: symlink followed by ... Right: resolvePath() collapsed .. before following links, so deploy out/alias/.. --force with alias pointing into the plugin was checked as out/ and emptied the plugin. It now resolves one segment at a time, as the filesystem does. test_a_symlink_followed_by_dot_dot_cannot_reach_the_plugin failed before the fix and passes after.
• Copilot, EOF TypeError. I found no TypeError with an empty stdin across all 24 commands, but two real EOF problems while looking: ask() returned null for a null default (askPackageManager() without npm) from a function declared string, and rename with no arguments asked forever once input had ended. ask() now always returns a string and records the end of input; rename stops with exit 1 (test_a_rename_nobody_answers_ends_instead_of_asking_forever).
• Copilot, standalone optimize exits 0. Fixed: php bones optimize exits with Composer's status. Inside make:* a failed dump stays a warning, since the file was written.
• Copilot, widget --force keeps the views. Kept on purpose: the two views are named after the plugin and shared by every widget it has, so make:widget Second --force would wipe what the first widget's views hold. The command now says so when it keeps them.

Also: make:app exits 1 on a missing, invalid, reserved or existing name. 148 tests, OK; the live check (11 cases) passes again.