fix: improve error handling and dependency installation logic in module dependency script

Author: dermatz

.ddev/commands/web/install-module-deps

@@ -20,22 +20,39 @@ cd "${MAGENTO_DIR}" || exit 1
 
 php -r "
     \$manifest = json_decode(file_get_contents('${MODULE_COMPOSER_JSON}'), true);
+    if (\$manifest === null) {
+        fwrite(STDERR, 'ERROR: Could not parse module composer.json at ${MODULE_COMPOSER_JSON}' . PHP_EOL);
+        exit(1);
+    }
     \$deps = [];
     foreach (\$manifest['require'] ?? [] as \$package => \$constraint) {
-        if (\$package !== 'php' && !str_starts_with(\$package, 'magento/')) {
-            \$deps[\$package] = \$constraint;
+        // Skip php, magento/*, and Composer platform packages (ext-*, lib-*, composer-*-api).
+        // Platform packages have no vendor/ directory and would cause repeated failed installs.
+        if (\$package === 'php'
+            || str_starts_with(\$package, 'magento/')
+            || str_starts_with(\$package, 'ext-')
+            || str_starts_with(\$package, 'lib-')
+            || \$package === 'composer-runtime-api'
+            || \$package === 'composer-plugin-api') {
+            continue;
         }
+        \$deps[\$package] = \$constraint;
     }
-    \$missing = [];
+    \$missingConstraints = [];
+    \$missingNames = [];
     foreach (\$deps as \$package => \$constraint) {
         if (!is_dir('vendor/' . \$package)) {
-            \$missing[] = escapeshellarg(\"\$package:\$constraint\");
+            \$missingConstraints[] = escapeshellarg(\"\$package:\$constraint\");
+            \$missingNames[] = escapeshellarg(\$package);
         }
     }
-    if (\$missing) {
-        \$cmd = 'composer require --no-interaction ' . implode(' ', \$missing);
-        echo 'Installing MageForge module dependencies: ' . implode(', ', \$missing) . PHP_EOL;
-        passthru(\$cmd, \$exitCode);
+    if (\$missingConstraints) {
+        echo 'Installing MageForge module dependencies: ' . implode(', ', \$missingNames) . PHP_EOL;
+        // Add constraints without resolving first, then update only the new packages.
+        // This prevents Composer from touching unrelated Magento core dependencies.
+        passthru('composer require --no-interaction --no-update ' . implode(' ', \$missingConstraints), \$exitCode);
+        if (\$exitCode !== 0) { exit(\$exitCode); }
+        passthru('composer update --no-interaction ' . implode(' ', \$missingNames), \$exitCode);
         exit(\$exitCode);
     }
 "