A project with its own phpcs.xml runs phpcs, even when

`squizlabs/php_codesniffer` is only a transitive dependency

Author: AJenbo

docs/CHANGELOG.md

@@ -110,6 +110,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **A Laravel project that requires Larastan gets PHPStan diagnostics too.** PHPStan auto-detection looked only for a direct `phpstan/phpstan` dependency in `composer.json`, so a project that requires `larastan/larastan` and lets it pull `phpstan/phpstan` in transitively never had `vendor/bin/phpstan` recognised, even though the binary was right there. A Laravel project is now recognised through a direct dependency on `larastan/larastan`, or a fork of it such as `calebdw/larastan`, instead: plain PHPStan does not understand Eloquent magic, facades, or container bindings, so a Laravel project that depends on `phpstan/phpstan` directly but has not installed Larastan is still left alone rather than run through an analyser that would misread its own framework.
 - **A project with its own `phpstan.neon` gets PHPStan diagnostics regardless of what `composer.json` declares.** PHPStan auto-detection depended entirely on a `composer.json` dependency, so a project that hand-authors a `phpstan.neon` or `phpstan.neon.dist` config, whether it depends on `phpstan/phpstan` transitively, installs a Larastan fork the dependency check does not otherwise certify, or wires PHPStan up some other way entirely, never had `vendor/bin/phpstan` recognised. A `phpstan.neon`/`phpstan.neon.dist` file at the workspace root is now itself enough to certify PHPStan on a project, including a Laravel one that has not installed Larastan.
+- **A project with its own `phpcs.xml` gets phpcbf as its formatter, even when `squizlabs/php_codesniffer` is only a transitive dependency.** Formatter auto-detection looked only for a direct `squizlabs/php_codesniffer` entry in `require-dev`, so a project that instead depends on a rules package like `slevomat/coding-standard` or `cakephp/cakephp-codesniffer`, which pull PHP_CodeSniffer in transitively, never had `vendor/bin/phpcbf` recognised even though the binary was right there. A `phpcs.xml`, `.phpcs.xml`, `phpcs.xml.dist`, or `.phpcs.xml.dist` file at the workspace root now certifies phpcbf on its own. Closes #374.
 - **A custom Eloquent builder keeps the model it was built for.** `SiteCertificate::query()->whereKey($id)->firstOrFail()` resolved to the base `Model`, or reported `subject type 'TModel' could not be resolved`, whenever the model routed its queries through a custom builder. PHP has no generics, so almost nobody writes `@template`/`@extends` on a builder subclass: `class SiteCertificateBuilder extends Builder {}` is the whole class, and the model was lost at whichever method on the chain returns it. The model the query was started from now travels through the builder to the end of the chain, so the result of `firstOrFail()`, `first()`, `get()`, and the rest completes, hovers, and is checked as the concrete model, whether the builder is declared with generics or without. A builder specialised this way also keeps everything the ordinary resolution gives it, including the query-builder methods it reaches through `@mixin`. Closes #362.
 - **`array_filter()` reports the type the filter leaves behind.** A callback that tests the value it is handed proves something about every entry that survives, but the result kept whatever element type went in, so `array_filter($values, fn ($v) => $v !== null)` still looked like it could hold `null` and returning it from a function declared `int[]` was reported as a type error. The surviving values are now narrowed the way the body of an `if` narrows the variable it guards, whether the test is written as an `is_…()` call, a comparison against `null`, an `instanceof` check, or a callable string such as `'is_int'`. The keys were already narrowed this way in the modes that hand the callback a key, and both halves narrow together under `ARRAY_FILTER_USE_BOTH`. Closes #376.
 - **A deprecation warning belongs to the variable it is written on.** The deprecated-usage check typed its subject from a cache keyed by variable name and class, so two methods of the same class that reuse a parameter name shared one entry and whichever type was bound first won. A Laravel controller with a `Request $request` method above a `PendingRequest $request` method reported `Illuminate\Http\Request::get is deprecated` on the HTTP client call, where `get()` is the ordinary way to make a request, and renaming either parameter made the warning vanish. Every subject is now typed in the scope it is written in, so each method, closure, and `instanceof` branch gets its own answer, and a genuine deprecation is still reported no matter which order the methods appear in.

docs/configuration.md

@@ -143,7 +143,7 @@ The file is optional. Unknown keys are silently ignored, so the file is forward-
 PHPantom ships a built-in PHP formatter (mago-formatter) that works out of the box, so `textDocument/formatting` requests are answered without any setup. The formatter is chosen per project in this order:
 
 1. **Explicit config wins.** A tool path set under `[formatting]` in `.phpantom.toml` (`pint`, `php-cs-fixer`, or `phpcbf`) is always used. Setting a tool to `""` disables it.
-2. **Composer `require-dev` wins over the built-in formatter.** If `composer.json` lists `laravel/pint`, `friendsofphp/php-cs-fixer`, or `squizlabs/php_codesniffer` in `require-dev`, PHPantom resolves the binary through Composer's bin-dir and runs it as a subprocess. These tools discover their own project config (`pint.json`, `.php-cs-fixer.php`, `.phpcs.xml`, etc.) as they normally would.
+2. **Composer `require-dev` wins over the built-in formatter.** If `composer.json` lists `laravel/pint`, `friendsofphp/php-cs-fixer`, or `squizlabs/php_codesniffer` in `require-dev`, PHPantom resolves the binary through Composer's bin-dir and runs it as a subprocess. A `phpcs.xml`, `.phpcs.xml`, `phpcs.xml.dist`, or `.phpcs.xml.dist` file at the workspace root certifies phpcbf the same way, so a project that only pulls `squizlabs/php_codesniffer` in transitively (e.g. through `slevomat/coding-standard`) is still detected. These tools discover their own project config (`pint.json`, `.php-cs-fixer.php`, `.phpcs.xml`, etc.) as they normally would.
 3. **Otherwise, the built-in formatter is used.**
 
 The built-in formatter defaults to the PER-CS 2.0 style. If a `mago.toml` is present at the workspace root, its `[formatter]` table is honoured instead, so PHPantom formats with the same preset and settings your project already uses with the Mago CLI:

src/diagnostics/mod.rs

@@ -133,8 +133,9 @@
 //!
 //! - **PHPCS proxy diagnostics** — run PHP_CodeSniffer via
 //!   `phpcs --report=json` and surface coding standard violations as
-//!   LSP diagnostics.  Auto-detected when `squizlabs/php_codesniffer`
-//!   is in `require-dev`; configurable under `[phpcs]`.
+//!   LSP diagnostics.  Auto-detected via `vendor/bin/phpcs` or `$PATH`,
+//!   independent of what `composer.json` declares; configurable under
+//!   `[phpcs]`.
 //!
 //!   PHPCS runs in its own **dedicated worker task**, following the
 //!   same pattern as the PHPStan worker.  At most one PHPCS process

src/formatting.rs

@@ -12,10 +12,12 @@
 //!    `.phpantom.toml`, use that tool.  If they set it to `""`, that
 //!    tool is disabled.
 //! 2. **Composer `require-dev` wins over built-in.**  If
-//!    `composer.json` lists `laravel/pint`,
-//!    `friendsofphp/php-cs-fixer`, or `squizlabs/php_codesniffer` in
-//!    `require-dev`, resolve the binary via Composer's bin-dir and run
-//!    it as a subprocess.
+//!    `composer.json` lists `laravel/pint` or `friendsofphp/php-cs-fixer`
+//!    in `require-dev`, resolve the binary via Composer's bin-dir and
+//!    run it as a subprocess.  `squizlabs/php_codesniffer` does the same,
+//!    or, if the project pulls it in only transitively (e.g. through
+//!    `slevomat/coding-standard`), a `phpcs.xml`/`.phpcs.xml` config file
+//!    at the workspace root certifies phpcbf just as well.
 //! 3. **Otherwise, use mago-formatter.**  No subprocess, no temp files,
 //!    no external dependencies.  Uses PER-CS 2.0 defaults or if present `mago.toml`.
 //!
@@ -93,8 +95,11 @@ pub(crate) enum FormattingStrategy {
 /// - If `config.is_disabled()` (both tools set to `""`) → `Disabled`.
 /// - If either tool has an explicit non-empty path in config →
 ///   `External` with those tools.
-/// - If `composer_json` has `friendsofphp/php-cs-fixer` or
-///   `squizlabs/php_codesniffer` in `require-dev` → `External`,
+/// - If `composer_json` has `laravel/pint`, `friendsofphp/php-cs-fixer`,
+///   or `squizlabs/php_codesniffer` in `require-dev`, or the workspace
+///   root has a `phpcs.xml`/`.phpcs.xml`/`phpcs.xml.dist`/
+///   `.phpcs.xml.dist` config file (which certifies phpcbf even when
+///   PHP_CodeSniffer is pulled in only transitively) → `External`,
 ///   resolving paths via the Composer bin-dir.
 /// - Otherwise → `BuiltIn`.
 pub(crate) fn resolve_strategy(
@@ -143,8 +148,11 @@ pub(crate) fn resolve_strategy(
         return FormattingStrategy::External(tools);
     }
 
-    // No explicit config — check composer.json require-dev.
-    if let Some(package) = composer_json {
+    // No explicit config — check composer.json require-dev, or a
+    // hand-authored phpcs config file for phpcbf.
+    let has_phpcs_config = workspace_root.is_some_and(crate::phpcs::has_project_config);
+
+    if composer_json.is_some() || has_phpcs_config {
         let mut tools = Vec::new();
         let bin = bin_dir.unwrap_or("vendor/bin");
 
@@ -155,21 +163,32 @@ pub(crate) fn resolve_strategy(
         let pint_disabled = config.pint.as_deref() == Some("");
 
         if !pint_disabled
-            && crate::composer::has_require_dev(package, "laravel/pint")
+            && composer_json
+                .is_some_and(|package| crate::composer::has_require_dev(package, "laravel/pint"))
             && let Some(tool) = resolve_from_bin_dir("pint", workspace_root, bin)
         {
             tools.push(tool);
         }
 
         if !fixer_disabled
-            && crate::composer::has_require_dev(package, "friendsofphp/php-cs-fixer")
+            && composer_json.is_some_and(|package| {
+                crate::composer::has_require_dev(package, "friendsofphp/php-cs-fixer")
+            })
             && let Some(tool) = resolve_from_bin_dir("php-cs-fixer", workspace_root, bin)
         {
             tools.push(tool);
         }
 
+        // A phpcs config file certifies phpcbf on its own: a project
+        // that pulls squizlabs/php_codesniffer in only transitively
+        // (e.g. through slevomat/coding-standard) never lists it in
+        // require-dev directly, but a phpcs.xml is still deliberate
+        // evidence the project uses it.
         if !phpcbf_disabled
-            && crate::composer::has_require_dev(package, "squizlabs/php_codesniffer")
+            && (has_phpcs_config
+                || composer_json.is_some_and(|package| {
+                    crate::composer::has_require_dev(package, "squizlabs/php_codesniffer")
+                }))
             && let Some(tool) = resolve_from_bin_dir("phpcbf", workspace_root, bin)
         {
             tools.push(tool);
@@ -877,6 +896,75 @@ mod tests {
         }
     }
 
+    #[test]
+    fn strategy_phpcs_config_file_without_composer_dependency() {
+        let dir = tempfile::tempdir().unwrap();
+        let vendor_bin = dir.path().join("vendor/bin");
+        std::fs::create_dir_all(&vendor_bin).unwrap();
+
+        let p = vendor_bin.join("phpcbf");
+        std::fs::write(&p, "#!/bin/sh\n").unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
+        }
+
+        // squizlabs/php_codesniffer is pulled in only transitively (e.g.
+        // via slevomat/coding-standard), so it never appears in
+        // require-dev directly. A hand-authored phpcs.xml certifies
+        // phpcbf on its own, even with no composer.json at all.
+        std::fs::write(dir.path().join("phpcs.xml"), "").unwrap();
+
+        let config = FormattingConfig::default();
+        let strategy = resolve_strategy(Some(dir.path()), &config, None, None);
+        match &strategy {
+            FormattingStrategy::External(tools) => {
+                assert_eq!(tools.len(), 1);
+                assert_eq!(tools[0].name, "phpcbf");
+                assert_eq!(tools[0].path, vendor_bin.join("phpcbf"));
+            }
+            other => panic!("Expected External, got {:?}", other),
+        }
+    }
+
+    #[test]
+    fn strategy_phpcs_xml_dist_certifies_phpcbf_over_transitive_dependency() {
+        let dir = tempfile::tempdir().unwrap();
+        let vendor_bin = dir.path().join("vendor/bin");
+        std::fs::create_dir_all(&vendor_bin).unwrap();
+
+        let p = vendor_bin.join("phpcbf");
+        std::fs::write(&p, "#!/bin/sh\n").unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
+        }
+
+        std::fs::write(dir.path().join("phpcs.xml.dist"), "").unwrap();
+
+        // Only a coding-standard package that pulls in squizlabs/php_codesniffer
+        // transitively; the direct dependency check alone would miss this.
+        let composer: crate::composer::ComposerPackage =
+            serde_json::from_value(serde_json::json!({
+                "require-dev": {
+                    "slevomat/coding-standard": "^8.0"
+                }
+            }))
+            .unwrap();
+
+        let config = FormattingConfig::default();
+        let strategy = resolve_strategy(Some(dir.path()), &config, Some(&composer), None);
+        match &strategy {
+            FormattingStrategy::External(tools) => {
+                assert_eq!(tools.len(), 1);
+                assert_eq!(tools[0].name, "phpcbf");
+            }
+            other => panic!("Expected External, got {:?}", other),
+        }
+    }
+
     #[test]
     fn strategy_require_dev_both_tools() {
         let dir = tempfile::tempdir().unwrap();