Description
Builder::isBuildAvailable() uses shell_exec('which cmake 2>/dev/null') and shell_exec('which g++ 2>/dev/null') / shell_exec('which clang++ 2>/dev/null') to detect build tools. The which command does not exist on Windows (the equivalent is where), so shell_exec returns null and isBuildAvailable() always returns false — even if cmake and a C++ compiler are on PATH.
Where
src/Builder.php:22 — shell_exec('which cmake 2>/dev/null')src/Builder.php:27-28 — shell_exec('which g++ 2>/dev/null') / shell_exec('which clang++ 2>/dev/null')
Failure scenario
On Windows with cmake and MSVC/clang installed, isBuildAvailable() returns false, so the source-build fallback in InstallScript never runs. The user gets "Build tools not available" even though they are.
Suggested fix
Use PHP_OS_FAMILY === 'Windows' to dispatch to where instead of which, or use a PHP-native check (e.g. shell_exec('where cmake 2>NUL') on Windows).
Verification
Found during the #57 workflow cycle (full-repo security review follow-up). Verified real and reachable on main; no duplicate (related: #95 macOS portability, #133 CI matrix).
Related: #95, #43, #57
Description
Builder::isBuildAvailable()usesshell_exec('which cmake 2>/dev/null')andshell_exec('which g++ 2>/dev/null')/shell_exec('which clang++ 2>/dev/null')to detect build tools. Thewhichcommand does not exist on Windows (the equivalent iswhere), soshell_execreturnsnullandisBuildAvailable()always returns false — even if cmake and a C++ compiler are on PATH.Where
src/Builder.php:22—shell_exec('which cmake 2>/dev/null')src/Builder.php:27-28—shell_exec('which g++ 2>/dev/null')/shell_exec('which clang++ 2>/dev/null')Failure scenario
On Windows with cmake and MSVC/clang installed,
isBuildAvailable()returns false, so the source-build fallback in InstallScript never runs. The user gets "Build tools not available" even though they are.Suggested fix
Use
PHP_OS_FAMILY === 'Windows'to dispatch towhereinstead ofwhich, or use a PHP-native check (e.g.shell_exec('where cmake 2>NUL')on Windows).Verification
Found during the #57 workflow cycle (full-repo security review follow-up). Verified real and reachable on
main; no duplicate (related: #95 macOS portability, #133 CI matrix).Related: #95, #43, #57