rgctl v0.4.10

rgctl v0.4.10

PHP Tier 1 language support — full custom LanguagePlugin with graph extraction, CFG/PDG, taint, and field-write (CPG) parity alongside Java, Go, Rust, and the other Tier 1 languages.

rgctl --version
rgctl discover . -l php --with-cfg --with-taint

Highlights

PHP Tier 1 (rgctl-lang-php)

New crate crates/rgctl-lang-php — tree-sitter PHP grammar, registered in languages.toml and shipped in the release binary.

Capability	Detail
Indexing	Classes, interfaces, traits, enums, namespaces, functions, methods, arrow functions, anonymous functions
Relations	Calls, Extends, Implements, Uses (trait composition), Import, Instantiates
Imports	namespace_use_* → Import symbols; import-aware to_qualified_hint on static calls
Traits	use TraitA, TraitB; → Uses edges
Modern PHP	Attributes (metadata.attributes), anonymous classes ($Anonymous{line}), promoted constructor properties, class constants on fields[], property-hooks flag
Dynamic calls	$obj->$method() / variable callees emitted with metadata.unresolved
CFG / PDG	if, while, for, foreach, switch, match, catch, loops, early returns
Taint	$_FILES, filter_input, PDO prepare / SQL injection patterns
CPG / mutations	Layer F field-write golden (php_cfg_captures_field_write_and_query) — full F1–F6 parity
Grammar switch	RGCTL_PHP_ONLY=1 selects LANGUAGE_PHP_ONLY (no inline HTML)

rgctl discover . -l php -e vendor,node_modules,.git
rgctl discover . -l php --with-cfg --with-security --with-taint
rgctl -f json gql "MATCH (n:Function) WHERE n.file_path CONTAINS '.php' RETURN n LIMIT 20"

Fixture: rgctl-tests/ecommerce-php/ — MVC-style controller → service → repository with auth flow, taint path, and field-write coverage.

Integration gates: tests/php_cfg_analysis.rs, tests/php_taint.rs, tests/dashboard_ecommerce_php.rs.

Large-corpus profiling

• example/magento2 added to scripts/fetch-profile-repos.sh (Magento Open Source stress corpus; exclude vendor/, generated/).
• Reference cold discover on maintainer hardware (~25k PHP files, default discover): ~12 s wall, ~266k nodes, ~100k functions.
• Deep discover (--with-cfg --with-security --with-taint): ~33 s wall on same hardware.

DI-heavy frameworks (Magento/Symfony) still produce sparse Calls edges for interface-typed receivers — tracked for future work in #75.

Documentation

• languages.md — PHP in Tier 1 table
• tier-1-language-support.md — parity snapshot updated (Calls, CFG, taint, dashboard gate, Layer F)
• example/README.md — Magento2 fetch path

Performance

Linux kernel cold discover gate (example/linux, default discover, release build) passes at 145 s wall baseline (+10% tolerance) — no regression from PHP plugin wiring.

Install

Platform	Asset
Linux x86_64	rgctl-0.4.10-x86_64-unknown-linux-gnu.tar.gz
macOS Apple Silicon	rgctl-0.4.10-aarch64-apple-darwin.tar.gz
macOS Intel	rgctl-0.4.10-x86_64-apple-darwin.tar.gz
Windows x86_64	rgctl-0.4.10-x86_64-pc-windows-msvc.zip

Verify: shasum -a 256 -c SHA256SUMS.txt

Docs

• User Guide — discover, CFG, taint
• Tier 1 language support — PHP parity matrix
• Languages
• AGENTS.md · Install

Merged PRs

• #74 — PHP Tier 1 language support (closes #73)

Compare

v0.4.9...v0.4.10

What's Changed

• Add PHP Tier 1 language support by @sshaaf in #74

Full Changelog: v0.4.9...v0.4.10