feat: add Symfony Runtime for Rapira - #1

chore: require rapira/testing ^0.1.7

The last request went unterminated only because the 0.1.6 double returned false together with it; like the host, 0.1.7 answers true for every served request and false from a separate empty call.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

The protected getMode() and getHttpDispatcher() hooks, the RequestLoop interface pair and the injectable boot $_SERVER of the request factory existed only so tests could replace the host; the Feature suite now scripts the host through the rapira/contract stubs instead, so the Runtime calls the Rapira functions directly and the runners build their own collaborators. The runners are internal and move into Internal\ next to them, which leaves Runtime the only public class. The options docblock no longer lists worker_loop_max, which only FrankenPHP's runner reads.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

The Rapira SAPI starts a request without an output buffer, so ob_flush() in a StreamedResponse callback raised a notice that Symfony turned into an exception, and the client got the first chunk followed by an error page. Both modes now send the response inside a buffer of their own, with the 8 KiB chunk size output_buffering gives php-fpm, and close whatever buffers the body left open.

Classic mode went through Symfony's HttpKernelRunner, which knows fastcgi_finish_request() but not rapira_finish_request(), so the client waited for terminate(). It gets a runner of its own that finishes the request before terminating, as Worker mode now does too. Outside Rapira the contract stub answers false and the runner finishes the request the way Symfony's own does, so php-fpm serving the same application needs no separate path.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

The loop kept the last request and response in its own variables while gc_collect_cycles() ran, so every request's graph survived until the next one replaced it. Serving a request now happens in a method of its own whose frame owns them. Terminate still runs after handle_request() returns: the response has been finished by then, and a terminate failure ends the worker instead of reaching the host as a failure of a request it already answered.

The host builds $_SERVER from the request alone, so the boot-time variables Dotenv set, APP_ENV and APP_SECRET among them, are still added to every request. Only HTTP_* entries were filtered out of them, so a boot-time HTTPS, QUERY_STRING or REMOTE_ADDR leaked into requests that lacked one; the worker now applies the same filter the dispatcher does.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

Such an application went through Symfony's own runners, which run it once and return, so a resident worker exited after its first pass without ever serving a request. Getting the runner now fails with a LogicException that names the mode and the application type; Classic mode still hands it to Symfony.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

chore: drop nyholm/psr7 and symfony/psr-http-message-bridge

The exchange went through a PSR-7 request on its way to HttpFoundation, and each hop lost a part of PHP's semantics: cookie values reached the application still URL-encoded, so a cookie Symfony set never read back the same; a repeated cookie name kept the last value where PHP keeps the first; several Cookie headers were joined with a comma; a form whose content type was not lowercase stayed unparsed; and file field names were nested by a parser of their own, without the mangling PHP applies to the fields next to them. The Symfony request is now built directly, with cookies, query, form and multipart names all parsed by parse_str() as in the laravel bridge, and form bodies parsed only for POST, PUT, PATCH and DELETE.

The host deletes an upload's spool file once the exchange finalizes, which is before terminate(), so each file used to be copied. It is now renamed instead, which the contract names as the way to keep it, and still removed after terminate().

The raw method travelled in three places, a request attribute and two server keys, for the emitter to tell a wire HEAD from what Symfony's uppercasing getMethod() calls HEAD. The emitter now reads it from the exchange it writes to, and the application sees it where PHP puts it, in REQUEST_METHOD.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

A HEAD request for a BinaryFileResponse was prepared as a GET, so the whole file was read only for the host to drop it; the response is now prepared for the request as it is, which leaves the file unread and still lets deleteFileAfterSend() remove it. A file is handed to the host with Exchange::sendFile(), ranges as an offset and a length, so PHP no longer holds its bytes. A file deleted after sending, a temporary file, a stream wrapper path and a status that sends no file still go through PHP, as does a file the host refuses.

Printed output was forwarded one byte at a time. It is now forwarded every 8 KiB and on every ob_flush(); a bare flush() reaches no output handler, so a body that relies on it alone waits for the chunk to fill, as under php-fpm with output_buffering. Output removed with ob_clean() is no longer forwarded, and the head now goes out with the first chunk instead of before the body runs. Header values of null are sent empty instead of reaching the host as null.

The range test removed its file before reading back the slice handed to the host, so it could only pass while nothing was handed over.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

A request that could not be converted, a terminal 1xx status, an EventStreamResponse, a header value the host rejects or a body that failed before printing anything propagated out of the loop, so one bad request cost the worker and every exchange queued behind it. Until a response head is written another response can still take its place, so such a failure is now logged through Rapira\log() and answered with a plain-text error, 400 when Symfony classifies the conversion failure as a bad request and 500 otherwise, and the loop goes on; a handled response that failed still terminates. A failure of the kernel, of terminate(), of a response whose head is already out, or of the output buffer stack still propagates, since the worker cannot vouch for its state after them.

Each exchange is served in a method of its own, so neither it nor the request outlives the call into the next receive().

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

… work

The README described Classic mode as Symfony's runner, dispatcher uploads as copies, streaming without a chunk size and sendFile() as unused, and told readers to install a branch alias that is no longer needed. It also ruled out native sessions in Dispatcher mode, while Symfony's session listener takes the session id from the request's cookies and sets the cookie on the response, so NativeSessionStorage works there; only a direct session_start() does not.

Symfony's Kernel::boot() resolves the REMOTE_ADDR placeholder of trusted_proxies once, from the $_SERVER of the moment, which in a resident worker is the first request's client; the README now warns against it.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

The SDK's dispatcher request factory was checked against php -S and the Rapira SAPI source, and the bridge differed from it in several places. A header field named outside [A-Za-z0-9-] reached the server bag, with `.` turned into `_`, and the header bag, which reads `_` as `-`; the host drops such a field in Worker mode, and here X_Forwarded_For could pose as X-Forwarded-For. It is now dropped as well.

Cookie values were URL-decoded with `+` as a space, a pair without `=` was skipped and a duplicate was detected before name mangling; PHP decodes cookies raw, keeps a bare name with an empty value and keeps the first of two names that mangle to one key. A form media type was cut only at a space or `;`, not at `,`. Form bodies were parsed only for POST, PUT, PATCH and DELETE, while the contract reads a body by its framing and never by the method name; a url-encoded or multipart body is now parsed by its Content-Type alone, for QUERY, GET or any other method. PHP drops an upload whose name has broken brackets, `u[v` or `a[b]c` say, while it repairs a text field of the same name; the bridge nested it.

The server params now carry what the SAPI sets in Worker mode and were missing here: REQUEST_SCHEME, GATEWAY_INTERFACE, SERVER_SOFTWARE, DOCUMENT_URI, and HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH next to the CONTENT_* pair. The test that pinned REQUEST_SCHEME as absent was checking that the boot-time value does not leak, so it now expects the request's own scheme.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

What the application printed while handling a request, a var_dump() or a stray echo, went to the SAPI output of the dispatcher process, which reaches no client. It is now captured around handle() and sent ahead of the body, as a SAPI would and as the laravel bridge does; a response that carries a printed prefix drops its Content-Length, which no longer counts the body, and a file keeps its length and goes out without the prefix. The output of a handle() that throws is dropped with its buffers.

A buffered body went to the host in one write whatever its size. Above 8 MiB it is now written in slices under a Content-Length of its own, so HTTP/1.1 stays off chunked encoding. A buffered body also no longer carries the response's own Content-Length, which the host would enforce against a body it measures itself.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

Rapira serves an application from the root, with no document root and no deployment in a subfolder, yet the dispatcher request carried SCRIPT_NAME, SCRIPT_FILENAME, PHP_SELF and the rest of the script location from the boot-time $_SERVER. Symfony's base URL detection reads them, so a path starting with /index.php lost that prefix to the base URL. Without them Symfony finds an empty base URL and base path, the whole path becomes the path info, and generated URLs are root-relative. The environment, APP_ENV and APP_SECRET among it, is still carried over; Worker mode keeps the script location, which the host fills there itself.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

Dispatcher mode is designed for code that serves exchanges concurrently, and the README did not say that Symfony cannot: a StreamedResponse is captured through process-wide output buffers and the framework keeps request-related state in statics and shared services. It now says so and sends code that needs the superglobals or header() to Worker mode. The request and response sections follow the latest changes: the dropped header names, the script location left out, form and multipart bodies parsed for any method, handler output ahead of the body, and long bodies split into 8 MiB writes.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

…n Linux

On Linux, Rapira 0.9.0 corrupts the PHP VM stack around a dispatched exchange, and calling isCancelled() or isFinalized() on it in a method makes the worker segfault on every request (rapira-rs/rapira#201). The host respawns the worker silently and the client gets an empty reply, which is how the Dispatcher acceptance suite stopped coming up on the Linux CI jobs. The bridge no longer calls either. A cancelled exchange is now handled and fails its first write, which ends as a discarded response; the error answer relies on its own record of the head instead of isFinalized(). The test for skipping a cancelled exchange is skipped with its expectation kept, so reverting this commit once the host is fixed restores the check; #2 tracks that.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: boot the kernel before the first request in Worker and Dispatcher modes
feat: let an extending runtime answer such a failure through createFailureResponse()

A throwable that escapes kernel->handle() leaves the kernel in an unknown state and reached the client as the host's bare error; it now gets a plain 500, and the loop ends so Rapira runs the script afresh instead of serving on with that kernel. An error page is the bundle's call, so the runtime offers one method to override rather than rendering one itself.

Rapira counts a worker that ends before its first request as a failed start and one that ends after it as a planned recycle, so the kernel boots before the loop for a broken container to be counted, as roadrunner-bundle does.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: require Rapira 0.9.1

Rapira 0.9.1 fixes the worker crash after isCancelled() and isFinalized() (rapira-rs/rapira#201), so the workaround from c6c60c4 is reverted; 0.9.0 still crashes on x86_64 Linux, hence the new minimum.

Closes #2

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

…t the kernel boots before the loop

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: leave the client's authority out of SERVER_NAME

Behind a proxy on a unix socket, REMOTE_ADDR held nothing or the socket path, so trusted_proxies matching on PRIVATE_SUBNETS failed in Dispatcher mode while Worker mode trusted the proxy.

The SAPI sets SERVER_NAME from the configured server name, which a dispatcher cannot see; filling it from the authority the client sent passed a client value off as a server one. Same change as rapira/http 0.1.6.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: keep a Dispatcher worker serving after a stream fails past its head
fix: keep application variables named like CGI ones in a request's $_SERVER
fix: stream a file response through PHP when Symfony's internal state is gone
fix: truncate input past PHP's limits instead of failing under the debug handler
fix: leave an empty upload input null in Dispatcher mode, as FileBag does

After handle_request() returns, the host has already removed the uploads and lifted max_execution_time, so terminate listeners lost the files and could hang the worker.

A body that fails after its head leaves the kernel intact, so only a damaged output buffer stack still ends the loop.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>

…cher mode

test: drop the nesting-level cookie test, which PHP never warns about
docs: say that a cut-off Dispatcher response is failed only after terminate

Classic and Worker modes log PHP's warning, so a silent truncation hid dropped input from operators.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>