[coisa]

Native STDIN and php -r exception frames caused Whoops to read virtual filenames, generating extra warnings while rendering the original failure. Adopt Whoops ^2.18.7, whose upstream fix preserves those frames while omitting source lookup for virtual sources.

Whoops remains optional. A Composer conflict rejects installed versions older than 2.18.7; installation guidance, recipes, the bundled consumer skill and the missing-dependency hint use the same floor. The 2.x PHP 7.4 support, APIs, legacy container, reporting and response policies remain unchanged.

Three bounded PHPUnit process regressions exercise native STDIN, php -r and a physical file through the existing middleware and renderer. They preserve the original throwable, frames, report order, application warnings, status, caller buffer and callbacks. The native cases fail with Whoops 2.18.6 and pass with 2.18.7.

Validation:

• PHP 8.5.11: complete Composer check, 383 tests / 1794 assertions, PHPCS/fixer and maximum PHPStan.
• Actual PHP 7.4.33 consumer: 26 focused tests / 181 assertions and platform checks; all project PHP files pass its syntax lint.
• Real Composer resolution rejects Whoops 2.18.6, accepts exact 2.18.7 and accepts installation without Whoops; the latter still loads the core and legacy container.
• 28 bounded example scenarios, documentation site validation and the 85-file distribution archive gate pass.

Closes #99.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T19:58:09.092311Z	0c64c36	PR opened
🔒 Security Review	✅ Completed 2026-10-20T19:59:18.729407Z	0c64c36	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Changelog

✅ Contribution check passed.

Head: bbc0a5d6528cba431570c4b96cc79b6f68554396

Base: 8878f4afda9d429e5775bbd5b0b0290baf32ac01

Contribution: 1 new valid fragment(s). Policy: ordinary.

• whoops-native-source-frames.md — fixed, patch

  Require optional Whoops `^2.18.7` for development HTML, adopting its upstream fix for native STDIN and `php -r` source inspection. Reject older Whoops versions through Composer without making the optional package mandatory. Preserve original exception frames, one original report, legitimate application warnings and the existing 2.x response and lifecycle policies. Align installation guidance and the bundled consumer skill, with bounded native source regressions alongside the renderer's unit tests.

[github-actions]

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
Overall Coverage	🟢 97.16%	🟢 97.16%	⚪ 0%

Minimum allowed coverage is 80%, this run produced 97.16%

Head: bbc0a5d. Tested commit: 4e66fad. PHP CI run.