feat(dev-tooling): add console_run output_file and arbitrary envs

[Martin Bens (SpiGAndromeda)]

console_run on the php-tooling server gains file-captured output and loses its environment allowlist, so an env-scoped console dump — debug:container with --env=test, say — can land on disk instead of in the response. Unbounded command output stays out of the conversation entirely. dev-tooling goes 3.18.0 to 3.19.0.

output_file

When the new optional parameter is present, the command's stdout streams host-side into a mktemp sibling that is renamed onto the target only after a zero exit, and the response carries a summary instead of the payload: the resolved path, the byte count, the exit status, and the noise-filtered stderr. A failed command leaves an existing target untouched and returns its stdout in the response, since a failed command's output is diagnostic rather than payload. A target that exists as a symlink or a non-regular file is refused, as is a value over 4096 bytes. A relative path resolves against the project root, a leading - is normalized with ./, and parent directories are created.

The capture path builds on wrap_command directly rather than exec_command, which merges stdout and stderr with 2>&1 — the template-synced layer is untouched, and calls without output_file still run through exec_command unchanged. The eval runs in a subshell so an exit reached inside the wrapped command ends the capture rather than the server; reproduced without the subshell as a killed server and an orphaned temp file.

env

The schema constraint widens from the dev/prod/test enum to ^[A-Za-z0-9_]{1,32}$, because Symfony environments are arbitrary names. Shopware's bin/console reads --env from argv before booting the kernel, so the value selects the environment in every wrapped environment type without any APP_ENV handling. The length bound lives inside the pattern because the vendored validator enforces pattern but not maxLength. The runtime path is unchanged, including the .console.env config default.

Limits

The console suite grows to 54 BATS tests (606 across the repository), including four that call the vendored validator directly to pin the pattern's accept and reject directions. The harness stubs execution, so only the native environment ran the capture path end to end; the container wrappers are asserted on their constructed command lines, and the claim that they deliver container stdout to the host is taken from their existing behavior rather than re-measured. A TOCTOU window between the symlink check and the rename remains open.

[github-actions]

Agent Skills Export

Built 7 skill packages:

• pr-description-writing
• commit-message-writing
• ci-log-interpretation
• feature-branch-pr-writing
• release-info-writing
• structuring-documentation
• adr-writing