[Adi-ty]

What this PR does

Fixes the lint/phpstan scaffold. Its config hardcoded src and includes, and PHPStan stops on a listed path that doesn't exist, so composer analyse failed in any project without both. The scaffold now asks for the paths to analyse through a required paths input, so it works on any PHP project: plugins, themes, or Composer packages like rtcamp/wp-primitives.

Stacked on #83: merge that first.

Closes

N/A

Changes

• Required paths input: comma-separated (--paths='inc/, my-plugin.php') and rendered as a NEON inline list, paths: [inc/, my-plugin.php]. It has no default, so interactive runs prompt for it and --non-interactive runs without it fail with EMISSINGINPUT instead of writing a broken config.
• Excludes shrink to optional vendor and node_modules: they only matter when paths includes ..
• Docs: the setup skill and docs/examples.md pass --paths in their lint/phpstan commands.
• Tests: supplied paths render verbatim; a missing paths is refused.

How I verified

❯ npm run check

Test Suites: 82 passed, 82 total
Tests:       1377 passed, 1377 total
Snapshots:   0 total

PHPStan 2.3.1 on scaffolded projects: --paths='inc/, acme.php' analyses with no errors, and --paths=. reports the project's own errors and nothing from vendor/.

Acceptance criteria

Runtime behavior

• Fresh scaffold + composer analyse runs with no path errors, whatever the project layout
• A missing paths input is refused, never guessed

Code quality

• Lint — zero errors
• Static analysis — zero errors
• Tests pass

Housekeeping

• CHANGELOG.md entry under ## Unreleased

Reviewer notes

• This replaces the first approach on this PR, which discovered paths through two new engine sources (entry-file:, exists:). Guessing silently skipped PHP outside its list and rendered an empty paths: when nothing matched, so that code is reverted.
• rtcamp/wp-phpstan stays ^1.0 — the ^2.0 bump follows the wp-phpstan release that ships level 8, as its own change.
• Constants defined at runtime (define() inside a function) still need the project's own bootstrapFiles.

[Copilot]

🟡 Changes recommended

Symlinks bypass project containment, and projects without matching paths receive an invalid PHPStan configuration.

2 open issues

• Handle analysis configs with zero matching paths · New
• Reject symlinked candidates outside the project root · New

What changed in this PR

Updates the PHPStan scaffold to discover existing project paths instead of hardcoding src and includes, using reusable scaffold-engine discovery sources.

Changes:

• Adds entry-file:<type> and exists:<path> discovery sources and validation support.
• Conditionally renders PHPStan analysis paths and removes the previous exclusions.
• Adds discovery and rendering tests, authoring documentation, and a changelog entry.

File	Description
node-packages/​wp-tooling/​tests/​scaffolds/​discover-sources.test.js	Tests entry-file and existing-path discovery.
node-packages/​wp-tooling/​tests/​scaffolds/​bundled-manifests.test.js	Tests generated PHPStan paths for plugins and themes.
node-packages/​wp-tooling/​src/​scaffolds/​validate.js	Allows both new discovery sources.
node-packages/​wp-tooling/​src/​scaffolds/​registry.js	Implements entry-file and existing-path resolution.
node-packages/​wp-tooling/​scaffolds/​lint/​phpstan/​templates/​phpstan.neon.dist.mustache	Renders analysis paths conditionally.
node-packages/​wp-tooling/​scaffolds/​lint/​phpstan/​scaffold.json	Declares inputs for conventional PHP paths.
node-packages/​wp-tooling/​docs/​authoring-scaffolds.md	Documents the new discovery sources.
node-packages/​wp-tooling/​docs/​ai-orchestration.md	Updates engine discovery guarantees and responsibilities.
node-packages/​wp-tooling/​CHANGELOG.md	Records discovery additions and the scaffold fix.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Blank-input validation and literal path serialization remain unresolved and can produce unusable PHPStan configurations.

2 open issues

• Reject empty or whitespace-only analysis paths · New
• Quote and escape paths in generated NEON lists · New

2 resolved since last review

• Reject symlinked candidates outside the project root
• Handle analysis configs with zero matching paths

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Escaping occurs before required-input validation, allowing whitespace-only values to bypass the new check.

2 open issues

• Quote and escape paths in generated NEON lists
• Reject empty or whitespace-only analysis paths

1 previously missed issue

In code that hasn't changed since last review

Validate required inputs before applying escaping

node-packages/​wp-tooling/​src/​scaffolds/​registry.js:1219

This checks the value after resolveDeclared() has applied its transform. Both setup/pa11y and setup/perf declare a required base_url with json-escape, so an actual tab-only or newline-only input becomes the nonblank text \t or \n. It therefore bypasses this check and renders an unusable URL instead of raising EMISSINGINPUT. Validate required values before escaping, while preserving post-transform enum validation and the resolver's partial-resolution behavior. Add regression cases for tab-only and newline-only values on a transformed required input.

_{Review effort: Balanced}