AGENTS.md

=== foundation rules ===

Laravel Boost Guidelines

The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.

Foundational Context

This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.

• php - 8.4
• filament/filament (FILAMENT) - v5
• laravel/ai (AI) - v0
• laravel/framework (LARAVEL) - v13
• laravel/horizon (HORIZON) - v5
• laravel/prompts (PROMPTS) - v0
• laravel/reverb (REVERB) - v1
• laravel/sanctum (SANCTUM) - v4
• laravel/socialite (SOCIALITE) - v5
• livewire/livewire (LIVEWIRE) - v4
• laravel/boost (BOOST) - v2
• laravel/mcp (MCP) - v0
• laravel/pail (PAIL) - v1
• laravel/pint (PINT) - v1
• laravel/sail (SAIL) - v1
• pestphp/pest (PEST) - v5
• phpunit/phpunit (PHPUNIT) - v13
• rector/rector (RECTOR) - v2
• laravel-echo (ECHO) - v1
• prettier (PRETTIER) - v3
• tailwindcss (TAILWINDCSS) - v4

Skills Activation

This project has domain-specific skills available in **/skills/**. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.

Conventions

• You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
• Use descriptive names for variables and methods. For example, isRegisteredForDiscounts, not discount().
• Check for existing components to reuse before writing a new one.

Verification Scripts

• Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.

Application Structure & Architecture

• Stick to existing directory structure; don't create new base folders without approval.
• Do not change the application's dependencies without approval.

Frontend Bundling

• If the user doesn't see a frontend change reflected in the UI, it could mean they need to run npm run build, npm run dev, or composer run dev. Ask them.

Documentation Files

• You must only create documentation files if explicitly requested by the user.

Replies

• Be concise in your explanations - focus on what's important rather than explaining obvious details.

=== boost rules ===

Laravel Boost

Tools

• Laravel Boost is an MCP server with tools designed specifically for this application. Prefer Boost tools over manual alternatives like shell commands or file reads.
• Use database-query to run read-only queries against the database instead of writing raw SQL in tinker.
• Use database-schema to inspect table structure before writing migrations or models.
• Use get-absolute-url to resolve the correct scheme, domain, and port for project URLs. Always use this before sharing a URL with the user.
• Use browser-logs to read browser logs, errors, and exceptions. Only recent logs are useful, ignore old entries.

Searching Documentation (IMPORTANT)

• Always use search-docs before making code changes. Do not skip this step. It returns version-specific docs based on installed packages automatically.
• Pass a packages array to scope results when you know which packages are relevant.
• Use multiple broad, topic-based queries: ['rate limiting', 'routing rate limiting', 'routing']. Expect the most relevant results first.
• Do not add package names to queries because package info is already shared. Use test resource table, not filament 4 test resource table.

Search Syntax

1. Use words for auto-stemmed AND logic: rate limit matches both "rate" AND "limit".
2. Use "quoted phrases" for exact position matching: "infinite scroll" requires adjacent words in order.
3. Combine words and phrases for mixed queries: middleware "rate limit".
4. Use multiple queries for OR logic: queries=["authentication", "middleware"].

Artisan

• Run Artisan commands directly via the command line (e.g., php artisan route:list). Use php artisan list to discover available commands and php artisan [command] --help to check parameters.
• Inspect routes with php artisan route:list. Filter with: --method=GET, --name=users, --path=api, --except-vendor, --only-vendor.
• Read configuration values using dot notation: php artisan config:show app.name, php artisan config:show database.default. Or read config files directly from the config/ directory.

Tinker

• Execute PHP in app context for debugging and testing code. Do not create models without user approval, prefer tests with factories instead. Prefer existing Artisan commands over custom tinker code.
• Always use single quotes to prevent shell expansion: php artisan tinker --execute 'Your::code();'
  • Double quotes for PHP strings inside: php artisan tinker --execute 'User::where("active", true)->count();'

=== php rules ===

PHP

• Always use curly braces for control structures, even for single-line bodies.
• Use PHP 8 constructor property promotion: public function __construct(public GitHub $github) { }. Do not leave empty zero-parameter __construct() methods unless the constructor is private.
• Use explicit return type declarations and type hints for all method parameters: function isAccessible(User $user, ?string $path = null): bool
• Use TitleCase for Enum keys: FavoritePerson, BestLake, Monthly.
• Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic.
• Use array shape type definitions in PHPDoc blocks.

=== deployments rules ===

Deployment

• Laravel can be deployed using Laravel Cloud, which is the fastest way to deploy and scale production Laravel applications.

=== herd rules ===

Laravel Herd

• The application is served by Laravel Herd at https?://[kebab-case-project-dir].test. Use the get-absolute-url tool to generate valid URLs. Never run commands to serve the site. It is always available.
• Use the herd CLI to manage services, PHP versions, and sites (e.g. herd sites, herd services:start <service>, herd php:list). Run herd list to discover all available commands.

=== tests rules ===

Test Enforcement

• Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
• Run the minimum number of tests needed to ensure code quality and speed. Use php artisan test --compact with a specific filename or filter.

=== laravel/core rules ===

Do Things the Laravel Way

• Use php artisan make: commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using php artisan list and check their parameters with php artisan [command] --help.
• If you're creating a generic PHP class, use php artisan make:class.
• Pass --no-interaction to all Artisan commands to ensure they work without user input. You should also pass the correct --options to ensure correct behavior.

Model Creation

• When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using php artisan make:model --help to check the available options.

APIs & Eloquent Resources

• For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.

URL Generation

• When generating links to other pages, prefer named routes and the route() function.

Testing

• When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
• Faker: Use methods such as $this->faker->word() or fake()->randomDigit(). Follow existing conventions whether to use $this->faker or fake().
• When creating tests, make use of php artisan make:test [options] {name} to create a feature test, and pass --unit to create a unit test. Most tests should be feature tests.

Vite Error

• If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run npm run build or ask the user to run npm run dev or composer run dev.

=== pint/core rules ===

Laravel Pint Code Formatter

• If you have modified any PHP files, you must run vendor/bin/pint --dirty --format agent before finalizing changes to ensure your code matches the project's expected style.
• Do not run vendor/bin/pint --test --format agent, simply run vendor/bin/pint --format agent to fix any formatting issues.

=== pest/core rules ===

Pest

• This project uses Pest for testing. Create tests: php artisan make:test --pest {name}.
• The {name} argument should not include the test suite directory. Use php artisan make:test --pest SomeFeatureTest instead of php artisan make:test --pest Feature/SomeFeatureTest.
• Run tests: php artisan test --compact or filter: php artisan test --compact --filter=testName.
• Do NOT delete tests without approval.

=== filament/filament rules ===

Filament

• Filament is a Laravel UI framework built on Livewire, Alpine.js, and Tailwind CSS. UIs are defined in PHP via fluent, chainable components. Follow existing conventions in this app.
• Use the search-docs tool for official documentation on Artisan commands, code examples, testing, relationships, and idiomatic practices. If search-docs is unavailable, refer to https://filamentphp.com/docs.

Artisan

• Always use Filament-specific Artisan commands to create files. Find available commands with the list-artisan-commands tool, or run php artisan --help.
• Inspect required options before running, and always pass --no-interaction.

Patterns

Always use static make() methods to initialize components. Most configuration methods accept a Closure for dynamic values.

Use Get $get to read other form field values for conditional logic:

use Filament\Forms\Components\Select; use Filament\Forms\Components\TextInput; use Filament\Schemas\Components\Utilities\Get;

Select::make('type') ->options(CompanyType::class) ->required() ->live(),

TextInput::make('company_name') ->required() ->visible(fn (Get $get): bool => $get('type') === 'business'),

Use Set $set inside ->afterStateUpdated() on a ->live() field to mutate another field reactively. Prefer ->live(onBlur: true) on text inputs to avoid per-keystroke updates:

use Filament\Schemas\Components\Utilities\Set; use Illuminate\Support\Str;

TextInput::make('title') ->required() ->live(onBlur: true) ->afterStateUpdated(fn (Set $set, ?string $state) => $set( 'slug', Str::slug($state ?? ''), )),

TextInput::make('slug') ->required(),

Compose layout by nesting Section and Grid. Children need explicit ->columnSpan() or ->columnSpanFull():

use Filament\Schemas\Components\Grid; use Filament\Schemas\Components\Section;

Section::make('Details') ->schema([ Grid::make(2)->schema([ TextInput::make('first_name') ->columnSpan(1), TextInput::make('last_name') ->columnSpan(1), TextInput::make('bio') ->columnSpanFull(), ]), ]),

Use Repeater for inline HasMany management. ->relationship() with no args binds to the relationship matching the field name:

use Filament\Forms\Components\Repeater;

Repeater::make('qualifications') ->relationship() ->schema([ TextInput::make('institution') ->required(), TextInput::make('qualification') ->required(), ]) ->columns(2),

Use state() with a Closure to compute derived column values:

use Filament\Tables\Columns\TextColumn;

TextColumn::make('full_name') ->state(fn (User $record): string => "{$record->first_name} {$record->last_name}"),

Use SelectFilter for enum or relationship filters, and Filter with a ->query() closure for custom logic:

use Filament\Tables\Filters\Filter; use Filament\Tables\Filters\SelectFilter; use Illuminate\Database\Eloquent\Builder;

SelectFilter::make('status') ->options(UserStatus::class),

SelectFilter::make('author') ->relationship('author', 'name'),

Filter::make('verified') ->query(fn (Builder $query) => $query->whereNotNull('email_verified_at')),

Actions are buttons that encapsulate optional modal forms and behavior:

use Filament\Actions\Action;

Action::make('updateEmail') ->schema([ TextInput::make('email') ->email() ->required(), ]) ->action(fn (array $data, User $record) => $record->update($data)),

Testing

Testing setup (requires pestphp/pest-plugin-livewire in composer.json):

• Always call $this->actingAs(User::factory()->create()) before testing panel functionality.
• For edit pages, pass ['record' => $user->id], use ->call('save') (not ->call('create')), and do not assert ->assertRedirect() (edit pages do not redirect after save).

use function Pest\Livewire\livewire;

livewire(ListUsers::class) ->assertCanSeeTableRecords($users) ->searchTable($users->first()->name) ->assertCanSeeTableRecords($users->take(1)) ->assertCanNotSeeTableRecords($users->skip(1));

use function Pest\Laravel\assertDatabaseHas;

livewire(CreateUser::class) ->fillForm([ 'name' => 'Test', 'email' => 'test@example.com', ]) ->call('create') ->assertNotified() ->assertHasNoFormErrors() ->assertRedirect();

assertDatabaseHas(User::class, [ 'name' => 'Test', 'email' => 'test@example.com', ]);

livewire(EditUser::class, ['record' => $user->id]) ->fillForm(['name' => 'Updated']) ->call('save') ->assertNotified() ->assertHasNoFormErrors();

assertDatabaseHas(User::class, [ 'id' => $user->id, 'name' => 'Updated', ]);

livewire(CreateUser::class) ->fillForm([ 'name' => null, 'email' => 'invalid-email', ]) ->call('create') ->assertHasFormErrors([ 'name' => 'required', 'email' => 'email', ]) ->assertNotNotified();

Use ->callAction(DeleteAction::class) for page actions, or ->callAction(TestAction::make('name')->table($record)) for table actions:

use Filament\Actions\Testing\TestAction;

livewire(ListUsers::class) ->callAction(TestAction::make('promote')->table($user), [ 'role' => 'admin', ]) ->assertNotified();

Correct Namespaces

• Form fields (TextInput, Select, Repeater, etc.): Filament\Forms\Components\
• Infolist entries (TextEntry, IconEntry, etc.): Filament\Infolists\Components\
• Layout components (Grid, Section, Fieldset, Tabs, Wizard, etc.): Filament\Schemas\Components\
• Schema utilities (Get, Set, etc.): Filament\Schemas\Components\Utilities\
• Table columns (TextColumn, IconColumn, etc.): Filament\Tables\Columns\
• Table filters (SelectFilter, Filter, etc.): Filament\Tables\Filters\
• Actions (DeleteAction, CreateAction, etc.): Filament\Actions\. Never use Filament\Tables\Actions\, Filament\Forms\Actions\, or any other sub-namespace for actions.
• Icons: Filament\Support\Icons\Heroicon enum (e.g., Heroicon::PencilSquare)

Common Mistakes

• Never assume public file visibility. File visibility is private by default. Always use ->visibility('public') when public access is needed.
• Never assume full-width layout. Grid, Section, Fieldset, and Repeater do not span all columns by default.
• Use Select::make('author_id')->relationship('author', 'name') for BelongsTo fields. BelongsToSelect does not exist in v4.
• Repeater uses ->schema(), not ->fields().
• Never add ->dehydrated(false) to fields that need to be saved. It strips the value from form state before ->action() or the save handler runs. Only use it for helper/UI-only fields.
• Use correct property types when overriding Page, Resource, and Widget properties. These properties have union types or changed modifiers that must be preserved:
  • $navigationIcon: protected static string | BackedEnum | null (not ?string)
  • $navigationGroup: protected static string | UnitEnum | null (not ?string)
  • $view: protected string (not protected static string) on Page and Widget classes

Testing (project-specific, not covered by Boost)

Never run the entire test suite. It's large and slow, and running it repeatedly (especially in the background) burns AI usage for no benefit. Always scope test runs to what you actually changed:

• Filter by test name: vendor/bin/pest --filter=testName or php artisan test --filter=testName.
• Or target the specific file(s): vendor/bin/pest tests/Feature/ExampleTest.php.
• If several files are plausibly affected, run each of those specific files/filters — do not fall back to a bare php artisan test / vendor/bin/pest with no scoping.
• Only run the full suite if the user explicitly asks for one (e.g. before a release, or to confirm a broad refactor didn't regress anything elsewhere).

Pre-PR Checklist (project-specific, not covered by Boost)

Before opening or finalizing a pull request in m3u-editor, both of the following are required, not optional:

1. Security scan — run composer security:scan (runs composer audit, npm audit --audit-level=high, and php artisan checkpoint:scan) and resolve or explicitly note any findings in the PR description. Do not open a PR with unaddressed high/critical findings.
2. Language files — if the change adds, removes, or edits any user-facing string (Blade views, Filament labels/notifications, validation messages, mail, etc.), update lang/en/*.php and lang/en.json accordingly. Then run php artisan lang:merge-conflicts before committing — lang files are alphabetically ordered, so any new key is likely to collide with concurrent PRs, and this command resolves and re-sorts them automatically. Run it even if you don't think you have a conflict yet; it's cheap and avoids a rebase headache later.

Project-specific skills

• filament-first (.claude/skills/filament-first/) — Filament-first UI rules for Blade views. This used to live under laravel-best-practices/rules/filament-first.md, but that directory is fully vendor-templated by Laravel Boost and gets overwritten on php artisan boost:update. Any new project-specific conventions should go in their own top-level skill directory under .claude/skills/, not inside laravel-best-practices/, for the same reason.
• pr-review-standards (.claude/skills/pr-review-standards/, also runnable as /pr-review [PR number | base-branch]) — project-specific PR review gates, applied alongside /code-review: memory-efficient queries (->cursor()/generators over unbounded ->all()/->get()), avoiding unnecessary complexity (no raw DB::statement() over the query builder, no new function where extending an existing one works, no duplicated logic where a shared Service/Filament Action exists — including stragglers a PR's own new helper should have replaced but didn't), framework-first UI (defers to filament-first, except explicitly-approved custom surfaces like the EPG Viewer and in-app player), no regressions (existing behavioral defaults anywhere in the app are opt-in to change, not silently altered — the Process* M3U/EPG import job chains and Sync* jobs get the most scrutiny as the flagship feature, but every feature area is in scope), and migration/schema safety (Postgres DDL like CREATE INDEX without CONCURRENTLY locking tables those job chains write to continuously).

Repo Architecture (project-specific, not covered by Boost)

• Filament admin panel plus a separate guest panel (app/Filament/GuestPanel/) with its own Resources/Pages/Widgets. Admin-panel query scoping does not automatically protect guest-panel routes.
• Scope both getEloquentQuery() and getGlobalSearchEloquentQuery() on a Resource — they run down separate code paths, so scoping one and not the other leaks records into global search. Canonical: app/Filament/Resources/DvrRecordings/DvrRecordingResource.php.
• Horizon supervisor dvr-queue (config/horizon.php) owns the dvr, dvr-post, and dvr-meta queues. Jobs dispatched onto these queues must stay on them; don't repurpose a queue name here without checking the supervisor config.
• The Xtream API surface is app/Http/Controllers/XtreamApiController.php (routed in routes/web.php as /player_api.php, /get.php, /xmltv.php), not a separate namespace or package.
• PRs target dev, not main/master.

High-Cost Gotchas (project-specific, not covered by Boost)

1. Bus::fake() (not Queue::fake()) is required to intercept dispatch() calls made from model event listeners — Queue::fake() alone won't catch them. Combine with Http::preventStrayRequests() in tests touching Playlist/DVR models. Canonical: tests/Feature/DvrRecordingDownloadTest.php.
2. Don't use Filament's Action::streamDownload() for files that can exceed ~1MB — it buffers and base64-encodes the whole file through Livewire. Instead point the action's ->url() at a dedicated route backed by a StreamedResponse controller. Canonical: app/Http/Controllers/DvrRecordingDownloadController.php.
3. Storage read/serve operations (resolveStorageDisk(), resolveMimeType(), downloadResponse()) belong on the model, not the controller — keeps the controller a thin auth-and-delegate layer. See app/Models/DvrRecording.php.
4. Controllers that use route-model binding still need an explicit ownership check (e.g. abort_unless($record->user_id === $request->user()->id, 403)) — Filament panel scoping does not extend to plain controllers.