fix(plugin): deprecation links and text, log routing, write-back references - #2939
Conversation
…rences Addresses the plugins-deprecation package of the 2026-06-09 framework review (refs di-packages:7, di-packages:10, di-packages:12, upgrade-docs:2, upgrade-docs:3, upgrade-docs:6). - Plugins.cfc plugin-load trace now logs to file=wheels (matching the symmetric PackageLoader entry) instead of polluting the security log. - All plugin deprecation messages now point at live versioned guide URLs (guides.wheels.dev/v4-0-0/...) instead of dead /docs/ paths, use present tense (deprecated as of 4.0, removed in 5.0), and describe the real remediation: packages installed under vendor/ via 'wheels packages add <name>'. The stale 'packages/ + vendor/ staging' phrasing in the CLI upgrade-check fix text is aligned too. - $invokeOnPluginLoad builds the onPluginLoad context with StructCopy instead of Duplicate: the Adobe CF workaround only needs a plain struct, and the deep clone's write-back replaced live application references (DI container, config struct) with stale copies, at O(application-size) cost per plugin. The full write-back loop is kept (not narrowed to new/changed keys) because re-assigning a shared reference is a no-op while Adobe CF copies arrays by value even in a shallow StructCopy, so changed-key detection is unreliable there. - $initializeMixins classifies components by dotted-path segment via ListFindNoCase instead of unanchored FindNoCase, so a model named app.models.ControllerStats no longer receives the controller mixins. - New shared Global.cfc $deprecated(feature, message, docUrl) helper: one policy (warn once per feature per application to wheels.log, register in application[appKey].deprecationWarnings) consumed by a new debug-panel Deprecations section. Plugins.cfc and the paginationLinks warning route through it. The MCP endpoint notice (protocol payload), the CommandBox upgrade command (separate runtime), and wheels.Test (adding new warnings is out of scope) intentionally keep their own surfaces. Verified locally on Lucee 7 + SQLite (worktree docker recipe): new specs fail on pre-fix code (RED) and pass post-fix; plugins*, global, view and events bundles green. CLI Module.cfc change is string-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Peter Amiri <peter@alurium.com>
![wheels-bot[bot]](https://avatars.githubusercontent.com/in/3657588?s=60&v=4){kind=small}
There was a problem hiding this comment.
Wheels Bot — Reviewer A
This PR correctly addresses six concrete bugs across the plugin subsystem — log routing to the wrong file, write-back reference leakage via Duplicate(application), mixin misclassification by unanchored substring, dead documentation URLs, stale/contradictory deprecation text, and inconsistent warning surfaces. Each individual fix is sound and well-explained. The new $deprecated() helper is a good design direction.
Two structural issues in the new helper mean its documented "warn once per feature per application" guarantee is not reliably upheld: the WriteLog call sits outside the registration try block, and the deprecation registry is modified without a lock. Neither crashes anything in production, but the per-request paginationLinks path is exposed to both failure modes under concurrent startup load. Requesting changes on those two points; the rest are comments or nits.
Correctness
vendor/wheels/Global.cfc:2987 — WriteLog fires outside the registration block
The docblock states "the first call for a given feature logs a warning … subsequent calls … are no-ops." The return inside the dedup loop correctly exits the whole function (CFML return exits from inside a try), so duplicate calls are skipped. But WriteLog is placed after the catch, not inside the if (StructKeyExists(application, local.appKey)) block:
} catch (any e) {
// Registration is best-effort; never let a deprecation notice break the caller.
}
local.text = "[Wheels] Deprecation: " & arguments.message; // always reached when return didn't fire
...
WriteLog(type = "warning", text = local.text, file = "wheels");When StructKeyExists(application, local.appKey) is false the if block is skipped entirely, nothing is registered, and execution falls straight through to WriteLog. On every subsequent call the same thing happens because the dedup array was never populated — the guarantee is fully broken for that lifetime.
The fix is to move WriteLog inside the try block, immediately after ArrayAppend, wrapped in its own inner try/catch:
ArrayAppend(application[local.appKey].deprecationWarnings, {
feature = arguments.feature,
message = arguments.message,
url = arguments.docUrl
});
try {
local.text = "[Wheels] Deprecation: " & arguments.message;
if (Len(arguments.docUrl)) { local.text &= " See: " & arguments.docUrl; }
WriteLog(type = "warning", text = local.text, file = "wheels");
} catch (any e) {}This makes WriteLog fire if-and-only-if registration just succeeded. The "best-effort" comment then accurately describes the combined block rather than only the registration half.
vendor/wheels/Global.cfc:2972 — no cflock on the deprecationWarnings read/modify/write
The dedup loop (read) and ArrayAppend (write) are unguarded. For plugin-load calls this is benign because application init is effectively single-threaded. But paginationLinks() uses a per-request short-circuit flag (request.wheels.$paginationLinksDeprecationLogged) — each request starts with a fresh request scope. Two concurrent first-time callers will both find "paginationLinks" absent, both append, and both log, doubling the entries:
// wrap the dedup loop + ArrayAppend:
cflock(name="wheels_deprecated_#arguments.feature#", type="exclusive", timeout=5) {
for (local.existing in application[local.appKey].deprecationWarnings) {
if (local.existing.feature == arguments.feature) { return; }
}
ArrayAppend(application[local.appKey].deprecationWarnings, {...});
}A feature-scoped lock name avoids serialising unrelated features. An app-wide lock ("wheels_deprecated_registry") also works and is simpler if contention is not a concern.
Conventions
vendor/wheels/Plugins.cfc:172 — mixin-only warning written to two separate registries
ArrayAppend(variables.$class.deprecationWarnings, { // legacy per-instance array
plugin = local.pluginKey,
message = local.warning
});
$deprecated( // new application-scope registry
feature = "plugins:mixin-only:#local.pluginKey#",
...
);Both appends are retained with no comment. If the legacy variables.$class.deprecationWarnings array is still read by external callers (e.g., tooling or tests inspecting PluginObj.getDeprecationWarnings()) keeping both is intentional backward-compat — a brief inline comment to that effect would prevent future readers from treating it as a copy-paste artifact. If nothing reads the old array any more, the ArrayAppend line is redundant.
Cross-engine
No new concerns beyond those acknowledged in the PR. ListFindNoCase with a multi-character delimiter string ("./\") is standard portable CFML on all target engines. The StructCopy rationale (Adobe CF copies arrays by value even in a shallow copy) is correctly documented inline. $deprecated is public with a $ prefix, satisfying mixin invariant 7.
Tests
vendor/wheels/tests/specs/pluginsModernSpec.cfc ~line 194 — cleanup not guarded against mid-test failure
The new test sets up application.$wheelstestSharedRef at the top of the it() body and removes it at the bottom. If any assertion fires before cleanup, application.$wheelstestSharedRef leaks into subsequent tests. The surrounding suite uses afterEach for teardown; consider a matching beforeEach/afterEach pair or a try/finally around the assertion block.
Cross-engine claim about StructCopy + Adobe CF arrays is untested
The inline comment and PR body state that "Adobe CF copies arrays by value even in a shallow StructCopy" — why the full write-back loop must be retained. The new test exercises a struct value ({value = "original"}), not an array, so this specific Adobe CF corner case is not covered. Acceptable as a defensive comment, but flagging that it is unverified by the suite.
Docs
vendor/wheels/events/onrequestend/debug.cfm:413 — hardcodes application.wheels vs $deprecated()'s dynamic $appKey()
$appKey() returns "wheels" by default but "$wheels" when application.$wheels exists (Global.cfc:2945). $deprecated() stores under application[$appKey()]; the debug panel reads from application.wheels. For the common default-key case these are identical; for a $wheels-keyed app the panel would silently show nothing. The rest of the debug panel uses application.wheels throughout (a pre-existing pattern), so this is a latent rather than new inconsistency, but it is worth resolving here since the new section introduces it.
No CHANGELOG entry — deliberately omitted per PR body ("consolidated at campaign end"). Acceptable.
Wheels Bot — Reviewer B (round 1)A's review is well-grounded: both correctness findings are real, every cited line was verified against the diff, and the conventions / test observations are accurate. One small nuance on the fix direction for finding 1, and one missed test concern. Overall I'm aligned with A's SycophancyNone detected. A opened with a fair summary, labelled each finding clearly, and did not approve despite two unresolved structural issues in production-path code. False positivesNone detected.
Missed issuesOne test observation A did not raise:
var state = {hadOriginalWarnings: false, originalWarnings: []}
beforeEach(() => {
state.hadOriginalWarnings = StructKeyExists(application.wheels, "deprecationWarnings")
if (state.hadOriginalWarnings) { state.originalWarnings = application.wheels.deprecationWarnings }
application.wheels.deprecationWarnings = []
})
afterEach(() => {
if (state.hadOriginalWarnings) {
application.wheels.deprecationWarnings = state.originalWarnings
} else {
StructDelete(application.wheels, "deprecationWarnings")
}
})Non-blocking for the correctness fixes A requested, but worth addressing in the same pass since the CI matrix includes Lucee 7 where closure scoping has changed. Verdict alignment
ConvergenceAligned with A. The two correctness items (WriteLog outside registration block, missing cflock) are real and should be fixed before merge. My additional finding (test closure variable carrier) is a non-blocking quality improvement worth bundling in the same fix pass. Joint recommendation: request changes on A's two items plus the closure-scoping test fix. |
…-gated log Address wheels-bot review on #2939: - Global.cfc: wrap the deprecation registry read/append in an exclusive app-wide lock and move the WriteLog inside the registration block so the log fires if-and-only-if a feature was just registered; when the Wheels application struct is absent the helper is now a silent no-op instead of logging on every call. - Plugins.cfc: comment the intentional dual registration (per-instance getDeprecationWarnings() surface vs app-wide $deprecated()). - debug.cfm: document why application.wheels (not $appKey()) is correct in the Deprecations panel (application.$wheels is init-transient and is reassigned by reference to application.wheels at the end of onapplicationstart). - deprecatedHelperSpec: share beforeEach/afterEach state through a carrier struct (anti-pattern 10) instead of bare unscoped names. - pluginsModernSpec: guard the shared-reference test cleanup with try/finally so a failing assertion cannot leak application keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Peter Amiri <peter@alurium.com>
Wheels Bot — Address Review (round 1)Applied consensus findings from Reviewer A and Reviewer B's
Skipped:
Local test re-run: the
The new commit will trigger a fresh Reviewer A run on the updated SHA. Convergence loop continues until reviewers align on |
|
Addressed the review in 8c97f0b. Blocking 1 — WriteLog outside the registration block (Global.cfc): Fixed as proposed. Blocking 2 — no cflock (Global.cfc): Fixed with the app-wide lock variant the review blessed ( Conventions — dual registry (Plugins.cfc:172): Intentional. The per-instance array feeds the public Tests — pluginsModernSpec cleanup: Wrapped the assertion block in Tests — StructCopy + Adobe arrays: Acknowledged, left as documented-only (as the review allowed). A reference-identity assertion on an array would legitimately diverge per engine — fail on Adobe (copy-by-value), pass on Lucee — so no single cross-engine-stable spec can pin it without per-engine forks. Docs — debug.cfm Reviewer B's missed issue — deprecatedHelperSpec closure scoping: Fixed with the suggested carrier struct ( Verification (Lucee 7 + SQLite, worktree docker single-bundle recipe): |
…logging Resolves the cli/lucli/Module.cfc conflict between this PR's U3 deprecation fix-text modernization (#2939) and develop's #2941 breaker-scan restructure, composing both sides: - Keep #2941's structure in the 2.x->3.x checks block: the dead app/plugins directory check is replaced by the targetMajor<4-gated root plugins check, and the test-base-class grep is broadened to both quote styles plus the wheels.Testbox shim. - Apply #2939's modernized remediation text ("Migrate plugins to packages installed under vendor/ (wheels packages add <name>)") to the surviving gated check, replacing the stale "activation model" wording. CHANGELOG.md required no resolution (identical to develop). The wheels_deprecated_registry app-wide lock and the registration-gated WriteLog in Global.cfc::$deprecated survive the merge unchanged. Verified locally (Lucee 7 + SQLite, docker dir-only mount): global (123), plugins bundles (85), cli.UpgradeCheckCoverageSpec (16), view (579), events (36) — all pass, 0 fail, 0 error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Peter Amiri <peter@alurium.com>
There was a problem hiding this comment.
Wheels Bot — Reviewer A
This revision addresses both correctness findings from the previous CHANGES_REQUESTED review at e4b5bf94f: WriteLog is now inside the locked registration block (fires if-and-only-if ArrayAppend just succeeded), and the exclusive cflock(name="wheels_deprecated_registry") serializes the dedup read, append, and log write atomically. The StructCopy + retained write-back rationale is sound, the ListFindNoCase mixin-classification fix is correct, the dual-registry comment was added as requested, the pluginsModernSpec.cfc new test uses try/finally for cleanup, and deprecatedHelperSpec.cfc uses the approved carrier-struct pattern with an explicit cross-reference to CLAUDE.md anti-pattern 10. No correctness, cross-engine, or security issues remain. Commenting (not approving) on two minor convention inconsistencies in the new spec file and one misleading sentence in the PR description.
Conventions
vendor/wheels/tests/specs/pluginsMixinClassificationSpec.cfc ~lines 12–24 — bare unscoped originalMixins shared across sibling closures
beforeEach(() => {
originalMixins = application.wheels.mixins // unscoped write
...
})
afterEach(() => {
application.wheels.mixins = originalMixins // unscoped read
})deprecatedHelperSpec.cfc (same PR, same commit) carries an explicit comment — "sibling closures (beforeEach/afterEach) must not share state through bare unscoped names (CLAUDE.md anti-pattern 10)" — and uses the carrier-struct pattern for exactly the same beforeEach/afterEach teardown shape. In practice the bare name resolves to the declaring component's variables scope on Lucee/Adobe/BoxLang so it works, but the inconsistency within the same PR is a maintenance hazard and contradicts the companion spec's own documentation. Apply the same pattern:
var state = {originalMixins: {}}
beforeEach(() => {
state.originalMixins = application.wheels.mixins
application.wheels.mixins = {
controller = {"$wheelstestClassificationProbe" = "controller"},
model = {"$wheelstestClassificationProbe" = "model"}
}
})
afterEach(() => {
application.wheels.mixins = state.originalMixins
})vendor/wheels/tests/specs/pluginsMixinClassificationSpec.cfc ~lines 32, 48 — new wheels.Plugins() runs the full plugin-loading constructor as a side effect
new wheels.Plugins().$initializeMixins(scopeStruct)new wheels.Plugins() calls init(), which calls $checkPluginsDeprecation() → $deprecated(feature="plugins-directory", ...). Under the now-correct locking logic, that appends to application.wheels.deprecationWarnings (once, silently). The mixin-classification spec never restores deprecationWarnings, so those entries accumulate across both it() blocks and persist into subsequent spec files. CreateObject skips init() entirely and isolates the function under test:
CreateObject("component", "wheels.Plugins").$initializeMixins(scopeStruct)$initializeMixins only reads application.wheels.mixins (mocked in beforeEach) and calls GetMetadata(variablesScope.this) — it does not require the Plugins instance to be initialised.
Docs
PR description misrepresents the previous review verdict
The PR body states "Reviewer verdict: approve, no blocking items (reviewed at e4b5bf9)." The wheels-bot review at that SHA was submitted as CHANGES_REQUESTED, not approve. Human reviewers scanning the description before reading the bot reviews would see a false approval claim. Please correct this sentence.
Wheels Bot — Reviewer B (round 1)A's review is clean. All three findings check out against the actual diff. No sycophancy, no false positives. Converging on changes-needed: the two spec findings are small but real enough to fix before merge, and the PR description correction takes seconds. SycophancyNone detected. A correctly stayed in COMMENTED state rather than approving, despite the substantive portions of the PR being sound. False positivesNone detected. Verified each claim:
Missed issuesNone detected. The other patterns worth a second look hold up:
Verdict alignmentA's COMMENTED state is consistent with the findings: all three items are real but non-blocking in production code (two are test hygiene, one is a doc string). Declining to approve is correct; these are addressable before merge. ConvergenceAligned. A's two spec findings are actionable (apply carrier-struct to |
- vendor/wheels/tests/specs/pluginsMixinClassificationSpec.cfc: apply carrier-struct pattern (CLAUDE.md anti-pattern 10) for beforeEach/afterEach state sharing — mirrors deprecatedHelperSpec.cfc - vendor/wheels/tests/specs/pluginsMixinClassificationSpec.cfc: replace 'new wheels.Plugins().$initializeMixins(...)' with CreateObject(...) to skip init() and stop $checkPluginsDeprecation from leaking entries into application.wheels.deprecationWarnings across this spec (and into subsequent specs) - PR description: corrected previous-verdict statement (CHANGES_REQUESTED at e4b5bf9, addressed in 8c97f0b) Signed-off-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Wheels Bot — Address Review (round 2)Applied consensus findings from Reviewer A and Reviewer B's convergence (round 1 at
Local test re-run: the
The new commit will trigger a fresh Reviewer A run on the updated SHA. Convergence loop continues until reviewers align on |
|
Confirming the three follow-up review nits are addressed as of
Independently verified locally (Lucee 7 + SQLite, single-bundle runs in a clean worktree of this branch): |
There was a problem hiding this comment.
Wheels Bot — Reviewer A
This round-3 commit addresses all three findings from the round-2 comment at 3d998ff9b: pluginsMixinClassificationSpec.cfc now uses the carrier-struct pattern (matching the companion deprecatedHelperSpec.cfc), both it() blocks use CreateObject to avoid init() side-effects on the deprecation-warnings registry, and the PR description no longer claims an approval that was never issued. No correctness, cross-engine, or security issues remain. Commenting on one minor style nit only.
Conventions
vendor/wheels/tests/specs/pluginsModernSpec.cfc ~line 170 — unscoped originalPluginComponentPath and PluginObj in the new it() block
it("keeps live application references intact after onPluginLoad", function() {
originalPluginComponentPath = application.wheels.pluginComponentPath
...
PluginObj = $pluginObj(config)Both go to the component's variables scope rather than being declared with var. Within a single it() closure this is safe — the assignments and all reads are in the same closure body, so there is no cross-closure sharing hazard (unlike the beforeEach/afterEach sibling case that was fixed in round 2). The pattern is also consistent with every other it() block in this file. No change required; flagging because a reader comparing this block with the carrier-struct comments in the companion specs will notice the apparent inconsistency and may wonder if it was an oversight.
Tests
All four spec files use WheelsTest BDD and extend wheels.WheelsTest — no legacy RocketUnit. Coverage is solid:
deprecatedHelperSpec.cfc— happy path, dedup, distinct-features, and lazy-init cases all covered;beforeEach/afterEachcorrectly restore thedeprecationWarningsarray via the carrier struct.pluginsMixinClassificationSpec.cfc— carrier struct added per round 2;CreateObjectused in bothit()blocks, skipping theinit()side-effect that appended toapplication.wheels.deprecationWarnings. TheControllerStatsmis-classification regression is pinned.pluginsDeprecationMessagingSpec.cfc— source-scan guards without comment-stripping. For "must-not-contain" guards this is intentionally strict: a commented-out stale URL would still fail the test, which is the correct behavior for a regression pin. Not a violation of CLAUDE.md anti-pattern 14 (which is about false positives from commented code, not false negatives from intentional exclusion pins).pluginsModernSpec.cfcextension —try/finallycleanup and the shallow-copy reference-identity invariant are well-tested. The test correctly distinguishes the oldDuplicate(application)behavior (forked reference) fromStructCopy(application)(shared reference) on Lucee 7; the CI compat matrix covers Adobe CF and BoxLang.
Docs
The inline HTML comment in debug.cfm (application.wheels (not $appKey()) is correct here) directly addresses the round-1 finding about the debug panel reading from a hardcoded key. The explanation is accurate: application.$wheels is the init-time working struct, and its final line reassigns the same reference to application.wheels — so all entries registered by $deprecated() during init are visible under application.wheels by the time any onRequestEnd runs.
Wheels Bot — Reviewer B (round 1)A's review is clean. The diff is internally consistent, cross-engine concerns are addressed, and A's single style nit (unscoped vars in the new SycophancyNone detected. A correctly chose COMMENTED rather than APPROVED for a PR that touches False positivesNone detected. A's defense of the source-scan tests in Missed issuesOne minor item A didn't call out: the per-request short-circuit guard in Verdict alignmentCOMMENTED is the correct verdict. A has one style nit that does not require changes, and the PR touches the DI subsystem, so human approval is the right gate. Consistent with the findings. ConvergenceAligned. No correctness, cross-engine, or security issues remain. A's single nit is non-blocking. The PR is review-clean for this SHA and ready for a human approver. Joint recommendation: approve once a human has reviewed the DI-subsystem changes in |
originalPluginComponentPath and PluginObj in the onPluginLoad reference-identity spec now use var declarations, removing the apparent inconsistency with the carrier-struct siblings that round 3 flagged as reader-confusing (intra-closure use, so behavior is unchanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Peter Amiri <peter@alurium.com>
There was a problem hiding this comment.
Wheels Bot — Reviewer A
This round-4 commit (39fb631a2) resolves the single outstanding item from the round-3 comment at 8c0a2d4af: originalPluginComponentPath and PluginObj in the "keeps live application references intact after onPluginLoad" block of pluginsModernSpec.cfc now carry explicit var declarations, matching the style of the carrier-struct siblings and removing the reader-confusion hazard that was flagged. No production code is touched. All correctness, cross-engine, convention, and security findings from the three prior rounds remain resolved.
Tests
The placement of the two declarations is correct:
var originalPluginComponentPathsits at the top of theit()body, before thetryblock — it is therefore in scope in thefinallybranch that reads it (application.wheels.pluginComponentPath = originalPluginComponentPath). Declaring it insidetrywould still compile (CFMLvaris function-scoped, not block-scoped), but the current placement is clearer about its required lifetime.var PluginObjsits inside thetryblock. It is only used within thattrybody, so function-scoped placement there is fine. There is no reference toPluginObjafter thetry/finallyexits.
Neither declaration touches a catch body, so BoxLang anti-pattern 11 (local.X = ... inside catch is discarded on exit) does not apply. The finally block has no loops, so Lucee 7 anti-pattern 12 (for (local.i = ...) in finally miscompiles) does not apply.
Commits
test(plugin): var-scope spec locals flagged in Reviewer A round 3 — type test (allowed list), scope plugin (short noun), header 66 chars (≤ 100), sentence-case. DCO Signed-off-by present and matches the author identity.
Wheels Bot — Reviewer B (round 1)A's review is clean. The commit is a 2-line change (both adding SycophancyNone detected. A cited specific line placements and explicitly verified all relevant cross-engine anti-patterns (BoxLang #11, Lucee 7 #12) before approving. False positivesNone detected.
Missed issuesNone detected. The change is test-only and trivially small. Prior rounds covered all production-code concerns (DI write-back, locking, mixin classification, deprecation routing). Nothing in this commit reopens any of those. Verdict alignmentAPPROVED is consistent with the findings. The prior B round on ConvergenceAligned. No outstanding issues. Joint recommendation: the PR is review-clean and ready for human final sign-off on the DI-subsystem changes in |
…ntegration-and-refle Resolves the CHANGELOG.md conflict by integrating the PR's entry as a new "### Performance" subsection inside develop's populated "## [Unreleased]" section (discarding the PR hunk's malformed single-hash "# [Unreleased]" header). vendor/wheels/Global.cfc auto-merged cleanly: develop's sibling changes since the merge base (#2933 cache culls + $objectFileName struct memoization, #2939 $deprecated registry, #2912/#2943 provider isolation + mixin-collision helpers, staticRoutes clear in $lockedLoadRoutes) touch regions orthogonal to this PR's $cachedModelLookup/$cachedControllerLookup helpers and the model()/controller() fast paths; both sides' semantics verified to survive — the fast path reads the same application.wheels.models/controllers structs that develop's unchanged $cachedModelClassExists/$createModelClass write. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Peter Amiri <peter@alurium.com>
1 participant
Summary
Finalizes the plugins-deprecation package from the 2026-06-09 framework review (wave 2). Six findings across the legacy plugin subsystem and its deprecation messaging: plugin-load tracing no longer pollutes the security log,
$invokeOnPluginLoadno longer replaces liveapplicationreferences (DI container, config) with stale deep clones, mixin classification matches dotted-path segments instead of substrings, all plugin deprecation messages point at live versioned guide URLs with accurate present-tense text and the real remediation (wheels packages add <name>), and a new shared$deprecated()helper unifies the warn-once policy with a debug-panel consumer.Reviewer history:
CHANGES_REQUESTEDate4b5bf94f(WriteLog outside the registration block + missingcflockon the dedup registry); both addressed in8c97f0b54and confirmed resolved by Reviewer A's follow-up at3d998ff9b.Findings addressed
wheels.log@vendor/wheels/Plugins.cfc:143-147—file="wheels_security"→file="wheels", matching the symmetricPackageLoader.cfcentry; zerowheels_securityrefs remain inPlugins.cfc.$invokeOnPluginLoadwrite-back replacesapplication.wheelsdi/application.wo/application.$wheelswith deep clones @vendor/wheels/Plugins.cfc:724—Duplicate(application)→StructCopy(application)(the Adobe CF context-struct workaround only needs a plain struct). Live DI/config references now survive; the full write-back loop is deliberately retained because same-ref reassignment is a no-op while Adobe CF copies arrays by value even under shallowStructCopy, making changed-key detection unreliable there (documented inline).$initializeMixinsclassifies components by substring match on the dotted path @vendor/wheels/Plugins.cfc:866-876— unanchoredFindNoCase("controllers", fullname)→ dotted-segmentListFindNoCase, with controllers checked before tests so thewheels.tests._assetsfixtures stay honest. A model namedapp.models.ControllerStatsno longer receives the controller mixin set.vendor/wheels/Plugins.cfc:179, 250, 617— dead/docs/...paths replaced with live versioned URLs (https://guides.wheels.dev/v4-0-0/upgrading/3x-to-4x/,https://guides.wheels.dev/v4-0-0/digging-deeper/packages/); both map to real pages underweb/sites/guides/src/content/docs/v4-0-0/.Plugins.cfcand the upgrade-check fix text @vendor/wheels/Plugins.cfc:176-180, 614-618+cli/lucli/Module.cfc:4102, 4121— future-tense "will be deprecated" and the abandoned "move to packages/ and copy to vendor/" staging design replaced with "deprecated as of 4.0, removed in 5.0" and the shipped remediation: packages installed undervendor/viawheels packages add <name>.vendor/wheels/Global.cfc:2965($deprecated(feature, message, docUrl)) — one policy: warn once per feature per application towheels.log, register inapplication[appKey].deprecationWarnings(try/catch best-effort), consumed by a new guarded + HTML-encoded debug-panel Deprecations section (vendor/wheels/events/onrequestend/debug.cfm:412-430).Plugins.cfc:176, 614and thepaginationLinkswarning (vendor/wheels/view/links.cfc:240) route through it. The MCP endpoint notice (protocol payload), the CommandBox upgrade command (separate runtime), andwheels.Testintentionally keep their own surfaces.Findings verified already-fixed
None — staleRefs checks confirmed all six findings were still live on
origin/developbefore this branch:wheels_securitypresent at developvendor/wheels/Plugins.cfc:146(DI7 live)."Migrate to packages/ + vendor/ activation model"/"Migrate to packages/ + vendor/ system"fix text present at developcli/lucli/Module.cfc:4102and:4121— the report's:4015citation was a line offset, not a stale finding; both real sites updated.Source
Internal multi-agent framework review 2026-06-09, wave 2, package plugins-deprecation (refs di-packages:7, di-packages:10, di-packages:12, upgrade-docs:2, upgrade-docs:3, upgrade-docs:6).
Tests
New/updated specs (core suite, WheelsTest BDD):
vendor/wheels/tests/specs/global/deprecatedHelperSpec.cfc—$deprecated()logs once per feature, registers indeprecationWarnings, dedupes on repeat calls.vendor/wheels/tests/specs/pluginsMixinClassificationSpec.cfc— dotted-segment classification, incl. theapp.models.ControllerStatsregression (fixtures undervendor/wheels/tests/_assets/mixins_classification/).vendor/wheels/tests/specs/pluginsDeprecationMessagingSpec.cfc— source-scan pins: live guide URLs, no future-tense/staging text, nowheels_securityanywhere inPlugins.cfc(intentionally broad regression pin).vendor/wheels/tests/specs/pluginsModernSpec.cfc— extended for theStructCopycontext behavior.Local verification (Lucee 7 + SQLite via the worktree-safe docker single-bundle recipe): both behavioral specs RED-verified against pre-fix code and green post-fix;
plugins*,global,view, andeventsbundles green. Thecli/lucli/Module.cfcchange is string-only. CI runs the full engine x DB matrix as the real gate.Cross-engine notes
$deprecatedispublicwith$prefix (mixin invariant 7 — private mixins are not integrated on Lucee/Adobe); the bare call inlinks.cfcresolves becauseControllerextendswheels.Global.application" workaround;$installPluginLoadAPIinjects only a closure, which theIsCustomFunctionwrite-back guard skips.attributeCollection, no inline-closure constructor args, noLeft(str, 0), no reserved-scope parameter names in the diff.pluginsMixinClassificationSpecrelies onGetMetadataomittingdisplayNamefor undeclared components — verified on Lucee 7; Adobe/BoxLang behavior is gated by the CI compat matrix (the production framework already depends on the same semantics).Changelog
Entry deliberately omitted; consolidated at campaign end.
🤖 Generated with Claude Code