Features

Auto-fix

Sheath supports autofix for a focused set of rules where the edit can be expressed reliably in source text.

#Commands

Preview fixes before changing files, then apply the level you have reviewed:

# apply safe fixes

php artisan sheath:lint --fix



# preview safe fixes

php artisan sheath:lint --dry-run



# preview safe and dangerous fixes

php artisan sheath:lint --dry-run --dangerous



# apply safe and dangerous fixes

php artisan sheath:lint --fix --dangerous

#Safe vs Dangerous

Safe fixes add or rewrite markup in a way that should preserve behavior.

Dangerous fixes add, remove, or rewrite markup in ways that may change behavior, appearance, or interaction. They are never applied unless you opt in with --dangerous or --fix-dangerous.

When you use --fix and --dry-run together, Sheath uses dry-run mode. It calculates and reports fixes without changing files, then writes a notice to standard error.

#Repeated Passes

--fix re-lints after each pass and keeps going until the file stops changing, up to ten passes. Overlapping fixes are skipped. Sheath::fix() behaves identically.

#Fixing a Buffer

--stdin --fix writes the fixed source to standard output instead of a report. An editor integration can pipe a buffer to Sheath and read the updated source.

Get-Content resources/views/welcome.blade.php | php artisan sheath:lint --stdin --fix

The exit code still reflects what is left after fixing, so a run with unresolved findings does not report success. Use --dry-run instead when you want the findings rather than the source.

#Finding Available Fixes

The rule browser shows which rules support autofix. Actual fix availability can depend on the markup, so --dry-run is the most reliable way to see what Sheath can change in your files. A rule may report a finding without offering a fix when Blade expressions make the source rewrite ambiguous.

#Examples

#Missing Button Type

<!-- before -->

<button>Save</button>



<!-- after -->

<button type="button">Save</button>

#Missing CSRF Field

<!-- before -->

<form method="POST" action="/posts">

    <input type="text" name="title">

</form>



<!-- after -->

<form method="POST" action="/posts">

    @csrf

    <input type="text" name="title">

</form>

#Duplicate Classes

<!-- before -->

<div class="btn btn btn-primary">Save</div>



<!-- after -->

<div class="btn btn-primary">Save</div>

#Unsafe Window Opener

<!-- before -->

<a href="https://example.com" target="_blank" rel="opener">Docs</a>



<!-- after -->

<a href="https://example.com" target="_blank" rel="opener noopener">Docs</a>

#neverFix

If you want a rule to continue reporting but never autofix, add it to neverFix in config/sheath.php:

'neverFix' => [

    'best-practices-no-inline-styles',

    'security-no-inline-js',

],

#Recommended Workflow

Preview safe and dangerous fixes before applying changes, then review the diff:

php artisan sheath:lint --dry-run

php artisan sheath:lint --dry-run --dangerous

php artisan sheath:lint --fix

git diff

#See Also