[Opathedane]

Summary

Targeted maintenance fix for confirmed WampServer discovery/assessment gaps reported against v2.8.1 (ASERVER2-style feedback). Not speculative feature expansion.

Root cause

1. Path inference only matched bare X.Y.Z directory segments. WampServer layouts use phpX.Y.Z (e.g. C:\wamp64\bin\php\php7.4.33\php.exe), so marker-free binaries stayed version-unknown and were skipped by patch posture.
2. Apache config roots omitted C:\wamp{,64}\bin\apache\*\conf, so Apache/mod_php inventory returned NOT_APPLICABLE on typical Wamp hosts.
3. php.ini well-known patterns listed C:\wamp\... but not C:\wamp64\bin\php\*\php.ini.
4. Executive/coverage messaging did not clearly separate verified binary metadata vs path-inferred vs unknown candidates, making directory-derived versions easy to over-read as confirmed installs.

Exact changes

• Extend VersionFromInstallPath to accept phpX.Y.Z and bare X.Y.Z; still emits install_path_version_segment → binary_path_inferred_version with PATH_INFERRED / MEDIUM (never verified-binary confidence; never active-HTTP attribution).
• Add bounded Apache globs: C:\wamp64\bin\apache\*\conf, C:\wamp\bin\apache\*\conf (filepath.Glob only; no recursive FS walk).
• Add C:\wamp64\bin\php\*\php.ini to well-known php.ini patterns; reuse existing parsers/coverage semantics.
• Report completeness: binary coverage counts (candidates / verified / path-inferred / unknown) in HTML executive card, CLI summary, binary_paths detail, verification gaps, and next steps. Schemas unchanged.
• Version remains 2.8.1 on this branch (no tag/publish).

Before / after (ASERVER2-style synthetic fixture)

Aspect	Before (v2.8.1)	After (this PR)
...\php\php7.4.33\php.exe (marker-free)	binary_path / version unknown; no EOL patch row	binary_path_inferred_version 7.4.33, provenance=path_inferred, confidence=MEDIUM
Patch posture	Often undetermined / incomplete for that install	LEGACY_VENDOR_VERIFICATION_REQUIRED with manual-verification language
Apache under wamp64\bin\apache\*\conf	apache_configuration NOT_APPLICABLE when only Wamp roots exist	Bounded discovery; handlers/modules as configured, not verified serving
php.ini under wamp64\bin\php\*	Missed by well-known patterns	Discovered as php_ini_candidate (not version/runtime authority)
Active web runtime	N/A / not verified	Still not Verified — config + path inference never upgrade to active HTTP runtime
Executive summary	Versions listed without provenance split	Explicit counts: verified vs path-inferred vs unknown; path-inferred flagged for manual verification

Regression covered by TestASERVER2WampStyleFixtureE2E and related tests in internal/audit/wamp_discovery_test.go.

Expected behavior on real ASERVER2 host

• Discover Wamp PHP trees named php7.4.33 (and siblings) under well-known globs already present in v2.8.1.
• Infer directory versions as path-inferred / MEDIUM when binaries lack embedded/PE markers; assess EOL/legacy review accordingly without claiming confirmed installation or proven CVE exposure from the directory name alone.
• Inventory Apache conf + php.ini under standard Wamp64 paths when accessible.
• Surface coverage completeness so operators can see what still needs manual verification (serving SAPI, binary metadata, vendor/LTS evidence).
• Does not execute PHP, does not prove which SAPI serves HTTP, does not replace host validation.

Remaining limitations

• Path-inferred versions are inventory leads only; PE/embedded markers remain preferred.
• Only standard Wamp layouts are added; custom drive letters / nonstandard roots still need --config-root / --deep-root / --php-ini.
• Apache Include depth and merge/IfModule/.htaccess simulation unchanged.
• Active HTTP SAPI verification remains NOT_IMPLEMENTED.

Test plan

• go test ./...
• go vet ./...
• go run ./cmd/php2shell doctor
• bash scripts/check-release-docs.sh
• bash scripts/build-windows-legacy.sh (MZ PE header OK)
• Positive/negative: php7.4.33, bare X.Y.Z, invalid/ambiguous names, marker-free fixtures, Apache/php.ini discovery, no false active-runtime, legacy messaging, HTML/CLI/CSV consistency
• CI matrix (Linux / Windows / macOS + legacy Windows build) on this PR

Recommendation

Recommend publishing as v2.8.2 after CI is green and maintainer approval — this is a validated correctness fix within maintenance scope.

Do not merge, tag, or publish without explicit approval.

Made with Cursor

[Opathedane]

Validation complete (ready for review)

Final commit: 75b077b0ce0e02f23d093eaff7195d0646a604b7

CI (run 40366766770)

Check	Result
test (ubuntu-24.04)	SUCCESS
test (windows-latest)	SUCCESS
test (macos-15-intel)	SUCCESS
Windows legacy (Go 1.20) cross-build	SUCCESS

Windows had failed on the first push (bd7fd3a) due to host c:\tools\php polluting the ASERVER2 fixture via scanConfigs. Fixed by hermetic isolation + Apache handler re-inventory skip.

Apache handler follow-up

Follow-up is legitimate when the handler binary is not already inventoried. When the same path was already discovered (well-known/PATH), Apache now skips re-adding binary evidence while still recording apache_php_handler_config. Result: one inventory row and one patch row per binary path; one install group for the php7.4.33 tree.

ASERVER2-style before/after (synthetic fixture)

Metric	Before (v2.8.1)	After (this PR)
PHP binary candidates	2 paths (marker-free)	2
Verified binary metadata	0	0
Path-inferred versions	0 (php7.4.33 not matched)	2 (7.4.33, MEDIUM)
Without comparable version	2	0
Patch / legacy review	Not assessed (no comparable version)	LEGACY_PHP_VENDOR_PATCH_VERIFICATION_REQUIRED — manual review
Active web runtime	Not verified	Still not Verified
Apache coverage (Wamp conf)	Often NOT_APPLICABLE	Handler/module/vhost config inventoried (configured ≠ serving)
php.ini under wamp64	Missed	Candidate observed

Compatibility

HTML / CLI / CSV / JSON / fleet summary fields preserved (schema=php2shell-assessment/v1). Discovery caps and offline/read-only behavior unchanged. No merge/tag/publish performed.