PHPackages                             be-framework/psalm-plugin - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Testing & Quality](/categories/testing)
4. /
5. be-framework/psalm-plugin

ActivePsalm-plugin[Testing & Quality](/categories/testing)

be-framework/psalm-plugin
=========================

Psalm plugin that detects Be Framework runtime errors at static-analysis time

1.x-dev(1mo ago)085[1 issues](https://github.com/be-framework/psalm-plugin/issues)[2 PRs](https://github.com/be-framework/psalm-plugin/pulls)1MITPHPPHP ^8.3

Since Jun 12Pushed 1mo agoCompare

[ Source](https://github.com/be-framework/psalm-plugin)[ Packagist](https://packagist.org/packages/be-framework/psalm-plugin)[ RSS](/packages/be-framework-psalm-plugin/feed)WikiDiscussions 1.x Synced 3w ago

READMEChangelogDependencies (6)Versions (3)Used By (1)

be-framework/psalm-plugin
=========================

[](#be-frameworkpsalm-plugin)

[![Test](https://github.com/be-framework/psalm-plugin/actions/workflows/test.yml/badge.svg)](https://github.com/be-framework/psalm-plugin/actions/workflows/test.yml)

Psalm plugin that detects [Be Framework](https://github.com/be-framework/Be.Framework) runtime errors at static-analysis time. It also teaches Psalm taint analysis that constructor parameters annotated with `Ray\InputQuery\Attribute\Input` are user-controlled input on configured root input classes.

What it detects
---------------

[](#what-it-detects)

### `MissingBeingParameterAttribute`

[](#missingbeingparameterattribute)

A Being class constructor parameter that lacks both `#[Input]` (`Ray\InputQuery\Attribute\Input`) and `#[Inject]` (`Ray\Di\Di\Inject`). At runtime this raises `Be\Framework\Exception\MissingParameterAttribute` from `BecomingArguments`.

```
final readonly class WeightLogged
{
    public function __construct(
        #[Input] public string $recordedAt,
        public StorageInterface $storage, // ← missing attribute, reported
    ) {}
}
```

A class is treated as a Being when its constructor declares at least one `#[Input]` parameter.

### `ConflictingBeingParameterAttribute`

[](#conflictingbeingparameterattribute)

A Being constructor parameter that carries **both** `#[Input]` and `#[Inject]`. At runtime this raises a conflict error from `BecomingArguments`.

```
public function __construct(
    #[Input, Inject] public StorageInterface $storage, // ← reported
) {}
```

### `InvalidValidateException`

[](#invalidvalidateexception)

A `#[Validate]` method that throws an exception not extending `\DomainException`. `Be\Framework\SemanticVariable\SemanticValidator` only catches `DomainException`, so other types silently bypass validation.

```
#[Validate]
public function validate(string $value): void
{
    if ($value === '') {
        throw new \RuntimeException('empty'); // ← reported
    }
}
```

Variable throws and ternary/match unions are resolved via Psalm's `NodeTypeProvider`. When the type cannot be resolved, the plugin stays silent (false-positive avoidance).

### `#[Input]` taint sources

[](#input-taint-sources)

When Psalm is run with `--taint-analysis`, only constructor parameters annotated with `Ray\InputQuery\Attribute\Input` on configured root input classes are treated as user-controlled input. `#[Inject]` parameters and unrelated variables are not tainted. Downstream input classes are not re-tainted after sanitization unless they are explicitly configured as sources.

Configure the first input classes in `psalm.xml`:

```

```

```
final readonly class ProfileInput
{
    public function __construct(
        #[Input] public string $name,
    ) {}

    public function render(): void
    {
        echo $this->name; // reported by Psalm as TaintedHtml
    }
}
```

Taint analysis is enabled separately from normal Psalm analysis:

```
vendor/bin/psalm --taint-analysis
```

There is a runnable demo in [`demo/`](demo/):

```
vendor/bin/psalm --config=demo/psalm.xml --taint-analysis --no-cache --no-progress
```

Installation
------------

[](#installation)

```
composer require --dev be-framework/psalm-plugin
```

Register the plugin in your `psalm.xml`:

```

```

Or use the Psalm plugin installer:

```
vendor/bin/psalm-plugin enable be-framework/psalm-plugin
```

Requirements
------------

[](#requirements)

- PHP 8.3+
- Psalm 6.x

Suppressing issues
------------------

[](#suppressing-issues)

Standard Psalm suppression works at the class or method level:

```
/** @psalm-suppress MissingBeingParameterAttribute */
final readonly class IntentionallyLoose
{
    // ...
}
```

License
-------

[](#license)

MIT

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance91

Actively maintained with recent releases

Popularity9

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity35

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

42d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/db4fc75ffc631168d0d7143b6f2c24b1534dfb921212bd851c026c5cbbb1344d?d=identicon)[koriym](/maintainers/koriym)

---

Top Contributors

[![koriym](https://avatars.githubusercontent.com/u/529021?v=4)](https://github.com/koriym "koriym (1 commits)")

---

Tags

static analysispsalmpsalm-pluginbe-framework

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/be-framework-psalm-plugin/health.svg)

```
[![Health](https://phpackages.com/badges/be-framework-psalm-plugin/health.svg)](https://phpackages.com/packages/be-framework-psalm-plugin)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3345.3M347](/packages/psalm-plugin-laravel)[vimeo/psalm

A static analysis tool for finding errors in PHP applications

5.9k82.2M8.0k](/packages/vimeo-psalm)[maglnet/composer-require-checker

CLI tool to analyze composer dependencies and verify that no unknown symbols are used in the sources of a package

1.0k12.4M911](/packages/maglnet-composer-require-checker)[laraveldaily/filacheck

Static analysis for Filament projects - detect deprecated patterns and code issues

12175.6k1](/packages/laraveldaily-filacheck)[weirdan/doctrine-psalm-plugin

Stubs to let Psalm understand Doctrine better

897.3M59](/packages/weirdan-doctrine-psalm-plugin)[savinmikhail/add_named_arguments_rector

Rector rule to add names to arguments for functions'/methods' calls

19100.7k5](/packages/savinmikhail-add-named-arguments-rector)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)