From 06827847e5cc6f30a3d49f51df629c9061905e2a Mon Sep 17 00:00:00 2001
From: Kenneth Hough <kenneth@keyqcloud.com>
Date: Sun, 26 Apr 2026 01:49:00 -0500
Subject: [PATCH] Read version from Composer's runtime data, not hardcoded
 constants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous implementation pinned MAJOR/MINOR/PATCH to 4.1.1 and
required someone to manually bump the constants on every release.
Nobody did — every install reported v4.1.1 regardless of what composer
actually pulled. The MCP serverInfo handshake surfaced this on a v4.3.1
install during Phase 2 verification.

Read \Composer\InstalledVersions::getPrettyVersion('keyqcloud/kyte-php')
instead. Returns:
  - "v4.3.2" on a tagged install
  - "dev-master" / "dev-feature/..." on a branch install
  - "unknown" if composer's runtime data isn't present (raw git clone)

This is the standard Composer 2.x API for "what version of this
package is installed." Zero maintenance, correct result.

3 new tests in tests/VersionTest.php pin the new contract:
non-empty string return, parity with Composer\InstalledVersions,
guard against regression to the old hardcoded "v4.1.1" string.

34/34 unit tests green.

Pre-existing flake noted: tests/ModelTest.php seeds rows in TestTable
that don't get torn down between runs; rerunning phpunit against the
same mariadb container fails at line 285. Fresh container passes.
Worth adding tearDown logic when ModelTest is next touched. Not
addressed here (scope discipline).
---
 phpunit.xml.dist      |  1 +
 src/Core/Version.php  | 35 ++++++++++++++++++++++++++++++-----
 tests/VersionTest.php | 38 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 5 deletions(-)
 create mode 100644 tests/VersionTest.php

diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 446387c..256c0cb 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -8,6 +8,7 @@
       <file>tests/HmacSessionStrategyTest.php</file>
       <file>tests/ModelTest.php</file>
       <file>tests/SignatureTest.php</file>
+      <file>tests/VersionTest.php</file>
     </testsuite>
     <testsuite name="aws">
       <file>tests/AwsAcmTest.php</file>
diff --git a/src/Core/Version.php b/src/Core/Version.php
index 653c3ee..3c41dcc 100644
--- a/src/Core/Version.php
+++ b/src/Core/Version.php
@@ -1,14 +1,39 @@
 <?php
 namespace Kyte\Core;
 
+/**
+ * Reports the running kyte-php version.
+ *
+ * Reads Composer's runtime installed-package data via Composer\InstalledVersions
+ * (Composer 2.x API). Returns the pretty version string composer resolved:
+ *
+ *   - Tagged install:    "v4.3.2"
+ *   - Branch install:    "dev-master" / "dev-feature/phase-2-mcp-tokens"
+ *   - Dev tree (no composer registration): "unknown"
+ *
+ * Replaces the old hardcoded MAJOR/MINOR/PATCH constants, which went stale
+ * (v4.1.1 was reported on v4.3.x installs because nobody bumped the consts).
+ */
 class Version
 {
-    const MAJOR=4;
-    const MINOR=1;
-    const PATCH=1;
+    private const FALLBACK = 'unknown';
+    private const PACKAGE  = 'keyqcloud/kyte-php';
 
-    public static function get()
+    public static function get(): string
     {
-        return sprintf('v%s.%s.%s', self::MAJOR, self::MINOR, self::PATCH);
+        if (!class_exists(\Composer\InstalledVersions::class)) {
+            return self::FALLBACK;
+        }
+
+        try {
+            $version = \Composer\InstalledVersions::getPrettyVersion(self::PACKAGE);
+        } catch (\OutOfBoundsException $e) {
+            // Package not registered in Composer's runtime data — happens
+            // when running a dev tree that hasn't been composer-installed
+            // (e.g. directly from a git clone).
+            return self::FALLBACK;
+        }
+
+        return $version ?? self::FALLBACK;
     }
 }
diff --git a/tests/VersionTest.php b/tests/VersionTest.php
new file mode 100644
index 0000000..1d3841e
--- /dev/null
+++ b/tests/VersionTest.php
@@ -0,0 +1,38 @@
+<?php
+namespace Kyte\Test;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Characterization tests for Kyte\Core\Version::get().
+ *
+ * The previous implementation hardcoded MAJOR/MINOR/PATCH constants that
+ * were never bumped — every install reported v4.1.1 regardless of what
+ * composer actually pulled. v4.3.2 replaced that with a Composer\InstalledVersions
+ * lookup; these tests pin the new contract.
+ */
+class VersionTest extends TestCase
+{
+    public function testGetReturnsNonEmptyString(): void
+    {
+        $version = \Kyte\Core\Version::get();
+        $this->assertIsString($version);
+        $this->assertNotSame('', $version);
+    }
+
+    public function testGetReturnsComposerInstalledVersion(): void
+    {
+        // Composer's runtime data is always present in a composer-installed
+        // tree (which the test suite is). Confirm we surface its pretty
+        // version, not the FALLBACK.
+        $expected = \Composer\InstalledVersions::getPrettyVersion('keyqcloud/kyte-php');
+        $this->assertSame($expected, \Kyte\Core\Version::get());
+    }
+
+    public function testGetDoesNotReturnHardcodedLegacyString(): void
+    {
+        // Guard against a regression where someone reintroduces the
+        // pre-v4.3.2 hardcoded "v4.1.1" string.
+        $this->assertNotSame('v4.1.1', \Kyte\Core\Version::get());
+    }
+}