v0.29.5

docs/PHP_FPM.md

@@ -123,7 +123,7 @@ post_max_size = 64M
 max_execution_time = 30
 ```
 
-RustProxy validates the lines and combines them with newline separators into the FastCGI `PHP_VALUE` parameter. PHP-FPM/PHP still decides whether a directive is changeable at this scope. `PHP_ADMIN_VALUE` is intentionally not exposed. Control characters/newlines inside names or values are rejected.
+RustProxy validates the lines and combines them with newline separators into the FastCGI `PHP_VALUE` parameter. PHP-FPM/PHP still decides whether a directive is changeable at this scope. `PHP_ADMIN_VALUE` is available separately through the validated administrator INI overrides for trusted PHP-FPM endpoints. Control characters/newlines inside names or values are rejected.
 
 These custom parameters are stored as normal Web Service configuration. Do not put secrets there unless normal configuration storage is an acceptable location for them.
 
@@ -139,6 +139,35 @@ $uri/
 
 Existing static files/directories are used first. The final path becomes the fallback and can therefore reach `index.php`. This resolution remains inside the already-selected Web Service and does not introduce a second vhost router.
 
+## Roundcube 1.7 static.php / PATH_INFO (0.29.5)
+
+Roundcube serves CSS, JavaScript and images through URLs such as
+`/static.php/skins/elastic/styles/styles.min.css?s=123`. These paths are
+**PHP-FPM requests to the existing** `public_html/static.php` **script**, not
+static filesystem lookups. Configure the selected Web Service (or attached
+shared PHP-FPM profile) with `php.enabled: true`, `php.path_info: true`, and
+`php.extensions: ["php"]`. Point its root to the Roundcube `public_html` tree.
+
+You can keep the normal Web Service `try_files` (`$uri`, `$uri/`,
+`/index.php?$query_string`). RustProxy 0.29.5 resolves a valid PHP script plus
+PATH_INFO after security checks and rewrites, **before** falling back through
+`try_files`. No regex rewrite or extra Web Service is required for these URLs
+when the main vhost selects this Web Service.
+
+For `/static.php/skins/elastic/images/favicon.ico?s=123`, FastCGI receives:
+
+```text
+SCRIPT_NAME=/static.php
+SCRIPT_FILENAME=<document_root>/static.php
+PATH_INFO=/skins/elastic/images/favicon.ico
+REQUEST_URI=/static.php/skins/elastic/images/favicon.ico?s=123
+QUERY_STRING=s=123
+```
+
+PHP-FPM still needs filesystem access to `static.php` and the Roundcube
+installation outside `public_html` that script reads. The PHP `PATH_INFO`
+option is explicit and remains off by default for unrelated services.
+
 ## Bounded execution
 
 Each compiled Web Service owns a bounded PHP concurrency semaphore. `max_concurrent_requests` limits simultaneous FastCGI requests. RustProxy does not create an unbounded wait queue: if no execution slot is immediately available it returns `503 Service Unavailable` with `Retry-After`.

docs/TEST_REPORT.md

@@ -1,4 +1,12 @@
-# Verification report - RustProxy 0.29.4
+# Verification report - RustProxy 0.29.5
+
+## 0.29.5 Roundcube PHP PATH_INFO dispatch (2026-10-09)
+
+- Cause confirmed by source: `serve_inner` originally ran `try_files` before recognizing `/static.php/skins/...` as a PHP script plus `PATH_INFO`. For an existing `static.php`, the last `try_files` candidate `/index.php` intercepted the asset request and could return HTML instead of the asset.
+- Fixed dispatch order following rewrites and path ACLs; execute existing PHP PATH_INFO targets before `try_files`. Access restrictions also apply to the resolved PHP script path; the other fallback path remains protected.
+- Added `roundcube_static_php_path_info_runs_before_front_controller_try_files` and `without_php_path_info_try_files_keeps_legacy_front_controller_fallback` using a local test FastCGI server and decoded FastCGI params. These are source tests until run with Cargo, **not** validated against live PHP-FPM or Roundcube.
+- Operator action: ensure PHP-FPM PATH_INFO splitting enabled on the chosen Web Service / shared profile; keep `try_files` for the main service. No extra special-case URL rewrite is needed for Roundcube `static.php` URLs.
+- Static checks passed: `version_contracts.py`, `web_server_contracts.py`, `rust_module_contracts.py`, `docs_check.py`, `langs_check.py`, `web_service_ui_test.mjs`, and `release_smoke.py`. `./dev.sh test` exceeded the available execution limit while running broader static `check_source.py`. `cargo`/`rustc` are unavailable; the new Rust FastCGI tests were not executed and neither was a live Roundcube integration.
 
 ## 0.29.4 PHP-FPM profile toolbar shortcut (2026-10-09)
 
@@ -94,9 +102,9 @@ This source package is not certified for production deployment.
 
 Installer/update now installs /etc/logrotate.d/rustproxy using the recorded service user/group. Updates repair /etc/profile.d/rustproxy-path.sh rather than warning. logrotate uses copytruncate because RustProxy holds open log descriptors; some log records may be lost during truncate. Rust build and live Debian/systemd acceptance remain unverified in this environment.
 
-## Version identity (0.29.4 source release)
+## Version identity (0.29.5 source release)
 
-`Cargo.toml` package version is the canonical release identity (now 0.29.4). Rust uses `CARGO_PKG_VERSION` at build time; `build.rs` substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with `scripts/version.py`. Run `python3 tools/checks/version_contracts.py` to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending.
+`Cargo.toml` package version is the canonical release identity (now 0.29.5). Rust uses `CARGO_PKG_VERSION` at build time; `build.rs` substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with `scripts/version.py`. Run `python3 tools/checks/version_contracts.py` to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending.
 
 ## Shared PHP-FPM profiles and Web Server cache/transform/Host patch (0.29.4)