Laravel Vendor Cleanup Laravel Package

Getting Started

Install the package as a dev dependency and run the audit in read-only mode first:

composer require --dev leek/laravel-vendor-cleanup
php artisan vendor-cleanup --help

The package finds published vendor files in your app that can be removed or refreshed: unchanged copies, orphaned published files, and stale copies whose vendor source has moved on. Start with a narrow audit such as config and view, then expand once you trust the output.

If you use Laravel Boost, run php artisan boost:install and select leek/laravel-vendor-cleanup in the third-party picker. Boost does not install third-party skills automatically. Then run:

/vendor-cleanup-audit
/vendor-cleanup-audit config view

The Boost skill is read-only by default and verifies findings before reporting them. If you are upgrading from an earlier version, re-run boost:install or boost:update and keep the package selected so the new skill files replace the old ones.

Look first at the README’s Boost section for the picker step, and after installation at references/verification.md, which Boost installs alongside the skill.

Implementation Patterns

• Audit before deleting. Use the command’s JSON output as the source of truth for review or CI reporting. Do not pipe that directly into deletion in a shared environment.
• Use scoped runs for large apps. Audit one category at a time, for example config and view, and review each batch before moving on.
• Prefer git rm for selected files. The Boost skill deletes only files you choose, using git rm. Avoid the command’s --delete flag for normal cleanup because it removes everything the command reports as unchanged, not just the files you reviewed.
• Let the Boost skill drive interactive cleanup. In Claude Code it asks which verified files to delete, which orphans to remove, and whether to republish stale copies via AskUserQuestion; other agents get numbered questions. File-by-file verification is delegated to a Sonnet subagent in Claude Code, keeping the main conversation cheaper.
• Treat stale copies carefully. Republish only when the published file has no local changes. Republishing a locally modified file drops those changes; the skill intentionally refuses to suggest it in that case.
• Verify orphans before removal. Check references with grep and inspect git history. The skill performs these checks and labels anything that fails as “Not confirmed” instead of reporting it as fact.
• Clear caches after config cleanup. After deleting published config files, run php artisan config:clear and exercise the app so vendor defaults take over cleanly.

Gotchas and Tips

• --delete is the main footgun. It removes every file the audit reports as unchanged. Use the skill’s guided deletion or manually git rm only the files you verified.
• Migrations are off-limits. The skill never offers to delete migrations, even when they look orphaned. Treat migration history as permanent.
• Upgrade if you are on macOS or Windows. Before v0.13.0, case-insensitive filesystem matching could treat differently cased folders such as Symfony’s Config/ as config folders, producing false “missing” config findings like FileLocator.php. Folder names now must match exactly.
• Re-run Boost installation after upgrading. composer update leek/laravel-vendor-cleanup alone does not replace the installed skill files. Run php artisan boost:install or boost:update and keep the package selected.
• Boost before 2.8 rendered the skill badly. Older Boost versions treated # comment lines inside code blocks as headings and split the examples. v0.13.0 removes those lines and installs cleanly on Boost 2.x.
• Read-only is enforced by pre-approved tools, not by trust. The skill’s allowed-tools covers only the exact audit commands and a few read-only tools. Deletions go through your normal permission prompt; do not broadly loosen that configuration.
• Check references/verification.md when a finding looks wrong. Per-category verification steps live there, and the skill’s “Not confirmed” label is a signal to inspect both files, diff them, and grep for references before acting.

Upgrade path:

composer update leek/laravel-vendor-cleanup
php artisan boost:install