- What is PsySH and how does it relate to Laravel Tinker?
- PsySH is a standalone, framework-agnostic PHP REPL and interactive debugger. In Laravel it is the engine underneath laravel/tinker, so when you run php artisan tinker you are using PsySH through a thin adapter. It can also be installed and run directly as a CLI tool.
- How do I install PsySH with Composer?
- For a Laravel app, install laravel/tinker as a dev dependency with composer require laravel/tinker --dev; Composer will pull in PsySH. For standalone use, run composer require psy/psysh --dev and launch vendor/bin/psysh. In production deployments, keep it in require-dev or omit dev dependencies entirely.
- Which Laravel versions support PsySH?
- PsySH itself is framework-agnostic and has no Laravel version constraint; Laravel compatibility comes from laravel/tinker and the PHP version it supports. Recent Laravel releases include Tinker by default, while older applications can add laravel/tinker and let Composer resolve a compatible PsySH. Always verify the resolved PsySH version with composer show psy/psysh rather than assuming Tinker's constraint is patched.
- Is PsySH safe to use in production?
- Treat PsySH as a development and debugging tool, not a production runtime dependency. Any exposed artisan tinker or custom PsySH console is a code-evaluation surface that can read data, call methods, and potentially exfiltrate secrets. Do not expose it to non-local environments beyond a tightly controlled admin group, and keep it patched.
- How do I embed a custom PsySH console inside a Laravel Artisan command?
- Embed PsySH by creating a Psy\Configuration, setting the bound object and data with setBoundObject and setData, then instantiating Psy\Shell and running it from an Artisan command. You can customize the banner, history path, commands, and completions without private APIs; Laravel Tinker is proof that this embedding model works inside Laravel's container. Keep custom commands narrowly scoped because they can become a data-exfiltration path.
- How do I fix CVE-2026-25129 in PsySH?
- CVE-2026-25129 is a CWD configuration-poisoning issue that affects PsySH versions before 0.12.19 and 0.11.23, including downstream consumers such as Tinker. Upgrade to at least those patched versions with composer update psy/psysh and confirm the resolved version. Restricted Mode and trustProject reduce the attack surface but do not remove the underlying design risk of discovering configuration from an untrusted working directory.
- Does PsySH support custom commands and tab completion?
- Yes. PsySH has a pluggable command system, so you can add Command subclasses to the shell, and it supports argument completions; CommandArgumentCompletionAware has been available since 0.12.22. Tab completion and syntax highlighting are core REPL features. Because PsySH is 0.x, re-test custom commands and completions on minor upgrades.
- How do I persist PsySH command history?
- PsySH supports persistent history and lets you configure the history file path through Psy\Configuration. Keep it on local developer machines or ephemeral container paths rather than shared volumes, because command history can contain secrets and production data. Disable or isolate history where multiple users share an environment.
- How should I test a PsySH integration in CI?
- Unit-test custom PsySH commands directly rather than driving the whole REPL, and use a pseudo-TTY only for integration tests that truly need terminal behavior. The experimental pure-PHP readline is opt-in and still seeking feedback, so avoid making it a CI requirement until it is the default. Pin PsySH versions and test across SSH, tmux, Windows, and CI terminal environments if you depend on the readline layer.
- What are alternatives to PsySH for Laravel REPL and debugging?
- laravel/tinker is not really an alternative; it is the Laravel wrapper around PsySH. For step debugging use Xdebug, and for application observability consider Laravel Telescope or Ray rather than exposing a REPL. If you need a support console or domain-specific shell, you can embed PsySH but should expect to replace most commands and own the 0.x churn.