[Bug]: Project root resolves to TypePHP's own package directory with a custom vendor-dir, so auto-boot: false is ignored #109

Summary

With a custom Composer vendor-dir (here libs), a script whose working directory is not the project root makes Config::getProjectRoot() return TypePHP's own package directory (libs/typephp/typephp). The project's composer.json and typephp.php are then never read, so extra.typephp.auto-boot: false (#95) is ignored and TypePHP boots with default settings.

This is the normal case for a web app: the web server's cwd is public/, and tests are often run from a directory without composer.json.

Reproduction (needs a Composer project and a cwd, so no playground link)

composer.json

{
    "autoload": {"psr-4": {"App\\": "src/"}},
    "require": {"typephp/typephp": "0.11.3"},
    "config": {"vendor-dir": "libs"},
    "extra": {"typephp": {"auto-boot": false}}
}

public/index.php

<?php

declare(strict_types=1);

require __DIR__ . '/../libs/autoload.php';

use TypePHP\Internal\Util\Config;

echo 'cwd: ', getcwd(), PHP_EOL;
echo 'project root: ', Config::getProjectRoot(), PHP_EOL;
echo 'auto-boot: ', var_export(Config::isAutoBootEnabled(), true), PHP_EOL;

composer install
cd public && php index.php

Actual

cwd: /path/to/project/public
project root: /path/to/project/libs/typephp/typephp
auto-boot: true

Expected

cwd: /path/to/project/public
project root: /path/to/project
auto-boot: false

Controls

• Same project, run from the project root (php public/index.php): root /path/to/project, auto-boot: false. The cwd check finds composer.json.
• Default vendor dir (drop config.vendor-dir, require ../vendor/autoload.php), run from public/: root /path/to/project, auto-boot: false. The /vendor/ path heuristic finds it.
• Only custom vendor-dir + cwd outside the root fails: the /vendor/ heuristic does not match libs/, and the upward walk from TypePHP's own directory stops at its own composer.json first.

Versions

v0.11.3 and dev-main @ 4e4244e, PHP 8.3, opcache.enable_cli=0.

Context

Our app keeps Composer packages in a libs dir below a Dvsi/ folder with its own composer.json; tests run from the repository root and web requests from the public folder. We wanted TypePHP as a dev dependency with auto-boot: false and an explicit boot in the test job only, but from every one of those working directories it boots with defaults instead, so it would run in every local request.

A possible fix: when the cwd check fails, ask Composer itself. \Composer\InstalledVersions::getRootPackage()['install_path'] returns the root package path whatever the vendor-dir, and is available since Composer 2.0.