Only insert at the first occurrence of the placement anchor - #66

Fixes wp-cli/config-command#231.

Problem

WPConfigTransformer::add() replaced the placement anchor using str_replace():

$contents = str_replace( $anchor, $new_src, $this->wp_config_src );

str_replace() replaces every occurrence. So if the anchor string appears more than once in wp-config.php — e.g. a /* That's all, stop editing! */ line duplicated by a provisioning script, a copy/paste edit, or a merged config fragment — wp config add / wp config set inserted the define() once per occurrence, and WordPress then emitted Constant XXX already defined notices.

Running wp config add FOO bar against such a file produced:

define( 'DB_NAME', 'test_db' );

define( 'FOO', 'bar' );
/* That's all, stop editing! Happy publishing. */

define( 'WP_DEBUG', false );

define( 'FOO', 'bar' );
/* That's all, stop editing! Happy publishing. */

Fix

Reuse the offset from the anchor lookup that add() already performs, and replace only that one occurrence with substr_replace():

$anchor_pos = strpos( $this->wp_config_src, $anchor );

if ( false === $anchor_pos ) {
	throw new Exception( 'Unable to locate placement anchor.' );
}

// Only replace the first occurrence, in case the anchor appears more than once.
$contents = substr_replace( $this->wp_config_src, $new_src, $anchor_pos, strlen( $anchor ) );

The config is now inserted exactly once, at the first occurrence, for both before and after placement. Behavior is unchanged for the common single-anchor case, for the EOF anchor, and for a missing anchor (which still throws Unable to locate placement anchor.).

Tests

New tests/DuplicateAnchorTest.php builds a wp-config.php whose anchor comment appears twice and covers:

• adding a constant inserts it exactly once and leaves both anchor comments intact
• adding a variable inserts it exactly once and leaves both anchor comments intact
• before placement lands at the first anchor, not the last
• after placement lands at the first anchor and inserts once
• an anchor that is not present still throws

The three duplication assertions fail against main and pass with this change, so they guard the regression rather than passing either way.

Note: this only affects add(). update() matches on the existing config source rather than the anchor, so it was not affected.

Follow-up

wp-cli/config-command pins wp-cli/wp-config-transformer: ^1.4.0, so config-command picks this up once a new release is tagged; no change is needed there.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NU3fkN1bbTGQXuTFWBsBcr