router.php

<?php
// Used by `wp server` to route requests.

namespace WP_CLI\Router;

/**
 * This is a copy of WordPress's add_filter() function.
 *
 * We duplicate it because WordPress is not loaded yet.
 */
function add_filter( $tag, $function_to_add, $priority = 10, $accepted_args = 1 ) {
	global $wp_filter, $merged_filters;

	$idx = _wp_filter_build_unique_id( $tag, $function_to_add, $priority );

	// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
	$wp_filter[ $tag ][ $priority ][ $idx ] = array(
		'function'      => $function_to_add,
		'accepted_args' => $accepted_args,
	);
	unset( $merged_filters[ $tag ] );
	return true;
}

/**
 * This is a copy of WordPress's _wp_filter_build_unique_id() function.
 *
 * We duplicate it because WordPress is not loaded yet. It cannot use
 * `WP_CLI::add_wp_hook()` either, as this file is executed by PHP's built-in
 * web server in a separate process where WP-CLI is not loaded.
 */
function _wp_filter_build_unique_id( $tag, $callback, $priority ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed -- $priority retained to match core's _wp_filter_build_unique_id() signature.
	if ( is_string( $callback ) ) {
		return $callback;
	}

	if ( is_object( $callback ) ) {
		// Closures are currently implemented as objects
		return (string) spl_object_id( $callback );
	}

	if ( ! isset( $callback[1] ) || ! is_string( $callback[1] ) ) {
		return null;
	}

	if ( is_object( $callback[0] ) ) {
		// Object Class Calling
		return ( (string) spl_object_id( $callback[0] ) ) . $callback[1];
	} elseif ( is_string( $callback[0] ) ) {
		// Static Calling
		return $callback[0] . '::' . $callback[1];
	}

	return null;
}

function _get_full_host( $url ) {
	// phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url
	$parsed_url = parse_url( $url );

	$host = $parsed_url['host'];
	if ( isset( $parsed_url['port'] ) && 80 !== $parsed_url['port'] ) {
		$host .= ':' . $parsed_url['port'];
	}

	return $host;
}

// We need to trick WordPress into using the URL set by `wp server`, especially on multisite.
add_filter(
	'option_home',
	function ( $url ) {
		$GLOBALS['wpcli_server_original_url'] = $url;

		return 'http://' . $_SERVER['HTTP_HOST'];
	},
	20
);

add_filter(
	'option_siteurl',
	function ( $url ) {
		if ( ! isset( $GLOBALS['wpcli_server_original_url'] ) ) {
			get_option( 'home' );  // trigger the option_home filter
		}

		$home_url_host = _get_full_host( $GLOBALS['wpcli_server_original_url'] );
		$site_url_host = _get_full_host( $url );

		if ( $site_url_host === $home_url_host ) {
			$url = str_replace( $site_url_host, $_SERVER['HTTP_HOST'], $url );
		}

		$url = str_replace( 'https://', 'http://', $url );

		return $url;
	},
	20
);

add_filter( 'got_url_rewrite', '__return_true' );

if ( getenv( 'WPCLI_SERVER_ADAPT_SCHEME' ) ) {
	ob_start(
		static function ( $buffer ) {
			if ( ! isset( $GLOBALS['wpcli_server_original_url'] ) ) {
				return $buffer;
			}
			$original_host = _get_full_host( $GLOBALS['wpcli_server_original_url'] );
			return str_replace(
				'https://' . $original_host,
				'http://' . $_SERVER['HTTP_HOST'],
				$buffer
			);
		}
	);
}

$_SERVER['SERVER_ADDR'] = gethostbyname( $_SERVER['SERVER_NAME'] );
$wpcli_server_root      = $_SERVER['DOCUMENT_ROOT'];
// phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url
$wpcli_server_path = '/' . ltrim( parse_url( urldecode( $_SERVER['REQUEST_URI'] ) )['path'], '/' );

$wpcli_server_file = $wpcli_server_root . $wpcli_server_path;
// Normalize slashes for file operations
$wpcli_server_file = str_replace( array( '/', '\\' ), DIRECTORY_SEPARATOR, $wpcli_server_file );

$wpcli_server_real_root = realpath( $wpcli_server_root );
$wpcli_server_real_file = file_exists( $wpcli_server_file ) ? realpath( $wpcli_server_file ) : false;

$wpcli_server_is_inside_root = false;
if ( false !== $wpcli_server_real_root && false !== $wpcli_server_real_file ) {
	if ( $wpcli_server_real_file === $wpcli_server_real_root || 0 === strpos( $wpcli_server_real_file, rtrim( $wpcli_server_real_root, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR ) ) {
		$wpcli_server_is_inside_root = true;
	}
}

if ( $wpcli_server_is_inside_root ) {
	if ( is_dir( $wpcli_server_real_file ) && substr( $wpcli_server_path, -1 ) !== '/' ) {
		header( 'Location: ' . str_replace( array( "\r", "\n" ), '', $wpcli_server_path ) . '/' );
		exit;
	}

	// Check if this is a PHP file by examining the extension
	if ( 'php' === strtolower( pathinfo( $wpcli_server_real_file, PATHINFO_EXTENSION ) ) ) {
		// Set $_SERVER variables to mimic direct access to the PHP file
		$_SERVER['SCRIPT_NAME']     = $wpcli_server_path;
		$_SERVER['PHP_SELF']        = $wpcli_server_path;
		$_SERVER['SCRIPT_FILENAME'] = $wpcli_server_real_file;

		chdir( dirname( $wpcli_server_real_file ) );
		require_once $wpcli_server_real_file;
	} else {
		return false;
	}
} else {
	// File doesn't exist or is outside document root - route to index.php for pretty permalinks
	$_SERVER['SCRIPT_NAME']     = '/index.php';
	$_SERVER['PHP_SELF']        = '/index.php';
	$_SERVER['SCRIPT_FILENAME'] = $wpcli_server_root . DIRECTORY_SEPARATOR . 'index.php';
	$_SERVER['PATH_INFO']       = $wpcli_server_path; // Help WordPress parse request

	chdir( $wpcli_server_root );
	require_once 'index.php';
}