Stop unknown plugin icon names from 500ing every page

[simonhamp]

Fixes Nightwatch issue #53 — InvalidArgumentException: Unable to locate a class or view for component [heroicon-o-image].

Root cause

plugins.icon_name is free text typed by developers — the "Heroicon name" input on the plugin Icon card. Show::updateIcon() only validated its shape (/^[a-z0-9-]+$/), never whether the icon actually exists. Views then rendered it as:

<x-dynamic-component :component="'heroicon-o-' . $plugin->icon_name" />

Blade resolves that alias at component-resolution time, so an unknown name throws InvalidArgumentException and 500s the entire page. The two names in the reports simply aren't Heroicons — it's photo, not image, and map-pin, not location. Once saved, a single bad row poisons every page that renders that plugin.

The blast radius was wider than the reported route: 10 render sites across 7 files, including the public plugin directory card, the public plugin listing, the cart, the Ultra index, the team page, and purchased plugins.

Changes

1. Render defensively — Plugin::getIconComponent() resolves the stored name through the blade-icons factory and falls back to heroicon-o-cube when it doesn't exist. All 10 call sites now use it. This is what recovers the rows already broken in production.
2. Stop the bad data at the door — Show::updateIcon() now rejects names that aren't real Heroicons, with a message pointing at heroicons.com.
3. Copy fix — the input hint read "e.g., cube, sparkles, bolt", which invites guessing. It now says to use the name exactly as it appears on heroicons.com, and includes photo/map-pin as examples.

The shape regex runs before the factory lookup, which also blocks the str_replace('.', '/') path traversal in blade-icons' file resolution (covered by a test).

Verification

New tests/Feature/PluginIconFallbackTest.php covers name validation, the render fallback, the four affected page types, and both validation branches on save.

I reverted the view changes and confirmed the tests reproduce the reported error verbatim — Unable to locate a class or view for component [heroicon-o-image]. — then restored and confirmed green. 82 tests across the plugin/cart/ultra/team suites pass. Pint clean.

Notes for review

• Existing bad rows are deliberately left as-is. They now render a cube instead of 500ing, and the owner gets a clear error next time they save the icon. Nulling them out in a migration would silently discard developer intent — happy to add one if you'd prefer.
• A longer-term option worth considering: replace the free-text input with a picker, so an invalid name is unrepresentable rather than merely rejected.
• Unrelated: php artisan test with a broad --filter OOMs at the default 128M CLI memory limit (dies in a Filament GridDirection.php). Not touched here.

🤖 Generated with Claude Code