fix(php-rpc): unpack the runtime bundle under the cache dir

A worker whose PHP cannot read the bundle out of the executable gets it
from an unpacked copy, which went to a directory derived from
XDG_CACHE_HOME alone. That ignored COMPOSER_CACHE_DIR, COMPOSER_HOME and
the cache-dir setting, and put the files outside the directory clear-cache
and the platform conventions cover. The callers now pass Composer's
configured cache directory down to base_path().

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

6 files changed, 58 insertions, 36 deletions

diff --git a/crates/shirabe-php-rpc/src/composer_runtime.rs b/crates/shirabe-php-rpc/src/composer_runtime.rs
index db52b776..d5024fad 100644
--- a/crates/shirabe-php-rpc/src/composer_runtime.rs
+++ b/crates/shirabe-php-rpc/src/composer_runtime.rs
@@ -22,22 +22,24 @@ const OVERRIDE_ENV: &str = "SHIRABE_COMPOSER_PHP_DIR";
 
 /// The path the Composer PHP runtime's files sit under in the worker: the checkout `OVERRIDE_ENV`
 /// names, or else the bundle, either inside this executable or in the directory it was extracted
-/// to.
-pub fn base_path() -> anyhow::Result<String> {
+/// to. A bundle the worker cannot read in place is unpacked under `cache_dir`, Composer's cache
+/// directory; the process answers with the path it resolved first, so a later call's `cache_dir`
+/// no longer moves the runtime.
+pub fn base_path(cache_dir: &std::path::Path) -> anyhow::Result<String> {
     static BASE: std::sync::OnceLock<Result<String, String>> = std::sync::OnceLock::new();
-    BASE.get_or_init(|| resolve().map_err(|e| format!("{e:#}")))
+    BASE.get_or_init(|| resolve(cache_dir).map_err(|e| format!("{e:#}")))
         .clone()
         .map_err(|e| anyhow::anyhow!(e))
 }
 
-fn resolve() -> anyhow::Result<String> {
+fn resolve(cache_dir: &std::path::Path) -> anyhow::Result<String> {
     if let Some(directory) = override_directory()? {
         return path_to_string(directory);
     }
     if worker_opens_bundle()? {
         return Ok(format!("phar://{ALIAS}"));
     }
-    path_to_string(extract()?)
+    path_to_string(extract_into(&cache_dir.join("runtime"))?)
 }
 
 fn path_to_string(directory: std::path::PathBuf) -> anyhow::Result<String> {
@@ -129,12 +131,8 @@ impl LocalFile {
     }
 }
 
-/// Unpacks the bundle into a content-addressed directory, so that a worker that cannot read the
-/// bundle in place gets the same files from the filesystem.
-fn extract() -> anyhow::Result<std::path::PathBuf> {
-    extract_into(&cache_directory()?.join("shirabe").join("runtime"))
-}
-
+/// Unpacks the bundle into a content-addressed directory under `root`, so that a worker that
+/// cannot read the bundle in place gets the same files from the filesystem.
 fn extract_into(root: &std::path::Path) -> anyhow::Result<std::path::PathBuf> {
     let destination = root.join(BUNDLE_ID);
     if destination.is_dir() {
@@ -159,17 +157,6 @@ fn extract_into(root: &std::path::Path) -> anyhow::Result<std::path::PathBuf> {
     Ok(destination)
 }
 
-fn cache_directory() -> anyhow::Result<std::path::PathBuf> {
-    if let Some(directory) = std::env::var_os("XDG_CACHE_HOME")
-        && !directory.is_empty()
-    {
-        return Ok(std::path::PathBuf::from(directory));
-    }
-    let home = std::env::var_os("HOME")
-        .ok_or_else(|| anyhow::anyhow!("neither XDG_CACHE_HOME nor HOME is set"))?;
-    Ok(std::path::Path::new(&home).join(".cache"))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -212,7 +199,8 @@ mod tests {
             return;
         }
 
-        assert_eq!(base_path().unwrap(), format!("phar://{ALIAS}"));
+        let cache = tempfile::tempdir().unwrap();
+        assert_eq!(base_path(cache.path()).unwrap(), format!("phar://{ALIAS}"));
     }
 
     /// The other half of `base_path`: a worker whose PHP cannot open the bundle is handed the
diff --git a/crates/shirabe/src/console/application.rs b/crates/shirabe/src/console/application.rs
index 56947243..1c0f0560 100644
--- a/crates/shirabe/src/console/application.rs
+++ b/crates/shirabe/src/console/application.rs
@@ -2439,7 +2439,19 @@ impl ApplicationHandle {
                                     && crate::plugin::find_file_in_registered_loaders(&dummy_str)
                                         .is_some()
                                     && {
-                                        EventDispatcher::ensure_composer_php_runtime()?;
+                                        let cache_dir = match composer_opt {
+                                            Some(ref composer_handle) => {
+                                                crate::composer::composer_full(composer_handle)
+                                                    .get_config()
+                                                    .borrow()
+                                                    .get_str("cache-dir")?
+                                            }
+                                            None => Factory::create_config(Some(io.clone()), None)?
+                                                .get_str("cache-dir")?,
+                                        };
+                                        EventDispatcher::ensure_composer_php_runtime(
+                                            std::path::Path::new(&cache_dir),
+                                        )?;
                                         crate::plugin::php_class_query(
                                             "class_exists",
                                             vec![shirabe_php_rpc::PluginValue::string(
diff --git a/crates/shirabe/src/event_dispatcher/event_dispatcher.rs b/crates/shirabe/src/event_dispatcher/event_dispatcher.rs
index 1a03ad70..55d867b6 100644
--- a/crates/shirabe/src/event_dispatcher/event_dispatcher.rs
+++ b/crates/shirabe/src/event_dispatcher/event_dispatcher.rs
@@ -699,7 +699,13 @@ impl EventDispatcher {
                         // The user's command class extends Symfony's Command, so the child
                         // process needs the real symfony/console classes before it can even
                         // autoload the user class.
-                        Self::ensure_composer_php_runtime()?;
+                        let cache_dir = self
+                            .composer()
+                            .borrow_partial()
+                            .get_config()
+                            .borrow()
+                            .get_str("cache-dir")?;
+                        Self::ensure_composer_php_runtime(std::path::Path::new(&cache_dir))?;
                         if !self.php_runtime_bool(
                             "class_exists",
                             vec![PluginValue::string(class_name.clone())],
@@ -1565,8 +1571,8 @@ try {{
 
     /// Loads the Composer PHP runtime (symfony/console and friends) into the worker, needed
     /// before a `scripts` Command class can be autoloaded and hosted.
-    pub(crate) fn ensure_composer_php_runtime() -> anyhow::Result<()> {
-        let autoload = Self::composer_php_runtime_autoload()?;
+    pub(crate) fn ensure_composer_php_runtime(cache_dir: &std::path::Path) -> anyhow::Result<()> {
+        let autoload = Self::composer_php_runtime_autoload(cache_dir)?;
         unwrap_php_result(call_function(
             "__shirabe_require",
             vec![PluginValue::string(autoload)],
@@ -1577,15 +1583,15 @@ try {{
     /// For testing only: a test that never registers a plugin package still needs the Composer
     /// PHP runtime in the worker before a class of its own can implement a Composer interface
     /// there.
-    pub fn __ensure_composer_php_runtime() -> anyhow::Result<()> {
-        Self::ensure_composer_php_runtime()
+    pub fn __ensure_composer_php_runtime(cache_dir: &std::path::Path) -> anyhow::Result<()> {
+        Self::ensure_composer_php_runtime(cache_dir)
     }
 
     /// The `vendor/autoload.php` of the Composer PHP runtime.
-    fn composer_php_runtime_autoload() -> anyhow::Result<String> {
+    fn composer_php_runtime_autoload(cache_dir: &std::path::Path) -> anyhow::Result<String> {
         Ok(format!(
             "{}/vendor/autoload.php",
-            shirabe_php_rpc::composer_runtime::base_path()?
+            shirabe_php_rpc::composer_runtime::base_path(cache_dir)?
         ))
     }
 
diff --git a/crates/shirabe/src/plugin/plugin_manager.rs b/crates/shirabe/src/plugin/plugin_manager.rs
index 1d8e6192..75852348 100644
--- a/crates/shirabe/src/plugin/plugin_manager.rs
+++ b/crates/shirabe/src/plugin/plugin_manager.rs
@@ -405,7 +405,12 @@ impl PluginManager {
 
         // The plugin code runs in the PHP worker: load the Composer PHP runtime (contracts like
         // PluginInterface) and the reverse-RPC autoloader before touching plugin classes there.
-        EventDispatcher::ensure_composer_php_runtime()?;
+        let cache_dir = composer
+            .borrow()
+            .get_config()
+            .borrow()
+            .get_str("cache-dir")?;
+        EventDispatcher::ensure_composer_php_runtime(std::path::Path::new(&cache_dir))?;
         EventDispatcher::ensure_script_autoloader()?;
 
         if let Some(files) = map.get("files").and_then(|v| v.as_array()) {
diff --git a/crates/shirabe/tests/common/php_worker.rs b/crates/shirabe/tests/common/php_worker.rs
index af1b6b44..b432cb4f 100644
--- a/crates/shirabe/tests/common/php_worker.rs
+++ b/crates/shirabe/tests/common/php_worker.rs
@@ -25,9 +25,14 @@ pub fn lock_php_worker() -> std::sync::MutexGuard<'static, ()> {
 }
 
 /// Requires the Composer PHP runtime's `vendor/autoload.php` into the worker, which is what makes
-/// the real `Composer\` classes autoloadable there.
+/// the real `Composer\` classes autoloadable there. A worker whose PHP cannot read the runtime out
+/// of the test binary unpacks it under a cache directory of this test run, never the one the
+/// developer's own Composer uses.
 pub fn load_composer_php_runtime() {
-    shirabe::event_dispatcher::EventDispatcher::__ensure_composer_php_runtime().unwrap();
+    static CACHE: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
+    let cache = CACHE.get_or_init(|| tempfile::tempdir().expect("no cache directory for the test"));
+    shirabe::event_dispatcher::EventDispatcher::__ensure_composer_php_runtime(cache.path())
+        .unwrap();
 }
 
 /// Calls a static method in the worker, panicking on either failure lane.
diff --git a/crates/shirabe/tests/plugin/plugin_installer_test.rs b/crates/shirabe/tests/plugin/plugin_installer_test.rs
index 0e1f01ee..2a065cc5 100644
--- a/crates/shirabe/tests/plugin/plugin_installer_test.rs
+++ b/crates/shirabe/tests/plugin/plugin_installer_test.rs
@@ -58,6 +58,12 @@ pub(crate) fn lock_php_worker() -> std::sync::MutexGuard<'static, ()> {
         .unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
+fn load_composer_php_runtime() {
+    static CACHE: std::sync::OnceLock<TempDir> = std::sync::OnceLock::new();
+    let cache = CACHE.get_or_init(|| tempfile::tempdir().expect("no cache directory for the test"));
+    EventDispatcher::__ensure_composer_php_runtime(cache.path()).unwrap();
+}
+
 /// `__DIR__ . '/Fixtures'` of the upstream test class.
 fn fixtures_dir() -> String {
     let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
@@ -817,7 +823,7 @@ fn test_incapable_plugin_is_correctly_detected() {
 /// PHPUnit autoloads `Composer\Test\Plugin\Mock\Capability` from the Composer checkout; the
 /// worker resolves `Composer\` to `src/Composer` only, so the class file is loaded by path.
 fn load_mock_capability_class() {
-    EventDispatcher::__ensure_composer_php_runtime().unwrap();
+    load_composer_php_runtime();
     let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
         .join("../../composer/tests/Composer/Test/Plugin/Mock/Capability.php")
         .canonicalize()
@@ -1043,7 +1049,7 @@ fn test_querying_with_non_existing_or_wrong_capability_class_types_throws() {
     let _worker = lock_php_worker();
     // `new \stdClass($ctorArgs)` receives the plugin, whose proxy stub implements the real
     // PluginInterface in the child.
-    EventDispatcher::__ensure_composer_php_runtime().unwrap();
+    load_composer_php_runtime();
     for wrong_implementation_class_type in non_existing_or_invalid_implementation_class_types() {
         assert_querying_with_invalid_capability_class_name_throws(
             &PhpMixed::String(wrong_implementation_class_type.to_string()),