feat(plugin): guard Rust-owned classes the worker has no proxy for

The worker's autoloader fell through to the real Composer source for every
Rust-owned FQCN without a proxy stub, so plugin code doing `new Filesystem()`
or subclassing `LibraryInstaller` silently ran on a second instance the Rust
side never sees. An unimplemented part of the plugin API has to fail with an
explicit error naming it, not quietly work on a disconnected copy.

The stub generator now emits a guard class for each of those FQCNs: the real
declaration, hierarchy and constants, with every constructor and method
raising an explicit error. References satisfied by the declaration alone
(`instanceof`, `X::class`, `Link::TYPE_REQUIRE`) keep working. Two FQCNs stay
resolvable to the real class, each listed with the worker-side mechanism that
makes a natively constructed instance correct.

The error had nowhere to go: `Installer::run` dropped the `Result` of both
`dispatch_script` calls, so an exception from a listener ended in exit 0.
Both propagate now, the way the exception does upstream.

Three real-plugin E2E comparisons stop at a guard and are ignored, each
naming the class it needs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

6 files changed, 415 insertions, 0 deletions

diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Installer/BinaryInstaller.php b/crates/shirabe-php-rpc/php/guards/Composer/Installer/BinaryInstaller.php
new file mode 100644
index 00000000..084ba3ff
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Installer/BinaryInstaller.php
@@ -0,0 +1,66 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Installer\BinaryInstaller.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Installer;
+
+use Composer\IO\IOInterface;
+use Composer\Package\PackageInterface;
+use Composer\Util\Filesystem;
+
+class BinaryInstaller
+{
+    public function __construct(IOInterface $io, string $binDir, string $binCompat, ?Filesystem $filesystem = null, ?string $vendorDir = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function installBinaries(PackageInterface $package, string $installPath, bool $warnOnOverwrite = true): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'installBinaries');
+    }
+
+    public function removeBinaries(PackageInterface $package): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'removeBinaries');
+    }
+
+    public static function determineBinaryCaller(string $bin): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'determineBinaryCaller');
+    }
+
+    protected function getBinaries(PackageInterface $package): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getBinaries');
+    }
+
+    protected function installFullBinaries(string $binPath, string $link, string $bin, PackageInterface $package): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'installFullBinaries');
+    }
+
+    protected function installUnixyProxyBinaries(string $binPath, string $link): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'installUnixyProxyBinaries');
+    }
+
+    protected function initializeBinDir(): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'initializeBinDir');
+    }
+
+    protected function generateWindowsProxyCode(string $bin, string $link): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'generateWindowsProxyCode');
+    }
+
+    protected function generateUnixyProxyCode(string $bin, string $link): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'generateUnixyProxyCode');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Installer/InstallerEvent.php b/crates/shirabe-php-rpc/php/guards/Composer/Installer/InstallerEvent.php
new file mode 100644
index 00000000..f35bbccc
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Installer/InstallerEvent.php
@@ -0,0 +1,47 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Installer\InstallerEvent.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Installer;
+
+use Composer\Composer;
+use Composer\DependencyResolver\Transaction;
+use Composer\EventDispatcher\Event;
+use Composer\IO\IOInterface;
+
+class InstallerEvent extends Event
+{
+    public function __construct(string $eventName, Composer $composer, IOInterface $io, bool $devMode, bool $executeOperations, Transaction $transaction)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function getComposer(): Composer
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getComposer');
+    }
+
+    public function getIO(): IOInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getIO');
+    }
+
+    public function isDevMode(): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isDevMode');
+    }
+
+    public function isExecutingOperations(): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isExecutingOperations');
+    }
+
+    public function getTransaction(): ?Transaction
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getTransaction');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Installer/LibraryInstaller.php b/crates/shirabe-php-rpc/php/guards/Composer/Installer/LibraryInstaller.php
new file mode 100644
index 00000000..81d4a1fe
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Installer/LibraryInstaller.php
@@ -0,0 +1,104 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Installer\LibraryInstaller.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Installer;
+
+use Composer\IO\IOInterface;
+use Composer\PartialComposer;
+use Composer\Repository\InstalledRepositoryInterface;
+use Composer\Package\PackageInterface;
+use Composer\Util\Filesystem;
+use Composer\Downloader\DownloadManager;
+
+class LibraryInstaller implements InstallerInterface, BinaryPresenceInterface
+{
+    public function __construct(IOInterface $io, PartialComposer $composer, ?string $type = 'library', ?Filesystem $filesystem = null, ?BinaryInstaller $binaryInstaller = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function supports(string $packageType)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'supports');
+    }
+
+    public function isInstalled(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isInstalled');
+    }
+
+    public function download(PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'download');
+    }
+
+    public function prepare($type, PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'prepare');
+    }
+
+    public function cleanup($type, PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'cleanup');
+    }
+
+    public function install(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'install');
+    }
+
+    public function update(InstalledRepositoryInterface $repo, PackageInterface $initial, PackageInterface $target)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'update');
+    }
+
+    public function uninstall(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'uninstall');
+    }
+
+    public function getInstallPath(PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getInstallPath');
+    }
+
+    public function ensureBinariesPresence(PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'ensureBinariesPresence');
+    }
+
+    protected function getPackageBasePath(PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPackageBasePath');
+    }
+
+    protected function installCode(PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'installCode');
+    }
+
+    protected function updateCode(PackageInterface $initial, PackageInterface $target)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'updateCode');
+    }
+
+    protected function removeCode(PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'removeCode');
+    }
+
+    protected function initializeVendorDir()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'initializeVendorDir');
+    }
+
+    protected function getDownloadManager(): DownloadManager
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getDownloadManager');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Installer/MetapackageInstaller.php b/crates/shirabe-php-rpc/php/guards/Composer/Installer/MetapackageInstaller.php
new file mode 100644
index 00000000..fbaeaeb3
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Installer/MetapackageInstaller.php
@@ -0,0 +1,66 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Installer\MetapackageInstaller.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Installer;
+
+use Composer\Repository\InstalledRepositoryInterface;
+use Composer\Package\PackageInterface;
+use Composer\IO\IOInterface;
+
+class MetapackageInstaller implements InstallerInterface
+{
+    public function __construct(IOInterface $io)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function supports(string $packageType)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'supports');
+    }
+
+    public function isInstalled(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isInstalled');
+    }
+
+    public function download(PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'download');
+    }
+
+    public function prepare($type, PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'prepare');
+    }
+
+    public function cleanup($type, PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'cleanup');
+    }
+
+    public function install(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'install');
+    }
+
+    public function update(InstalledRepositoryInterface $repo, PackageInterface $initial, PackageInterface $target)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'update');
+    }
+
+    public function uninstall(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'uninstall');
+    }
+
+    public function getInstallPath(PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getInstallPath');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Installer/PluginInstaller.php b/crates/shirabe-php-rpc/php/guards/Composer/Installer/PluginInstaller.php
new file mode 100644
index 00000000..dc09803b
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Installer/PluginInstaller.php
@@ -0,0 +1,64 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Installer\PluginInstaller.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Installer;
+
+use Composer\IO\IOInterface;
+use Composer\PartialComposer;
+use Composer\Repository\InstalledRepositoryInterface;
+use Composer\Package\PackageInterface;
+use Composer\Plugin\PluginManager;
+use Composer\Util\Filesystem;
+
+class PluginInstaller extends LibraryInstaller
+{
+    public function __construct(IOInterface $io, PartialComposer $composer, ?Filesystem $fs = null, ?BinaryInstaller $binaryInstaller = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function supports(string $packageType)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'supports');
+    }
+
+    public function disablePlugins(): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'disablePlugins');
+    }
+
+    public function prepare($type, PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'prepare');
+    }
+
+    public function download(PackageInterface $package, ?PackageInterface $prevPackage = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'download');
+    }
+
+    public function install(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'install');
+    }
+
+    public function update(InstalledRepositoryInterface $repo, PackageInterface $initial, PackageInterface $target)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'update');
+    }
+
+    public function uninstall(InstalledRepositoryInterface $repo, PackageInterface $package)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'uninstall');
+    }
+
+    protected function getPluginManager(): PluginManager
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPluginManager');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Installer/ProjectInstaller.php b/crates/shirabe-php-rpc/php/guards/Composer/Installer/ProjectInstaller.php
new file mode 100644
index 00000000..50c7792e
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Installer/ProjectInstaller.php
@@ -0,0 +1,68 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Installer\ProjectInstaller.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Installer;
+
+use React\Promise\PromiseInterface;
+use Composer\Package\PackageInterface;
+use Composer\Downloader\DownloadManager;
+use Composer\Repository\InstalledRepositoryInterface;
+use Composer\Util\Filesystem;
+
+class ProjectInstaller implements InstallerInterface
+{
+    public function __construct(string $installPath, DownloadManager $dm, Filesystem $fs)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function supports(string $packageType): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'supports');
+    }
+
+    public function isInstalled(InstalledRepositoryInterface $repo, PackageInterface $package): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isInstalled');
+    }
+
+    public function download(PackageInterface $package, ?PackageInterface $prevPackage = null): ?PromiseInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'download');
+    }
+
+    public function prepare($type, PackageInterface $package, ?PackageInterface $prevPackage = null): ?PromiseInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'prepare');
+    }
+
+    public function cleanup($type, PackageInterface $package, ?PackageInterface $prevPackage = null): ?PromiseInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'cleanup');
+    }
+
+    public function install(InstalledRepositoryInterface $repo, PackageInterface $package): ?PromiseInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'install');
+    }
+
+    public function update(InstalledRepositoryInterface $repo, PackageInterface $initial, PackageInterface $target): ?PromiseInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'update');
+    }
+
+    public function uninstall(InstalledRepositoryInterface $repo, PackageInterface $package): ?PromiseInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'uninstall');
+    }
+
+    public function getInstallPath(PackageInterface $package): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getInstallPath');
+    }
+}