feat(plugin): guard Rust-owned classes the worker has no proxy for

The worker's autoloader fell through to the real Composer source for every
Rust-owned FQCN without a proxy stub, so plugin code doing `new Filesystem()`
or subclassing `LibraryInstaller` silently ran on a second instance the Rust
side never sees. An unimplemented part of the plugin API has to fail with an
explicit error naming it, not quietly work on a disconnected copy.

The stub generator now emits a guard class for each of those FQCNs: the real
declaration, hierarchy and constants, with every constructor and method
raising an explicit error. References satisfied by the declaration alone
(`instanceof`, `X::class`, `Link::TYPE_REQUIRE`) keep working. Two FQCNs stay
resolvable to the real class, each listed with the worker-side mechanism that
makes a natively constructed instance correct.

The error had nowhere to go: `Installer::run` dropped the `Result` of both
`dispatch_script` calls, so an exception from a listener ended in exit 0.
Both propagate now, the way the exception does upstream.

Three real-plugin E2E comparisons stop at a guard and are ignored, each
naming the class it needs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

10 files changed, 422 insertions, 0 deletions

diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ArchivableFilesFinder.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ArchivableFilesFinder.php
new file mode 100644
index 00000000..be2ed91c
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ArchivableFilesFinder.php
@@ -0,0 +1,24 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Archiver\ArchivableFilesFinder.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Archiver;
+
+use FilterIterator;
+
+class ArchivableFilesFinder extends FilterIterator
+{
+    public function __construct(string $sources, array $excludes, bool $ignoreFilters = false)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function accept(): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'accept');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ArchiveManager.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ArchiveManager.php
new file mode 100644
index 00000000..97e9071b
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ArchiveManager.php
@@ -0,0 +1,51 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Archiver\ArchiveManager.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Archiver;
+
+use Composer\Downloader\DownloadManager;
+use Composer\Util\Loop;
+use Composer\Package\CompletePackageInterface;
+
+class ArchiveManager
+{
+    public function __construct(DownloadManager $downloadManager, Loop $loop)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function addArchiver(ArchiverInterface $archiver): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'addArchiver');
+    }
+
+    public function setOverwriteFiles(bool $overwriteFiles): self
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setOverwriteFiles');
+    }
+
+    public function getPackageFilenameParts(CompletePackageInterface $package): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPackageFilenameParts');
+    }
+
+    public function getPackageFilenameFromParts(array $parts): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPackageFilenameFromParts');
+    }
+
+    public function getPackageFilename(CompletePackageInterface $package): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPackageFilename');
+    }
+
+    public function archive(CompletePackageInterface $package, string $format, string $targetDir, ?string $fileName = null, bool $ignoreFilters = false): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'archive');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/PharArchiver.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/PharArchiver.php
new file mode 100644
index 00000000..71303caf
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/PharArchiver.php
@@ -0,0 +1,27 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Archiver\PharArchiver.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Archiver;
+
+class PharArchiver implements ArchiverInterface
+{
+    public function __construct()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function archive(string $sources, string $target, string $format, array $excludes = [], bool $ignoreFilters = false): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'archive');
+    }
+
+    public function supports(string $format, ?string $sourceType): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'supports');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ZipArchiver.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ZipArchiver.php
new file mode 100644
index 00000000..130ce74c
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Archiver/ZipArchiver.php
@@ -0,0 +1,27 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Archiver\ZipArchiver.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Archiver;
+
+class ZipArchiver implements ArchiverInterface
+{
+    public function __construct()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function archive(string $sources, string $target, string $format, array $excludes = [], bool $ignoreFilters = false): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'archive');
+    }
+
+    public function supports(string $format, ?string $sourceType): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'supports');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/ArrayLoader.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/ArrayLoader.php
new file mode 100644
index 00000000..4e37ad7f
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/ArrayLoader.php
@@ -0,0 +1,40 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Loader\ArrayLoader.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Loader;
+
+use Composer\Package\BasePackage;
+use Composer\Package\Version\VersionParser;
+
+class ArrayLoader implements LoaderInterface
+{
+    public function __construct(?VersionParser $parser = null, bool $loadOptions = false)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function load(array $config, string $class = 'Composer\Package\CompletePackage'): BasePackage
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'load');
+    }
+
+    public function loadPackages(array $versions): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'loadPackages');
+    }
+
+    public function parseLinks(string $source, string $sourceVersion, string $description, array $links): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'parseLinks');
+    }
+
+    public function getBranchAlias(array $config): ?string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getBranchAlias');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/RootPackageLoader.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/RootPackageLoader.php
new file mode 100644
index 00000000..3d2d3390
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/RootPackageLoader.php
@@ -0,0 +1,39 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Loader\RootPackageLoader.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Loader;
+
+use Composer\Package\BasePackage;
+use Composer\Config;
+use Composer\IO\IOInterface;
+use Composer\Package\Version\VersionGuesser;
+use Composer\Package\Version\VersionParser;
+use Composer\Repository\RepositoryManager;
+
+class RootPackageLoader extends ArrayLoader
+{
+    public function __construct(RepositoryManager $manager, Config $config, ?VersionParser $parser = null, ?VersionGuesser $versionGuesser = null, ?IOInterface $io = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function load(array $config, string $class = 'Composer\Package\RootPackage', ?string $cwd = null): BasePackage
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'load');
+    }
+
+    public static function extractStabilityFlags(array $requires, string $minimumStability, array $stabilityFlags): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'extractStabilityFlags');
+    }
+
+    public static function extractReferences(array $requires, array $references): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'extractReferences');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/ValidatingArrayLoader.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/ValidatingArrayLoader.php
new file mode 100644
index 00000000..c6f7af70
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Loader/ValidatingArrayLoader.php
@@ -0,0 +1,44 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Loader\ValidatingArrayLoader.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Loader;
+
+use Composer\Package\BasePackage;
+use Composer\Package\Version\VersionParser;
+
+class ValidatingArrayLoader implements LoaderInterface
+{
+    public const CHECK_ALL = 3;
+    public const CHECK_UNBOUND_CONSTRAINTS = 1;
+    public const CHECK_STRICT_CONSTRAINTS = 2;
+
+    public function __construct(LoaderInterface $loader, bool $strictName = true, ?VersionParser $parser = null, int $flags = 0)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function load(array $config, string $class = 'Composer\Package\CompletePackage'): BasePackage
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'load');
+    }
+
+    public function getWarnings(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getWarnings');
+    }
+
+    public function getErrors(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getErrors');
+    }
+
+    public static function hasPackageNamingError(string $name, bool $isLink = false): ?string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'hasPackageNamingError');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Locker.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Locker.php
new file mode 100644
index 00000000..4009f162
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Locker.php
@@ -0,0 +1,113 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Locker.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package;
+
+use Composer\Json\JsonFile;
+use Composer\Installer\InstallationManager;
+use Composer\Repository\LockArrayRepository;
+use Composer\Util\ProcessExecutor;
+use Composer\IO\IOInterface;
+
+class Locker
+{
+    public function __construct(IOInterface $io, JsonFile $lockFile, InstallationManager $installationManager, string $composerFileContents, ?ProcessExecutor $process = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function getJsonFile(): JsonFile
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getJsonFile');
+    }
+
+    public static function getContentHash(string $composerFileContents): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getContentHash');
+    }
+
+    public function isLocked(): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isLocked');
+    }
+
+    public function isFresh(): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isFresh');
+    }
+
+    public function getLockedRepository(bool $withDevReqs = false): LockArrayRepository
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getLockedRepository');
+    }
+
+    public function getDevPackageNames(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getDevPackageNames');
+    }
+
+    public function getPlatformRequirements(bool $withDevReqs = false): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPlatformRequirements');
+    }
+
+    public function getMinimumStability(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getMinimumStability');
+    }
+
+    public function getStabilityFlags(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getStabilityFlags');
+    }
+
+    public function getPreferStable(): ?bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPreferStable');
+    }
+
+    public function getPreferLowest(): ?bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPreferLowest');
+    }
+
+    public function getPlatformOverrides(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPlatformOverrides');
+    }
+
+    public function getAliases(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getAliases');
+    }
+
+    public function getPluginApi()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPluginApi');
+    }
+
+    public function getLockData(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getLockData');
+    }
+
+    public function setLockData(array $packages, ?array $devPackages, array $platformReqs, array $platformDevReqs, array $aliases, string $minimumStability, array $stabilityFlags, bool $preferStable, bool $preferLowest, array $platformOverrides, bool $write = true): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setLockData');
+    }
+
+    public function updateHash(JsonFile $composerJson, ?callable $dataProcessor = null): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'updateHash');
+    }
+
+    public function getMissingRequirementInfo(RootPackageInterface $package, bool $includeDev): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getMissingRequirementInfo');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Version/VersionBumper.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Version/VersionBumper.php
new file mode 100644
index 00000000..c9a4ae00
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Version/VersionBumper.php
@@ -0,0 +1,25 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Version\VersionBumper.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Version;
+
+use Composer\Package\PackageInterface;
+use Composer\Semver\Constraint\ConstraintInterface;
+
+class VersionBumper
+{
+    public function __construct()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function bumpRequirement(ConstraintInterface $constraint, PackageInterface $package): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'bumpRequirement');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Package/Version/VersionSelector.php b/crates/shirabe-php-rpc/php/guards/Composer/Package/Version/VersionSelector.php
new file mode 100644
index 00000000..2264073f
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Package/Version/VersionSelector.php
@@ -0,0 +1,32 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Package\Version\VersionSelector.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Package\Version;
+
+use Composer\IO\IOInterface;
+use Composer\Package\PackageInterface;
+use Composer\Repository\RepositorySet;
+use Composer\Repository\PlatformRepository;
+
+class VersionSelector
+{
+    public function __construct(RepositorySet $repositorySet, ?PlatformRepository $platformRepo = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function findBestCandidate(string $packageName, ?string $targetPackageVersion = null, string $preferredStability = 'stable', $platformRequirementFilter = null, int $repoSetFlags = 0, ?IOInterface $io = null, $showWarnings = true)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'findBestCandidate');
+    }
+
+    public function findRecommendedRequireVersion(PackageInterface $package): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'findRecommendedRequireVersion');
+    }
+}