feat(plugin): guard Rust-owned classes the worker has no proxy for

The worker's autoloader fell through to the real Composer source for every
Rust-owned FQCN without a proxy stub, so plugin code doing `new Filesystem()`
or subclassing `LibraryInstaller` silently ran on a second instance the Rust
side never sees. An unimplemented part of the plugin API has to fail with an
explicit error naming it, not quietly work on a disconnected copy.

The stub generator now emits a guard class for each of those FQCNs: the real
declaration, hierarchy and constants, with every constructor and method
raising an explicit error. References satisfied by the declaration alone
(`instanceof`, `X::class`, `Link::TYPE_REQUIRE`) keep working. Two FQCNs stay
resolvable to the real class, each listed with the worker-side mechanism that
makes a natively constructed instance correct.

The error had nowhere to go: `Installer::run` dropped the `Result` of both
`dispatch_script` calls, so an exception from a listener ended in exit 0.
Both propagate now, the way the exception does upstream.

Three real-plugin E2E comparisons stop at a guard and are ignored, each
naming the class it needs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

5 files changed, 339 insertions, 0 deletions

diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Plugin/CommandEvent.php b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/CommandEvent.php
new file mode 100644
index 00000000..df84c294
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/CommandEvent.php
@@ -0,0 +1,36 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Plugin\CommandEvent.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Plugin;
+
+use Composer\EventDispatcher\Event;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class CommandEvent extends Event
+{
+    public function __construct(string $name, string $commandName, InputInterface $input, OutputInterface $output, array $args = [], array $flags = [])
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function getInput(): InputInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getInput');
+    }
+
+    public function getOutput(): OutputInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getOutput');
+    }
+
+    public function getCommandName(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getCommandName');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PluginManager.php b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PluginManager.php
new file mode 100644
index 00000000..857c740e
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PluginManager.php
@@ -0,0 +1,118 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Plugin\PluginManager.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Plugin;
+
+use Composer\Composer;
+use Composer\IO\IOInterface;
+use Composer\PartialComposer;
+use Composer\Package\PackageInterface;
+use Composer\Plugin\Capability\Capability;
+
+class PluginManager
+{
+    public function __construct(IOInterface $io, Composer $composer, ?PartialComposer $globalComposer = null, $disablePlugins = false)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function setRunningInGlobalDir(bool $runningInGlobalDir): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setRunningInGlobalDir');
+    }
+
+    public function loadInstalledPlugins(): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'loadInstalledPlugins');
+    }
+
+    public function deactivateInstalledPlugins(): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'deactivateInstalledPlugins');
+    }
+
+    public function getPlugins(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPlugins');
+    }
+
+    public function getRegisteredPlugins(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getRegisteredPlugins');
+    }
+
+    public function getGlobalComposer(): ?PartialComposer
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getGlobalComposer');
+    }
+
+    public function registerPackage(PackageInterface $package, bool $failOnMissingClasses = false, bool $isGlobalPlugin = false): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'registerPackage');
+    }
+
+    public function deactivatePackage(PackageInterface $package): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'deactivatePackage');
+    }
+
+    public function uninstallPackage(PackageInterface $package): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'uninstallPackage');
+    }
+
+    protected function getPluginApiVersion(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPluginApiVersion');
+    }
+
+    public function addPlugin(PluginInterface $plugin, bool $isGlobalPlugin = false, ?PackageInterface $sourcePackage = null): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'addPlugin');
+    }
+
+    public function removePlugin(PluginInterface $plugin): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'removePlugin');
+    }
+
+    public function uninstallPlugin(PluginInterface $plugin): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'uninstallPlugin');
+    }
+
+    protected function getCapabilityImplementationClassName(PluginInterface $plugin, string $capability): ?string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getCapabilityImplementationClassName');
+    }
+
+    public function getPluginCapability(PluginInterface $plugin, $capabilityClassName, array $ctorArgs = []): ?Capability
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPluginCapability');
+    }
+
+    public function getPluginCapabilities($capabilityClassName, array $ctorArgs = []): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPluginCapabilities');
+    }
+
+    public function arePluginsDisabled($type)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'arePluginsDisabled');
+    }
+
+    public function disablePlugins(): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'disablePlugins');
+    }
+
+    public function isPluginAllowed(string $package, bool $isGlobalPlugin, bool $optional = false, bool $prompt = true): bool
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'isPluginAllowed');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PostFileDownloadEvent.php b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PostFileDownloadEvent.php
new file mode 100644
index 00000000..c387767b
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PostFileDownloadEvent.php
@@ -0,0 +1,50 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Plugin\PostFileDownloadEvent.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Plugin;
+
+use Composer\EventDispatcher\Event;
+use Composer\Package\PackageInterface;
+
+class PostFileDownloadEvent extends Event
+{
+    public function __construct(string $name, ?string $fileName, ?string $checksum, string $url, string $type, $context = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function getFileName(): ?string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getFileName');
+    }
+
+    public function getChecksum(): ?string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getChecksum');
+    }
+
+    public function getUrl(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getUrl');
+    }
+
+    public function getContext()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getContext');
+    }
+
+    public function getPackage(): ?PackageInterface
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPackage');
+    }
+
+    public function getType(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getType');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PreFileDownloadEvent.php b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PreFileDownloadEvent.php
new file mode 100644
index 00000000..f1c53d99
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PreFileDownloadEvent.php
@@ -0,0 +1,65 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Plugin\PreFileDownloadEvent.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Plugin;
+
+use Composer\EventDispatcher\Event;
+use Composer\Util\HttpDownloader;
+
+class PreFileDownloadEvent extends Event
+{
+    public function __construct(string $name, HttpDownloader $httpDownloader, string $processedUrl, string $type, $context = null)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function getHttpDownloader(): HttpDownloader
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getHttpDownloader');
+    }
+
+    public function getProcessedUrl(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getProcessedUrl');
+    }
+
+    public function setProcessedUrl(string $processedUrl): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setProcessedUrl');
+    }
+
+    public function getCustomCacheKey(): ?string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getCustomCacheKey');
+    }
+
+    public function setCustomCacheKey(?string $customCacheKey): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setCustomCacheKey');
+    }
+
+    public function getType(): string
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getType');
+    }
+
+    public function getContext()
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getContext');
+    }
+
+    public function getTransportOptions(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getTransportOptions');
+    }
+
+    public function setTransportOptions(array $options): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setTransportOptions');
+    }
+}
diff --git a/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PrePoolCreateEvent.php b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PrePoolCreateEvent.php
new file mode 100644
index 00000000..537a777d
--- /dev/null
+++ b/crates/shirabe-php-rpc/php/guards/Composer/Plugin/PrePoolCreateEvent.php
@@ -0,0 +1,70 @@
+<?php
+
+// Generated by scripts/plugin-stub-generator; do not edit by hand.
+// Guard for Composer\Plugin\PrePoolCreateEvent.
+// The Rust side owns this class and the worker has no proxy for it, so this
+// declaration shadows the real one: the constants and the hierarchy stay, while
+// constructing it or calling anything on it raises an explicit error.
+
+namespace Composer\Plugin;
+
+use Composer\EventDispatcher\Event;
+use Composer\DependencyResolver\Request;
+
+class PrePoolCreateEvent extends Event
+{
+    public function __construct(string $name, array $repositories, Request $request, array $acceptableStabilities, array $stabilityFlags, array $rootAliases, array $rootReferences, array $packages, array $unacceptableFixedPackages)
+    {
+        \ShirabeUnsupportedClass::fail(self::class, '__construct');
+    }
+
+    public function getRepositories(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getRepositories');
+    }
+
+    public function getRequest(): Request
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getRequest');
+    }
+
+    public function getAcceptableStabilities(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getAcceptableStabilities');
+    }
+
+    public function getStabilityFlags(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getStabilityFlags');
+    }
+
+    public function getRootAliases(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getRootAliases');
+    }
+
+    public function getRootReferences(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getRootReferences');
+    }
+
+    public function getPackages(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getPackages');
+    }
+
+    public function getUnacceptableFixedPackages(): array
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'getUnacceptableFixedPackages');
+    }
+
+    public function setPackages(array $packages): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setPackages');
+    }
+
+    public function setUnacceptableFixedPackages(array $packages): void
+    {
+        \ShirabeUnsupportedClass::fail(self::class, 'setUnacceptableFixedPackages');
+    }
+}