feat(plugin): guard Rust-owned classes the worker has no proxy for

The worker's autoloader fell through to the real Composer source for every
Rust-owned FQCN without a proxy stub, so plugin code doing `new Filesystem()`
or subclassing `LibraryInstaller` silently ran on a second instance the Rust
side never sees. An unimplemented part of the plugin API has to fail with an
explicit error naming it, not quietly work on a disconnected copy.

The stub generator now emits a guard class for each of those FQCNs: the real
declaration, hierarchy and constants, with every constructor and method
raising an explicit error. References satisfied by the declaration alone
(`instanceof`, `X::class`, `Link::TYPE_REQUIRE`) keep working. Two FQCNs stay
resolvable to the real class, each listed with the worker-side mechanism that
makes a natively constructed instance correct.

The error had nowhere to go: `Installer::run` dropped the `Result` of both
`dispatch_script` calls, so an exception from a listener ended in exit 0.
Both propagate now, the way the exception does upstream.

Three real-plugin E2E comparisons stop at a guard and are ignored, each
naming the class it needs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 18 insertions, 4 deletions

diff --git a/crates/shirabe-php-rpc/src/lib.rs b/crates/shirabe-php-rpc/src/lib.rs
index 34c3961d..d818b364 100644
--- a/crates/shirabe-php-rpc/src/lib.rs
+++ b/crates/shirabe-php-rpc/src/lib.rs
@@ -1035,6 +1035,13 @@ const RUNTIME_FILES: &[(&str, &str)] = &[
     ),
 ];
 
+/// Guard classes made autoloadable inside the worker, behind the stubs: they shadow the real
+/// Composer class of every Rust-owned FQCN no stub proxies, so the worker cannot fall through to
+/// the real implementation and run an instance the Rust side never sees. Generated by
+/// `scripts/plugin-stub-generator/generate-stubs`; too many to spell out here, so `build.rs`
+/// builds the list from the directory itself.
+const GUARD_FILES: &[(&str, &str)] = include!(concat!(env!("OUT_DIR"), "/guard-files.rs"));
+
 struct Worker {
     stream: UnixStream,
     // Also queried for its exit status when a socket read/write fails, to tell a dead worker
@@ -1106,9 +1113,15 @@ fn spawn_worker() -> anyhow::Result<Worker> {
     std::fs::write(&script_path, GLUE_SCRIPT)?;
 
     let stubs_dir = tempdir.path().join("stubs");
-    for (relative_path, contents) in STUB_FILES.iter().chain(RUNTIME_FILES) {
-        let path = stubs_dir.join(relative_path);
-        std::fs::create_dir_all(path.parent().expect("stub paths have a parent"))?;
+    let guards_dir = tempdir.path().join("guards");
+    let files = STUB_FILES
+        .iter()
+        .chain(RUNTIME_FILES)
+        .map(|entry| (&stubs_dir, entry))
+        .chain(GUARD_FILES.iter().map(|entry| (&guards_dir, entry)));
+    for (dir, (relative_path, contents)) in files {
+        let path = dir.join(relative_path);
+        std::fs::create_dir_all(path.parent().expect("generated class paths have a parent"))?;
         std::fs::write(&path, contents)?;
     }
 
@@ -1141,7 +1154,8 @@ fn spawn_worker() -> anyhow::Result<Worker> {
     command
         .arg(&script_path)
         .arg(WORKER_SOCKET_FD.to_string())
-        .arg(&stubs_dir);
+        .arg(&stubs_dir)
+        .arg(&guards_dir);
     // SAFETY: the closure only calls async-signal-safe syscalls, as required between fork and
     // exec. It owns the child end, so the descriptor stays alive until the exec happens.
     unsafe {