feat(diagnose): audit the Composer runtime the executable carries

checkComposerAudit reported success instead of auditing anything, because
the binary ships no vendor/composer/installed.json on disk. It reads the one
in the embedded Composer PHP runtime now, and Composer's warning for a
missing installed.json is back.

Only that file leaves the bundle, into a temporary directory that goes away
with the handle; the runtime is unpacked whole only for a worker that cannot
read the bundle in place. Phar::extractTo's $files argument selects it,
which the shim ignored so far.

SHIRABE_COMPOSER_PHP_DIR moves into composer_runtime, so the worker and a
reader on the Rust side resolve the runtime through the same branch.

DiagnoseCommandTest::testCmdSuccess is ignored: packagist has advisories
against composer/composer 2.9.7, the version Composer::VERSION reports, so
diagnose exits 1 where the test expects 0. Upstream Composer 2.9.7 reports
the same advisories.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 51 insertions, 3 deletions

diff --git a/crates/shirabe-php-shim/src/phar.rs b/crates/shirabe-php-shim/src/phar.rs
index 1815cbf1..574cf69a 100644
--- a/crates/shirabe-php-shim/src/phar.rs
+++ b/crates/shirabe-php-shim/src/phar.rs
@@ -147,6 +147,7 @@ fn extract_entries(
     archive_path: &std::path::Path,
     entries: &[PharEntry],
     directory: &std::path::Path,
+    files: Option<&[&str]>,
     overwrite: bool,
 ) -> anyhow::Result<()> {
     let extract_error = |detail: String| {
@@ -158,8 +159,21 @@ fn extract_entries(
         .into()
     };
 
+    if let Some(files) = files
+        && let Some(missing) = files
+            .iter()
+            .find(|file| !entries.iter().any(|entry| entry.localname == **file))
+    {
+        return Err(extract_error(format!("\"{}\" is not in the phar", missing)));
+    }
+
     std::fs::create_dir_all(directory).map_err(|e| extract_error(e.to_string()))?;
     for entry in entries {
+        if let Some(files) = files
+            && !files.contains(&entry.localname.as_str())
+        {
+            continue;
+        }
         let rel = std::path::Path::new(&entry.localname);
         if rel.is_absolute()
             || rel
@@ -448,10 +462,16 @@ impl Phar {
     pub fn extract_to(
         &self,
         directory: impl AsRef<std::path::Path>,
-        _files: Option<()>,
+        files: Option<&[&str]>,
         overwrite: bool,
     ) -> anyhow::Result<()> {
-        extract_entries(&self.path, &self.entries, directory.as_ref(), overwrite)
+        extract_entries(
+            &self.path,
+            &self.entries,
+            directory.as_ref(),
+            files,
+            overwrite,
+        )
     }
 }
 
@@ -623,13 +643,14 @@ impl PharData {
     pub fn extract_to(
         &self,
         directory: impl AsRef<std::path::Path>,
-        _files: Option<()>,
+        files: Option<&[&str]>,
         overwrite: bool,
     ) -> anyhow::Result<()> {
         extract_entries(
             &self.path,
             &self.entries.borrow(),
             directory.as_ref(),
+            files,
             overwrite,
         )
     }
@@ -1060,6 +1081,33 @@ mod tests {
     }
 
     #[test]
+    fn phar_native_extract_takes_the_named_files_only() {
+        let dir = tempfile::tempdir().unwrap();
+        let phar_path = dir.path().join("selected.phar");
+        std::fs::write(&phar_path, build_native_phar(false, halt_compiler_token())).unwrap();
+        let phar = Phar::new(&phar_path).unwrap();
+
+        let out = dir.path().join("extracted");
+        phar.extract_to(&out, Some(&["dir/hello.txt"]), true)
+            .unwrap();
+        assert_eq!(
+            std::fs::read(out.join("dir/hello.txt")).unwrap(),
+            b"Hello World"
+        );
+        assert!(!out.join("big.txt").exists());
+
+        let error = phar
+            .extract_to(&out, Some(&["dir/absent.txt"]), true)
+            .unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("\"dir/absent.txt\" is not in the phar"),
+            "unexpected error: {error}"
+        );
+    }
+
+    #[test]
     fn phar_native_broken_signature_is_rejected() {
         let dir = tempfile::tempdir().unwrap();
         let phar_path = dir.path().join("tampered.phar");