fix(cache): allow underscores in metadata cache keys

Cache::read()/write() rewrite every character outside the allowlist to
"-", so a package name containing "_" was stored and looked up under a
file name Composer never writes: the repository metadata cache was never
hit for those packages, and "vendor/foo_bar" collided with
"vendor/foo-bar". With no cached copy there is no last-modified date to
send either, so a degraded repository resolved such packages as not
found instead of serving the cached metadata.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 79588fc5..1b160ae6 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -265,7 +265,7 @@ impl ComposerRepository {
             config.get("cache-repo-dir").as_string().unwrap_or(""),
             preg_replace(r"{[^a-z0-9.]}i", "-", &Url::sanitize(url.clone())),
         );
-        let cache = Cache::new(io.clone(), &cache_dir, Some("a-z0-9.$~"), None, false);
+        let cache = Cache::new(io.clone(), &cache_dir, Some("a-z0-9.$~_"), None, false);
         let version_parser = VersionParser::new();
         let loader = ArrayLoader::new(Some(version_parser.clone()), true);