fix(php-rpc): unpack the runtime bundle under the cache dir

A worker whose PHP cannot read the bundle out of the executable gets it
from an unpacked copy, which went to a directory derived from
XDG_CACHE_HOME alone. That ignored COMPOSER_CACHE_DIR, COMPOSER_HOME and
the cache-dir setting, and put the files outside the directory clear-cache
and the platform conventions cover. The callers now pass Composer's
configured cache directory down to base_path().

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

3 files changed, 32 insertions, 9 deletions

diff --git a/crates/shirabe/src/console/application.rs b/crates/shirabe/src/console/application.rs
index 56947243..1c0f0560 100644
--- a/crates/shirabe/src/console/application.rs
+++ b/crates/shirabe/src/console/application.rs
@@ -2439,7 +2439,19 @@ impl ApplicationHandle {
                                     && crate::plugin::find_file_in_registered_loaders(&dummy_str)
                                         .is_some()
                                     && {
-                                        EventDispatcher::ensure_composer_php_runtime()?;
+                                        let cache_dir = match composer_opt {
+                                            Some(ref composer_handle) => {
+                                                crate::composer::composer_full(composer_handle)
+                                                    .get_config()
+                                                    .borrow()
+                                                    .get_str("cache-dir")?
+                                            }
+                                            None => Factory::create_config(Some(io.clone()), None)?
+                                                .get_str("cache-dir")?,
+                                        };
+                                        EventDispatcher::ensure_composer_php_runtime(
+                                            std::path::Path::new(&cache_dir),
+                                        )?;
                                         crate::plugin::php_class_query(
                                             "class_exists",
                                             vec![shirabe_php_rpc::PluginValue::string(
diff --git a/crates/shirabe/src/event_dispatcher/event_dispatcher.rs b/crates/shirabe/src/event_dispatcher/event_dispatcher.rs
index 1a03ad70..55d867b6 100644
--- a/crates/shirabe/src/event_dispatcher/event_dispatcher.rs
+++ b/crates/shirabe/src/event_dispatcher/event_dispatcher.rs
@@ -699,7 +699,13 @@ impl EventDispatcher {
                         // The user's command class extends Symfony's Command, so the child
                         // process needs the real symfony/console classes before it can even
                         // autoload the user class.
-                        Self::ensure_composer_php_runtime()?;
+                        let cache_dir = self
+                            .composer()
+                            .borrow_partial()
+                            .get_config()
+                            .borrow()
+                            .get_str("cache-dir")?;
+                        Self::ensure_composer_php_runtime(std::path::Path::new(&cache_dir))?;
                         if !self.php_runtime_bool(
                             "class_exists",
                             vec![PluginValue::string(class_name.clone())],
@@ -1565,8 +1571,8 @@ try {{
 
     /// Loads the Composer PHP runtime (symfony/console and friends) into the worker, needed
     /// before a `scripts` Command class can be autoloaded and hosted.
-    pub(crate) fn ensure_composer_php_runtime() -> anyhow::Result<()> {
-        let autoload = Self::composer_php_runtime_autoload()?;
+    pub(crate) fn ensure_composer_php_runtime(cache_dir: &std::path::Path) -> anyhow::Result<()> {
+        let autoload = Self::composer_php_runtime_autoload(cache_dir)?;
         unwrap_php_result(call_function(
             "__shirabe_require",
             vec![PluginValue::string(autoload)],
@@ -1577,15 +1583,15 @@ try {{
     /// For testing only: a test that never registers a plugin package still needs the Composer
     /// PHP runtime in the worker before a class of its own can implement a Composer interface
     /// there.
-    pub fn __ensure_composer_php_runtime() -> anyhow::Result<()> {
-        Self::ensure_composer_php_runtime()
+    pub fn __ensure_composer_php_runtime(cache_dir: &std::path::Path) -> anyhow::Result<()> {
+        Self::ensure_composer_php_runtime(cache_dir)
     }
 
     /// The `vendor/autoload.php` of the Composer PHP runtime.
-    fn composer_php_runtime_autoload() -> anyhow::Result<String> {
+    fn composer_php_runtime_autoload(cache_dir: &std::path::Path) -> anyhow::Result<String> {
         Ok(format!(
             "{}/vendor/autoload.php",
-            shirabe_php_rpc::composer_runtime::base_path()?
+            shirabe_php_rpc::composer_runtime::base_path(cache_dir)?
         ))
     }
 
diff --git a/crates/shirabe/src/plugin/plugin_manager.rs b/crates/shirabe/src/plugin/plugin_manager.rs
index 1d8e6192..75852348 100644
--- a/crates/shirabe/src/plugin/plugin_manager.rs
+++ b/crates/shirabe/src/plugin/plugin_manager.rs
@@ -405,7 +405,12 @@ impl PluginManager {
 
         // The plugin code runs in the PHP worker: load the Composer PHP runtime (contracts like
         // PluginInterface) and the reverse-RPC autoloader before touching plugin classes there.
-        EventDispatcher::ensure_composer_php_runtime()?;
+        let cache_dir = composer
+            .borrow()
+            .get_config()
+            .borrow()
+            .get_str("cache-dir")?;
+        EventDispatcher::ensure_composer_php_runtime(std::path::Path::new(&cache_dir))?;
         EventDispatcher::ensure_script_autoloader()?;
 
         if let Some(files) = map.get("files").and_then(|v| v.as_array()) {