1 files changed, 18 insertions, 4 deletions
diff --git a/crates/shirabe-php-rpc/src/lib.rs b/crates/shirabe-php-rpc/src/lib.rs
index 34c3961d..d818b364 100644
--- a/crates/shirabe-php-rpc/src/lib.rs
+++ b/crates/shirabe-php-rpc/src/lib.rs
@@ -1035,6 +1035,13 @@ const RUNTIME_FILES: &[(&str, &str)] = &[
     ),
 ];
 
+/// Guard classes made autoloadable inside the worker, behind the stubs: they shadow the real
+/// Composer class of every Rust-owned FQCN no stub proxies, so the worker cannot fall through to
+/// the real implementation and run an instance the Rust side never sees. Generated by
+/// `scripts/plugin-stub-generator/generate-stubs`; too many to spell out here, so `build.rs`
+/// builds the list from the directory itself.
+const GUARD_FILES: &[(&str, &str)] = include!(concat!(env!("OUT_DIR"), "/guard-files.rs"));
+
 struct Worker {
     stream: UnixStream,
     // Also queried for its exit status when a socket read/write fails, to tell a dead worker
@@ -1106,9 +1113,15 @@ fn spawn_worker() -> anyhow::Result<Worker> {
     std::fs::write(&script_path, GLUE_SCRIPT)?;
 
     let stubs_dir = tempdir.path().join("stubs");
-    for (relative_path, contents) in STUB_FILES.iter().chain(RUNTIME_FILES) {
-        let path = stubs_dir.join(relative_path);
-        std::fs::create_dir_all(path.parent().expect("stub paths have a parent"))?;
+    let guards_dir = tempdir.path().join("guards");
+    let files = STUB_FILES
+        .iter()
+        .chain(RUNTIME_FILES)
+        .map(|entry| (&stubs_dir, entry))
+        .chain(GUARD_FILES.iter().map(|entry| (&guards_dir, entry)));
+    for (dir, (relative_path, contents)) in files {
+        let path = dir.join(relative_path);
+        std::fs::create_dir_all(path.parent().expect("generated class paths have a parent"))?;
         std::fs::write(&path, contents)?;
     }
 
@@ -1141,7 +1154,8 @@ fn spawn_worker() -> anyhow::Result<Worker> {
     command
         .arg(&script_path)
         .arg(WORKER_SOCKET_FD.to_string())
-        .arg(&stubs_dir);
+        .arg(&stubs_dir)
+        .arg(&guards_dir);
     // SAFETY: the closure only calls async-signal-safe syscalls, as required between fork and
     // exec. It owns the child end, so the descriptor stays alive until the exec happens.
     unsafe {