From b4ab3df2ec85fbe477d7721344a8cd3630b437a1 Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sun, 16 Aug 2026 13:59:28 +0900 Subject: feat(plugin): guard Rust-owned classes the worker has no proxy for The worker's autoloader fell through to the real Composer source for every Rust-owned FQCN without a proxy stub, so plugin code doing `new Filesystem()` or subclassing `LibraryInstaller` silently ran on a second instance the Rust side never sees. An unimplemented part of the plugin API has to fail with an explicit error naming it, not quietly work on a disconnected copy. The stub generator now emits a guard class for each of those FQCNs: the real declaration, hierarchy and constants, with every constructor and method raising an explicit error. References satisfied by the declaration alone (`instanceof`, `X::class`, `Link::TYPE_REQUIRE`) keep working. Two FQCNs stay resolvable to the real class, each listed with the worker-side mechanism that makes a natively constructed instance correct. The error had nowhere to go: `Installer::run` dropped the `Result` of both `dispatch_script` calls, so an exception from a listener ended in exit 0. Both propagate now, the way the exception does upstream. Three real-plugin E2E comparisons stop at a guard and are ignored, each naming the class it needs. Co-Authored-By: Claude Opus 5 (1M context) --- crates/shirabe-php-rpc/src/lib.rs | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'crates/shirabe-php-rpc/src/lib.rs') diff --git a/crates/shirabe-php-rpc/src/lib.rs b/crates/shirabe-php-rpc/src/lib.rs index 34c3961d..d818b364 100644 --- a/crates/shirabe-php-rpc/src/lib.rs +++ b/crates/shirabe-php-rpc/src/lib.rs @@ -1035,6 +1035,13 @@ const RUNTIME_FILES: &[(&str, &str)] = &[ ), ]; +/// Guard classes made autoloadable inside the worker, behind the stubs: they shadow the real +/// Composer class of every Rust-owned FQCN no stub proxies, so the worker cannot fall through to +/// the real implementation and run an instance the Rust side never sees. Generated by +/// `scripts/plugin-stub-generator/generate-stubs`; too many to spell out here, so `build.rs` +/// builds the list from the directory itself. +const GUARD_FILES: &[(&str, &str)] = include!(concat!(env!("OUT_DIR"), "/guard-files.rs")); + struct Worker { stream: UnixStream, // Also queried for its exit status when a socket read/write fails, to tell a dead worker @@ -1106,9 +1113,15 @@ fn spawn_worker() -> anyhow::Result { std::fs::write(&script_path, GLUE_SCRIPT)?; let stubs_dir = tempdir.path().join("stubs"); - for (relative_path, contents) in STUB_FILES.iter().chain(RUNTIME_FILES) { - let path = stubs_dir.join(relative_path); - std::fs::create_dir_all(path.parent().expect("stub paths have a parent"))?; + let guards_dir = tempdir.path().join("guards"); + let files = STUB_FILES + .iter() + .chain(RUNTIME_FILES) + .map(|entry| (&stubs_dir, entry)) + .chain(GUARD_FILES.iter().map(|entry| (&guards_dir, entry))); + for (dir, (relative_path, contents)) in files { + let path = dir.join(relative_path); + std::fs::create_dir_all(path.parent().expect("generated class paths have a parent"))?; std::fs::write(&path, contents)?; } @@ -1141,7 +1154,8 @@ fn spawn_worker() -> anyhow::Result { command .arg(&script_path) .arg(WORKER_SOCKET_FD.to_string()) - .arg(&stubs_dir); + .arg(&stubs_dir) + .arg(&guards_dir); // SAFETY: the closure only calls async-signal-safe syscalls, as required between fork and // exec. It owns the child end, so the descriptor stays alive until the exec happens. unsafe { -- cgit v1.3.1-4-g156e