Respect sys_temp_dir from the parent process

.github/workflows/e2e-tests.yml

@@ -451,6 +451,17 @@ jobs:
               OUTPUT=$(../../bin/phpstan analyze -l 0 -vvv test.php 2>&1)
               echo "$OUTPUT"
               ../bashunit -a contains 'Parallel processing scheduler' "$OUTPUT"
+          - script: |
+              cd e2e/bug-14093
+              # Use a relative sys_temp_dir so the value starts with a letter (not /), just like Windows
+              # paths starting with a drive letter. If the sys_temp_dir value isn't correctly quoted,
+              # PHP evaluates ~ as a bitwise NOT rather than a literal character, truncating the path.
+              mkdir tmp~1
+              php -d "sys_temp_dir='tmp~1'" ../../bin/phpstan analyze
+              if [ -d tmp ]; then
+                echo "FAIL: tmp was created by a worker, meaning sys_temp_dir='tmp~1' was incorrectly evaluated to 'tmp'"
+                exit 1
+              fi
 
     steps:
       - name: Harden the runner (Audit all outbound calls)

e2e/bug-14093/phpstan.neon

@@ -0,0 +1,4 @@
+parameters:
+	level: 8
+	paths:
+		- test.php

e2e/bug-14093/test.php

@@ -0,0 +1,6 @@
+<?php declare(strict_types=1);
+
+function add(int $a, int $b): int
+{
+	return $a + $b;
+}

src/Process/ProcessHelper.php

@@ -11,6 +11,7 @@
 use function is_bool;
 use function php_ini_loaded_file;
 use function sprintf;
+use function sys_get_temp_dir;
 use const PHP_BINARY;
 
 final class ProcessHelper
@@ -32,6 +33,9 @@ public static function getWorkerCommand(
 
 		$processCommandArray = [
 			$phpCmd,
+			'-d',
+			// quote value so PHP will parse it as a string when the path contains a bitwise operator like ~
+			'sys_temp_dir=' . escapeshellarg("'" . sys_get_temp_dir() . "'"),
 		];
 
 		if ($input->getOption('memory-limit') === null) {