utils/path: allow loading API source cache

[cho-m]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

To fix #20984

Before

❯ brew install -svd rustup
==> Fetching downloads for: rustup
✔︎ API Source rustup.rb
✔︎ Bottle Manifest rust (1.91.0)
✔︎ Formula rustup (1.28.2)
✔︎ Bottle rust (1.91.0)
...
==> Cleaning
==> Finishing up
Warning: The post-install step did not complete successfully
You can try again using:
  brew postinstall rustup
Warning: Removed Sorbet lines from backtrace!
Rerun with `--verbose` to see the original backtrace
==> Caveats

After

❯ brew install -svd rustup
==> Fetching downloads for: rustup
✔︎ API Source rustup.rb
✔︎ Bottle Manifest rust (1.91.0)
✔︎ Formula rustup (1.28.2)
✔︎ Bottle rust (1.91.0)
...
==> Cleaning
==> Finishing up
==> Caveats

[Copilot]

Pull Request Overview

This PR adds support for loading packages from the Homebrew API source cache directory when API installation is enabled. This allows the loadable_package_path? method to accept paths from the API source cache as valid package locations.

• Adds API source cache path to allowed paths when API installation is enabled

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Rylan12]

Good catch!

Although I wonder, should we be reading the post-install block from the cache or from the newly installed keg?

[MikeMcQuaid]

Makes sense, thanks!

[ZhongRuoyu]

Does the argument in #20487 still apply here? CC @Bo98

[MikeMcQuaid]

Does the argument in #20487 still apply here? CC @Bo98

@ZhongRuoyu Yes, probably. Can you or @Bo98 suggest an alternate solution here?

[MikeMcQuaid]

Actually: let's merge this as-is for now and we can address afterwards. I don't really see a way of handling this without that.

If we want to ensure that specific security cases that rely on multiple overlapping environment variables cannot be handled: that should be done with a regression test.

[ZhongRuoyu]

Yes, probably. Can you or Bo98 suggest an alternate solution here?

I think we can load the post_install block from the newly installed keg (which @Rylan12 also suggested in his review):

• formula_installer: use formula from keg when post-installing source builds #20992