Uninstall untrusted casks safely

[MikeMcQuaid]

• Avoid evaluating untrusted Ruby cask files during uninstall
• Keep installed JSON cask metadata usable for default removal
• Warn when falling back to recorded uninstall artifacts

Fixes #22892
Closes #22894

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR updates Homebrew’s cask uninstall flow to avoid evaluating Ruby cask definitions from untrusted taps when HOMEBREW_REQUIRE_TAP_TRUST is enabled, while still allowing already-installed casks to be removed using recorded install/uninstall metadata (including installed JSON metadata where available).

Changes:

• Teach NamedArgs#load_formula_or_cask to fall back to an installed-cask representation for “keg-like” cask operations when the tap/cask is untrusted.
• Update Cask::Installer#load_installed_caskfile! to skip loading an untrusted installed Ruby caskfile and instead reconstruct a safe default uninstall artifact set from the cask’s recorded tab uninstall artifacts.
• Add command-level specs covering both “skip untrusted installed .rb” and “use installed JSON metadata” uninstall paths.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
Library/Homebrew/test/cmd/uninstall_spec.rb	Adds regression tests ensuring uninstall works without evaluating untrusted Ruby caskfiles and prefers installed JSON metadata when present.
Library/Homebrew/cli/named_args.rb	Adds a trust-aware fallback to load an installed cask for keg-like operations (e.g., uninstall) when the tap/cask is untrusted.
Library/Homebrew/cask/installer.rb	Skips evaluating untrusted installed Ruby caskfiles during uninstall and builds uninstall artifacts from recorded metadata instead.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.