Invalid require line can be left in composer.json if composer fails to run - this prevents further package installs

[rosswintle]

Setup

Mac running latest MacOS (Sierra 10.12.5) Composer v1.5.1 WP-CLI v1.3

Issue

If you run wp package install <package> and the package is not valid and composer fails for some reason (in my case it was out of memory) then .wp-cli/packages/composer.json is not reverted and the invalid package is left in the require section. This means that subsequent wp package installs will fail.

Can this be handled better?

Steps to reproduce

• Edit php.ini and set your memory_limit low so that composer update fails (mine failed with 128M)
• Run wp package install runcommand/dist-archive - this gave me the following output before running out of memory:

Installing package runcommand/dist-archive (dev-master)
Updating /Users/rosswintle/.wp-cli/packages/composer.json to require the package...
Registering git@github.com:runcommand/dist-archive.git as a VCS repository...
Using Composer to install the package...
---
Loading composer repositories with package information
Updating dependencies

• Note that composer.json was not reverted and now contains an invalid package reference (as runcommand/dist-archive doesn't work for some reason
• Edit php.ini and set your memory_limit back to something higher
• Run wp package install runcommand/dist-archive - this runs right though until Error: Package installation failed (Composer return code 2). Reverted composer.json
• Realise that the package is now in a different place and run wp package install wp-cli/dist-archive-command - this fails because The requested package runcommand/dist-archive could not be found in any version, there may be a typo in the package name.
• All subsequent attempts to install a package fail because the incorrect package name is in the composer.json

This seems like an edge case, but I wonder if there are other cases where the requires section of composer.json may become invalid (if a package is deleted from GitHub, perhaps?) and prevent further package installs?

[schlessera]

Related: #25