[alii]

Dedup pass over the jsc bindings, runtime APIs, bun:test matchers and shell builtins. Only moves and removes code; no intended behavior change. 45 files, about -1.4k lines net.

• ConsoleObject: TagPayload (a mirror of Tag that existed to carry one variant's payload) is gone; TagResult carries the payload as an Option. WrappedWriter::new replaces 32 struct literals and the per-function pf! macros.
• VirtualMachine / jsc_hooks: one wait loop behind load_entry_point and load_entry_point_for_test_runner; auto_tick / auto_tick_active become auto_tick<const ACTIVE: bool>.
• bun:test: toEqual / toStrictEqual share one implementation; the toHave*With family shares argument comparison, mock.results parsing and failure epilogues.
• Shell: basename / dirname share PathBuiltin; cp/ls/mkdir/touch get their OutputTaskVTable impl from one macro; subproc stdio init is one match with per-arm cfg; the Blob stdin writer is shared with Bun.spawn.
• dns: generic PendingCacheKey<Req> and one pending-chain drain replace the per-record-kind copies.
• valkey: the seven command-shape macros collapse into cmd! and cmd_varargs!; all commands keep their name, wire command, argument names and state requirement.
• Smaller: AsyncModule error builders, CryptoHasher / PasswordObject / csrf argument parsing, napi create_string_* prologue, bake init_transpiler_impl and the DevServer field-exhaustiveness macro, udp setsockopt helpers, ipc drain loops, socket callback tail, CodeCoverage line mapping.

One deliberate non-1:1 spot: mkdir's on_io_writer_chunk alone had an Idle | Done => panic! arm, which the macro drops to match the other three builtins; Idle still panics one frame down in Mkdir::next, and Done is only set after the last chunk callback has run.

Dropped along the way because main landed its own version: the cron consolidation (#40024) and the URL unification (#40238).

Verified with a debug build, cargo clippy --workspace, rust:check-all (12 targets), and the touched suites (console / inspect, expect + matchers, shell, crypto, csrf, dns, ipc, socket, udp, napi, bake, coverage, valkey), plus byte-for-byte differential checks against canary for the matcher messages, shell output and publish errors. The unified auto_tick is re-compared statement for statement against main's two functions after every rebase.

Review-driven commits

• Second commit: mordant's same_match_twice on toHaveNthReturnedWith / toHaveLastReturnedWith, which now share mock::check_returned_with.
• Third commit: parse_mock_result looks the result tag up through the existing RETURN_STATUS_MAP.
• Fourth commit: call_socket_handler takes its optional extra argument as an Option<JSValue>.

Rebase notes

Rebased onto main nineteen times. Where main changed code this PR had moved into a helper, the change is applied once inside the helper; where main landed its own version of a piece (cron #40024, URL #40238, the websocket publish prologue #39389), the piece was dropped. The larger re-derivations:

• Make bun_core::String own its WTF ref #40238 and Give borrowed string bytes a lifetime (Utf8Bytes<'a>, EncodedSlice<'a>) #40374 (String ownership and borrowed-bytes lifetimes): applied inside the ConsoleObject print_* functions, parse_verify_algorithm, CryptoHasher::hash, the napi string helpers, the shell argument helper, parse_mock_result, and the AsyncModule error builders (now fallible, same nine properties in the same order as main's inlined versions).
• Remove redundant exception checks that follow already-checked calls #40251 and Add jsc-exception-lint and fix the missing exception checks it finds #40410 (redundant exception checks, missing exception checks): applied inside parse_verify_algorithm, the ipc drain helpers (dispatch::fold around handle_ipc_message), and the matchers' get_direct_index calls.
• bun_ptr: RefPtr releases on Drop; remove ScopedRef/IntrusiveRc/DestructorCtx #40478 (RefPtr releases on Drop): DNSLookup.resolver is a RefPtr as on main; the manual deref sites main deleted were never in this PR's helpers.
• node:fs: async calls with a Buffer path no longer keep the Buffer alive forever #40511 (Stdio::ArrayBuffer removed, PinnedArrayBuffer redirects): the shared stdin writer is Blob-only on both platform arms; the shell's single Readable::init takes main's redirect_buf and hands the BufferedOutput to PipeReader::create as main does.
• Refcounted types own their teardown: impl Drop instead of destroy hooks, RefPtr instead of raw holders, rc classes #40516 (refcounted types own their teardown): the shell's unified Writable::init keeps main's FileSink::create_with_pipe value return on the Windows arm; the dns Resolver Drop / RefPtr::init_ref guards and the ProcessHandle holder land outside this PR's helpers.
• bun test --parallel: send coverage and test results to the coordinator as data, not rendered LCOV/XML #40678 (bun test --parallel coverage wire format): the resolve_line / map_to_original closures in CodeCoverage::generate sit on top of main's ByteRange loops (for block in blocks, set(stmts.len())).
• Add missing exception checks in expect matchers, mock functions and error construction #40068 (missing exception checks in the matchers): DiffFormatter::new(global, received, expected, not)? replaces the struct literal once inside mock::throw_diff and once in the unified toEqual, so the six toHave*With matchers and toStrictEqual get main's fallible formatting through the shared code. The matcher suites pass under BUN_JSC_validateExceptionChecks=1.
• Don't request a GC before waiting on the entry point #39541 (no startup GC): the perform_gc() removal applied once in the shared entry-point wait; Don't request a GC before waiting on the entry point #39541's own tests pass here.
• redis: add bitmap, HLL, geo, scripting, server, and stream commands #29339's 45 new redis commands converted to the new macros; shell(mkdir, touch): report operands longer than the path buffers instead of aborting #38379 / shell(ls): decide operand errors with lstat, not the O_DIRECTORY errno #40091 (mkdir, touch, ls) and socket: report a peer reset on Windows as close(socket, ECONNRESET) instead of a code-less error #39615 / node:net: keep the process alive while an early-unref'd/paused socket is still connecting #39856 / DuplexUpgradeContext: hold state in Cell/JsCell, take ThisPtr instead of *mut Self #40022 (socket) land beside the shared code, not inside it.

Pre-existing items surfaced by review, not changed here

Handed off: the redis bitcount range / hscan cursor argument handling.

Follow-ups: shell stdio init StdioResult::unwraps as error returns; redis keys argument reported as key rather than pattern; dns PendingCacheKey::append as an unsafe fn; bake production init_transpiler freeing the arena projection like DevServer does; sealing StaticHasher so the Digest cast is enforced by the trait; harmonizing the three napi string failure paths; the cron consolidation redone against #40024's shape.

[alii]

@robobun adopt

[robobun]

Retargeted at main by alii; kept current since (latest: 3623211, nineteen rebases plus three small review commits), mergeable, all review-bot threads settled, mordant and binary-size green. Two pieces have been dropped as main landed its own versions (cron in #40024, URL in #40238), so the PR is now 45 files. In the latest CI run the one red is the RSS assertion in test/js/node/test/parallel/test-crypto-dh-leak.js on the x64 ASAN lane; it fails on other recently merged PRs too and is in main-break triage. This PR touches no DiffieHellman code. This is the single PR to review; alii has been preparing it to land.

[robobun]

^{Updated 7:05 PM PT - Sep 7th, 2026}

❌ @robobun, your commit 3623211 has 1 failures in Build #112382 (All Failures):

• test/js/node/test/parallel/test-crypto-dh-leak.js - code 1 on 🐧 13 x64-asan

---

🧪   To try this PR locally:

bunx bun-pr 32023

That installs a local version of the PR into your bun-32023 executable, so you can run:

bun-32023 --bun

[claude]

I didn't find any bugs, but this is a large refactor (53 files, net −5k lines) touching unsafe runtime internals across the VM event loop, IPC, NAPI, DNS, crypto, shell, and cron — worth a human pass to confirm the behavioral-equivalence claims hold across all the consolidations.

Extended reasoning...

Overview

This PR consolidates duplicated code across ~53 files in the Bun runtime: collapsing the TagPayload/Tag split in ConsoleObject, unifying the four PendingCacheKey types in DNS into one generic, merging auto_tick/auto_tick_active via a const generic, factoring shell builtins' OutputTaskVTable into a macro, restructuring CronRegisterJob/CronRemoveJob around a shared CronJobCommon base, deduping the CryptoHasher digest-output parsing, deleting the dead draft FFI implementation, and turning jsc::URL into a re-export of bun_url::whatwg::URL plus a UrlJsc extension trait. The diff is ~525k chars (truncated) with a net −5k lines.

Security risks

Several touched files are security-adjacent: csrf_jsc.rs (CSRF token generation/verification option parsing), CryptoHasher.rs and PasswordObject.rs (digest output handling, algorithm validation), and napi_body.rs (unsafe pointer/length handling for caller-supplied buffers). The changes look like straight extractions of existing logic into helpers with identical semantics, and the bug-hunting pass found nothing, but crypto/CSRF argument parsing and unsafe NAPI slice construction are exactly the kind of code where a subtle reordering or changed early-return can matter.

Level of scrutiny

High. Even granting the "zero intended behavior change" framing, this PR rewrites substantial unsafe Rust across the event loop (jsc_hooks.rs), intrusive-list DNS draining (drain_chain_ok/drain_chain_err), raw-pointer self-freeing state machines in cron.rs, and Stacked-Borrows-sensitive ManuallyDrop/ptr::read paths in subprocess Writable. The cron rework in particular merges two separate state enums and maybe_finished/finish paths into one generic — the kind of consolidation where a per-variant edge case (e.g. which states tolerate nonzero exit, which Drop runs) is easy to lose. These are production-critical hot paths, not sandbox code.

Other factors

CI is green across all lanes per the robobun comment, and the existing test suite is cited as regression coverage. The PR is also stacked (foundations → install-cli → this), so merge ordering matters. No prior human reviews are on the timeline. Given the breadth, the unsafe-heavy surface, and the security-adjacent files, this should get a human reviewer's eyes even if mechanically clean.

[robobun]

Re the specific high-scrutiny areas called out above, on the rebased head (b6193e2):

• cron (CronRegisterJob/CronRemoveJob → CronJobCommon): test/js/bun/cron/ 91 pass, 0 fail.
• NAPI (napi_create_string_* prologue extraction into NapiStringUnit + napi_string_slice): napi.test.ts -t string 9/9 pass; napi-value-ffi.test.ts 0 fail.
• DNS (PendingCacheKey generic + drain_chain_*): container has no outbound DNS so the external-host lookups fail identically under both the debug build and the baked release bun (52/80 and 39/69, same test names). CI lanes with network pass them (zero DNS annotations on build 64472).
• Event loop / IPC / shell / crypto / csrf: in the PR description's verification list.

Build 64472 is at 281 jobs green with zero test-failure annotations; the only red is a darwin 26 lane that exited on a buildkite artifact-download timeout before running anything.

Agreed a human pass is warranted given the scope; flagging @alii since this was handed over via adopt.

[claude]

The automated bug hunt came back clean, but this needs a human pass — 52 files across the event loop, JSC GC/formatter, DNS, IPC, NAPI, sockets, cron, and shell, with two rounds of non-trivial conflict resolution against main.

Checked and ruled out: the merged auto_tick<ACTIVE> preserves both original tails (GC-timer / rejected-promises skipped only when ACTIVE); drain_chain_ok keeps the ensure_still_alive bracketing and per-global re-materialization from every original drain_pending_*; the cron CronJobCommon extraction preserves the raw-ptr / no-FnEntry-protector discipline and per-job accepts_nonzero_exit differences; digest_to_bytes still returns the freshly-written digest bytes after the output_digest extraction.

Extended reasoning...

Overview

Net −5k line deduplication refactor across 52 runtime files: collapses TagPayload→Tag in the console formatter (shared with macro evaluator and test-runner pretty-printer), unifies four near-identical PendingCacheKey types in DNS behind a generic + HasTail/NameKeyed traits, extracts drain_chain_{ok,err} from five drain_pending_* copies, merges auto_tick/auto_tick_active into one const-generic fn, folds CronRegisterJob/CronRemoveJob state into a CronJobCommon base, macro-izes the shell builtins' OutputTaskVTable impl, extracts shared IPC drain loops, deletes the dead draft FFI implementation, and moves URL to a re-export with a UrlJsc extension trait. Two rebases onto main with 11+5 documented conflict resolutions.

Security risks

No new attack surface — this is code motion and helper extraction. The touched areas include NAPI string creation (unsafe slice construction from C pointers) and CSRF option parsing, but both are straight extractions of existing validation into helpers with identical guard order. No parsing/auth/crypto logic changed.

Level of scrutiny

High. This is production-critical native runtime code with pervasive unsafe, raw-pointer receivers whose contracts depend on Stacked-Borrows reasoning (cron's "local reborrow, no FnEntry protector" pattern), GC-rooting order (ensure_still_alive placement in DNS drain chains), and event-loop hot paths. The refactor's correctness hinges on every extracted helper preserving side-effect order and every conflict resolution correctly threading main's concurrent semantic changes (e.g. Rc<Handlers> in socket_body, transfer_to_js in napi) through the moved code. A subtle divergence in any one of the ~30 extractions could ship a UAF or a lost error path that the test suite doesn't cover.

Other factors

CI is green (281+ jobs) and the PR description documents per-file test verification, but the author's own bot already flagged that a human pass is warranted. The diff is stacked on another PR (install-cli) with a required merge order. Several extractions change control-flow shape in ways that are equivalent but not mechanically obvious — e.g. PasswordObject's verify_sync previously returned JSValue::ZERO on one dead-code branch and now returns Err(Thrown), and Mkdir::on_io_writer_chunk previously panicked on Idle/Done and now falls through to next(). These looked benign on inspection but are exactly the kind of thing a maintainer should confirm.

[robobun]

On the two specific control-flow shape changes called out above:

PasswordObject verify_sync (Ok(JSValue::ZERO) → Err(JsError::Thrown)): the branch is the algorithm_from_zig_string → None path with has_exception() already true. At the host_fn boundary these are identical: src/jsc/host_fn.rs maps Err(JsError::Thrown) → JSValue::ZERO (lines 114/123/681), so both sides hand C++ the same zero return with the same pending exception. The async verify twin already used Err(Thrown) here; the refactor's shared helper normalizes the sync twin to match.

Mkdir on_io_writer_chunk (Idle/Done panic → falls through to next()): mkdir was the only one of the six builtins with the explicit panic; touch/ls/cp/basename/dirname already used the if let State::Exec ... else None shape the macro emits. For Idle the behavior is unchanged (next() itself still panics on State::Idle). For Done it would now return Builtin::done(.., 0) instead of panicking, but that path is unreachable: chunks are only enqueued from write_err/write_out while in Exec, so the callback cannot fire after the state transitions to Done.

Build 72447 on the rebased head: 82 passed so far, one napi.test.ts GC-finalization-timing failure on windows x64-baseline that's fleet-wide (also in builds 72400/72410/72415/72420/72440).

[alii]

@robobun split this into a few prs. it's too big to land safely.

[robobun]

On it. Splitting by subsystem into separate PRs, each stacked on claude/split/install-cli like this one, so they can be reviewed and landed independently. Will link them here when they are up.

[robobun]

Split into eight PRs, all stacked on claude/split/install-cli and independent of each other (each compiles in isolation; the union cherry-picks cleanly and is byte-identical to this PR's head f29ce8fe4, which CI ran at 285/286):

PR	Scope	Δ
#37358	Console formatter TagPayload → Tag	5 files, −368
#37359	jsc::URL re-export + UrlJsc trait	3 files, −117
#37360	expect equality / mock-call matchers	10 files, −108
#37361	Subprocess stdin writer shared with shell; builtin vtable macro	10 files, −329
#37362	Delete draft FFI host_fns.rs	2 files, −601
#37363	Cron job state machines; DNS pending-cache drains	3 files, −430
#37365	auto_tick, IPC drains, async modules, entry-point wait	4 files, −242
#37366	Small per-file dedups (crypto, api objects, sockets, valkey, napi, bake, coverage)	17 files, −636

Each body carries the rebase-resolution notes relevant to its files and the suites run against it. Converting this one to a draft and leaving it open as the validated union for reference; happy to close it outright once the splits start landing.

[robobun]

Re-landed directly on main (the stack underneath it, #32000 / #32022, is gone or stale): base retargeted to main, squashed to one commit (1aba1ea), 53 files, +3294 / -5031.

The PR description now lists what was dropped because main already has it or it depended on #32022, and which parts were re-derived against main (matchers on the throw! macro, cron after #35122 / #36571, dns after #36619 / #37075, the URL unification now carrying its bun_url half). Verification is in the description as well: check-all on all 10 targets, clippy, rustfmt, source lints, the touched suites on a debug build, and byte-for-byte differential runs against the current canary for the matcher messages, publish errors, shell builtins, file: URL handling, redis URL parsing and dns.

#32024 is still stacked on this branch and needs the same treatment on its own.

[alii]

@robobun get this mergeable — main moved and it conflicts again.

[robobun]

On it. Checking whether the base moved under the splits too; will rebase whatever conflicts and report back here.

[robobun]

Conflicts again: #40374 (lifetimes for borrowed string bytes) touches 28 of the 45 files in this diff. Working through it now.

[robobun]

Mergeable again at c370bb7. #40374 (lifetimes for borrowed string bytes) reached 28 files here; where it landed in code this PR had moved into helpers, the change is applied inside the helper, most visibly the AsyncModule error builders, which now follow main's fallible-closure shape and produce the same nine properties in the same order as main's inlined versions (checked mechanically). Build, clippy, check-all, fmt and the matcher, hasher, password, inspect, napi, csrf, markdown and isolation suites pass; details in the body.

[alii]

@robobun conflicts - also make the pr body much shorter

[robobun]

On it: rebasing now, and I will cut the body down to a short summary with the history folded away.

[robobun]

Done both: mergeable again at 25037bc (one trivial conflict, #40410 making get_direct_index fallible, applied at the three matcher call sites; build, clippy, check-all, fmt and the matcher / ipc / console / gc-cadence suites pass), and the body is cut to a short summary of the current 45-file diff with the review commits, rebase history and follow-ups folded into collapsed sections.

[robobun]

Conflicts again (#40478, RefPtr releases on Drop, touches 9 files here). Rebasing now.

[robobun]

Mergeable again at b6c15ae. One small conflict (#40478: DNSLookup.resolver becomes a RefPtr), resolved to main's type with this PR's visibility; nothing in this PR's helpers used the manual deref sites that PR removed. auto_tick still matches main's twins; build, clippy, check-all, fmt and the spawn stdin suite pass.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[robobun]

Conflicts again (23 new main commits, 7 files in this diff touched). Rebasing now.

[robobun]

Rebased onto main at 0e395c2 (the seventeenth time). The branch is mergeable, 45 files.

This round absorbed #40511 (Stdio::ArrayBuffer removed, PinnedArrayBuffer for shell redirects). The shared stdin writer is now Blob-only, and the shell's single Readable::init takes main's redirect_buf and passes the BufferedOutput to PipeReader::create as main does.

The first push of this rebase (d064697) still matched Stdio::ArrayBuffer in the Windows-only arm of Writable::init. The Linux build does not compile that arm, so only the two Windows build jobs in CI caught it. b42f557 fixes the arm, and rust:check-all now passes on all 12 targets. The remaining failures in that CI run all passed on retry and are outside this diff.

The PR body has the #40511 note in the rebase section.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[robobun]

Rebased onto main at a46c250 (the eighteenth time). The branch is mergeable, 45 files, head 7ce9e50.

Eleven of the 35 new main commits touch files in this PR. One conflict, in CodeCoverage.rs: #40678 rewrote the coverage loops around ByteRange (for block in blocks, set(stmts.len())), and this PR's resolve_line / map_to_original closures now sit on top of that. The rest merged on their own. #40516 (refcounted teardown) lands inside the shell's unified Writable::init as main's FileSink::create_with_pipe value return, and its dns Resolver Drop and ProcessHandle changes are outside this PR's helpers.

Checks after the rebase: the PR removes none of the lines main added in these files and re-adds none main removed. The unified auto_tick is still statement-identical to main's two functions (74 and 68 statements). cargo fmt --check, cargo clippy --workspace (0 warnings) and rust:check-all (12 of 12 targets) pass. The debug build passes the matcher, shell builtin, shell core, spawn, ipc, udp, markdown, coverage, console, crypto, csrf and bake suites. The socket, tcp-server, dns and ls permission tests fail here with the same set as the stock binary (no outbound DNS, root, localhost dual-stack), and the four 500-iteration leak.test.ts memleak tests hit their 100s ceiling under the local ASAN debug build (about 215 ms per iteration here, most of it heapStats() plus three forced GCs). That file passed on the x64 ASAN lane in the previous CI run.

The PR body has the #40516 and #40678 notes in the rebase section.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[robobun]

Rebased onto main at a3e0ab6 (the nineteenth time). The branch is mergeable, 45 files, head 3623211.

264 new main commits, 35 of them touching files in this PR. Seven conflicts, all in the matchers, from #40068 (missing exception checks): main replaced the DiffFormatter struct literal with the fallible DiffFormatter::new(global, received, expected, not)?. That change now lives once inside mock::throw_diff and once in the unified toEqual, so the six toHave*With matchers and toStrictEqual reach it through the shared code instead of each carrying the call. The toStrictEqual.rs modify/delete conflict resolves the same way: the file stays deleted and the unified implementation carries main's line.

Checks after the rebase: the matcher and mock suites pass under BUN_JSC_validateExceptionChecks=1 (279 tests, plus 87 in mock-fn), which is what #40068 added the checks for. The PR removes none of the lines main added in these files and re-adds none main removed (the only hits are the six DiffFormatter::new call sites that moved into the helper). The unified auto_tick is still statement-identical to main's two functions (74 and 68 statements). cargo fmt --check, cargo clippy --workspace (0 warnings) and rust:check-all (12 of 12 targets) pass. The debug build also passes the shell, shell builtin, coverage, csrf, cryptohasher, ipc, udp, console, napi and bake suites.

Main's own changes in these files survive: the udp hostname validation and Win32 error mapping (#40986, #40860), the napi symbol rename, and the dns and shell stdio fixes are all intact.

The PR body has the #40068 note in the rebase section.

[claude]

Code review found no issues

No high-confidence issues detected in this change.