fix(bun-compile): replace build-time patches with source-level VFS checks

Move openBoundaryFileSync VFS fast path and config validation $bunfs
issue filtering from fragile build-time regex patches to proper source
code with isBunfsPath/isBunCompiledBinary checks. This eliminates two
of the most failure-prone patch points that broke on every upstream
version bump.

Author: DeJeune

scripts/build-bun-compile.ts

@@ -292,52 +292,9 @@ export async function readPackageName(_root) { return ${JSON.stringify(ctx.pkgJs
         contents: patchManifestTs(readFileSync(args.path, "utf-8")),
         loader: "ts",
       }));
-      // Patch config/validation.ts: filter $bunfs manifest issues inside
-      // validateConfigObjectWithPluginsBase itself. Bun inlines callers ~32
-      // times, so patching callers in io.ts only covers 2. Patch the source.
-      build.onLoad({ filter: /config[/\\]validation\.ts$/ }, (args) => {
-        let src = readFileSync(args.path, "utf-8");
-        // Target the final return in validateConfigObjectWithPluginsBase (after plugin loop)
-        // which is `if (issues.length > 0) {\n    return { ok: false, issues, warnings };\n  }\n\n  return { ok: true, config, warnings };\n}`
-        src = src.replaceAll(
-          /if \(issues\.length > 0\) \{\s*return \{ ok: false, issues, warnings \};\s*\}\s*\n\s*return \{ ok: true, config, warnings \};\s*\}/g,
-          (match) => {
-            return [
-              `{`,
-              `  const __filtered = issues.filter((iss: any) => !(typeof iss.message === "string" && iss.message.includes("manifest not found") && iss.message.includes("$bunfs")));`,
-              `  if (__filtered.length > 0) return { ok: false as const, issues: __filtered, warnings };`,
-              `}`,
-              `return { ok: true as const, config, warnings };`,
-              `}`,
-            ].join("\n");
-          },
-        );
-        return { contents: src, loader: "ts" };
-      });
-      // Patch openBoundaryFileSync to handle $bunfs virtual paths.
-      // Boundary validation (symlinks, hardlinks, TOCTOU identity) doesn't
-      // apply to virtual filesystem paths and fails because VFS openSync
-      // creates temp files whose fstat doesn't match the VFS lstat.
-      build.onLoad({ filter: /infra[/\\]boundary-file-read\.ts$/ }, (args) => {
-        let src = readFileSync(args.path, "utf-8");
-        src = src.replace(
-          /export function openBoundaryFileSync\(params: OpenBoundaryFileSyncParams\): BoundaryFileOpenResult \{/,
-          [
-            `export function openBoundaryFileSync(params: OpenBoundaryFileSyncParams): BoundaryFileOpenResult {`,
-            `  if (typeof params.absolutePath === "string" && (params.absolutePath.includes("$bunfs") || params.absolutePath.includes("B:\\\\~BUN"))) {`,
-            `    const ioFs = params.ioFs ?? fs;`,
-            `    try {`,
-            `      const fd = ioFs.openSync(params.absolutePath, ioFs.constants.O_RDONLY);`,
-            `      const stat = ioFs.fstatSync(fd);`,
-            `      return { ok: true, path: params.absolutePath, fd, stat, rootRealPath: params.rootPath };`,
-            `    } catch {`,
-            `      return { ok: false, reason: "io" };`,
-            `    }`,
-            `  }`,
-          ].join("\n"),
-        );
-        return { contents: src, loader: "ts" };
-      });
+      // NOTE: openBoundaryFileSync VFS fast path and config validation $bunfs
+      // issue filtering are now handled in source code (boundary-file-read.ts
+      // and validation.ts) instead of build-time patches.
       // NOTE: playwright-core is bundled (not external) so Bun handles it.
       // Patch workspace-templates to prefer VFS-embedded templates directory
       build.onLoad({ filter: /agents[/\\]workspace-templates\.ts$/ }, (args) => {

src/config/validation.ts

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { isBunCompiledBinary } from "../daemon/runtime-binary.js";
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
 import { CHANNEL_IDS, normalizeChatChannelId } from "../channels/registry.js";
 import { withBundledPluginAllowlistCompat } from "../plugins/bundled-compat.js";
@@ -668,8 +669,15 @@ function validateConfigObjectWithPluginsBase(
     }
   }
 
-  if (issues.length > 0) {
-    return { ok: false, issues, warnings };
+  // In Bun compiled binaries, VFS-embedded extensions that lack a manifest
+  // file produce spurious "plugin manifest not found: /$bunfs/..." issues.
+  // Filter them out so they don't block config validation.
+  const finalIssues = isBunCompiledBinary()
+    ? issues.filter((iss) => !(iss.message.includes("manifest not found") && iss.message.includes("$bunfs")))
+    : issues;
+
+  if (finalIssues.length > 0) {
+    return { ok: false, issues: finalIssues, warnings };
   }
 
   return { ok: true, config, warnings };

src/infra/boundary-file-read.ts

@@ -12,6 +12,14 @@ import {
   type SafeOpenSyncFailureReason,
 } from "./safe-open-sync.js";
 
+// Bun compiled binary virtual filesystem paths bypass boundary validation
+// because symlink/hardlink/TOCTOU checks don't apply to VFS.
+const BUNFS_PREFIX_UNIX = "/$bunfs/";
+const BUNFS_PREFIX_WIN = "B:\\~BUN\\";
+function isBunfsPath(p: string): boolean {
+  return p.startsWith(BUNFS_PREFIX_UNIX) || p.startsWith(BUNFS_PREFIX_WIN);
+}
+
 type BoundaryReadFs = Pick<
   typeof fs,
   | "closeSync"
@@ -67,6 +75,18 @@ export function canUseBoundaryFileOpen(ioFs: typeof fs): boolean {
 }
 
 export function openBoundaryFileSync(params: OpenBoundaryFileSyncParams): BoundaryFileOpenResult {
+  // Fast path for Bun compiled binary VFS paths — boundary validation
+  // (symlinks, hardlinks, TOCTOU identity) doesn't apply to virtual FS.
+  if (isBunfsPath(params.absolutePath)) {
+    const ioFs = params.ioFs ?? fs;
+    try {
+      const fd = ioFs.openSync(params.absolutePath, ioFs.constants.O_RDONLY);
+      const stat = ioFs.fstatSync(fd);
+      return { ok: true, path: params.absolutePath, fd, stat, rootRealPath: params.rootPath };
+    } catch {
+      return { ok: false, reason: "io" };
+    }
+  }
   const ioFs = params.ioFs ?? fs;
   const resolved = resolveBoundaryFilePathGeneric({
     absolutePath: params.absolutePath,