From 306d952c0e4bbe4697d223a0b5e3db045f94c972 Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Fri, 6 Nov 2026 14:54:15 -0800 Subject: [PATCH 1/2] fix(hub): give the coder's sandbox a bun shim to the hub's Bun --- apps/hub/src/builds/posix-sandbox.ts | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/apps/hub/src/builds/posix-sandbox.ts b/apps/hub/src/builds/posix-sandbox.ts index 0e7a9f15..8c89916c 100644 --- a/apps/hub/src/builds/posix-sandbox.ts +++ b/apps/hub/src/builds/posix-sandbox.ts @@ -425,13 +425,16 @@ export async function createPosixBuildExecutor( throw new BuildExecutionError("owned_build_workspace_required"); const executable = await realpath(process.execPath); // Standard `#!/usr/bin/env node` launchers must resolve inside the sandbox, - // which has no Node; a hub-owned shim on PATH runs them with Bun instead. + // which has no Node, and the hub's Bun need not be named `bun` (npm installs + // it as bun.exe); hub-owned shims on PATH run both with the hub's Bun. shimDirectory = await realpath( await mkdtemp(join(tmpdir(), "sb-node-shim-")), ); - const nodeShim = join(shimDirectory, "node"); - await writeFile(nodeShim, `#!/bin/sh\nexec ${quote(executable)} "$@"\n`); - await chmod(nodeShim, 0o755); + for (const name of ["node", "bun"]) { + const shim = join(shimDirectory, name); + await writeFile(shim, `#!/bin/sh\nexec ${quote(executable)} "$@"\n`); + await chmod(shim, 0o755); + } // Resolve workspace packages before isolation: Bun's runtime lookup scans repository paths // the sandbox must keep hidden. The bundled runner needs no host package discovery. const toolChild = join(shimDirectory, "posix-child.js"); From b216e49938b2886eba4983bc4a3cc8287ddcb64f Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Fri, 6 Nov 2026 14:57:36 -0800 Subject: [PATCH 2/2] refactor(hub): name the sandbox shim folder for all its shims --- apps/hub/src/builds/posix-sandbox.ts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/apps/hub/src/builds/posix-sandbox.ts b/apps/hub/src/builds/posix-sandbox.ts index 8c89916c..ea024420 100644 --- a/apps/hub/src/builds/posix-sandbox.ts +++ b/apps/hub/src/builds/posix-sandbox.ts @@ -427,9 +427,7 @@ export async function createPosixBuildExecutor( // Standard `#!/usr/bin/env node` launchers must resolve inside the sandbox, // which has no Node, and the hub's Bun need not be named `bun` (npm installs // it as bun.exe); hub-owned shims on PATH run both with the hub's Bun. - shimDirectory = await realpath( - await mkdtemp(join(tmpdir(), "sb-node-shim-")), - ); + shimDirectory = await realpath(await mkdtemp(join(tmpdir(), "sb-shim-"))); for (const name of ["node", "bun"]) { const shim = join(shimDirectory, name); await writeFile(shim, `#!/bin/sh\nexec ${quote(executable)} "$@"\n`);