isWeb() in fs.js incorrectly detects Bun as web environment, breaking keychain access

[andrii-solokh]

Summary

When running @salesforce/core under the Bun runtime, the isWeb() check in lib/fs/fs.js returns true, causing the library to use memfs (in-memory filesystem) instead of node:fs. This breaks all filesystem-dependent functionality, including keychain access for org authentication.

Root Cause

In lib/fs/fs.js, line 37:

const isWeb = () => process.env.FORCE_MEMFS === 'true' || 'window' in globalThis || 'self' in globalThis;

Bun exposes self in globalThis as an alias for globalThis itself (for Web API compatibility), similar to how browsers expose self. This causes 'self' in globalThis to return true, making isWeb() incorrectly identify Bun as a web/browser environment.

Impact

All fs operations go through memfs instead of the real filesystem. The first visible symptom is typically:

MissingCredentialProgramError: Unable to find required security software: /usr/bin/security

This happens because memfs.statSync('/usr/bin/security') throws (the file doesn't exist in the in-memory filesystem), even though /usr/bin/security exists on disk.

Reproduction

1. Install a project that depends on @salesforce/core@^8.28.0
2. Run it with Bun (e.g., bun run my-cli-command)
3. Any operation that triggers keychain/crypto access will fail with MissingCredentialProgramError

Verification:

// Bun exposes self
bun -e "console.log('self' in globalThis)" // true

// Node.js does not
node -e "console.log('self' in globalThis)" // false

Suggested Fix

The isWeb() check should use a more reliable detection method. Options:

1. Check for window (DOM) specifically, since self exists in both Web Workers and Bun:

   const isWeb = () => process.env.FORCE_MEMFS === 'true' || (typeof window !== 'undefined' && typeof document !== 'undefined');

2. Exclude known server runtimes:

   const isWeb = () => process.env.FORCE_MEMFS === 'true' || (('window' in globalThis || 'self' in globalThis) && !('process' in globalThis && process.versions?.node || process.versions?.bun));

3. Check for the absence of node:fs availability instead of checking globals.

Environment

• @salesforce/core: 8.28.0
• Runtime: Bun 1.3.9
• OS: macOS (Darwin arm64)

Related Repository

The affected code lives in forcedotcom/sfdx-core (src/fs/fs.ts).

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[mitchspano]

Thanks for raising this issue to our attention. The Salesforce core developer tools have never formally supported alternate JavaScript / TypeScript runtimes such as Bun or Deno. However, as the product owner for most of the DX tooling, I am very curious as to what you're trying to accomplish that you cannot with Node.

[andrii-solokh]

Thank you for the comment, and I completely understand that Bun has never been formally supported.

We're building LATdx, a CLI tool for accelerating Salesforce Apex test execution. We compile it into a single Bun binary for distribution, which gives us significantly faster startup times and a simpler install story (one self-contained executable, no node_modules).

We depend on @salesforce/core for org authentication and SOAP API access. Everything works correctly once we patch around the isWeb() detection, so the underlying functionality is fully compatible with Bun. The only blocker is this self in globalThis check.

[soridalac]

Hi @andrii-solokh, this issue has been created to a new work item: W-21890292