Bun 1.3.14 confinement rejects trusted eval bootstrap before sealed workflow import

Summary

The current main runtime release gate fails on Bun 1.3.14 because the sealed-snapshot confinement preload rejects Bun's synthetic --eval module before that bootstrap can import the authenticated descriptor-rooted workflow.

The failing test is:

startRun forwards cloud provider credentials through the Smithers environment filter

This is separate from the reopened-workspace change in #950. The failure reproduces when that one test runs alone, and the failing confinement and test files are byte-identical to main.

Environment

• Ultrafuzz main: 0b8405f623bc913e5e9547ee2f5ced7a5a4f8c2d
• Node.js: 24.19.0
• Bun: 1.3.14
• pnpm: 11.1.1
• Linux with procfs

Reproduction

Build the workspace so that the Modal execution dependency is present. Then run the exact runtime test:

pnpm -r build
node --test --test-name-pattern='^startRun forwards cloud provider credentials through the Smithers environment filter$' packages/runtime/dist-test/test/runtime.test.js

The test also fails in the complete @ultrafuzz/runtime suite.

Actual result

Bun exits before the descriptor-rooted workflow loads:

workflow controller module resolved outside its sealed snapshot:
<fixture>/[eval]
(sealed snapshot: <fixture>/.ultrafuzz/runs/cloud-environment/smithers/execution-snapshots/<digest>)

The isolated test ends with status 1. The failure is deterministic in this environment.

Root cause

The test starts Bun with the sealed bun-module-confinement.js preload and a trusted --eval bootstrap. Bun 1.3.14 exposes that synthetic bootstrap to the preload as a file-namespace path named <cwd>/[eval].

BUN_MODULE_CONFINEMENT_SOURCE uses a negative path filter for every file outside the sealed execution snapshot. It therefore rejects [eval] before the bootstrap can import UFZ_DESCRIPTOR_WORKFLOW_MODULE through /proc/self/fd/3.

The later outside-snapshot rejection assertion never runs.

This differs from closed issues #778 and #793, which admitted authenticated descriptor aliases, and from #837, which concerned bare-package resolution after descriptor loading. Here the synthetic eval entry module itself is rejected before descriptor loading starts.

Acceptance criteria

• The exact runtime test passes on Bun 1.3.14.
• The trusted eval bootstrap can import the authenticated descriptor-rooted workflow.
• The bootstrap does not gain authority to import arbitrary files relative to its working directory.
• A direct or symlinked module outside the authenticated execution snapshot still fails closed.
• A descriptor that resolves outside the snapshot, including a closed and reused descriptor number, still fails closed.
• Canonical and current-process descriptor aliases inside the snapshot continue to load with normal relative and bare-package resolution.
• Regression coverage exercises Bun --eval and a normal file entrypoint.
• The fix does not disable confinement and does not add an unconfined fallback.

Start with bun-module-confinement.js and BUN_MODULE_CONFINEMENT_SOURCE, then run the isolated runtime test command in the issue on Bun 1.3.14. Exercise the trusted --eval bootstrap and normal file entrypoint alongside the listed outside-snapshot and descriptor cases. Done means the exact test passes while confinement still rejects unauthorized modules and descriptors.