Replace bun_core::Error intern machinery with per-crate thiserror enums

[robobun]

Replaces the runtime-interned global error set bun_core::Error (#[repr(transparent)] NonZeroU16) and the err!() macro with idiomatic per-crate thiserror enums.

Why

err!(Name) cached a global RwLock<Vec<&'static str>> intern lookup in a per-site AtomicU16. Not a const, so it could never be a pattern; every dispatch was an if-else guard chain with no exhaustiveness check (worst case ~40 arms in FetchTasklet::to_body_value_error). This was Zig's anyerror, ported.

Design

One #[derive(thiserror::Error)] enum per crate at <crate_dir>/error.rs, re-exported as crate::Error + crate::Result<T, E = Error>:

#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
pub enum Error {
    #[error("TooManyRedirects")]
    TooManyRedirects,
    #[error(transparent)] Sys(#[from] bun_errno::SystemErrno),
    #[error(transparent)] Alloc(#[from] bun_alloc::AllocError),
}

• err!("OutOfMemory") (92 sites, 17 crates) routes to bun_alloc::AllocError
• errno/fs names (ENOENT, FileNotFound, AccessDenied, NoSpaceLeft, NameTooLong, NotDir, EISDIR, BadPathName, all E*) route to bun_errno::SystemErrno (2 bytes). NOT bun_sys::Error (40 bytes; the context tier).
• Cross-crate duplicate names are intentional: css::Error::InvalidCharacter != sql::Error::InvalidCharacter.
• #[error(transparent)] X(#[from] ...) for pass-through; ? composes via From.
• Every enum also impls bun_core::output::ErrName so Output::err(e, ...) keeps working.
• Every #[error("...")] string preserves the original err!("...") literal verbatim.
• No new deps (thiserror = "2" was already a workspace dep). No dyn Error / Box<dyn Error> / anyhow.

Deleted

• macro_rules! err + .bun_err link-section (src/bun_core/lib.rs)
• SEED, EXTRA, intern_slow, intern_cached, Error::intern, Error::from_errno, Error::from_raw, Error::name, Error::as_u16, the RwLock<Vec<&'static str>> intern table (src/bun_core/result.rs)
• named_error_set! macro (all 31 call sites deleted; enums now derive thiserror::Error directly)
• OrWriteFailed trait
• ErrorCode::from(bun_core::Error) / ErrorCode::to_error() (src/jsc/ErrorCode.rs): these aliased the intern u16 onto the JS error-code table index. Callers of Errorable::err() now pass ErrorCode(ErrorCode::JS_ERROR_OBJECT) directly.
• impl From<bun_sys::Error> for bun_core::Error (src/sys/lib.rs); replaced with From<bun_sys::Error> for bun_errno::SystemErrno.

bun_core::Error still exists but is now bun_core's own local 13-variant thiserror enum (for the bun_core::io::Write trait's return type).

Foundation

• bun_errno::SystemErrno now impls Display + core::error::Error (via strum::IntoStaticStr).
• bun_alloc::AllocError now impls Display + core::error::Error.

Scope

• 1,641 err!() call sites across 40 crates, 449 distinct names
• 523 files changed, +7435 -4331

Verification

• cargo check --workspace --keep-going: green
• cargo build --workspace --keep-going: green (post-mono const asserts)
• bun run rust:check-all: green across all 10 targets (linux/macos/windows x x64/aarch64 + android)

Deferred

• bun_runtime (192 local variants) and bun_install (117) kept as flat per-crate enums rather than module-level split. Splitting would change == semantics for the 9 names that span modules inside bun_runtime; both enums are still <=4 bytes with Sys nesting.
• Shrinking bun_sys::Error (40 bytes), variant payloads, $ERR_* JS machinery: out of scope.

[robobun]

^{Updated 9:05 PM PT - Jul 10th, 2026}

@autofix-ci[bot], your commit be52741 is building: #71777

[robobun]

This is a behavior-preserving type-level refactor: the verification is the three-step compiler ladder (cargo check --workspace, cargo build --workspace, bun run rust:check-all across 10 targets), all green. Added test/js/bun/util/error-name-preservation.test.ts as a smoke test pinning the user-visible error codes/messages that flow through the refactored paths (errno routing, the fetch error match arm). By design those assertions hold on both main and this branch; the test exists to catch any future drift in #[error("...")] strings or .name() arms, not to demonstrate a pre-existing bug.

[claude]

Additional findings (outside current diff — PR may have been updated during review):

• 🔴 src/install/PackageInstall.rs:2150-2160 — The realpath_err closure now maps E::ENOENT to crate::Error::Sys(SystemErrno::ENOENT), whose .name() is "ENOENT" — but the comment directly above says test/cli/install/bun-link.test.ts asserts on FileNotFound:``, and that test (line 462, not touched by this PR) checks expect(err4).toContain("FileNotFound: failed linking dependency/workspace to node_modules..."). Either restore the Zig-style names in this closure (e.g. via local variants like `crate::Error::FileNotFound`) or update bun-link.test.ts in this PR; the same user-visible rename applies to `AccessDenied`→`EACCES`, `NotDir`→`ENOTDIR`, and `NameTooLong`→`ENAMETOOLONG` in this closure.

  Extended reasoning...

  What changed

  Before this PR, realpath_err in install_with_link_run mapped errno values to Zig-style named errors:

  E::ENOENT => bun_core::err!("FileNotFound"),
  E::EACCES => bun_core::err!("AccessDenied"),
  E::ENOTDIR => bun_core::err!("NotDir"),
  E::ENAMETOOLONG => bun_core::err!("NameTooLong"),

  The PR replaces these with:

  E::ENOENT => crate::Error::Sys(bun_errno::SystemErrno::ENOENT),
  E::EACCES => crate::Error::Sys(bun_errno::SystemErrno::EACCES),
  E::ENOTDIR => crate::Error::Sys(bun_errno::SystemErrno::ENOTDIR),
  E::ENAMETOOLONG => crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG),

  The comment immediately above the closure was left in place and still reads: "so map the openat errno to the named error tag to preserve the user-visible error tag (test/cli/install/bun-link.test.ts asserts on FileNotFound:)" — i.e. the whole point of this closure was to preserve the Zig-style tag name, and the PR undid exactly that while keeping the comment.

  Why the name changes

  install::Error::name() at src/install/error.rs:390 implements Self::Sys(e) => <&'static str>::from(e). SystemErrno derives strum::IntoStaticStr, so <&'static str>::from(SystemErrno::ENOENT) yields the variant name "ENOENT", not "FileNotFound". Likewise EACCES, ENOTDIR, ENAMETOOLONG.

  How this reaches user output

  When the realpath openat fails, realpath_err(err) is wrapped as InstallResult::fail(…, Step::LinkingDependency, None) (PackageInstall.rs:2177). In PackageInstaller.rs:2079-2088, the else-branch of the failure handler calls:

  Output::err(cause.err, "failed {} for package <b>{}<r>", (cause.step.name(), …))

  Output::err uses the ErrName trait for the prefix, and Step::LinkingDependency.name() is "linking dependency/workspace to node_modules". So the printed line becomes:

  error: ENOENT: failed linking dependency/workspace to node_modules for package <name>
  

  The DanglingSymlink and EACCES special-case branches at PackageInstaller.rs:1978/1994 don't intercept ENOENT, so it reaches the else-branch.

  Step-by-step proof of the test failure

  1. test/cli/install/bun-link.test.ts:462 runs bun install against a linked package whose target directory does not exist, and asserts:

     expect(err4).toContain(`FileNotFound: failed linking dependency/workspace to node_modules for package ${link_name}`);

  2. The realpath openat fails with ENOENT; realpath_err returns crate::Error::Sys(SystemErrno::ENOENT).
  3. cause.err.name() → "ENOENT".
  4. Printed: ENOENT: failed linking dependency/workspace to node_modules for package ….
  5. toContain("FileNotFound: …") fails.
  6. bun-link.test.ts is not in this PR's changed-files list (grep of pr_diff.txt shows only the source comment referencing it), so nothing updates the assertion.

  The PR description also claims "Every #[error("...")] string preserves the original err!("...") literal verbatim" — this site is a counterexample.

  Fix

  Either:

  • Add FileNotFound / AccessDenied / NotDir / NameTooLong variants to install::Error (or reuse existing local variants) and return those from realpath_err so .name() matches the old strings; or
  • Update test/cli/install/bun-link.test.ts:462 (and any siblings asserting on AccessDenied:/NotDir:/NameTooLong: from this path) to expect the errno-style names in the same PR, and update the stale comment above realpath_err.

  Per CLAUDE.md's Landing PRs guidance ("When changing output/defaults/messages, grep the suite for assertions on the old behavior and update them in the same PR"), one of these needs to land with this change.

[robobun]

Pushed fixes for the review findings and the CI crashes (263e54c):

Review findings:

• errno_to_zig_err: deleted the stub; added bun_errno::from_errno(i32) -> SystemErrno and migrated all ~30 callers so SendFile/Windows-install paths keep their real errno names.
• realpath_err closure: added FileNotFound/AccessDenied/NotDir/NameTooLong as local install::Error variants and restored them in the closure, so bun-link.test.ts assertion on FileNotFound: holds.
• is_package_missing_from_cache: dropped the duplicate || ENOENT operand (second arm now checks Error::FileNotFound).

CI crashes (the 19 segfaults + ASAN stack-buffer-overflow):
Root cause was an ABI mismatch across #[no_mangle] extern "Rust" link-time boundaries. Two functions had the declaration and definition in different crates, and after the refactor each side named its own crate's Error type. Result<T, E> layouts diverged, so the callee wrote past the caller's stack slot.

• __bun_resolver_init_package_manager (resolver↔install): both sides now use bun_core::Error with an ABI-match comment.
• __bun_macro_context_call (js_parser↔js_parser_jsc): definition now returns bun_js_parser::Error and maps everything to MacroFailed.

Also fixed ResolveMessage::fmt to dispatch on err.name() rather than structural == (resolver errors arrive nested via CrateError::Resolver(...)), and replaced a now-reachable unreachable!() in ffi_body.rs with a proper throw.

Verified locally: rust:check-all 10/10 green, scope-mismatch-panic.test.ts 18/18 pass, resolve-error.test.ts 15/15 pass.

[robobun]

Pushed 21d0fe7 addressing the round-5 review findings and the CI test failures at 6090ffe:

• Decoder error codes (ZlibError/BrotliDecompressionError/ZstdDecompressionError) preserved via transparent nesting.
• http::Error::Cert is now a 66-variant fieldless CertError enum (was &'static str). Error enum sizes: http 24→4, install/jsc 24→6, crash 24→4, runtime 32→8.
• Blob::on_structured_clone_deserialize catch-all no longer panics on #[from]-wrapped errors.
• PackageInstaller EACCES check, handle_root_error FileNotFound disjunct, and dead macro-error else branch addressed.
• bun_core::spawn_sync_inherit/getcwd errno-name loss: deferred to follow-up (tier-0 layering; review agreed).

Gate: the smoke test in this PR is intentionally behavior-pinning, not fail-before. This is a type-level refactor (1,641 err! sites → per-crate thiserror enums) whose correctness criterion is cargo check --workspace + cargo build --workspace + bun run rust:check-all (10/10 targets) all green, plus the existing test suite staying green. No JS-observable delta exists by design, so there is no test that fails on main and passes here. Merge decision is on the review findings + CI, not the gate's stash check.

[robobun]

Status at ff387ce:

Green: compiler ladder (check/build/rust:check-all 10/10), no crashes in CI (ABI + Blob fixes landed), enum sizes down to 4-8 bytes, all intern machinery deleted.

Remaining (known, mechanical):

• ~14 clippy::needless_pass_by_value lints on fns taking the now-larger crate::Error by value (opposite lint to the pass-by-ref one just fixed; fix is &Error at ~14 sites).
• ~7 test failures in build 71498, all error-message-preservation: napi-loader query-string, stack-overflow-at-entry, issue/03830 macro, fetch redirect vtab, bun-build-compile. Same fix pattern as the ~15 sites already addressed in the last 6 commits (dispatch on .name() or add a missing variant).

Stopping per the brief's "if the error count isn't strictly decreasing, stop and report" instruction rather than continue the fix→new-lint cascade. The tail is tractable; every remaining failure is the same class.

[robobun]

Updated remaining-work list with the two new review findings (same bug class):

Lossy From conversions with _ => Unexpected catch-alls (fix: accept impl ErrName or &'static str directly, like handle_root_error in 7b0d093):

• JSGlobalObject::throw_error — affects ~25 Bun.* API error messages (FormData, braces, gunzipSync, shell, Transpiler, DevServer, fetch)
• AutoInstaller::{path_for_resolution, enqueue_package_for_download} trait return types — diagnostic-only
• From<install::Error> for bun_core::Error catch-all (once the above two are widened, this impl can be deleted)

These plus the ~7 CI test failures are the complete known tail. All are the same mechanical fix pattern demonstrated in commits 6090ffe and 7b0d093.

[robobun]

Merge-conflict notification received (8 commits behind main; #33613 and #33925 likely touch files this PR modifies in src/http/ and re-export shims).

Holding the rebase until the documented remaining-work tail is addressed. Rebasing a known-red 540-file PR before that would restart the gate/CI loop without changing the outcome, and conflict resolution in the ~40 error.rs files is safer done once after the dispatch-site fixes land than twice. If you'd prefer the rebase done now for review purposes, say so and I'll do it in a follow-up session.

[Jarred-Sumner]

@robobun rebase and resume

[robobun]

Rebased onto main (clean, no conflicts) and resumed per request. Pushed a7c9b08:

• jsc_hooks.rs: JSError dispatch also matches Js(_) and Bundler(Js(_)) so napi-loader and plugin exceptions reach take_error (import-query.test.ts, plugins.test.ts).
• http::Error::Picohttp(ParseResponseError) preserves Malformed_HTTP_Response code (fetch-redirect.test.ts, client-fetch.test.ts).
• JSGlobalObject::throw_error takes impl ErrName (same pattern as handle_root_error), so FormData/braces/shell/Transpiler/etc. throw their real error name.
• bundler::Error::Js preserves JsError identity through PluginRunner.

cargo check, cargo clippy, rust:check-all (10/10) green. CI will tell us what's left of the ~7-test tail.

[robobun]

CI at 6395780: the two remaining refactor-caused test failures (03830.test.ts macro message, resolve.test.ts auto-install errno) are both green now after 4b8e111.

Only failure is proxy-stress-concurrent.test.ts on macOS-13-x64: 1 of 1200 https-over-https-proxy requests failed on two of the ×1200 memory-probe iterations. That test asserts on request success count, not error names/codes, so it's unrelated to this refactor. Re-rolled once (4829df6).

[robobun]

CI 71695 at cacb44a: all refactor-caused test failures are green. Two remaining failures are single-platform flake unrelated to this PR:

• proxy-stress-concurrent.test.ts (macOS-13-x64 only): 1 of 1200 https-over-https-proxy requests failed. Same flake as build 71681; a networking stress test that counts request success, not error codes.
• no-orphans.test.ts (linux-aarch64 only): perl fast-exit orphan-reaping test. Process lifecycle test, no error-name path.

Neither touches anything this refactor changes (error enum types / .name() strings / dispatch). The diff is green on cargo check, cargo build, cargo clippy, bun run rust:check-all (10/10 targets), and the entire test suite on all other lanes. Re-roll already spent (4829df6). Needs a maintainer to merge past the gate (structurally unprovable for a behavior-preserving refactor, per earlier comments) and these two single-lane flakes.

[robobun]

Thanks for the numbers. Honest assessment of what this refactor could plausibly explain:

Install +12.5% — most plausibly mine. install::Error went from 2 bytes (NonZeroU16) to 6 bytes, so every Result<T, install::Error> return (hundreds of call sites in the install hot path) has a wider discriminant + payload. On a ~11ms operation that's almost all Rust, ~1.3ms of extra stack-copy/register-spill across the ? chain is believable. The fix would be dropping the cross-crate #[from] nesting in install::Error (Http/Spawn/Resolver/etc.) so it goes back to ≤2 bytes; that was the trade-off we discussed in the thread.

Express/Fastify −2-3% rps, +4% sys CPU — less clear. http::Error is 4 bytes (was 2), and runtime::Error is 8, but the serve hot path shouldn't be constructing errors. If it's the Result<T, E> return width on non-error paths in request handling, that's the same size fix.

Fastify +53 MB RSS / +27% minor faults — I can't attribute this to the refactor. The error enums are stack/register values; nothing here changes heap allocation patterns, and Express doesn't show the same RSS delta. This looks like a separate issue (or a different build — the table says bun-32488, is that this PR's build?).

If you want me to pursue the size shrink (drop cross-crate nesting → install::Error back to ≤2 bytes), I can, but it's the "selective flattening" we deferred earlier and will re-open a handful of the .name()-dispatch questions. Happy to take direction.

[Jarred-Sumner]

@robobun sorry this is a different PR please ignore.

[robobun]

Understood, no worries. PR state unchanged: cacb44aa, all refactor-caused test failures green, only the two unrelated single-lane flakes (proxy-stress on macOS-13-x64, no-orphans on linux-aarch64) remaining. Ready for review.

[Jarred-Sumner]

@robobun fix comments + conflicts

[robobun]

Rebased onto main (1 conflict in jsc_hooks.rs, 2 new err! sites from main in Blob.rs) and applied the dead-code cleanups per review: 16+10+3 dead variants deleted from jsc/crash_handler/install error.rs, WorkspaceMap.rs always-false disjuncts dropped, VirtualMachine.rs dead store removed. All checks green (check/clippy/rust:check-all 10/10). Pushed 75631c0.

[robobun]

CI 71735 at 75631c0 (rebased + dead-code cleanups): all refactor-caused test failures green. Single remaining failure is test-worker-message-port-transfer-terminate.js SIGABRT on x64-asan only — a worker-termination race test under ASAN, not error-code related. Diff doesn't touch Worker/MessagePort/terminate.

Re-roll already spent. Diff is green on cargo check/build/clippy, rust:check-all 10/10, and all other CI lanes. Ready for merge past the gate + this one unrelated lane.