process/worker: env descriptor validation, worker execArgv policy table with per-worker --expose-gc (+3 tests, worker 74%→76%)

packages/bun-usockets/src/crypto/root_certs.cpp

@@ -23,12 +23,18 @@ extern "C" void BUN__warn__extra_ca_load_failed(const char* filename, const char
 // Forward declarations for platform-specific functions
 // (Actual implementations are in platform-specific files)
 
-// External variable from Zig CLI arguments
+// External variables from the CLI arguments
 extern "C" bool Bun__Node__UseSystemCA;
+extern "C" bool Bun__Node__NoUseSystemCA;
 
 // Helper function to check if system CA should be used
 // Checks both CLI flag (--use-system-ca) and environment variable (NODE_USE_SYSTEM_CA=1)
 static bool us_should_use_system_ca() {
+  // --no-use-system-ca is the one thing that overrides NODE_USE_SYSTEM_CA, so a
+  // flag whose purpose is to restrict trust actually restricts it.
+  if (Bun__Node__NoUseSystemCA) {
+    return false;
+  }
   // Check CLI flag first
   if (Bun__Node__UseSystemCA) {
     return true;

packages/bun-usockets/src/eventing/epoll_kqueue.c

@@ -473,6 +473,13 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
         }
     }
 
+    /* Only ticks that really park are timed, so a busy loop pays nothing and a
+     * parked one pays two vDSO reads against a syscall it was making anyway.
+     * Publish the entry so a cross-thread reader can add the in-progress park. */
+    const uint64_t idle_start_ns = will_idle_inside_event_loop ? us_internal_monotonic_ns() : 0;
+    if (will_idle_inside_event_loop)
+        __atomic_store_n(&loop->data.idle_entry_ns, idle_start_ns, __ATOMIC_SEQ_CST);
+
     /* Fetch ready polls */
 #ifdef LIBUS_USE_EPOLL
     /* A zero timespec already has a fast path in ep_poll (fs/eventpoll.c):
@@ -491,6 +498,15 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
         timeout);
 #endif
 
+    if (will_idle_inside_event_loop) {
+        /* Clock read first so zero+add are adjacent seq_cst ops: a reader between them under-counts
+         * (bounded by one park) rather than double-counts. seq_cst — release would not order the add
+         * before the store on ARM. */
+        uint64_t now = us_internal_monotonic_ns();
+        __atomic_store_n(&loop->data.idle_entry_ns, 0, __ATOMIC_SEQ_CST);
+        __atomic_add_fetch(&loop->data.idle_ns, now - idle_start_ns, __ATOMIC_SEQ_CST);
+    }
+
     /* Before anything can allocate again. */
     if (handed_off)
         mi_on_thread_idle_end();

packages/bun-usockets/src/eventing/libuv.c

@@ -332,6 +332,10 @@ struct us_loop_t *us_create_loop(void *hint,
 
   loop->uv_loop = hint ? hint : uv_loop_new();
   loop->is_default = hint != 0;
+  /* Without this libuv never accumulates provider_idle_time, so
+   * uv_metrics_idle_time() — and performance.eventLoopUtilization() — read 0.
+   * node enables it unconditionally too (node.cc, node_worker.cc). */
+  uv_loop_configure(loop->uv_loop, UV_METRICS_IDLE_TIME);
 
   loop->uv_pre = us_malloc(sizeof(uv_prepare_t));
   uv_prepare_init(loop->uv_loop, loop->uv_pre);

packages/bun-usockets/src/internal/internal.h

@@ -158,6 +158,9 @@ uint64_t us_internal_monotonic_ns(void);
 long long us_internal_sweep_timeout_ns(struct us_loop_t *loop);
 void us_internal_sweep_if_due(struct us_loop_t *loop);
 #endif
+/* Nanoseconds this loop has spent parked, including a park in progress. Safe
+ * from another thread. Both platforms: Rust calls it ungated. */
+uint64_t us_loop_idle_ns(struct us_loop_t *loop);
 void us_internal_free_closed_sockets(us_loop_r loop);
 void us_internal_loop_link_group(struct us_loop_t *loop, struct us_socket_group_t *group);
 void us_internal_loop_unlink_group(struct us_loop_t *loop, struct us_socket_group_t *group);

packages/bun-usockets/src/internal/loop_data.h

@@ -76,6 +76,15 @@ struct us_internal_loop_data_t {
      * for lsquic's time-driven state. POSIX folds the deadline into the
      * epoll_pwait2 timeout via getTimeout() instead. */
     struct us_timer_t *quic_timer;
+#endif
+#ifndef LIBUS_USE_LIBUV
+    /* Nanoseconds parked, for eventLoopUtilization(). Read cross-thread —
+     * __atomic_* only. MIRRORED in src/uws_sys/InternalLoopData.rs: this struct
+     * is us_loop_t's first member, so a field here shifts num_polls. */
+    unsigned long long idle_ns;
+    /* Monotonic ns the current park began, 0 when not parked: a mid-park reader
+     * must add (now - entry) or it sees a stale total. So does libuv. */
+    unsigned long long idle_entry_ns;
 #endif
     struct us_socket_group_t *iterator;
     char *recv_buf;

packages/bun-usockets/src/loop.c

@@ -119,6 +119,26 @@ void us_internal_sweep_if_due(struct us_loop_t *loop) {
 #endif
 
 
+/* Nanoseconds this loop has spent parked, for performance.eventLoopUtilization().
+ * Safe to call from another thread. */
+uint64_t us_loop_idle_ns(struct us_loop_t *loop) {
+#ifdef LIBUS_USE_LIBUV
+    return uv_metrics_idle_time(loop->uv_loop);
+#else
+    uint64_t idle = __atomic_load_n(&loop->data.idle_ns, __ATOMIC_SEQ_CST);
+    /* Parked right now? The total is only folded in when the park ends, so add
+     * the in-progress interval — otherwise a mid-park reader sees a stale idle
+     * and over-reports active. Same as libuv's uv_metrics_idle_time. */
+    uint64_t entry = __atomic_load_n(&loop->data.idle_entry_ns, __ATOMIC_SEQ_CST);
+    if (entry > 0) {
+        uint64_t now = us_internal_monotonic_ns();
+        if (now > entry)
+            idle += now - entry;
+    }
+    return idle;
+#endif
+}
+
 void us_internal_loop_data_init(struct us_loop_t *loop, void (*wakeup_cb)(struct us_loop_t *loop),
     void (*pre_cb)(struct us_loop_t *loop), void (*post_cb)(struct us_loop_t *loop)) {
     // We allocate with calloc, so we only need to initialize the specific fields in use.

src/clap/comptime.rs

@@ -543,6 +543,7 @@ impl<Id> ComptimeClap<Id> {
             diagnostic: opt.diagnostic,
             state: streaming::State::Normal,
             positional: None,
+            short_aliases: opt.short_aliases,
         };
 
         while let Some(arg) = stream.next()? {

src/clap/lib.rs

@@ -374,6 +374,10 @@ impl Default for Help {
 pub struct ParseOptions<'a> {
     pub diagnostic: Option<&'a mut Diagnostic>,
     pub stop_after_positional_at: usize,
+    /// Whole-token rewrites applied only where a token is being classified as a
+    /// flag, never to an option's value or a `--` target. Node keeps its own
+    /// aliases on exactly that branch (node_options-inl.h).
+    pub short_aliases: &'static [(&'static [u8], &'static [u8])],
 }
 
 // Help/usage/error rendering — none of this is on the cold-start hot chain
@@ -455,6 +459,7 @@ pub fn parse<Id: 'static>(
         ParseOptions {
             diagnostic: opt.diagnostic,
             stop_after_positional_at: opt.stop_after_positional_at,
+            short_aliases: opt.short_aliases,
         },
     )?;
     Ok(Args { clap })
@@ -474,6 +479,7 @@ pub fn parse_with_table<Id: 'static>(
         ParseOptions {
             diagnostic: opt.diagnostic,
             stop_after_positional_at: opt.stop_after_positional_at,
+            short_aliases: opt.short_aliases,
         },
     )?;
     Ok(Args { clap })

src/clap/streaming.rs

@@ -61,6 +61,7 @@ pub struct StreamingClap<'p, 'a, Id, ArgIterator> {
     pub(crate) state: State<'a>,
     pub(crate) positional: Option<&'p clap::Param<Id>>,
     pub(crate) diagnostic: Option<&'p mut clap::Diagnostic>,
+    pub(crate) short_aliases: &'static [(&'static [u8], &'static [u8])],
 }
 
 // ArgIterator is the
@@ -300,9 +301,17 @@ where
     }
 
     fn parse_next_arg(&mut self) -> Result<Option<ArgInfo<'a>>, ArgError> {
-        let Some(full_arg) = self.iter.next() else {
+        let Some(mut full_arg) = self.iter.next() else {
             return Ok(None);
         };
+        // Only tokens reaching here are being read as flags: option values and
+        // `--` targets are pulled straight off `iter`, so they stay verbatim.
+        for (from, to) in self.short_aliases {
+            if full_arg == *from {
+                full_arg = to;
+                break;
+            }
+        }
         if full_arg == b"--" || full_arg == b"-" {
             return Ok(Some(ArgInfo {
                 arg: full_arg,
@@ -354,6 +363,7 @@ mod tests {
             remain: args_strings,
         };
         let mut c = StreamingClap::<u8, args::SliceIterator> {
+            short_aliases: &[],
             params,
             iter: &mut iter,
             state: State::Normal,
@@ -386,6 +396,7 @@ mod tests {
             remain: args_strings,
         };
         let mut c = StreamingClap::<u8, args::SliceIterator> {
+            short_aliases: &[],
             params,
             iter: &mut iter,
             state: State::Normal,

src/install/PackageManager/CommandLineArguments.rs

@@ -1002,6 +1002,7 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/pm#scan<r>.
             clap::ParseOptions {
                 diagnostic: Some(&mut diag),
                 stop_after_positional_at: 0,
+                ..Default::default()
             },
         ) {
             Ok(a) => {

src/js/builtins/ProcessObjectInternals.ts

@@ -528,13 +528,27 @@ export function windowsEnv(
       return typeof p !== "symbol" ? delete internalEnv[k] : false;
     },
     defineProperty(_, p, attributes) {
+      if (typeof p === "symbol") {
+        // JSProcessEnvMap rejects symbol keys (after descriptor validation),
+        // matching node; no bookkeeping applies.
+        return $Object.$defineProperty(internalEnv, p, attributes);
+      }
       const k = String(p).toUpperCase();
-      $assert(typeof p === "string"); // proxy is only string and symbol. the symbol would have thrown by now
-      if (!(k in internalEnv) && !envMapList.includes(p)) {
+      // Same predicate as the set trap: `k in internalEnv` would be always-true
+      // for the DontEnum TZ/TLS/proxy CustomAccessors and drop them from ownKeys.
+      const isNewKey = !envMapList.includes(p) && !envMapList.some(x => x.toUpperCase() === k);
+      // Define before bookkeeping: JSProcessEnvMap may throw on a partial data
+      // descriptor, and a rejected define must not leave a phantom envMapList key.
+      const r = $Object.$defineProperty(internalEnv, k, attributes);
+      if (isNewKey) {
         envMapList.push(p);
       }
-      editWindowsEnvVar(k, internalEnv[k]);
-      return $Object.$defineProperty(internalEnv, k, attributes);
+      // String-coerce: the data path is coerced natively, but an accessor
+      // descriptor (deliberate divergence) installs a getter whose result
+      // reaches this read raw, and editWindowsEnvVar requires string|null.
+      const v = internalEnv[k];
+      editWindowsEnvVar(k, v == null ? null : String(v));
+      return r;
     },
     getOwnPropertyDescriptor(target, p) {
       if (typeof p === "string") {

src/js/internal/async_hooks_tick.ts

@@ -1,14 +1,6 @@
-// Bridge between node:async_hooks createHook() and the process.nextTick
-// queue (builtins/ProcessObjectInternals.ts). Enabled `init` hooks are pushed
-// into `tickInitHooks` so the nextTick hot path pays only an array-length
-// check when no hook is enabled.
-//
-// The array identity must stay stable (push/splice only, never reassign):
-// the nextTick closure captures it once at setup.
-//
-// Currently only TickObject `init` events are delivered (enough for
-// console.log/stream.write tick-coalescing tests); promise, timer and native
-// resource events are still unimplemented.
+// Bridge between createHook() and process.nextTick: enabled `init` hooks live in `tickInitHooks` so the
+// hot path pays only an array-length check. Array identity is stable (push/splice only) — nextTick captures it once.
+// Only TickObject and WORKER `init` events are delivered; other resource types are unimplemented.
 const tickInitHooks = [];
 let nextAsyncId = 1;
 

src/js/internal/perf/event_loop_utilization.ts

@@ -0,0 +1,27 @@
+// Shared by perf_hooks and worker_threads; see https://github.com/nodejs/node/blob/main/lib/internal/perf/event_loop_utilization.js
+// `elu` is [elapsedSinceLoopStartMs, idleMs] or null before the loop turns (node's `loopStart <= 0` branch → {0,0,0}).
+// Divisions are unguarded: node returns NaN for a zero total, collapsing to 0 would diverge.
+function internalEventLoopUtilization(elu, util1, util2) {
+  if (elu === null) {
+    return { idle: 0, active: 0, utilization: 0 };
+  }
+
+  if (util2) {
+    const idle = util1.idle - util2.idle;
+    const active = util1.active - util2.active;
+    return { idle, active, utilization: active / (idle + active) };
+  }
+
+  const idle = elu[1];
+  const active = elu[0] - idle;
+
+  if (!util1) {
+    return { idle, active, utilization: active / (idle + active) };
+  }
+
+  const idleDelta = idle - util1.idle;
+  const activeDelta = active - util1.active;
+  return { idle: idleDelta, active: activeDelta, utilization: activeDelta / (idleDelta + activeDelta) };
+}
+
+export default { internalEventLoopUtilization };

src/js/node/async_hooks.ts

@@ -495,16 +495,14 @@ function createHook(hook) {
     throw $ERR_ASYNC_CALLBACK("hook.promiseResolve");
 
   let enabledInit;
-  return {
+  const asyncHook = {
     enable() {
       if (init !== undefined && enabledInit === undefined) {
-        // init is delivered for TickObject resources (process.nextTick);
-        // other resource types are still unimplemented.
-        // Per-instance wrapper: two hooks registered with the same init
-        // function must stay independently removable (removal is by
-        // identity, and removing the other instance's entry would reorder
-        // its callback relative to unrelated hooks).
-        enabledInit = (asyncId, type, triggerAsyncId, resource) => init(asyncId, type, triggerAsyncId, resource);
+        // Only TickObject and WORKER init are delivered. Per-instance wrapper so two hooks with the
+        // same init stay independently removable. node calls init as a method on the AsyncHook
+        // (https://github.com/nodejs/node/blob/main/lib/internal/async_hooks.js), so `this.disable()` works.
+        enabledInit = (asyncId, type, triggerAsyncId, resource) =>
+          init.$call(asyncHook, asyncId, type, triggerAsyncId, resource);
         require("internal/async_hooks_tick").tickInitHooks.push(enabledInit);
       }
       if (before !== undefined || after !== undefined || destroy !== undefined || promiseResolve !== undefined) {
@@ -531,6 +529,7 @@ function createHook(hook) {
       return this;
     },
   };
+  return asyncHook;
 }
 
 const executionAsyncIdNotImpl = createWarning(

src/js/node/perf_hooks.ts

@@ -116,12 +116,13 @@ function createPerformanceNodeTiming() {
   return object;
 }
 
-function eventLoopUtilization(_utilization1, _utilization2) {
-  return {
-    idle: 0,
-    active: 0,
-    utilization: 0,
-  };
+// [elapsedSinceLoopStartMs, idleMs] for this thread's loop, or null before it
+// has turned.
+const getLoopELU = $newRustFunction("bun.rs", "getLoopELU", 0);
+const { internalEventLoopUtilization } = require("internal/perf/event_loop_utilization");
+
+function eventLoopUtilization(utilization1, utilization2) {
+  return internalEventLoopUtilization(getLoopELU(), utilization1, utilization2);
 }
 
 const { PerformanceResourceTiming } = globalThis;

src/js/node/tls.ts

@@ -1683,8 +1683,11 @@ function cacheDefaultCACertificates() {
     ArrayPrototypePush.$call(defaultCACertificates, bundled[i]);
   }
 
-  // Include system certificates when --use-system-ca is set or NODE_USE_SYSTEM_CA=1
-  if (getUseSystemCA() || process.env.NODE_USE_SYSTEM_CA === "1") {
+  // --use-system-ca / --no-use-system-ca are per-thread and explicit; only when
+  // neither was given does NODE_USE_SYSTEM_CA decide. node lets the env var win
+  // under --use-bundled-ca but not under --no-use-system-ca.
+  const useSystemCA = getUseSystemCA();
+  if (useSystemCA === true || (useSystemCA === undefined && process.env.NODE_USE_SYSTEM_CA === "1")) {
     const system = cacheSystemCACertificates();
     for (let i = 0; i < system.length; ++i) {
       ArrayPrototypePush.$call(defaultCACertificates, system[i]);