process.env: Node-semantics exotic object on POSIX; coerce/validate/setenv-sync, first-wins dup load, typed-cache invalidate

src/bun_core/env_var.rs

@@ -369,6 +369,14 @@ pub(crate) mod kind {
 
                 raw_env
             }
+
+            /// Drop the cached value so the next `get()` re-reads libc.
+            /// `process.env` writes call setenv() and then this, so the cached
+            /// pointer into the old environ slot is never dereferenced again.
+            #[inline]
+            pub(crate) fn reset(&self) {
+                self.len_value.store(NOT_LOADED_LEN, Ordering::Release);
+            }
         }
     }
 
@@ -448,6 +456,12 @@ pub(crate) mod kind {
                 );
                 Some(string_is_truthy)
             }
+
+            #[inline]
+            pub(crate) fn reset(&self) {
+                self.value
+                    .store(StoredType::Unknown as u8, Ordering::Relaxed);
+            }
         }
     }
 
@@ -619,6 +633,11 @@ pub(crate) mod kind {
                     }
                 }
             }
+
+            #[inline]
+            pub(crate) fn reset(&self) {
+                self.value.store(UNKNOWN_SENTINEL, Ordering::Relaxed);
+            }
         }
     }
 }
@@ -763,6 +782,13 @@ macro_rules! platform_specific_new {
                 }
             }
 
+            /// Drop the cached value so the next `get()` re-reads libc; used by
+            /// the `process.env` write path after `setenv()`.
+            #[allow(dead_code)]
+            pub fn reset() {
+                CACHE.reset();
+            }
+
             /// Retrieve the value of the environment variable, reloading it from the environment.
             /// Fails if the current platform is unsupported.
             fn get_force_reload() -> Option<K::ValueType> {
@@ -951,3 +977,34 @@ macro_rules! new_feature_flag {
     };
 }
 pub(crate) use new_feature_flag;
+
+/// Drop the cached value for the typed accessor whose key matches `name`, so
+/// the next `get()` re-reads libc. `process.env` writes call `setenv()` and
+/// then this — otherwise `os.homedir()` / `os.tmpdir()` would keep returning
+/// the value cached on first read.
+///
+/// Only the string-kind accessors that are read at runtime (after VM startup)
+/// are listed; the `BUN_*` flags are read once on boot and intentionally left
+/// cached.
+pub fn invalidate_for_setenv(name: &[u8]) {
+    macro_rules! try_var {
+        ($v:ident) => {
+            if let Some(k) = $v::platform_key() {
+                if crate::strings::eql(k.as_bytes(), name) {
+                    $v::reset();
+                    return;
+                }
+            }
+        };
+    }
+    try_var!(HOME);
+    try_var!(PATH);
+    try_var!(USER);
+    try_var!(TMPDIR);
+    try_var!(TEMP);
+    try_var!(TMP);
+    try_var!(SHELL);
+    try_var!(XDG_CACHE_HOME);
+    try_var!(XDG_CONFIG_HOME);
+    try_var!(XDG_DATA_HOME);
+}

src/dotenv/env_loader.rs

@@ -583,19 +583,30 @@ impl Loader {
 
         let environ: &[*const c_char] = bun_sys::environ();
         self.map.map.ensure_total_capacity(environ.len())?;
+        // The kernel accepts duplicate KEY= entries in environ. libc getenv()
+        // and Node both return the FIRST occurrence, so keep the first and
+        // skip later duplicates. Indices below `prior_count` were seeded
+        // before this scan (e.g. `bun test` pre-seeding NODE_ENV) and are
+        // still overwritten so the process environment retains priority.
+        let prior_count = self.map.map.count();
         for &_env in environ {
             // SAFETY: environ entries are NUL-terminated C strings from the OS
             let env = unsafe { bun_core::ffi::cstr(_env) }.to_bytes();
-            if let Some(i) = strings::index_of_char(env, b'=') {
-                let key = &env[..i as usize];
-                let value = &env[i as usize + 1..];
-                if !key.is_empty() {
-                    self.map.put(key, value)?;
-                }
-            } else {
-                if !env.is_empty() {
-                    self.map.put(env, b"")?;
-                }
+            // An entry without '=' is malformed per POSIX ("name=value"); libc
+            // getenv() and Node ignore it.
+            let Some(i) = strings::index_of_char(env, b'=') else {
+                continue;
+            };
+            let key = &env[..i as usize];
+            if key.is_empty() {
+                continue;
+            }
+            let value = &env[i as usize + 1..];
+            let gop = self.map.get_or_put_without_value(key)?;
+            if !gop.found_existing || gop.index < prior_count {
+                *gop.value_ptr = HashTableValue {
+                    value: Box::from(value),
+                };
             }
         }
         self.did_load_process = true;

src/js/builtins/ProcessObjectInternals.ts

@@ -490,9 +490,18 @@
       return internalEnv[p];
     },
     set(_, p, value) {
-      const k = String(p).toUpperCase();
-      $assert(typeof p === "string"); // proxy is only string and symbol. the symbol would have thrown by now
+      // Node's env setter does `ToString` on key and value, which throws on a
+      // Symbol; JS `String()` special-cases Symbols, so reject explicitly.
+      if (typeof p === "symbol" || typeof value === "symbol") {
+        throw new TypeError("Cannot convert a Symbol value to a string");
+      }
+      const k = (p as string).toUpperCase();
       value = String(value); // If toString() throws, we want to avoid it existing in the envMapList
+      // Node silently ignores empty names and names containing '=' (the
+      // assignment succeeds but nothing is stored, matching RealEnvStore::Set).
+      if (k === "" || k.indexOf("=") !== -1) {
+        return true;
+      }
       // Track the key for enumeration if it isn't already there. Don't gate on
       // `k in internalEnv`: the proxy-related env-var accessors (HTTP_PROXY,
       // HTTPS_PROXY, NO_PROXY and lowercase variants) always exist on
@@ -528,13 +537,44 @@
       return typeof p !== "symbol" ? delete internalEnv[k] : false;
     },
     defineProperty(_, p, attributes) {
-      const k = String(p).toUpperCase();
-      $assert(typeof p === "string"); // proxy is only string and symbol. the symbol would have thrown by now
+      if (typeof p === "symbol") {
+        throw new TypeError("Cannot convert a Symbol value to a string");
+      }
+      const k = (p as string).toUpperCase();
+      // Node only accepts a fully-permissive data descriptor and routes it
+      // through the env setter (RealEnvStore::PropertyDefinerCallback).
+      if ("get" in attributes || "set" in attributes) {
+        throw $ERR_INVALID_OBJECT_DEFINE_PROPERTY(
+          "'process.env' does not accept an accessor(getter/setter) descriptor",
+        );
+      }
+      if (
+        !("value" in attributes) ||
+        attributes.configurable !== true ||
+        attributes.writable !== true ||
+        attributes.enumerable !== true
+      ) {
+        throw $ERR_INVALID_OBJECT_DEFINE_PROPERTY(
+          "'process.env' only accepts a configurable, writable, and enumerable data descriptor",
+        );
+      }
+      const value = String(attributes.value);
+      if (k === "" || k.indexOf("=") !== -1) {
+        return true;
+      }
       if (!(k in internalEnv) && !envMapList.includes(p)) {
         envMapList.push(p);
       }
-      editWindowsEnvVar(k, internalEnv[k]);
-      return $Object.$defineProperty(internalEnv, k, attributes);
+      editWindowsEnvVar(k, value);
+      internalEnv[k] = value;
+      return true;
+    },
+    preventExtensions() {
+      // Node: Object.freeze/seal/preventExtensions on process.env throw.
+      return false;
+    },
+    isExtensible() {
+      return true;
     },
     getOwnPropertyDescriptor(target, p) {
       if (typeof p === "string") {