Skip to content

fix: ignore VSCode inspector env vars in standalone executables#27662

Open
robobun wants to merge 1 commit intomainfrom
claude/disable-vscode-inspector-envvars-standalone
Open

fix: ignore VSCode inspector env vars in standalone executables#27662
robobun wants to merge 1 commit intomainfrom
claude/disable-vscode-inspector-envvars-standalone

Conversation

@robobun
Copy link
Collaborator

@robobun robobun commented Mar 1, 2026

Summary

  • BUN_INSPECT, BUN_INSPECT_CONNECT_TO, and BUN_INSPECT_PRELOAD environment variables are now ignored when running as a bun build --compile standalone executable
  • BUN_OPTIONS (e.g. BUN_OPTIONS=--inspect) continues to work as before, so users can still explicitly enable the inspector in standalone binaries

Motivation

When VSCode's Bun extension opens a "JavaScript Debug Terminal", it sets BUN_INSPECT, BUN_INSPECT_NOTIFY, and BUN_INSPECT_CONNECT_TO in the terminal environment. Running a standalone executable in that terminal would unexpectedly enable the inspector — and with ?break=1, hang indefinitely waiting for a debugger connection. Standalone executables are end-user programs that should not be affected by IDE debug instrumentation.

Test plan

  • New test verifies BUN_INSPECT with ?break=1 is ignored in standalone (previously would hang)
  • New test verifies BUN_OPTIONS=--smol still works in standalone via process.execArgv
  • Test fails on system bun (confirming behavioral change) and passes on debug build

🤖 Generated with Claude Code

BUN_INSPECT, BUN_INSPECT_CONNECT_TO, and BUN_INSPECT_PRELOAD are now
ignored when running as a `bun build --compile` standalone executable.
This prevents VSCode's debug terminal from unexpectedly enabling the
inspector (and potentially hanging) in compiled binaries. Users can
still explicitly enable the inspector via BUN_OPTIONS=--inspect.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@github-actions github-actions bot added the claude label Mar 1, 2026
@robobun
Copy link
Collaborator Author

robobun commented Mar 1, 2026

Updated 11:51 PM PT - Feb 28th, 2026

❌ Your commit 1c2b1bec has 5 failures in Build #38389 (All Failures):


🧪   To try this PR locally:

bunx bun-pr 27662

That installs a local version of the PR into your bun-27662 executable, so you can run:

bun-27662 --bun
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 1, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 7ef4b1b and 1c2b1be.

📒 Files selected for processing (3)
  • src/bun.js/VirtualMachine.zig
  • src/cli/Arguments.zig
  • test/cli/inspect/standalone-inspect.test.ts

Walkthrough

Modifies debugger configuration and inspector preload handling to detect and bypass environment variables in standalone mode. Adds tests verifying that BUN_INSPECT environment variables are ignored in standalone executables while BUN_OPTIONS remains functional.

Changes

Cohort / File(s) Summary
Debugger and Inspector Configuration
src/bun.js/VirtualMachine.zig, src/cli/Arguments.zig
Adds standalone mode detection to bypass BUN_INSPECT and BUN_INSPECT_PRELOAD environment variables in standalone executables, with comments explaining that BUN_OPTIONS remains functional through the enable path.
Standalone Inspection Tests
test/cli/inspect/standalone-inspect.test.ts
Introduces test suite verifying BUN_INSPECT is ignored in standalone executables while BUN_OPTIONS options remain functional.
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main change: ignoring VSCode inspector environment variables in standalone executables, which is the primary objective of this PR.
Description check ✅ Passed The description provides clear sections addressing 'What does this PR do?' (Summary and Motivation) and 'How did you verify your code works?' (Test plan), exceeding the minimal template requirements.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@claude claude bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - small, well-motivated fix that correctly suppresses VSCode debug env vars in standalone executables while preserving BUN_OPTIONS.

Extended reasoning...

Overview

This PR modifies two source files (VirtualMachine.zig and Arguments.zig) and adds one test file. In VirtualMachine.zig, when configureDebugger runs and the process is a standalone executable (standalone_module_graph != null), BUN_INSPECT and BUN_INSPECT_CONNECT_TO are replaced with empty strings so neither the .unspecified unix nor connect_to branches activate. In Arguments.zig, BUN_INSPECT_PRELOAD is similarly nulled out when StandaloneModuleGraph.get() != null. The .enable path (used by BUN_OPTIONS=--inspect) is unaffected since it flows through the CLI flag, not the env vars.

Security risks

No security concerns. This change reduces attack surface by preventing environment-variable-driven debugger activation in standalone binaries, which are end-user programs.

Level of scrutiny

This is production-critical runtime code, but the change is minimal (two conditional expressions plus one null check) and the logic is easy to verify. The empty-string and null fallbacks cleanly disable the env-var paths without affecting any other control flow.

Other factors

The new test covers both the suppression case (BUN_INSPECT with break=1 no longer hangs) and the pass-through case (BUN_OPTIONS still works). No bugs found by the automated bug hunting system. No outstanding reviewer comments to address.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

1 participant