feat(compat): integrate upstream Bun PRs for OpenClaw

CHANGELOG.md

@@ -0,0 +1,6 @@
+# OpenClaw Bun fork changelog
+
+## Unreleased
+
+- Integrate 19 pending upstream PRs for filesystem, SQLite, worker, async-hook, HTTP/TLS, module-loader, process, and path compatibility, retaining their original histories and required worker/query-cache prerequisites.
+- Resolve interactions between worker and timer hooks, pending HTTPS listen configuration, forceful shutdown after graceful close, and literal filename delimiters in module resolution and lookup paths.

docs/runtime/sqlite.mdx

@@ -649,6 +649,8 @@ const db = new Database();
 db.loadExtension("myext");
 ```
 
+Workers can repeat `setCustomSQLite()` with the exact same path. Bun rejects a different path after SQLite loads.
+
 </Note>
 
 ### `.fileControl(cmd: number, value: any)`

packages/bun-types/sqlite.d.ts

@@ -341,11 +341,10 @@ declare module "bun:sqlite" {
      *
      * @note macOS-only
      *
-     * This only works before SQLite is loaded, that is,
-     * before you call `new Database()`.
-     *
-     * It can only be run once because it loads
-     * the SQLite library into the process.
+     * The initial call only works before SQLite is loaded, that is,
+     * before you call `new Database()`. Later calls with the exact same path
+     * are idempotent so workers can adopt the process-wide selection.
+     * A different path is rejected after SQLite loads.
      *
      * @param path The path to the SQLite library
      */

packages/bun-usockets/src/crypto/openssl.c

@@ -169,6 +169,8 @@ static int us_ctx_cache_ex_idx = -1;
  * ca/caFile options or a later addCACert): the per-socket client attach must
  * not replace such a store with the process-shared default roots. */
 static int us_ctx_user_ca_ex_idx = -1;
+/* The resolved system-CA decision the context was built with (stored as value+1 so 0 = unset). */
+static int us_ctx_use_system_ca_ex_idx = -1;
 static int us_ssl_reneg_state_idx = -1;
 /* Per-connection async-SNI suspension state (select_certificate_cb retry). */
 static int us_ssl_sni_pending_idx = -1;
@@ -450,6 +452,7 @@ static void us_ex_idx_init(void) {
   us_sni_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ctx_cache_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, bun_ssl_ctx_cache_on_free);
   us_ctx_user_ca_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
+  us_ctx_use_system_ca_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ctx_sni_policy_ex_idx = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL, NULL);
   us_ssl_reneg_state_idx = SSL_get_ex_new_index(0, NULL, NULL, NULL, us_ssl_reneg_state_free);
   us_ssl_sni_pending_idx = SSL_get_ex_new_index(0, NULL, NULL, NULL, us_ssl_sni_pending_free);
@@ -961,13 +964,15 @@ static int us_ssl_ctx_use_privatekey_content(SSL_CTX *ctx, const char *content,
  * the still-empty SSL_CTX_new() store are first replaced by a private full
  * default-root copy, and the context is marked so the per-socket attach keeps
  * it. https://github.com/nodejs/node/blob/v26.3.0/src/crypto/crypto_context.cc#L1831 */
+int us_ssl_ctx_use_system_ca(SSL_CTX *ctx) {
+  us_ex_idx_ensure();
+  intptr_t stored = (intptr_t)SSL_CTX_get_ex_data(ctx, us_ctx_use_system_ca_ex_idx);
+  return stored ? (int)(stored - 1) : us_default_use_system_ca();
+}
+
 static X509_STORE *us_ssl_ctx_get_own_cert_store(SSL_CTX *ctx) {
   X509_STORE *store = SSL_CTX_get_cert_store(ctx);
-  /* us_get_shared_default_ca_store() up-refs before returning, so release
-   * the reference taken just for this comparison. */
-  X509_STORE *shared = us_get_shared_default_ca_store();
-  int store_is_shared = store != NULL && store == shared;
-  X509_STORE_free(shared);
+  int store_is_shared = us_is_shared_default_ca_store(store);
   us_ex_idx_ensure();
   int store_is_empty = 0;
   if (store != NULL && !store_is_shared) {
@@ -979,7 +984,7 @@ static X509_STORE *us_ssl_ctx_get_own_cert_store(SSL_CTX *ctx) {
    * no `ca` configured at all may be seeded with the default roots here. */
   int user_ca = SSL_CTX_get_ex_data(ctx, us_ctx_user_ca_ex_idx) != NULL;
   if (store == NULL || store_is_shared || (store_is_empty && !user_ca)) {
-    X509_STORE *own = us_get_default_ca_store();
+    X509_STORE *own = us_get_default_ca_store(us_ssl_ctx_use_system_ca(ctx));
     if (own == NULL) {
       return NULL;
     }
@@ -1269,6 +1274,9 @@ SSL_CTX *us_ssl_ctx_build_raw(struct us_bun_socket_context_options_t options,
   /* Register the live-count free_func first thing so every exit (including
    * build_fail) balances. The packed reneg policy reuses the same slot. */
   SSL_CTX_set_ex_data(ssl_context, us_ssl_ctx_ex_idx(), NULL);
+  const int use_system_ca = us_resolve_use_system_ca(options.use_system_ca);
+  us_ex_idx_ensure();
+  SSL_CTX_set_ex_data(ssl_context, us_ctx_use_system_ca_ex_idx, (void *)(intptr_t)(use_system_ca + 1));
 
   /* Default options we rely on — changing these breaks the BIO logic. */
   SSL_CTX_set_read_ahead(ssl_context, 1);
@@ -1401,7 +1409,7 @@ SSL_CTX *us_ssl_ctx_build_raw(struct us_bun_socket_context_options_t options,
      * addRootCerts() when `ca` is absent - the handshake-time auto-chain and
      * (for requestCert) client verification both read it. The getter up-refs,
      * so set_cert_store owns exactly one reference per context. */
-    SSL_CTX_set_cert_store(ssl_context, us_get_shared_default_ca_store());
+    SSL_CTX_set_cert_store(ssl_context, us_get_shared_default_ca_store(use_system_ca));
     if (options.request_cert) {
       SSL_CTX_set_verify(ssl_context,
           options.reject_unauthorized ? (SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
@@ -1792,7 +1800,7 @@ void us_internal_ssl_attach(struct us_socket_t *s, SSL_CTX *ctx,
          * A context whose store holds user-provided CAs (ca/caFile options or
          * addCACert) keeps using its own store - overriding it here would
          * hide those CAs from chain verification. */
-        X509_STORE *roots = us_get_shared_default_ca_store();
+        X509_STORE *roots = us_get_shared_default_ca_store(us_ssl_ctx_use_system_ca(ctx));
         if (roots) SSL_set0_verify_cert_store(ssl, roots);
       }
     }
@@ -3277,6 +3285,23 @@ static int sni_cb(SSL *ssl, int *al, void *arg) {
   return SSL_TLSEXT_ERR_OK;
 }
 
+void us_listen_socket_set_ssl_ctx(struct us_listen_socket_t *ls, SSL_CTX *ctx) {
+  if (ls->ssl_ctx == ctx) return;
+
+  SSL_CTX_up_ref(ctx);
+  SSL_CTX *previous = ls->ssl_ctx;
+  ls->ssl_ctx = ctx;
+
+  if (ls->sni) {
+    SSL_CTX_set_tlsext_servername_callback(ctx, sni_cb);
+  }
+  if (ls->on_server_name) {
+    SSL_CTX_set_select_certificate_cb(ctx, us_select_cert_cb);
+  }
+
+  if (previous) SSL_CTX_free(previous);
+}
+
 int us_listen_socket_add_server_name(struct us_listen_socket_t *ls,
                                      const char *hostname_pattern,
                                      SSL_CTX *ctx, void *user) {

packages/bun-usockets/src/crypto/root_certs.cpp

@@ -1,6 +1,7 @@
 #include "./root_certs_header.h"
 #include "./internal/internal.h"
 #include <mutex>
+#include <atomic>
 #include <string.h>
 #include <string_view>
 #include <unordered_set>
@@ -48,22 +49,34 @@ static void us_cert_file_into_bio(void *ctx, const uint8_t *data, size_t len) {
 // Forward declarations for platform-specific functions
 // (Actual implementations are in platform-specific files)
 
-// External variable from Zig CLI arguments
+// External variables from the CLI arguments
 extern "C" bool Bun__Node__UseSystemCA;
-
-// Helper function to check if system CA should be used
-// Checks both CLI flag (--use-system-ca) and environment variable (NODE_USE_SYSTEM_CA=1)
-static bool us_should_use_system_ca() {
-  // Check CLI flag first
+extern "C" bool Bun__Node__NoUseSystemCA;
+// BunCAStore discriminant (Arguments.rs): 1 == --use-openssl-ca.
+extern "C" uint8_t Bun__Node__CAStore;
+static const uint8_t BUN_CA_STORE_OPENSSL = 1;
+
+// The process-wide default: --no-use-system-ca beats everything, then --use-system-ca, then
+// NODE_USE_SYSTEM_CA=1. A thread (node: Environment) started with its own flag overrides this for
+// the contexts it creates — see us_bun_socket_context_options_t.use_system_ca.
+extern "C" int us_default_use_system_ca() {
+  if (Bun__Node__NoUseSystemCA) {
+    return 0;
+  }
   if (Bun__Node__UseSystemCA) {
-    return true;
+    return 1;
   }
-
-  // Check environment variable
   const char *use_system_ca = getenv("NODE_USE_SYSTEM_CA");
   return use_system_ca && strcmp(use_system_ca, "1") == 0;
 }
 
+// Resolve an options-struct tri-state (0: process default, >0: include system roots, <0: exclude).
+extern "C" int us_resolve_use_system_ca(int requested) {
+  if (requested > 0) return 1;
+  if (requested < 0) return 0;
+  return us_default_use_system_ca();
+}
+
 // Platform-specific system certificate loading implementations are separated:
 // - macOS: root_certs_darwin.cpp (Security framework with dynamic loading)
 // - Windows: root_certs_windows.cpp (Windows CryptoAPI)
@@ -291,39 +304,49 @@ const us_system_certs_t &us_get_root_system_certs() {
   return system_certs;
 }
 
-extern "C" X509_STORE *us_get_default_ca_store() {
+extern "C" X509_STORE *us_get_default_ca_store(int use_system_ca) {
   X509_STORE *store = X509_STORE_new();
   if (store == NULL) {
     return NULL;
   }
   X509_STORE_set_flags(store, X509_V_FLAG_IGNORE_EXPIRED_TRUST_ANCHORS);
 
-  X509_LAZY_CERT_SET *bundled = us_get_bundled_root_cert_set();
-  if (bundled == NULL || !X509_STORE_add_lazy_cert_set(store, bundled)) {
-    X509_STORE_free(store);
-    return NULL;
-  }
+  // --use-openssl-ca: OpenSSL's default lookups *instead of* the bundled roots, and no system store, as in node's
+  // NewRootCertStore (https://github.com/nodejs/node/blob/v26.3.0/src/crypto/crypto_context.cc#L1099-L1109).
+  const int openssl_ca = Bun__Node__CAStore == BUN_CA_STORE_OPENSSL;
+  if (openssl_ca) {
+    if (!X509_STORE_set_default_paths(store)) {
+      X509_STORE_free(store);
+      return NULL;
+    }
+  } else {
+    X509_LAZY_CERT_SET *bundled = us_get_bundled_root_cert_set();
+    if (bundled == NULL || !X509_STORE_add_lazy_cert_set(store, bundled)) {
+      X509_STORE_free(store);
+      return NULL;
+    }
 
-  // What X509_STORE_set_default_paths(store) trusts: the default certificate file (above) and the default hashed
-  // certificate directory, which BoringSSL already consults lazily per lookup.
-  const us_openssl_default_cert_file &file = us_get_openssl_default_cert_file();
-  if (file.certs != nullptr && !X509_STORE_add_lazy_cert_set(store, file.certs)) {
-    X509_STORE_free(store);
-    return NULL;
-  }
-  for (size_t i = 0; file.trusted != nullptr && i < sk_X509_num(file.trusted); i++) {
-    X509_STORE_add_cert(store, sk_X509_value(file.trusted, i));
-  }
-  for (size_t i = 0; file.crls != nullptr && i < sk_X509_CRL_num(file.crls); i++) {
-    X509_STORE_add_crl(store, sk_X509_CRL_value(file.crls, i));
-  }
-  X509_LOOKUP *hash_dir = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
-  if (hash_dir == NULL) {
-    X509_STORE_free(store);
-    return NULL;
+    // What X509_STORE_set_default_paths(store) trusts: the default certificate file (above) and the default hashed
+    // certificate directory, which BoringSSL already consults lazily per lookup.
+    const us_openssl_default_cert_file &file = us_get_openssl_default_cert_file();
+    if (file.certs != nullptr && !X509_STORE_add_lazy_cert_set(store, file.certs)) {
+      X509_STORE_free(store);
+      return NULL;
+    }
+    for (size_t i = 0; file.trusted != nullptr && i < sk_X509_num(file.trusted); i++) {
+      X509_STORE_add_cert(store, sk_X509_value(file.trusted, i));
+    }
+    for (size_t i = 0; file.crls != nullptr && i < sk_X509_CRL_num(file.crls); i++) {
+      X509_STORE_add_crl(store, sk_X509_CRL_value(file.crls, i));
+    }
+    X509_LOOKUP *hash_dir = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
+    if (hash_dir == NULL) {
+      X509_STORE_free(store);
+      return NULL;
+    }
+    X509_LOOKUP_add_dir(hash_dir, NULL, X509_FILETYPE_DEFAULT);
+    ERR_clear_error();
   }
-  X509_LOOKUP_add_dir(hash_dir, NULL, X509_FILETYPE_DEFAULT);
-  ERR_clear_error();
 
   STACK_OF(X509) *root_extra_cert_instances = us_get_root_extra_cert_instances();
   if (root_extra_cert_instances) {
@@ -332,7 +355,9 @@ extern "C" X509_STORE *us_get_default_ca_store() {
     }
   }
 
-  if (us_should_use_system_ca()) {
+  // `use_system_ca` is the decision of the thread this store is built for (us_resolve_use_system_ca), not only the
+  // process-wide flag: node makes --use-system-ca a per-Environment option.
+  if (use_system_ca && !openssl_ca) {
     const us_system_certs_t &system = us_get_root_system_certs();
     if (system.lazy != nullptr && !X509_STORE_add_lazy_cert_set(store, system.lazy)) {
       X509_STORE_free(store);
@@ -346,18 +371,27 @@ extern "C" X509_STORE *us_get_default_ca_store() {
   return store;
 }
 
-// Process-wide immutable default store. Safe to share across SSL_CTXs that
-// don't add per-config CAs (the user-`ca` path in build_raw populates the
-// SSL_CTX's own private, initially-empty store instead), so roots parsed for
-// one connection's chain are already there for the next.
-extern "C" X509_STORE *us_get_shared_default_ca_store() {
-  static X509_STORE *shared = nullptr;
-  static std::once_flag once;
-  std::call_once(once, []() { shared = us_get_default_ca_store(); });
+// Process-wide immutable default stores, one per system-CA decision. Safe to share across SSL_CTXs that don't add
+// per-config CAs (the user-`ca` path in build_raw populates the SSL_CTX's own private, initially-empty store instead),
+// so roots parsed for one connection's chain are already there for the next.
+static std::atomic<X509_STORE *> shared_default_ca_store[2] = { nullptr, nullptr };
+
+extern "C" X509_STORE *us_get_shared_default_ca_store(int use_system_ca) {
+  static std::once_flag once[2];
+  int i = use_system_ca ? 1 : 0;
+  std::call_once(once[i], [i]() { shared_default_ca_store[i].store(us_get_default_ca_store(i)); });
+  X509_STORE *shared = shared_default_ca_store[i].load();
   if (shared) X509_STORE_up_ref(shared);
   return shared;
 }
 
+// Whether `store` is one of the process-shared default stores (as opposed to a context's own).
+// Compares against whatever has been built so far; builds nothing.
+extern "C" int us_is_shared_default_ca_store(X509_STORE *store) {
+  return store != nullptr
+      && (store == shared_default_ca_store[0].load() || store == shared_default_ca_store[1].load());
+}
+
 extern "C" const char *us_get_default_ciphers() {
   return DEFAULT_CIPHER_LIST;
 }

packages/bun-usockets/src/crypto/root_certs_header.h

@@ -20,5 +20,10 @@ const us_system_certs_t &us_get_root_system_certs();
 #define CPPDECL extern
 #endif
 
-CPPDECL X509_STORE *us_get_default_ca_store();
-CPPDECL X509_STORE *us_get_shared_default_ca_store();
+CPPDECL int us_default_use_system_ca();
+CPPDECL int us_resolve_use_system_ca(int requested);
+CPPDECL X509_STORE *us_get_default_ca_store(int use_system_ca);
+CPPDECL X509_STORE *us_get_shared_default_ca_store(int use_system_ca);
+CPPDECL int us_is_shared_default_ca_store(X509_STORE *store);
+/* The resolved system-CA decision an SSL_CTX built by us_ssl_ctx_build_raw was created with. */
+CPPDECL int us_ssl_ctx_use_system_ca(SSL_CTX *ctx);

packages/bun-usockets/src/eventing/epoll_kqueue.c

@@ -523,6 +523,10 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
         }
     }
 
+    const uint64_t idle_start_ns = will_idle_inside_event_loop ? us_internal_monotonic_ns() : 0;
+    if (will_idle_inside_event_loop)
+        __atomic_store_n(&loop->data.idle_entry_ns, idle_start_ns, __ATOMIC_SEQ_CST);
+
     /* Fetch ready polls */
 #ifdef LIBUS_USE_EPOLL
     /* A zero timespec already has a fast path in ep_poll (fs/eventpoll.c):
@@ -541,6 +545,18 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
         timeout);
 #endif
 
+    if (will_idle_inside_event_loop) {
+        /* us_loop_idle_ns (another thread) retries while idle_seq is odd or changed underneath it, so
+         * it never observes the entry cleared without the park added (a non-monotonic sample). */
+        __atomic_add_fetch(&loop->data.idle_seq, 1, __ATOMIC_SEQ_CST);
+        /* Clock read inside the odd window: a reader's own clock read (taken before it validated an
+         * even seq) is then never later than the park length we record, so samples stay monotonic. */
+        uint64_t now = us_internal_monotonic_ns();
+        __atomic_store_n(&loop->data.idle_entry_ns, 0, __ATOMIC_SEQ_CST);
+        __atomic_add_fetch(&loop->data.idle_ns, now - idle_start_ns, __ATOMIC_SEQ_CST);
+        __atomic_add_fetch(&loop->data.idle_seq, 1, __ATOMIC_SEQ_CST);
+    }
+
     /* Before anything can allocate again. */
     if (handed_off)
         mi_on_thread_idle_end();

packages/bun-usockets/src/eventing/libuv.c

@@ -314,6 +314,7 @@ struct us_loop_t *us_create_loop(void *hint,
     return NULL;
   }
   loop->is_default = hint != 0;
+  uv_loop_configure(loop->uv_loop, UV_METRICS_IDLE_TIME);
 
   loop->uv_pre = us_malloc(sizeof(uv_prepare_t));
   uv_prepare_init(loop->uv_loop, loop->uv_pre);

packages/bun-usockets/src/internal/internal.h

@@ -169,6 +169,9 @@ uint64_t us_internal_monotonic_ns(void);
 long long us_internal_sweep_timeout_ns(struct us_loop_t *loop);
 void us_internal_sweep_if_due(struct us_loop_t *loop);
 #endif
+/* Nanoseconds this loop has spent parked, including a park in progress. Safe
+ * from another thread. Both platforms: Rust calls it ungated. */
+uint64_t us_loop_idle_ns(struct us_loop_t *loop);
 void us_internal_free_closed_sockets(us_loop_r loop);
 void us_internal_loop_link_group(struct us_loop_t *loop, struct us_socket_group_t *group);
 void us_internal_loop_unlink_group(struct us_loop_t *loop, struct us_socket_group_t *group);

packages/bun-usockets/src/internal/loop_data.h

@@ -69,6 +69,15 @@ struct us_internal_loop_data_t {
      * for lsquic's time-driven state. POSIX folds the deadline into the
      * epoll_pwait2 timeout via getTimeout() instead. */
     struct us_timer_t *quic_timer;
+#endif
+#ifndef LIBUS_USE_LIBUV
+    /* Nanoseconds parked, for eventLoopUtilization(). Read cross-thread —
+     * __atomic_* only. MIRRORED in src/uws_sys/InternalLoopData.rs: this struct
+     * is us_loop_t's first member, so a field here shifts num_polls. */
+    unsigned long long idle_ns;
+    unsigned long long idle_entry_ns;
+    /* Seqlock over the park-exit update of the two fields above (odd while in progress). */
+    unsigned long long idle_seq;
 #endif
     struct us_socket_group_t *iterator;
     char *recv_buf;