[BUG] Bun module exports are returned as undefined

[notkadez]

Summary

When secure-exec runs under Bun as the host, Bun's node:v8.deserialize() rejects payload bytes produced by the Rust V8 runtime. Node accepts those same bytes.

This breaks Bun-host run() export decoding and any other host-side decode path that consumes Rust V8 ValueSerializer output.

Minimal repro

Node serialized bytes:

node -e "const v8=require('node:v8'); process.stdout.write(v8.serialize({message:'hello'}).toString('hex'))"

Observed:

ff0f6f22076d657373616765220568656c6c6f7b01

Bun serialized bytes:

bun --eval "import v8 from 'node:v8'; process.stdout.write(Buffer.from(v8.serialize({message:'hello'})).toString('hex'))"

Observed:

0d00000002070000806d657373616765100500008068656c6c6fffffffff

Bun deserializing the Node/Rust bytes:

bun --eval "import v8 from 'node:v8'; const hex='ff0f6f22076d657373616765220568656c6c6f7b01'; try { console.log(JSON.stringify(v8.deserialize(Buffer.from(hex,'hex')))); } catch (err) { console.error(String(err)); process.exit(1); }"

Observed:

TypeError: Unable to deserialize data.

Control:

node -e "const v8=require('node:v8'); const hex='ff0f6f22076d657373616765220568656c6c6f7b01'; console.log(JSON.stringify(v8.deserialize(Buffer.from(hex,'hex'))))"

Observed:

{"message":"hello"}

Impact

• Bun host cannot decode Rust V8 runtime exports
• Bun host behavior diverges from Node on the same V8 payloads

Root cause

Bun's node:v8 implementation is not compatible with real V8 wire format; instead it uses JavaScriptCore wire format.

[NathanFlurry]

oh boy this'll be fun to polyfill. iirc there is a v8 polyfill available that we can use on the secure-exec js side. will have to look in to if the jscore wire format is supported natively to put it on the rust side which will be faster.

[Necmttn]

Additional issue: src/polyfills/ missing from published @secure-exec/nodejs@0.2.0-rc.2

While investigating the Bun v8 wire format issue, I attempted a Node.js host bridge as a workaround. However, @secure-exec/nodejs@0.2.0-rc.2 on npm is also broken under Node — the runtime eagerly bundles polyfills via dist/polyfills.js, which resolves paths like:

../src/polyfills/stream-web.js
../src/polyfills/crypto.js
../src/polyfills/util-types.js
...

These files exist in the source repo (packages/nodejs/src/polyfills/) but are not included in the published npm tarball — only dist/polyfills.js and dist/polyfills.d.ts are shipped.

Additionally, dist/polyfills.js contains a hardcoded pnpm workspace path for web-streams-polyfill:

const WEB_STREAMS_PONYFILL_PATH = fileURLToPath(
  new URL("../../../node_modules/.pnpm/node_modules/web-streams-polyfill/dist/ponyfill.js", import.meta.url)
);

This resolves to a non-existent path outside the monorepo dev environment.

Result: Even simple driver.run('module.exports = 1 + 1') fails under both Bun and Node with:

Build failed with 1 error:
error: Could not resolve ".../src/polyfills/stream-web.js"

Suggested fix: Include src/polyfills/*.js in the package's files field, and resolve web-streams-polyfill dynamically via createRequire instead of a hardcoded pnpm path.