Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.219 Home All releases ←olderv2.1.218 v2.1.220newer→
Claude Code v2.1.219

bun:ffi dropped for native Bun and process APIs in three low-level paths

Under the hood
Useful2 Signal0
Elsewhere

Low-level process and hardening paths now use built-in APIs instead of loading system libraries.

What

Three places that used dlopen through bun:ffi now call native APIs directly, and a fourth FFI helper was deleted.

Details
  • Process replacement no longer dlopens libSystem/libc for execve; it calls process.execve with a sanitized env object where __proto__ is defined rather than assigned.
  • The macOS TCC responsibility-disclaim spawn dropped its posix_spawn FFI dance for process.execve(e, r, n, { macDisclaimResponsibility: !0 }).
  • PR_SET_DUMPABLE hardening now calls Bun.ant.setDumpable(!1).
  • The SO_PEERCRED/getpeereid FFI peer-credential helpers were removed outright.
  • These are macOS and Linux paths; the execve helper still returns early on Windows.
Evidence

prctl(PR_SET_DUMPABLE,0) returned nonzero

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.219 →