chore(release): v1.0.3

.bazelversion

@@ -0,0 +1 @@
+9.0.1

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
             phase8_target: windows
     runs-on: ${{ matrix.os }}
     env:
-      USE_BAZEL_VERSION: 9.0.0
+      USE_BAZEL_VERSION: 9.0.1
     steps:
       - uses: actions/checkout@v4
       - uses: bazel-contrib/setup-bazel@0.18.0
@@ -35,9 +35,48 @@ jobs:
           external-cache: true
           disk-cache: ci-${{ matrix.phase8_target }}
           cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Install Nix
+        if: runner.os != 'Windows'
+        uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      - name: Restore and save Nix store cache
+        if: runner.os != 'Windows'
+        uses: nix-community/cache-nix-action@v7
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+      - name: Install flake dependencies
+        if: runner.os != 'Windows'
+        run: nix develop --accept-flake-config -c true
+      - name: Set up Python
+        if: runner.os == 'Windows'
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Provide python3 shim
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          cat >"$RUNNER_TEMP/bin/python3" <<'EOF'
+          #!/usr/bin/env bash
+          exec python "$@"
+          EOF
+          chmod +x "$RUNNER_TEMP/bin/python3"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
       - name: Run tests (${{ matrix.phase8_target }})
+        if: runner.os != 'Windows'
         shell: bash
         run: |
           echo "Phase 8 target: ${{ matrix.phase8_target }}"
-          targets="$(./tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}")"
+          mapfile -t targets < <(./tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}")
-          bazel test ${targets}
+          nix develop --accept-flake-config -c bazel test --test_output=errors "${targets[@]}"
+      - name: Run tests (${{ matrix.phase8_target }})
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          echo "Phase 8 target: ${{ matrix.phase8_target }}"
+          mapfile -t targets < <(./tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}")
+          bazel test --test_output=errors "${targets[@]}"

.github/workflows/pages.yml

@@ -23,7 +23,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     env:
-      USE_BAZEL_VERSION: 9.0.0
+      USE_BAZEL_VERSION: 9.0.1
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

MODULE.bazel

@@ -1,6 +1,6 @@
 module(
     name = "rules_bun",
-    version = "1.0.1",
+    version = "1.0.3",
 )
 
 # Core ruleset dependencies.

MODULE.bazel.lock

@@ -34,8 +34,9 @@
     "https://bcr.bazel.build/modules/bazel_features/1.3.0/MODULE.bazel": "cdcafe83ec318cda34e02948e81d790aab8df7a929cec6f6969f13a489ccecd9",
     "https://bcr.bazel.build/modules/bazel_features/1.30.0/MODULE.bazel": "a14b62d05969a293b80257e72e597c2da7f717e1e69fa8b339703ed6731bec87",
     "https://bcr.bazel.build/modules/bazel_features/1.33.0/MODULE.bazel": "8b8dc9d2a4c88609409c3191165bccec0e4cb044cd7a72ccbe826583303459f6",
-    "https://bcr.bazel.build/modules/bazel_features/1.33.0/source.json": "13617db3930328c2cd2807a0f13d52ca870ac05f96db9668655113265147b2a6",
     "https://bcr.bazel.build/modules/bazel_features/1.4.1/MODULE.bazel": "e45b6bb2350aff3e442ae1111c555e27eac1d915e77775f6fdc4b351b758b5d7",
+    "https://bcr.bazel.build/modules/bazel_features/1.42.1/MODULE.bazel": "275a59b5406ff18c01739860aa70ad7ccb3cfb474579411decca11c93b951080",
+    "https://bcr.bazel.build/modules/bazel_features/1.42.1/source.json": "fcd4396b2df85f64f2b3bb436ad870793ecf39180f1d796f913cc9276d355309",
     "https://bcr.bazel.build/modules/bazel_features/1.9.1/MODULE.bazel": "8f679097876a9b609ad1f60249c49d68bfab783dd9be012faf9d82547b14815a",
     "https://bcr.bazel.build/modules/bazel_skylib/1.0.3/MODULE.bazel": "bcb0fd896384802d1ad283b4e4eb4d718eebd8cb820b0a2c3a347fb971afd9d8",
     "https://bcr.bazel.build/modules/bazel_skylib/1.1.1/MODULE.bazel": "1add3e7d93ff2e6998f9e118022c84d163917d912f5afafb3058e3d2f1545b5e",
@@ -51,8 +52,8 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/source.json": "34a3c8bcf233b835eb74be9d628899bb32999d3e0eadef1947a0a562a2b16ffb",
-    "https://bcr.bazel.build/modules/buildozer/8.2.1/MODULE.bazel": "61e9433c574c2bd9519cad7fa66b9c1d2b8e8d5f3ae5d6528a2c2d26e68d874d",
+    "https://bcr.bazel.build/modules/buildozer/8.5.1/MODULE.bazel": "a35d9561b3fc5b18797c330793e99e3b834a473d5fbd3d7d7634aafc9bdb6f8f",
-    "https://bcr.bazel.build/modules/buildozer/8.2.1/source.json": "7c33f6a26ee0216f85544b4bca5e9044579e0219b6898dd653f5fb449cf2e484",
+    "https://bcr.bazel.build/modules/buildozer/8.5.1/source.json": "e3386e6ff4529f2442800dee47ad28d3e6487f36a1f75ae39ae56c70f0cd2fbd",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.2/MODULE.bazel": "a70cf1bba851000ba93b58ae2f6d76490a9feb74192e57ab8e8ff13c34ec50cb",
     "https://bcr.bazel.build/modules/googletest/1.11.0/MODULE.bazel": "3a83f095183f66345ca86aa13c58b59f9f94a2f81999c093d4eeaa2d262d12f4",
     "https://bcr.bazel.build/modules/googletest/1.14.0.bcr.1/MODULE.bazel": "22c31a561553727960057361aa33bf20fb2e98584bc4fec007906e27053f80c6",
@@ -112,8 +113,8 @@
     "https://bcr.bazel.build/modules/rules_cc/0.1.5/MODULE.bazel": "88dfc9361e8b5ae1008ac38f7cdfd45ad738e4fa676a3ad67d19204f045a1fd8",
     "https://bcr.bazel.build/modules/rules_cc/0.2.0/MODULE.bazel": "b5c17f90458caae90d2ccd114c81970062946f49f355610ed89bebf954f5783c",
     "https://bcr.bazel.build/modules/rules_cc/0.2.13/MODULE.bazel": "eecdd666eda6be16a8d9dc15e44b5c75133405e820f620a234acc4b1fdc5aa37",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.14/MODULE.bazel": "353c99ed148887ee89c54a17d4100ae7e7e436593d104b668476019023b58df8",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.17/MODULE.bazel": "1849602c86cb60da8613d2de887f9566a6d354a6df6d7009f9d04a14402f9a84",
-    "https://bcr.bazel.build/modules/rules_cc/0.2.14/source.json": "55d0a4587c5592fad350f6e698530f4faf0e7dd15e69d43f8d87e220c78bea54",
+    "https://bcr.bazel.build/modules/rules_cc/0.2.17/source.json": "3832f45d145354049137c0090df04629d9c2b5493dc5c2bf46f1834040133a07",
     "https://bcr.bazel.build/modules/rules_cc/0.2.8/MODULE.bazel": "f1df20f0bf22c28192a794f29b501ee2018fa37a3862a1a2132ae2940a23a642",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.9.0/MODULE.bazel": "c9e8c682bf75b0e7c704166d79b599f93b72cfca5ad7477df596947891feeef6",
     "https://bcr.bazel.build/modules/rules_fuzzing/0.5.2/MODULE.bazel": "40c97d1144356f52905566c55811f13b299453a14ac7769dfba2ac38192337a8",
@@ -193,7 +194,7 @@
     "//bun:extensions.bzl%bun": {
       "general": {
         "bzlTransitiveDigest": "314UOH4dQIGBHGpxCwA7yzI++E2J3bjIc20m5MZhM7U=",
-        "usagesDigest": "Pk8TCTd2EBKQ8R+VSF0M7sU9apLb/5tBy/dP2pjs3AU=",
+        "usagesDigest": "prFfUGEBfgU9euYPzwB9Wux0cLYR+2MKCz+nUIyHYkI=",
         "recordedInputs": [
           "REPO_MAPPING:,bazel_tools bazel_tools"
         ],
@@ -284,7 +285,7 @@
     "//bun:extensions.bzl%bun_install": {
       "general": {
         "bzlTransitiveDigest": "314UOH4dQIGBHGpxCwA7yzI++E2J3bjIc20m5MZhM7U=",
-        "usagesDigest": "2qW6PUxkK7CgK8mcsgVvlIbuJS/cBBkw5mylpKlqftE=",
+        "usagesDigest": "rhYKu+vVZOHFMZV+ai/X42v6prfhsLITQYyLZaCnX+g=",
         "recordedInputs": [
           "REPO_MAPPING:,bazel_tools bazel_tools"
         ],

README.md

@@ -66,7 +66,7 @@ Strict defaults are enabled by default:
 
 - `bun_install` skips lifecycle scripts unless `ignore_scripts = False`
 - `bun_build`, `bun_bundle`, `bun_compile`, and `bun_test` require `install_mode = "disable"`
-- Runtime launchers do not inherit the host `PATH` unless `inherit_host_path = True`
+- Runtime launchers stage hermetic `bun`, `bunx`, and `node` commands on `PATH` and do not inherit the host `PATH` unless `inherit_host_path = True`
 
 To refresh generated rule docs:
 
@@ -80,7 +80,7 @@ Release announcements should provide a copy-pasteable module snippet in the
 standard ruleset form:
 
 ```starlark
-bazel_dep(name = "rules_bun", version = "1.0.1")
+bazel_dep(name = "rules_bun", version = "1.0.3")
 ```
 
 Then add the Bun repositories and register the toolchains in `MODULE.bazel`:
@@ -218,10 +218,11 @@ bun_script(
 )
 ```
 
-When `node_modules` is provided, executables from `node_modules/.bin` are added
+Launcher-based runtime rules stage hermetic `bun`, `bunx`, and `node`
-to the runtime `PATH`. The host `PATH` is not inherited unless
+commands on `PATH`. When `node_modules` is provided, executables from
-`inherit_host_path = True`. This label typically comes from `bun_install`,
+`node_modules/.bin` are also added to the runtime `PATH`. The host `PATH` is
-which still produces a standard `node_modules/` directory.
+not inherited unless `inherit_host_path = True`. This label typically comes
+from `bun_install`, which still produces a standard `node_modules/` directory.
 
 ### `bun_build` and `bun_compile`
 

VERSION

@@ -1,3 +1,3 @@
-1.0.1
+1.0.3
 stable
 0

docs/rules.md

@@ -12,7 +12,7 @@ Public API surface for Bun Bazel rules.
 Strict defaults:
 
 - `bun_build`, `bun_bundle`, `bun_compile`, and `bun_test` require `install_mode = "disable"`
-- Runtime launchers do not inherit the host `PATH` unless `inherit_host_path = True`
+- Runtime launchers stage hermetic `bun`, `bunx`, and `node` commands on `PATH` and do not inherit the host `PATH` unless `inherit_host_path = True`
 
 <a id="bun_binary"></a>
 
@@ -41,7 +41,7 @@ Use this rule for non-test scripts and CLIs that should run via `bazel run`.
 | <a id="bun_binary-entry_point"></a>entry_point |  Path to the main JS/TS file to execute.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
 | <a id="bun_binary-env_files"></a>env_files |  Additional environment files loaded with `--env-file`.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_binary-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages at runtime. Non-`disable` values are runtime opt-ins and are not hermetic.   | String | optional |  `"disable"`  |
-| <a id="bun_binary-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_binary-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_binary-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_binary-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
 | <a id="bun_binary-preload"></a>preload |  Modules to preload with `--preload` before running the entry point.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
@@ -265,7 +265,7 @@ watch/HMR plus optional full restarts on selected file changes.
 | <a id="bun_dev-entry_point"></a>entry_point |  Path to the main JS/TS file to execute in dev mode.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
 | <a id="bun_dev-env_files"></a>env_files |  Additional environment files loaded with `--env-file`.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_dev-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages in dev mode. This is a local workflow helper, not a hermetic execution surface.   | String | optional |  `"disable"`  |
-| <a id="bun_dev-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_dev-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_dev-no_clear_screen"></a>no_clear_screen |  If true, disables terminal clearing on Bun reloads.   | Boolean | optional |  `False`  |
 | <a id="bun_dev-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_dev-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
@@ -295,7 +295,7 @@ Use this rule to expose existing package scripts such as `dev`, `build`, or
 `check` via `bazel run` without adding wrapper shell scripts. This is a good fit
 for Vite-style workflows, where scripts like `vite dev` or `vite build` are
 declared in `package.json` and expect to run from the package directory with
-`node_modules/.bin` available on `PATH`.
+the staged Bun runtime tool bin and `node_modules/.bin` available on `PATH`.
 
 **ATTRIBUTES**
 
@@ -309,10 +309,10 @@ declared in `package.json` and expect to run from the package directory with
 | <a id="bun_script-execution_mode"></a>execution_mode |  How Bun should execute matching workspace scripts.   | String | optional |  `"single"`  |
 | <a id="bun_script-filters"></a>filters |  Workspace package filters passed via repeated `--filter` flags.   | List of strings | optional |  `[]`  |
 | <a id="bun_script-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages while running the script. This is a local workflow helper, not a hermetic execution surface.   | String | optional |  `"disable"`  |
-| <a id="bun_script-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_script-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_script-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_script-no_exit_on_error"></a>no_exit_on_error |  If true, Bun keeps running other workspace scripts when one fails.   | Boolean | optional |  `False`  |
-| <a id="bun_script-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles. Executables from `node_modules/.bin` are added to `PATH`, which is useful for scripts such as `vite`.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
+| <a id="bun_script-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles. The staged Bun runtime tool bin and executables from `node_modules/.bin` are added to `PATH`, which is useful for scripts such as `vite`.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
 | <a id="bun_script-package_json"></a>package_json |  Label of the `package.json` file containing the named script.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
 | <a id="bun_script-preload"></a>preload |  Modules to preload with `--preload` before running the script.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_script-run_flags"></a>run_flags |  Additional raw flags forwarded to `bun run` before the script name.   | List of strings | optional |  `[]`  |
@@ -356,7 +356,7 @@ Supports Bazel test filtering (`--test_filter`) and coverage integration.
 | <a id="bun_test-coverage_reporters"></a>coverage_reporters |  Repeated Bun coverage reporters such as `text` or `lcov`.   | List of strings | optional |  `[]`  |
 | <a id="bun_test-env_files"></a>env_files |  Additional environment files loaded with `--env-file`.   | <a href="https://bazel.build/concepts/labels">List of labels</a> | optional |  `[]`  |
 | <a id="bun_test-install_mode"></a>install_mode |  Whether Bun may auto-install missing packages while testing. Hermetic tests require `\"disable\"`, and other values are rejected.   | String | optional |  `"disable"`  |
-| <a id="bun_test-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="bun_test-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="bun_test-max_concurrency"></a>max_concurrency |  Optional maximum number of concurrent tests.   | Integer | optional |  `0`  |
 | <a id="bun_test-no_env_file"></a>no_env_file |  If true, disables Bun's automatic `.env` loading.   | Boolean | optional |  `False`  |
 | <a id="bun_test-node_modules"></a>node_modules |  Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
@@ -427,7 +427,7 @@ the provided tool with any default arguments.
 | <a id="js_run_devserver-package_dir_hint"></a>package_dir_hint |  Optional package-relative directory hint when package_json is not supplied.   | String | optional |  `"."`  |
 | <a id="js_run_devserver-package_json"></a>package_json |  Optional package.json used to resolve the package working directory.   | <a href="https://bazel.build/concepts/labels">Label</a> | optional |  `None`  |
 | <a id="js_run_devserver-tool"></a>tool |  Executable target to launch as the dev server.   | <a href="https://bazel.build/concepts/labels">Label</a> | required |  |
-| <a id="js_run_devserver-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after staged `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
+| <a id="js_run_devserver-inherit_host_path"></a>inherit_host_path |  If true, appends the host PATH after the staged Bun runtime tool bin and `node_modules/.bin` entries at runtime.   | Boolean | optional |  `False`  |
 | <a id="js_run_devserver-working_dir"></a>working_dir |  Working directory at runtime: Bazel runfiles workspace root or the resolved package directory.   | String | optional |  `"workspace"`  |
 
 

flake.nix

@@ -15,7 +15,7 @@
       ...
     }:
     let
-      bazelVersion = "9.0.0";
+      bazelVersion = "9.0.1";
     in
     repo-lib.lib.mkRepo {
       inherit self nixpkgs;
@@ -108,12 +108,6 @@
               version.args = [ "--version" ];
               banner.color = "YELLOW";
             })
-            (repo-lib.lib.tools.fromPackage {
-              name = "Go";
-              package = pkgs.go;
-              version.args = [ "version" ];
-              banner.color = "CYAN";
-            })
             (repo-lib.lib.tools.fromPackage {
               name = "Bazel";
               package = bazel9;
@@ -123,20 +117,21 @@
           ];
 
           shell.packages = [
-            pkgs.gopls
-            pkgs.gotools
             pkgs.bazel-buildtools
+            pkgs.curl
+            pkgs.python3
             self.packages.${system}.release
           ];
 
           checks.tests = {
-            command = "bazel test //tests/...";
+            command = "bazelisk test //tests/...";
             stage = "pre-push";
             passFilenames = false;
             runtimeInputs = [
               bazel9
               pkgs.bun
-              pkgs.go
+              pkgs.curl
+              pkgs.python3
             ];
           };
         };

internal/bun_binary.bzl

@@ -114,7 +114,7 @@ _BUN_BINARY_ATTRS.update({
     ),
     "inherit_host_path": attr.bool(
         default = False,
-        doc = "If true, appends the host PATH after staged node_modules/.bin entries at runtime.",
+        doc = "If true, appends the host PATH after the staged Bun runtime tool bin and node_modules/.bin entries at runtime.",
     ),
 })
 

internal/bun_dev.bzl

@@ -122,7 +122,7 @@ _BUN_DEV_ATTRS.update({
     ),
     "inherit_host_path": attr.bool(
         default = False,
-        doc = "If true, appends the host PATH after staged node_modules/.bin entries at runtime.",
+        doc = "If true, appends the host PATH after the staged Bun runtime tool bin and node_modules/.bin entries at runtime.",
     ),
 })
 

internal/bun_script.bzl

@@ -83,7 +83,7 @@ _BUN_SCRIPT_ATTRS.update({
         doc = "Label of the `package.json` file containing the named script.",
     ),
     "node_modules": attr.label(
-        doc = "Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles. Executables from `node_modules/.bin` are added to `PATH`, which is useful for scripts such as `vite`.",
+        doc = "Optional label providing package files from a `node_modules` tree, typically produced by `bun_install`, in runfiles. The staged Bun runtime tool bin and executables from `node_modules/.bin` are added to `PATH`, which is useful for scripts such as `vite`.",
     ),
     "data": attr.label_list(
         allow_files = True,
@@ -148,7 +148,7 @@ _BUN_SCRIPT_ATTRS.update({
     ),
     "inherit_host_path": attr.bool(
         default = False,
-        doc = "If true, appends the host PATH after staged node_modules/.bin entries at runtime.",
+        doc = "If true, appends the host PATH after the staged Bun runtime tool bin and node_modules/.bin entries at runtime.",
     ),
 })
 
@@ -159,8 +159,9 @@ bun_script = rule(
 Use this rule to expose existing package scripts such as `dev`, `build`, or
 `check` via `bazel run` without adding wrapper shell scripts. This is a good fit
 for Vite-style workflows, where scripts like `vite dev` or `vite build` are
-declared in `package.json` and expect to run from the package directory. This
+declared in `package.json` and expect to run from the package directory with
-is a local workflow helper rather than a hermetic build rule.
+the staged Bun runtime tool bin and `node_modules/.bin` on `PATH`. This is a
+local workflow helper rather than a hermetic build rule.
 """,
     attrs = _BUN_SCRIPT_ATTRS,
     executable = True,

internal/bun_test.bzl

@@ -180,7 +180,7 @@ _BUN_TEST_ATTRS.update({
     ),
     "inherit_host_path": attr.bool(
         default = False,
-        doc = "If true, appends the host PATH after staged node_modules/.bin entries at runtime.",
+        doc = "If true, appends the host PATH after the staged Bun runtime tool bin and node_modules/.bin entries at runtime.",
     ),
 })
 

internal/js_run_devserver.bzl

@@ -92,7 +92,7 @@ _JS_RUN_DEVSERVER_ATTRS.update({
     ),
     "inherit_host_path": attr.bool(
         default = False,
-        doc = "If true, appends the host PATH after staged node_modules/.bin entries at runtime.",
+        doc = "If true, appends the host PATH after the staged Bun runtime tool bin and node_modules/.bin entries at runtime.",
     ),
 })
 

internal/runtime_launcher.js

@@ -489,6 +489,31 @@ function materializeTreeContents(sourceRoot, destinationRoot) {
   }
 }
 
+function stageRuntimeToolAlias(sourcePath, destinationPath, preferLinks) {
+  removePath(destinationPath);
+  ensureDir(dirname(destinationPath));
+  if (preferLinks && !IS_WINDOWS) {
+    symlinkSync(sourcePath, destinationPath);
+    return;
+  }
+  copyPath(sourcePath, destinationPath);
+}
+
+function stageRuntimeToolBin(runtimeWorkspace, bunPath, preferLinks) {
+  const runtimeToolBin = join(runtimeWorkspace, ".rules_bun", "bin");
+  ensureDir(runtimeToolBin);
+
+  const bunName = IS_WINDOWS ? "bun.exe" : "bun";
+  const stagedBunPath = join(runtimeToolBin, bunName);
+  materializePath(realpathSync(bunPath), stagedBunPath, preferLinks);
+
+  for (const aliasName of IS_WINDOWS ? ["bunx.exe", "node.exe"] : ["bunx", "node"]) {
+    stageRuntimeToolAlias(stagedBunPath, join(runtimeToolBin, aliasName), preferLinks);
+  }
+
+  return runtimeToolBin;
+}
+
 function stageWorkspaceView(sourceRoot, destinationRoot, packageRelDir) {
   ensureDir(destinationRoot);
   const skippedEntry = firstPathComponent(packageRelDir);
@@ -765,9 +790,19 @@ function mirrorInstallRepoWorkspaceNodeModules(
   }
 }
 
-function buildRuntimePath(runtimeWorkspace, runtimePackageDir, runtimeInstallRoot, inheritHostPath) {
+function buildRuntimePath(
+  runtimeToolBin,
+  runtimeWorkspace,
+  runtimePackageDir,
+  runtimeInstallRoot,
+  inheritHostPath,
+) {
   const entries = [];
 
+  if (existsSync(runtimeToolBin) && statSync(runtimeToolBin).isDirectory()) {
+    entries.push(runtimeToolBin);
+  }
+
   const installBin = join(runtimeInstallRoot, "node_modules", ".bin");
   const packageBin = join(runtimePackageDir, "node_modules", ".bin");
   const workspaceBin = join(runtimeWorkspace, "node_modules", ".bin");
@@ -915,9 +950,16 @@ function createRuntime(spec, runfiles) {
     materializePath(runtimeInstallNodeModules, runtimePackageNodeModules, preferLinks);
   }
 
+  const runtimeToolBin = stageRuntimeToolBin(
+    runtimeWorkspace,
+    runfiles.rlocation(spec.bun_short_path),
+    preferLinks,
+  );
+
   const env = { ...process.env };
   const pathKey = pathEnvKey(env);
   const runtimePath = buildRuntimePath(
+    runtimeToolBin,
     runtimeWorkspace,
     runtimePackageDir,
     runtimeInstallRoot,
@@ -992,12 +1034,31 @@ function composeBunArgs(spec, runfiles, runtime) {
   return args;
 }
 
+function isWindowsBatchFile(command) {
+  return IS_WINDOWS && /\.(cmd|bat)$/i.test(String(command || ""));
+}
+
+function quoteForWindowsShell(command) {
+  return `"${String(command).replace(/"/g, '""')}"`;
+}
+
+function spawnChild(command, args, options) {
+  const spawnOptions = {
+    ...options,
+    stdio: "inherit",
+  };
+  if (isWindowsBatchFile(command)) {
+    return spawn(quoteForWindowsShell(command), args, {
+      ...spawnOptions,
+      shell: true,
+    });
+  }
+  return spawn(command, args, spawnOptions);
+}
+
 function spawnProcess(command, args, options) {
   return new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn(command, args, {
+    const child = spawnChild(command, args, options);
-      ...options,
-      stdio: "inherit",
-    });
     child.once("error", rejectPromise);
     child.once("exit", (code, signal) => {
       resolvePromise({ child, code, signal });
@@ -1077,10 +1138,9 @@ async function runDevMode(spec, runfiles, userArgs) {
     currentRuntime = createRuntime(spec, runfiles);
     const bunPath = runfiles.rlocation(spec.bun_short_path);
     const bunArgs = [...composeBunArgs(spec, runfiles, currentRuntime), watchFlag, ...passthroughArgs];
-    child = spawn(bunPath, bunArgs, {
+    child = spawnChild(bunPath, bunArgs, {
       cwd: currentRuntime.runtimeExecDir,
       env: currentRuntime.env,
-      stdio: "inherit",
     });
     exitPromise = new Promise((resolvePromise, rejectPromise) => {
       child.once("error", rejectPromise);

tests/binary_test/BUILD.bazel

@@ -44,8 +44,8 @@ sh_test(
     size = "small",
     srcs = ["verify_data_shape.sh"],
     args = [
-        "$(location //internal:bun_binary.bzl)",
+        "$(rlocationpath //internal:bun_binary.bzl)",
-        "$(location //tests/binary_test:BUILD.bazel)",
+        "$(rlocationpath //tests/binary_test:BUILD.bazel)",
     ],
     data = [
         "//internal:bun_binary.bzl",

tests/binary_test/path_probe.ts

@@ -1,5 +1,18 @@
+import { spawnSync } from "node:child_process";
+
 const pathValue = process.env.PATH ?? "";
 
+function commandSucceeds(command: string, args: string[]): boolean {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    env: process.env,
+  });
+  return result.status === 0;
+}
+
 console.log(JSON.stringify({
   hasHostSentinel: pathValue.includes("rules_bun_host_path_sentinel"),
+  canRunBun: commandSucceeds("bun", ["-e", "process.exit(0)"]),
+  canRunBunx: commandSucceeds("bunx", ["--version"]),
+  canRunNode: commandSucceeds("node", ["-e", "process.exit(0)"]),
 }));

tests/binary_test/run_binary.sh

@@ -8,12 +8,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/binary_test/run_env_binary.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/binary_test/run_flag_binary.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/binary_test/run_parent_env_binary.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/binary_test/run_path_binary.sh

@@ -8,12 +8,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    env PATH="rules_bun_host_path_sentinel:${PATH:-}" cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    env PATH="rules_bun_host_path_sentinel:${PATH:-}" cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   env PATH="rules_bun_host_path_sentinel:${PATH:-}" "${launcher}" "$@"
@@ -22,12 +17,12 @@ run_launcher() {
 default_output="$(run_launcher "${default_binary}")"
 inherit_output="$(run_launcher "${inherit_binary}")"
 
-if [[ ${default_output} != '{"hasHostSentinel":false}' ]]; then
+if [[ ${default_output} != '{"hasHostSentinel":false,"canRunBun":true,"canRunBunx":true,"canRunNode":true}' ]]; then
   echo "Expected default launcher to hide host PATH, got: ${default_output}" >&2
   exit 1
 fi
 
-if [[ ${inherit_output} != '{"hasHostSentinel":true}' ]]; then
+if [[ ${inherit_output} != '{"hasHostSentinel":true,"canRunBun":true,"canRunBunx":true,"canRunNode":true}' ]]; then
   echo "Expected inherit_host_path launcher to preserve host PATH, got: ${inherit_output}" >&2
   exit 1
 fi

tests/binary_test/verify_data_shape.sh

@@ -1,8 +1,64 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-rule_file="$1"
+if [[ -z ${RUNFILES_DIR:-} && -n ${TEST_SRCDIR:-} && -d ${TEST_SRCDIR} ]]; then
-build_file="$2"
+  RUNFILES_DIR="${TEST_SRCDIR}"
+fi
+if [[ -z ${RUNFILES_DIR:-} && -z ${RUNFILES_MANIFEST_FILE:-} ]]; then
+  if [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.exe.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.exe.runfiles_manifest"
+  fi
+fi
+
+resolve_runfile() {
+  local path="${1:-}"
+  local candidate
+  local resolved
+
+  if [[ -z ${path} ]]; then
+    echo "Error: missing runfile path" >&2
+    exit 1
+  fi
+  if [[ ${path} == /* || ${path} =~ ^[A-Za-z]:[\\/] ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+  if [[ -e ${path} ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+
+  for candidate in \
+    "${path}" \
+    "${TEST_WORKSPACE:-}/${path}" \
+    "_main/${path}"; do
+    [[ -z ${candidate} ]] && continue
+    if [[ -n ${RUNFILES_DIR:-} && -e "${RUNFILES_DIR}/${candidate}" ]]; then
+      printf '%s\n' "${RUNFILES_DIR}/${candidate}"
+      return 0
+    fi
+    if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
+      resolved="$(
+        awk -v key="${candidate}" 'index($0, key " ") == 1 { print substr($0, length(key) + 2); exit }' \
+          "${RUNFILES_MANIFEST_FILE}"
+      )"
+      if [[ -n ${resolved} ]]; then
+        printf '%s\n' "${resolved}"
+        return 0
+      fi
+    fi
+  done
+
+  echo "Error: unable to resolve runfile: ${path}" >&2
+  exit 1
+}
+
+rule_file="$(resolve_runfile "${1:-}")"
+build_file="$(resolve_runfile "${2:-}")"
 
 grep -Eq 'extra_files = ctx\.files\.data \+ ctx\.files\.preload \+ ctx\.files\.env_files \+ \[bun_bin\]' "${rule_file}"
 grep -Eq 'name = "hello_js_with_data_bin"' "${build_file}"

tests/bun_test_test/BUILD.bazel

@@ -60,7 +60,7 @@ sh_test(
     name = "bun_test_failing_suite_test",
     size = "small",
     srcs = ["failing_suite_shape.sh"],
-    args = ["$(location //tests/bun_test_test:BUILD.bazel)"],
+    args = ["$(rlocationpath //tests/bun_test_test:BUILD.bazel)"],
     data = ["//tests/bun_test_test:BUILD.bazel"],
 )
 

tests/bun_test_test/failing_suite_shape.sh

@@ -1,7 +1,63 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-build_file="$1"
+if [[ -z ${RUNFILES_DIR:-} && -n ${TEST_SRCDIR:-} && -d ${TEST_SRCDIR} ]]; then
+  RUNFILES_DIR="${TEST_SRCDIR}"
+fi
+if [[ -z ${RUNFILES_DIR:-} && -z ${RUNFILES_MANIFEST_FILE:-} ]]; then
+  if [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.exe.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.exe.runfiles_manifest"
+  fi
+fi
+
+resolve_runfile() {
+  local path="${1:-}"
+  local candidate
+  local resolved
+
+  if [[ -z ${path} ]]; then
+    echo "Error: missing runfile path" >&2
+    exit 1
+  fi
+  if [[ ${path} == /* || ${path} =~ ^[A-Za-z]:[\\/] ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+  if [[ -e ${path} ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+
+  for candidate in \
+    "${path}" \
+    "${TEST_WORKSPACE:-}/${path}" \
+    "_main/${path}"; do
+    [[ -z ${candidate} ]] && continue
+    if [[ -n ${RUNFILES_DIR:-} && -e "${RUNFILES_DIR}/${candidate}" ]]; then
+      printf '%s\n' "${RUNFILES_DIR}/${candidate}"
+      return 0
+    fi
+    if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
+      resolved="$(
+        awk -v key="${candidate}" 'index($0, key " ") == 1 { print substr($0, length(key) + 2); exit }' \
+          "${RUNFILES_MANIFEST_FILE}"
+      )"
+      if [[ -n ${resolved} ]]; then
+        printf '%s\n' "${resolved}"
+        return 0
+      fi
+    fi
+  done
+
+  echo "Error: unable to resolve runfile: ${path}" >&2
+  exit 1
+}
+
+build_file="$(resolve_runfile "${1:-}")"
 
 grep -Eq 'name = "failing_suite"' "${build_file}"
 if grep -Eq 'tags = \["manual"\]' "${build_file}"; then

tests/bundle_test/BUILD.bazel

@@ -197,7 +197,10 @@ sh_test(
     name = "bundle_sourcemap_shape_test",
     size = "small",
     srcs = ["verify_sourcemap_shape.sh"],
-    tags = ["exclusive"],
+    tags = [
+        "exclusive",
+        "no-sandbox",
+    ],
     data = [
         "BUILD.bazel",
         "//:repo_runtime_files",
@@ -238,7 +241,10 @@ sh_test(
     name = "bun_build_compile_flag_shape_test",
     size = "small",
     srcs = ["verify_flag_aquery.sh"],
-    tags = ["exclusive"],
+    tags = [
+        "exclusive",
+        "no-sandbox",
+    ],
     data = [
         "BUILD.bazel",
         "cli.ts",

tests/bundle_test/verify_flag_aquery.sh

@@ -6,40 +6,7 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 source "${script_dir}/../nested_bazel_test.sh"
 setup_nested_bazel_cmd
 
-find_workspace_root() {
+rules_bun_root="$(find_nested_bazel_workspace_root "${BASH_SOURCE[0]}")"
-  local candidate
-  local module_path
-  local search_dir
-
-  for candidate in \
-    "${TEST_SRCDIR:-}/${TEST_WORKSPACE:-}" \
-    "${TEST_SRCDIR:-}/_main"; do
-    if [[ -n ${candidate} && -f "${candidate}/MODULE.bazel" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  done
-
-  if [[ -n ${TEST_SRCDIR:-} ]]; then
-    module_path="$(find "${TEST_SRCDIR}" -maxdepth 3 -name MODULE.bazel -print -quit 2>/dev/null || true)"
-    if [[ -n ${module_path} ]]; then
-      dirname "${module_path}"
-      return 0
-    fi
-  fi
-
-  search_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
-  candidate="$(cd "${search_dir}/../.." && pwd -P)"
-  if [[ -f "${candidate}/MODULE.bazel" ]]; then
-    printf '%s\n' "${candidate}"
-    return 0
-  fi
-
-  echo "Unable to locate rules_bun workspace root" >&2
-  exit 1
-}
-
-rules_bun_root="$(find_workspace_root)"
 
 cleanup() {
   local status="$1"

tests/bundle_test/verify_sourcemap_shape.sh

@@ -6,40 +6,7 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 source "${script_dir}/../nested_bazel_test.sh"
 setup_nested_bazel_cmd
 
-find_workspace_root() {
+rules_bun_root="$(find_nested_bazel_workspace_root "${BASH_SOURCE[0]}")"
-  local candidate
-  local module_path
-  local search_dir
-
-  for candidate in \
-    "${TEST_SRCDIR:-}/${TEST_WORKSPACE:-}" \
-    "${TEST_SRCDIR:-}/_main"; do
-    if [[ -n ${candidate} && -f "${candidate}/MODULE.bazel" ]]; then
-      printf '%s\n' "${candidate}"
-      return 0
-    fi
-  done
-
-  if [[ -n ${TEST_SRCDIR:-} ]]; then
-    module_path="$(find "${TEST_SRCDIR}" -maxdepth 3 -name MODULE.bazel -print -quit 2>/dev/null || true)"
-    if [[ -n ${module_path} ]]; then
-      dirname "${module_path}"
-      return 0
-    fi
-  fi
-
-  search_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
-  candidate="$(cd "${search_dir}/../.." && pwd -P)"
-  if [[ -f "${candidate}/MODULE.bazel" ]]; then
-    printf '%s\n' "${candidate}"
-    return 0
-  fi
-
-  echo "Unable to locate rules_bun workspace root" >&2
-  exit 1
-}
-
-rules_bun_root="$(find_workspace_root)"
 
 cleanup() {
   local status="$1"

tests/ci_test/BUILD.bazel

@@ -4,7 +4,7 @@ sh_test(
     name = "phase8_ci_matrix_shape_test",
     size = "small",
     srcs = ["phase8_ci_matrix_shape_test.sh"],
-    args = ["$(location //.github/workflows:ci.yml)"],
+    args = ["$(rlocationpath //.github/workflows:ci.yml)"],
     data = ["//.github/workflows:ci.yml"],
 )
 
@@ -12,7 +12,7 @@ sh_test(
     name = "phase8_ci_targets_test",
     size = "small",
     srcs = ["phase8_ci_targets_test.sh"],
-    args = ["$(location :phase8_ci_targets.sh)"],
+    args = ["$(rlocationpath :phase8_ci_targets.sh)"],
     data = [":phase8_ci_targets.sh"],
 )
 

tests/ci_test/phase8_ci_matrix_shape_test.sh

@@ -1,7 +1,63 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-workflow_file="$1"
+if [[ -z ${RUNFILES_DIR:-} && -n ${TEST_SRCDIR:-} && -d ${TEST_SRCDIR} ]]; then
+  RUNFILES_DIR="${TEST_SRCDIR}"
+fi
+if [[ -z ${RUNFILES_DIR:-} && -z ${RUNFILES_MANIFEST_FILE:-} ]]; then
+  if [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.exe.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.exe.runfiles_manifest"
+  fi
+fi
+
+resolve_runfile() {
+  local path="${1:-}"
+  local candidate
+  local resolved
+
+  if [[ -z ${path} ]]; then
+    echo "Error: missing runfile path" >&2
+    exit 1
+  fi
+  if [[ ${path} == /* || ${path} =~ ^[A-Za-z]:[\\/] ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+  if [[ -e ${path} ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+
+  for candidate in \
+    "${path}" \
+    "${TEST_WORKSPACE:-}/${path}" \
+    "_main/${path}"; do
+    [[ -z ${candidate} ]] && continue
+    if [[ -n ${RUNFILES_DIR:-} && -e "${RUNFILES_DIR}/${candidate}" ]]; then
+      printf '%s\n' "${RUNFILES_DIR}/${candidate}"
+      return 0
+    fi
+    if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
+      resolved="$(
+        awk -v key="${candidate}" 'index($0, key " ") == 1 { print substr($0, length(key) + 2); exit }' \
+          "${RUNFILES_MANIFEST_FILE}"
+      )"
+      if [[ -n ${resolved} ]]; then
+        printf '%s\n' "${resolved}"
+        return 0
+      fi
+    fi
+  done
+
+  echo "Error: unable to resolve runfile: ${path}" >&2
+  exit 1
+}
+
+workflow_file="$(resolve_runfile "${1:-}")"
 if [ -z "${workflow_file}" ]; then
   echo "Error: workflow file path required as first argument" >&2
   exit 1
@@ -17,7 +73,7 @@ check_pattern() {
 }
 
 check_pattern '^name:[[:space:]]+CI$' "missing workflow name CI"
-check_pattern 'USE_BAZEL_VERSION:[[:space:]]+9\.0\.0' "missing Bazel 9.0.0 pin"
+check_pattern 'USE_BAZEL_VERSION:[[:space:]]+9\.0\.1' "missing Bazel 9.0.1 pin"
 check_pattern 'os:[[:space:]]+ubuntu-latest' "missing ubuntu matrix entry"
 check_pattern 'phase8_target:[[:space:]]+linux-x64' "missing linux-x64 matrix target"
 check_pattern 'os:[[:space:]]+macos-14' "missing macos matrix entry"

tests/ci_test/phase8_ci_targets_test.sh

@@ -1,7 +1,63 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-resolver="${1:-}"
+if [[ -z ${RUNFILES_DIR:-} && -n ${TEST_SRCDIR:-} && -d ${TEST_SRCDIR} ]]; then
+  RUNFILES_DIR="${TEST_SRCDIR}"
+fi
+if [[ -z ${RUNFILES_DIR:-} && -z ${RUNFILES_MANIFEST_FILE:-} ]]; then
+  if [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.exe.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.exe.runfiles_manifest"
+  fi
+fi
+
+resolve_runfile() {
+  local path="${1:-}"
+  local candidate
+  local resolved
+
+  if [[ -z ${path} ]]; then
+    echo "Error: missing runfile path" >&2
+    exit 1
+  fi
+  if [[ ${path} == /* || ${path} =~ ^[A-Za-z]:[\\/] ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+  if [[ -e ${path} ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+
+  for candidate in \
+    "${path}" \
+    "${TEST_WORKSPACE:-}/${path}" \
+    "_main/${path}"; do
+    [[ -z ${candidate} ]] && continue
+    if [[ -n ${RUNFILES_DIR:-} && -e "${RUNFILES_DIR}/${candidate}" ]]; then
+      printf '%s\n' "${RUNFILES_DIR}/${candidate}"
+      return 0
+    fi
+    if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
+      resolved="$(
+        awk -v key="${candidate}" 'index($0, key " ") == 1 { print substr($0, length(key) + 2); exit }' \
+          "${RUNFILES_MANIFEST_FILE}"
+      )"
+      if [[ -n ${resolved} ]]; then
+        printf '%s\n' "${resolved}"
+        return 0
+      fi
+    fi
+  done
+
+  echo "Error: unable to resolve runfile: ${path}" >&2
+  exit 1
+}
+
+resolver="$(resolve_runfile "${1:-}")"
 if [[ -z ${resolver} ]]; then
   echo "Error: resolver path required as first argument" >&2
   exit 1

tests/install_test/BUILD.bazel

@@ -148,7 +148,10 @@ sh_test(
     name = "bun_install_workspace_parity_test",
     size = "large",
     srcs = ["workspace_parity.sh"],
-    tags = ["exclusive"],
+    tags = [
+        "exclusive",
+        "no-sandbox",
+    ],
     args = select({
         ":linux_x86_64": ["$(location @bun_linux_x64//:bun)"],
         ":linux_aarch64": ["$(location @bun_linux_aarch64//:bun)"],
@@ -185,7 +188,10 @@ sh_test(
     name = "bun_install_repeatability_test",
     size = "small",
     srcs = ["repeatability.sh"],
-    tags = ["exclusive"],
+    tags = [
+        "exclusive",
+        "no-sandbox",
+    ],
     args = select({
         ":linux_x86_64": ["$(location @bun_linux_x64//:bun)"],
         ":linux_aarch64": ["$(location @bun_linux_aarch64//:bun)"],
@@ -214,7 +220,10 @@ sh_test(
     name = "bun_install_lifecycle_scripts_test",
     size = "small",
     srcs = ["lifecycle_scripts.sh"],
-    tags = ["exclusive"],
+    tags = [
+        "exclusive",
+        "no-sandbox",
+    ],
     args = select({
         ":linux_x86_64": ["$(location @bun_linux_x64//:bun)"],
         ":linux_aarch64": ["$(location @bun_linux_aarch64//:bun)"],

tests/install_test/lifecycle_scripts.sh

@@ -8,7 +8,7 @@ setup_nested_bazel_cmd
 
 bun_path="$1"
 
-rules_bun_root="$(cd "${script_dir}/../.." && pwd -P)"
+rules_bun_root="$(find_nested_bazel_workspace_root "${BASH_SOURCE[0]}")"
 
 workdir="$(mktemp -d)"
 cleanup() {

tests/install_test/repeatability.sh

@@ -8,7 +8,7 @@ setup_nested_bazel_cmd
 
 bun_path="$1"
 
-rules_bun_root="$(cd "${script_dir}/../.." && pwd -P)"
+rules_bun_root="$(find_nested_bazel_workspace_root "${BASH_SOURCE[0]}")"
 
 workdir="$(mktemp -d)"
 cleanup() {

tests/install_test/workspace_parity.sh

@@ -8,7 +8,7 @@ setup_nested_bazel_cmd
 
 bun_path="${1:-bun}"
 
-rules_bun_root="$(cd "${script_dir}/../.." && pwd -P)"
+rules_bun_root="$(find_nested_bazel_workspace_root "${BASH_SOURCE[0]}")"
 
 workdir="$(mktemp -d)"
 cleanup() {

tests/integration_test/examples_basic_run_e2e_test.sh

@@ -19,12 +19,7 @@ start_launcher() {
   local log_target="$2"
   shift 2
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" >"${log_target}" 2>&1 &
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" >"${log_target}" 2>&1 &
   else
     "${launcher}" "$@" >"${log_target}" 2>&1 &
   fi

tests/integration_test/examples_vite_monorepo_e2e_test.sh

@@ -22,12 +22,7 @@ start_launcher() {
   local log_target="$2"
   shift 2
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" >"${log_target}" 2>&1 &
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" >"${log_target}" 2>&1 &
   else
     "${launcher}" "$@" >"${log_target}" 2>&1 &
   fi

tests/integration_test/repo_all_targets_test.sh

@@ -3,6 +3,17 @@ set -euo pipefail
 
 workflow_file="$1"
 
-grep -Fq './tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}"' "${workflow_file}"
+assert_contains() {
-grep -Fq 'targets="$(./tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}")"' "${workflow_file}"
+  local expected="$1"
-grep -Fq 'bazel test ${targets}' "${workflow_file}"
+
+  if ! grep -Fq "${expected}" "${workflow_file}"; then
+    echo "Error: expected workflow snippet not found:" >&2
+    printf '  %s\n' "${expected}" >&2
+    exit 1
+  fi
+}
+
+assert_contains './tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}"'
+assert_contains 'mapfile -t targets < <(./tests/ci_test/phase8_ci_targets.sh "${{ matrix.phase8_target }}")'
+assert_contains 'nix develop --accept-flake-config -c bazel test --test_output=errors "${targets[@]}"'
+assert_contains 'bazel test --test_output=errors "${targets[@]}"'

tests/js_compat_test/run_binary.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/js_compat_test/run_devserver.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/nested_bazel_test.sh

@@ -1,24 +1,108 @@
 #!/usr/bin/env bash
 
 setup_nested_bazel_cmd() {
-  if command -v bazel >/dev/null 2>&1; then
+  local bazel_bin
-    bazel_cmd=(bazel)
+  local nested_bazel_base
-  elif command -v bazelisk >/dev/null 2>&1; then
+  local -a scrubbed_env_vars
-    bazel_cmd=(bazelisk)
+
+  if bazel_bin="$(command -v bazel 2>/dev/null)"; then
+    :
+  elif bazel_bin="$(command -v bazelisk 2>/dev/null)"; then
+    :
   else
     echo "bazel or bazelisk is required on PATH" >&2
     exit 1
   fi
+
+  nested_bazel_base="${TEST_TMPDIR:-${TMPDIR:-/tmp}}/rules_bun_nested_bazel"
+  mkdir -p "${nested_bazel_base}"
+  nested_bazel_root="$(mktemp -d "${nested_bazel_base}/session.XXXXXX")"
+  mkdir -p "${nested_bazel_root}/tmp"
+
+  scrubbed_env_vars=(
+    BAZEL_TEST
+    BUILD_EXECROOT
+    COVERAGE_DIR
+    GTEST_OUTPUT
+    GTEST_SHARD_INDEX
+    GTEST_SHARD_STATUS_FILE
+    GTEST_TMP_DIR
+    GTEST_TOTAL_SHARDS
+    JAVA_RUNFILES
+    PYTHON_RUNFILES
+    RUNFILES_DIR
+    RUNFILES_MANIFEST_FILE
+    RUNFILES_MANIFEST_ONLY
+    TEST_BINARY
+    TEST_INFRASTRUCTURE_FAILURE_FILE
+    TEST_LOGSPLITTER_OUTPUT_FILE
+    TEST_PREMATURE_EXIT_FILE
+    TEST_SHARD_INDEX
+    TEST_SHARD_STATUS_FILE
+    TEST_SRCDIR
+    TEST_TARGET
+    TEST_TMPDIR
+    TEST_TOTAL_SHARDS
+    TEST_UNDECLARED_OUTPUTS_ANNOTATIONS
+    TEST_UNDECLARED_OUTPUTS_ANNOTATIONS_DIR
+    TEST_UNDECLARED_OUTPUTS_DIR
+    TEST_UNDECLARED_OUTPUTS_MANIFEST
+    TEST_UNDECLARED_OUTPUTS_ZIP
+    TEST_UNUSED_RUNFILES_LOG_FILE
+    TEST_WARNINGS_OUTPUT_FILE
+    XML_OUTPUT_FILE
+  )
+
+  nested_bazel_env=(env)
+  for env_var in "${scrubbed_env_vars[@]}"; do
+    nested_bazel_env+=("-u" "${env_var}")
+  done
+  nested_bazel_env+=("TMPDIR=${nested_bazel_root}/tmp")
+
+  bazel_cmd=(
+    "${nested_bazel_env[@]}"
+    "${bazel_bin}"
+    "--batch"
+    "--ignore_all_rc_files"
+    "--output_user_root=${nested_bazel_root}/output_user_root"
+  )
+}
+
+find_nested_bazel_workspace_root() {
+  local script_path="${1:-${BASH_SOURCE[0]}}"
+  local candidate
+  local script_dir
+
+  for candidate in \
+    "${TEST_SRCDIR:-}/${TEST_WORKSPACE:-}" \
+    "${TEST_SRCDIR:-}/_main"; do
+    if [[ -n ${candidate} && -f "${candidate}/MODULE.bazel" ]]; then
+      printf '%s\n' "${candidate}"
+      return 0
+    fi
+  done
+
+  script_dir="$(cd "$(dirname "${script_path}")" && pwd -P)"
+  candidate="$(cd "${script_dir}/../.." && pwd -P)"
+  if [[ -f "${candidate}/MODULE.bazel" ]]; then
+    printf '%s\n' "${candidate}"
+    return 0
+  fi
+
+  echo "Unable to locate rules_bun workspace root" >&2
+  exit 1
 }
 
 shutdown_nested_bazel_workspace() {
   local workspace_dir="${1:-}"
-  if [[ -z ${workspace_dir} || ! -d ${workspace_dir} ]]; then
+  if [[ -n ${workspace_dir} && -d ${workspace_dir} ]]; then
-    return 0
+    (
+      cd "${workspace_dir}"
+      "${bazel_cmd[@]}" shutdown >/dev/null 2>&1
+    ) || true
   fi
 
-  (
+  if [[ -n ${nested_bazel_root:-} && -d ${nested_bazel_root} ]]; then
-    cd "${workspace_dir}"
+    rm -rf "${nested_bazel_root}"
-    "${bazel_cmd[@]}" shutdown >/dev/null 2>&1
+  fi
-  ) || true
 }

tests/npm_compat_test/BUILD.bazel

@@ -44,7 +44,10 @@ sh_test(
     name = "npm_translate_lock_workspace_test",
     size = "small",
     srcs = ["npm_translate_lock_workspace_test.sh"],
-    tags = ["exclusive"],
+    tags = [
+        "exclusive",
+        "no-sandbox",
+    ],
     args = select({
         ":linux_x86_64": ["$(location @bun_linux_x64//:bun)"],
         ":linux_aarch64": ["$(location @bun_linux_aarch64//:bun)"],

tests/npm_compat_test/npm_translate_lock_workspace_test.sh

@@ -8,7 +8,7 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 source "${script_dir}/../nested_bazel_test.sh"
 setup_nested_bazel_cmd
 
-rules_bun_root="$(cd "${script_dir}/../.." && pwd -P)"
+rules_bun_root="$(find_nested_bazel_workspace_root "${BASH_SOURCE[0]}")"
 
 workdir="$(mktemp -d)"
 cleanup() {

tests/script_test/run_env_script.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/script_test/run_paraglide_monorepo_builds.sh

@@ -14,12 +14,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/script_test/run_script.sh

@@ -8,12 +8,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/script_test/run_vite_app.sh

@@ -19,12 +19,7 @@ start_launcher() {
   local log_target="$2"
   shift 2
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" >"${log_target}" 2>&1 &
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" >"${log_target}" 2>&1 &
   else
     "${launcher}" "$@" >"${log_target}" 2>&1 &
   fi

tests/script_test/run_vite_monorepo_apps.sh

@@ -22,12 +22,7 @@ start_launcher() {
   local log_target="$2"
   shift 2
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" >"${log_target}" 2>&1 &
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" >"${log_target}" 2>&1 &
   else
     "${launcher}" "$@" >"${log_target}" 2>&1 &
   fi

tests/script_test/run_workspace_parallel.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/script_test/run_workspace_script.sh

@@ -7,12 +7,7 @@ run_launcher() {
   local launcher="$1"
   shift
   if [[ ${launcher} == *.cmd ]]; then
-    local command
+    cmd.exe /c call "${launcher}" "$@" | tr -d '\r'
-    printf -v command '"%s"' "${launcher}"
-    for arg in "$@"; do
-      printf -v command '%s "%s"' "${command}" "${arg}"
-    done
-    cmd.exe /c "${command}" | tr -d '\r'
     return 0
   fi
   "${launcher}" "$@"

tests/toolchain_test/BUILD.bazel

@@ -45,12 +45,12 @@ sh_test(
     size = "small",
     srcs = ["toolchain_version.sh"],
     args = select({
-        ":linux_x86_64": ["$(location @bun_linux_x64//:bun)"],
+        ":linux_x86_64": ["$(rlocationpath @bun_linux_x64//:bun)"],
-        ":linux_aarch64": ["$(location @bun_linux_aarch64//:bun)"],
+        ":linux_aarch64": ["$(rlocationpath @bun_linux_aarch64//:bun)"],
-        ":darwin_x86_64": ["$(location @bun_darwin_x64//:bun)"],
+        ":darwin_x86_64": ["$(rlocationpath @bun_darwin_x64//:bun)"],
-        ":darwin_aarch64": ["$(location @bun_darwin_aarch64//:bun)"],
+        ":darwin_aarch64": ["$(rlocationpath @bun_darwin_aarch64//:bun)"],
-        ":windows_x86_64": ["$(location @bun_windows_x64//:bun)"],
+        ":windows_x86_64": ["$(rlocationpath @bun_windows_x64//:bun)"],
-        "//conditions:default": ["$(location @bun_linux_x64//:bun)"],
+        "//conditions:default": ["$(rlocationpath @bun_linux_x64//:bun)"],
     }),
     data = select({
         ":linux_x86_64": ["@bun_linux_x64//:bun"],
@@ -66,6 +66,6 @@ sh_test(
     name = "toolchain_resolution_matrix_test",
     size = "small",
     srcs = ["toolchain_resolution_matrix.sh"],
-    args = ["$(location //tests/toolchain_test:BUILD.bazel)"],
+    args = ["$(rlocationpath //tests/toolchain_test:BUILD.bazel)"],
     data = ["//tests/toolchain_test:BUILD.bazel"],
 )

tests/toolchain_test/toolchain_resolution_matrix.sh

@@ -1,7 +1,63 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-build_file="$1"
+if [[ -z ${RUNFILES_DIR:-} && -n ${TEST_SRCDIR:-} && -d ${TEST_SRCDIR} ]]; then
+  RUNFILES_DIR="${TEST_SRCDIR}"
+fi
+if [[ -z ${RUNFILES_DIR:-} && -z ${RUNFILES_MANIFEST_FILE:-} ]]; then
+  if [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.exe.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.exe.runfiles_manifest"
+  fi
+fi
+
+resolve_runfile() {
+  local path="${1:-}"
+  local candidate
+  local resolved
+
+  if [[ -z ${path} ]]; then
+    echo "Error: missing runfile path" >&2
+    exit 1
+  fi
+  if [[ ${path} == /* || ${path} =~ ^[A-Za-z]:[\\/] ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+  if [[ -e ${path} ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+
+  for candidate in \
+    "${path}" \
+    "${TEST_WORKSPACE:-}/${path}" \
+    "_main/${path}"; do
+    [[ -z ${candidate} ]] && continue
+    if [[ -n ${RUNFILES_DIR:-} && -e "${RUNFILES_DIR}/${candidate}" ]]; then
+      printf '%s\n' "${RUNFILES_DIR}/${candidate}"
+      return 0
+    fi
+    if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
+      resolved="$(
+        awk -v key="${candidate}" 'index($0, key " ") == 1 { print substr($0, length(key) + 2); exit }' \
+          "${RUNFILES_MANIFEST_FILE}"
+      )"
+      if [[ -n ${resolved} ]]; then
+        printf '%s\n' "${resolved}"
+        return 0
+      fi
+    fi
+  done
+
+  echo "Error: unable to resolve runfile: ${path}" >&2
+  exit 1
+}
+
+build_file="$(resolve_runfile "${1:-}")"
 
 grep -Eq 'name = "linux_x86_64"' "${build_file}"
 grep -Eq 'name = "linux_aarch64"' "${build_file}"

tests/toolchain_test/toolchain_version.sh

@@ -1,8 +1,64 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-bun_path="$1"
+if [[ -z ${RUNFILES_DIR:-} && -n ${TEST_SRCDIR:-} && -d ${TEST_SRCDIR} ]]; then
-version="$(${bun_path} --version)"
+  RUNFILES_DIR="${TEST_SRCDIR}"
+fi
+if [[ -z ${RUNFILES_DIR:-} && -z ${RUNFILES_MANIFEST_FILE:-} ]]; then
+  if [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+  elif [[ -f "$0.exe.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.exe.runfiles_manifest"
+  fi
+fi
+
+resolve_runfile() {
+  local path="${1:-}"
+  local candidate
+  local resolved
+
+  if [[ -z ${path} ]]; then
+    echo "Error: missing runfile path" >&2
+    exit 1
+  fi
+  if [[ ${path} == /* || ${path} =~ ^[A-Za-z]:[\\/] ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+  if [[ -e ${path} ]]; then
+    printf '%s\n' "${path}"
+    return 0
+  fi
+
+  for candidate in \
+    "${path}" \
+    "${TEST_WORKSPACE:-}/${path}" \
+    "_main/${path}"; do
+    [[ -z ${candidate} ]] && continue
+    if [[ -n ${RUNFILES_DIR:-} && -e "${RUNFILES_DIR}/${candidate}" ]]; then
+      printf '%s\n' "${RUNFILES_DIR}/${candidate}"
+      return 0
+    fi
+    if [[ -n ${RUNFILES_MANIFEST_FILE:-} ]]; then
+      resolved="$(
+        awk -v key="${candidate}" 'index($0, key " ") == 1 { print substr($0, length(key) + 2); exit }' \
+          "${RUNFILES_MANIFEST_FILE}"
+      )"
+      if [[ -n ${resolved} ]]; then
+        printf '%s\n' "${resolved}"
+        return 0
+      fi
+    fi
+  done
+
+  echo "Error: unable to resolve runfile: ${path}" >&2
+  exit 1
+}
+
+bun_path="$(resolve_runfile "${1:-}")"
+version="$("${bun_path}" --version)"
 
 if [[ ! ${version} =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
   echo "Unexpected bun version output: ${version}" >&2