bun.fmt.fmtJavaScript is a stub: no syntax highlighting, no redaction

bun.fmt resolves to packages/runtime/src/fmt.zig (home.zig:173), whose highlighter does nothing:

pub fn format(self: QuickAndDirtyJavaScriptSyntaxHighlighter, writer: *std.Io.Writer) std.Io.Writer.Error!void {
    _ = self.opts;
    try writer.writeAll(self.text);
}

Every option is discarded — enable_colors, check_for_unhighlighted_write, and redact_sensitive_information (declared at fmt.zig:237) all have no effect. Any caller asking for highlighted or redacted output silently gets the raw text back.

The real implementation is packages/runtime/src/bun_core/fmt.zig (fmtJavaScript at :694, redaction at :146 via strings.startsWithSecret).

The stated blocker is stale

jsc/js2native_workarounds.zig claimed the real highlighter "needs unported strings.startsWith{Secret,UUID}". Both are present:

• startsWithUUID — string/immutable.zig:209, re-exported at strings.zig:48
• startsWithSecret — string/immutable.zig:312, not re-exported

So the actual blocker is a single missing re-export in strings.zig, not an unported function. (I corrected that comment in 445b0d5f3.)

Impact

• js/bun/util/highlighter.test.ts is 15 pass / 1 fail; the failure is this stub. It was a SIGABRT before 445b0d5f3 added the missing Formatter variant.
• Anything else printing highlighted source — error overlays, Bun.inspect of code, the markdown ANSI renderer — is silently unhighlighted.

Suggested shape

1. Re-export startsWithSecret from strings.zig next to startsWithUUID.
2. Check whether bun_core/fmt.zig then compiles as-is.
3. Decide whether bun.fmt should point at bun_core/fmt.zig, or whether the two modules should merge — home.zig:173 currently binds the stub, so switching it affects every bun.fmt caller and wants its own diff and test pass.

Refs #66

Ported and pushed to main in c058b475f.

• bun.fmt.QuickAndDirtyJavaScriptSyntaxHighlighter and fmtJavaScript now bind to Home's maintained copy of Bun's real bun_core/fmt.zig implementation instead of the raw-text stub.
• Exported the already-ported startsWithSecret, isUUID, and findUrlPassword primitives required by the complete highlighting/redaction paths.
• Added permanent tests proving ANSI syntax highlighting and named-secret redaction through the public bun.fmt surface.
• The real Home runtime module graph passes semantic compilation with no emission (519 MB guarded peak).
• The unchanged Bun highlighter algorithm passes 2/2 isolated executable behavior tests (167 MB peak).
• zig ast-check, zig fmt --check, and git diff --check pass.

The native-linked focused runtime artifact still crossed the fixed 3,840 MB ceiling during linking (3,948 MB reported, host 32%), so the cap was not raised and this issue remains open until the unchanged highlighter.test.ts runs end-to-end against a freshly linked Home binary. Commit author is glennmichael123 <gtorregosa@gmail.com> with no coauthors.

Verified end to end on the fresh ReleaseFast runtime at current main (bae99f883):

• implementation remains in c058b475f;
• unchanged js/bun/util/highlighter.test.ts: 16 passed, 0 failed;
• syntax highlighting, end-of-input safety, secret redaction, and the bunfig error path all execute through the native bun.fmt implementation;
• no test edits, skips, timeout changes, or fallback implementation were used.

Closing this focused checkpoint as complete. Parent parity tracking continues in #66.