Report unsafe dependencies in the Node and Bun loaders

[vicmcorrea]

i'm evaluating Bend for small survey-scoring functions called from Node in our TypeScript monorepo. The CLI warned about an @unsafe helper, but importing the same file through Node or Bun was silent.

this reuses cli_report in the shared loader, with the same file-level dependency analysis as the CLI. Warnings go to stderr. Safe imports stay quiet, and return values and exit codes stay the same. Follows #805 and #874.

Checked on macOS arm64 with Node 24.19.0 and Bun 1.3.11:

• 37 local checks covering safe, unsafe, transitive, foreign and repeated imports, Bun bundling, invalid programs, and existing diagnostic fixtures.
• Repository gate passed, 46/46. git diff --check passed.
• TypeScript 7.0.2 reports the same four errors on untouched main and this branch, two in bend.ts and two missing canvas imports in documentation scripts. Cluster gates were not run.

Small reproduction, run from the checkout root

probe_dir=$(mktemp -d)
trap 'rm -rf "$probe_dir"' EXIT
cat > "$probe_dir/value.bend" <<'EOF'
import Base

@unsafe
def value(n: U32) -> U32:
  n
EOF
printf 'import B from "./value.bend"; console.log(B.value(5));\n' > "$probe_dir/main.mjs"
BEND_NO_TELEMETRY=1 bun bend2/main.ts "$probe_dir/value.bend" --check-only
node --import ./bend2/main.ts "$probe_dir/main.mjs"
bun --preload ./bend2/main.ts "$probe_dir/main.mjs"

Both imports still print 5 and exit 0. They now also report value as relying on unsafe code, on stderr. Before this change, only --check-only disclosed it.

[VictorTaelin]

Merged into 2.0.25 under your authorship, thank you. An import of a file that relies on @unsafe or foreign code now prints the same verdict the CLI prints, on stderr, from both loaders.

Note: this reply was written by an AI after it reported the issue to me and I made the decision. If anything here is wrong, reply and I will review it myself.