fix(runtime): ship Bun 1.4.2 and keep the CI test runner on 1.4.0

.github/actions/setup-project-bun/action.yml

@@ -1,8 +1,18 @@
 name: Setup project Bun
 description: >-
-  Install the Bun runtime for a job. Installs the version declared in
-  package.json (dependencies.bun), keeping the runtime SOT in one place so
-  version bumps only touch package.json and bun.lock.
+  Install the package.json Bun pin for a job's role: dependencies.bun for
+  runtime (default), or testRunnerBun for test-runner.
+
+# Runtime 1.4.2 fixes #6684's Windows Bun.fetch stream truncation. The test runner
+# stays on 1.4.0: #4821 reverted #4064 after 1.4.2's multi-file --isolate preload
+# segfault; #6713 run 37631558263 reproduces it on Linux 1/4, macOS 2/2, Windows 9/9.
+# Rejoin only after the upstream runner crash is fixed and a green lane=all
+# dispatch proves the unified version; then delete testRunnerBun and this role input.
+inputs:
+  role:
+    description: Bun role to install (runtime or test-runner).
+    required: false
+    default: runtime
 
 outputs:
   version:
@@ -15,14 +25,28 @@ runs:
     - name: Resolve project Bun version
       id: resolve
       shell: bash
+      env:
+        BUN_ROLE: ${{ inputs.role }}
       run: |
-        version="$(node -p "require('./package.json').dependencies.bun")"
-        if [ -z "$version" ]; then
-          echo "::error::Could not resolve Bun version from package.json"
-          exit 1
-        fi
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-        echo "Using Bun $version from package.json"
+        node <<'NODE'
+        const pkg = require('./package.json');
+        const role = process.env.BUN_ROLE;
+        let key;
+        let version;
+        switch (role) {
+          case 'runtime': key = 'dependencies.bun'; version = pkg.dependencies?.bun; break;
+          case 'test-runner': key = 'testRunnerBun'; version = pkg.testRunnerBun; break;
+          default:
+            console.error(`::error::Unknown Bun role: ${role}`);
+            process.exit(1);
+        }
+        if (typeof version !== 'string' || version !== version.trim() || !/^\d+\.\d+\.\d+$/.test(version)) {
+          console.error(`::error::Missing or invalid package.json ${key} for Bun role ${role}`);
+          process.exit(1);
+        }
+        require('node:fs').appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\n`);
+        console.log(`Using Bun ${version} from package.json ${key} (${role})`);
+        NODE
 
     - name: Setup Bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

.github/workflows/ci.yml

@@ -549,6 +549,11 @@ jobs:
           printf 'Scheduled run: workflow from %s, testing dev at %s\n' "$GITHUB_SHA" "$sha" >> "$GITHUB_STEP_SUMMARY"
           printf 'scheduled run tests dev at %s (workflow %s)\n' "$sha" "$GITHUB_SHA"
 
+  # Bun roles (#6713): runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming;
+  # test-runner 1.4.0 avoids 1.4.2's multi-file --isolate preload segfault (#4821
+  # reverted #4064; run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9).
+  # Rejoin after the upstream runner crash is fixed and a green lane=all dispatch
+  # proves the unified version, then delete testRunnerBun and the action's role input.
   # The suite, split by file across four Linux runners.
   #
   # `scripts/ci/run-bun-test-batches.sh` assigns files to shards by the per-file
@@ -603,6 +608,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       # The GUI install is NOT optional here, however unrelated it looks to a
       # test shard. Several files under tests/ import JSX-bearing modules from
@@ -649,6 +656,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -689,6 +698,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -725,6 +736,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -824,6 +837,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -893,6 +908,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -1035,6 +1052,8 @@ jobs:
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -1240,8 +1259,8 @@ jobs:
         run: bun run structure:check
 
   # The composite Bun setup, run on each runner family it serves, when a change touches only the
-  # action (see the setup_action filter). One step past the action proves it installed the runtime
-  # package.json declares; nothing else runs, so this never grows into a suite.
+  # action (see the setup_action filter). Each role proves its resolved and installed
+  # version matches package.json; nothing else runs, so this never grows into a suite.
   setup-action:
     name: setup action ${{ matrix.os }}
     needs: changes
@@ -1277,6 +1296,26 @@ jobs:
             exit 1
           fi
 
+      - name: Setup project Bun test runner
+        id: bun-test-runner
+        uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner
+
+      - name: Require the test runner package.json declares
+        shell: bash
+        env:
+          RESOLVED: ${{ steps.bun-test-runner.outputs.version }}
+        run: |
+          set -euo pipefail
+          declared="$(node -p "require('./package.json').testRunnerBun")"
+          installed="$(bun --version)"
+          echo "declared=$declared resolved=$RESOLVED installed=$installed"
+          if [ "$RESOLVED" != "$declared" ] || [ "$installed" != "$declared" ]; then
+            echo "::error::setup-project-bun resolved '$RESOLVED' and installed '$installed', but package.json testRunnerBun declares '$declared'"
+            exit 1
+          fi
+
   # The Rust remote-workspace helper, when a change touches it (see the remote_helper filter).
   # Formatting once, then clippy and the crate's tests on each platform: the sandbox and the live
   # confinement tests compile only on macOS and Windows, and Linux covers the protocol and stub.
@@ -1432,10 +1471,8 @@ jobs:
           persist-credentials: false
           ref: ${{ needs.changes.outputs.checkout_ref }}
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
+      - name: Setup project Bun
+        uses: ./.github/actions/setup-project-bun
 
       - name: Install dependencies
         run: |

.github/workflows/dev-version-bump.yml

@@ -78,10 +78,13 @@ jobs:
           persist-credentials: false
 
       # The repository-owned composite action, not a hand-pinned setup-bun SHA: it
-      # resolves the Bun version from package.json so the runtime SOT stays in one
-      # place. An independently pinned action here would drift from every other job.
+      # selects package.json's test-runner pin even for this single-file test so
+      # validation follows the CI runner contract (see setup-project-bun/action.yml).
+      # This job edits version metadata; it does not compile a shipped runtime.
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

CONTRIBUTING.md

@@ -33,8 +33,8 @@ For local development commands, architecture notes, and release workflow details
 contributing guide above instead of duplicating instructions here.
 
 Source development requires the `bun` CLI on your `PATH`. The published npm package bundles its own
-Bun runtime for end users, but contributor commands such as `bun install`, `bun run test`, and
-`bun run prepush` run from your local Bun installation.
+Bun runtime for end users. Package scripts such as `bun run test` and `bun run prepush` may resolve
+Bun through that bundled dependency.
 
 ## Pull request contract
 
@@ -61,6 +61,10 @@ A ready-for-review PR is the author's claim that the change is complete, underst
 
 ## Local validation and hooks
 
+The suite uses Bun 1.4.0 (`testRunnerBun`) while the shipped runtime is 1.4.2.
+`scripts/test.ts` finds a 1.4.0 binary on PATH or in `~/.bun/bin`, or uses
+`OCX_TEST_RUNNER_BUN`; install that version locally if it is missing.
+
 Run `bun run test` before review readiness. If the full local suite is too costly
 for the task or available resources, run at least focused regression tests for
 the changed behavior. Document the reason, commands, results, and remaining

Dockerfile

@@ -1,7 +1,12 @@
 # syntax=docker/dockerfile:1
 
 # Keep the runtime aligned with package.json and pin the multi-platform image index.
-ARG BUN_IMAGE=oven/bun:1.4.0@sha256:5ff609364c049b54eb0ff560ec96319729a972078ef2c755d758f0c6ef89c2d6
+# Runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming; CI tests stay on 1.4.0
+# because 1.4.2 segfaults reloading preloads in multi-file --isolate (#4821;
+# #6713 run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9). Rejoin after the
+# upstream crash fix passes a unified-version lane=all dispatch, then delete
+# package.json's testRunnerBun pin and setup-project-bun's role input.
+ARG BUN_IMAGE=oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 FROM ${BUN_IMAGE} AS manifest
 WORKDIR /home/bun/app

README.md

@@ -458,8 +458,8 @@ Acknowledging a report is not the same as triaging it, and no first-response tar
 
 ## Development
 
-Source development requires the `bun` CLI on your `PATH`. This is separate from the published npm
-package's bundled Bun runtime, which is used only by installed `ocx` commands.
+Source development requires the `bun` CLI on your `PATH`. The published npm package bundles its own
+Bun runtime for installed `ocx` commands; package scripts may also resolve Bun through that bundled dependency.
 
 ```bash
 git clone https://github.com/lidge-jun/opencodex.git

docs-site/src/content/docs/contributing.md

@@ -6,7 +6,7 @@ description: Develop opencodex — setup, layout, conventions, and how to add a
 ## Setup
 
 Source development requires the `bun` CLI on your `PATH`. The published npm package bundles its own
-Bun runtime for users, but this checkout's scripts run through your local Bun installation.
+Bun runtime for users; package scripts may resolve Bun through that bundled dependency.
 
 ```bash
 git clone https://github.com/lidge-jun/opencodex.git
@@ -45,6 +45,10 @@ bun run privacy:scan              # credential/privacy scan used by CI
 bun run prepare:package           # refresh package launchers/assets
 ```
 
+The suite uses Bun 1.4.0 (`package.json`'s `testRunnerBun`) while the shipped runtime is 1.4.2.
+`scripts/test.ts` finds a 1.4.0 binary on PATH or in `~/.bun/bin`, or uses `OCX_TEST_RUNNER_BUN`.
+Install that version locally if it is missing; the resolver never downloads it.
+
 Run `bun run test` by default. If a full run is disproportionately expensive for the task size,
 available machine resources, or concurrent worktrees, you must at least run focused regression tests
 that exercise the changed behavior, such as `bun test tests/<domain>/<name>.test.ts`. Explain the

docs-site/src/content/docs/fr/contributing.md

@@ -6,7 +6,7 @@ description: Développez opencodex — installation, structure, conventions et a
 ## Configuration
 
 Le développement depuis les sources exige la CLI `bun` dans votre `PATH`. Le paquet npm publié fournit son propre
-runtime Bun aux utilisateurs, mais les scripts de ce dépôt utilisent votre installation locale de Bun.
+runtime Bun aux utilisateurs ; les scripts du paquet peuvent résoudre Bun via cette dépendance incluse.
 
 ```bash
 git clone https://github.com/lidge-jun/opencodex.git