[WRONG BRANCH] release: 2.81.0

.github/actions/setup-project-bun/action.yml

@@ -1,8 +1,18 @@
 name: Setup project Bun
 description: >-
-  Install the Bun runtime for a job. Installs the version declared in
-  package.json (dependencies.bun), keeping the runtime SOT in one place so
-  version bumps only touch package.json and bun.lock.
+  Install the package.json Bun pin for a job's role: dependencies.bun for
+  runtime (default), or testRunnerBun for test-runner.
+
+# Runtime 1.4.2 fixes #6684's Windows Bun.fetch stream truncation. The test runner
+# stays on 1.4.0: #4821 reverted #4064 after 1.4.2's multi-file --isolate preload
+# segfault; #6713 run 37631558263 reproduces it on Linux 1/4, macOS 2/2, Windows 9/9.
+# Rejoin only after the upstream runner crash is fixed and a green lane=all
+# dispatch proves the unified version; then delete testRunnerBun and this role input.
+inputs:
+  role:
+    description: Bun role to install (runtime or test-runner).
+    required: false
+    default: runtime
 
 outputs:
   version:
@@ -15,14 +25,28 @@ runs:
     - name: Resolve project Bun version
       id: resolve
       shell: bash
+      env:
+        BUN_ROLE: ${{ inputs.role }}
       run: |
-        version="$(node -p "require('./package.json').dependencies.bun")"
-        if [ -z "$version" ]; then
-          echo "::error::Could not resolve Bun version from package.json"
-          exit 1
-        fi
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-        echo "Using Bun $version from package.json"
+        node <<'NODE'
+        const pkg = require('./package.json');
+        const role = process.env.BUN_ROLE;
+        let key;
+        let version;
+        switch (role) {
+          case 'runtime': key = 'dependencies.bun'; version = pkg.dependencies?.bun; break;
+          case 'test-runner': key = 'testRunnerBun'; version = pkg.testRunnerBun; break;
+          default:
+            console.error(`::error::Unknown Bun role: ${role}`);
+            process.exit(1);
+        }
+        if (typeof version !== 'string' || version !== version.trim() || !/^\d+\.\d+\.\d+$/.test(version)) {
+          console.error(`::error::Missing or invalid package.json ${key} for Bun role ${role}`);
+          process.exit(1);
+        }
+        require('node:fs').appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\n`);
+        console.log(`Using Bun ${version} from package.json ${key} (${role})`);
+        NODE
 
     - name: Setup Bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

.github/workflows/ci.yml

@@ -549,6 +549,11 @@
           printf 'Scheduled run: workflow from %s, testing dev at %s\n' "$GITHUB_SHA" "$sha" >> "$GITHUB_STEP_SUMMARY"
           printf 'scheduled run tests dev at %s (workflow %s)\n' "$sha" "$GITHUB_SHA"
 
+  # Bun roles (#6713): runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming;
+  # test-runner 1.4.0 avoids 1.4.2's multi-file --isolate preload segfault (#4821
+  # reverted #4064; run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9).
+  # Rejoin after the upstream runner crash is fixed and a green lane=all dispatch
+  # proves the unified version, then delete testRunnerBun and the action's role input.
   # The suite, split by file across four Linux runners.
   #
   # `scripts/ci/run-bun-test-batches.sh` assigns files to shards by the per-file
@@ -603,6 +608,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       # The GUI install is NOT optional here, however unrelated it looks to a
       # test shard. Several files under tests/ import JSX-bearing modules from
@@ -649,6 +656,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -689,6 +698,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -725,6 +736,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -824,6 +837,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -893,6 +908,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -1035,6 +1052,8 @@
 
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner # See the Bun roles contract above test.
 
       - name: Install dependencies
         run: |
@@ -1240,8 +1259,8 @@
         run: bun run structure:check
 
   # The composite Bun setup, run on each runner family it serves, when a change touches only the
-  # action (see the setup_action filter). One step past the action proves it installed the runtime
-  # package.json declares; nothing else runs, so this never grows into a suite.
+  # action (see the setup_action filter). Each role proves its resolved and installed
+  # version matches package.json; nothing else runs, so this never grows into a suite.
   setup-action:
     name: setup action ${{ matrix.os }}
     needs: changes
@@ -1277,10 +1296,30 @@
             exit 1
           fi
 
+      - name: Setup project Bun test runner
+        id: bun-test-runner
+        uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner
+
+      - name: Require the test runner package.json declares
+        shell: bash
+        env:
+          RESOLVED: ${{ steps.bun-test-runner.outputs.version }}
+        run: |
+          set -euo pipefail
+          declared="$(node -p "require('./package.json').testRunnerBun")"
+          installed="$(bun --version)"
+          echo "declared=$declared resolved=$RESOLVED installed=$installed"
+          if [ "$RESOLVED" != "$declared" ] || [ "$installed" != "$declared" ]; then
+            echo "::error::setup-project-bun resolved '$RESOLVED' and installed '$installed', but package.json testRunnerBun declares '$declared'"
+            exit 1
+          fi
+
   # The Rust remote-workspace helper, when a change touches it (see the remote_helper filter).
   # Formatting once, then clippy and the crate's tests on each platform: the sandbox and the live
   # confinement tests compile only on macOS and Windows, and Linux covers the protocol and stub.
   remote-helper:
     name: remote helper ${{ matrix.os }}
     needs: changes
     if: needs.changes.outputs.remote_helper == 'true'
@@ -1432,12 +1471,10 @@
           persist-credentials: false
           ref: ${{ needs.changes.outputs.checkout_ref }}
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
+      - name: Setup project Bun
+        uses: ./.github/actions/setup-project-bun
 
       - name: Install dependencies
         run: |
           bun install --frozen-lockfile
           cd desktop

.github/workflows/dev-version-bump.yml

@@ -78,10 +78,13 @@ jobs:
           persist-credentials: false
 
       # The repository-owned composite action, not a hand-pinned setup-bun SHA: it
-      # resolves the Bun version from package.json so the runtime SOT stays in one
-      # place. An independently pinned action here would drift from every other job.
+      # selects package.json's test-runner pin even for this single-file test so
+      # validation follows the CI runner contract (see setup-project-bun/action.yml).
+      # This job edits version metadata; it does not compile a shipped runtime.
       - name: Setup project Bun
         uses: ./.github/actions/setup-project-bun
+        with:
+          role: test-runner
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

CONTRIBUTING.md

@@ -33,8 +33,8 @@ For local development commands, architecture notes, and release workflow details
 contributing guide above instead of duplicating instructions here.
 
 Source development requires the `bun` CLI on your `PATH`. The published npm package bundles its own
-Bun runtime for end users, but contributor commands such as `bun install`, `bun run test`, and
-`bun run prepush` run from your local Bun installation.
+Bun runtime for end users. Package scripts such as `bun run test` and `bun run prepush` may resolve
+Bun through that bundled dependency.
 
 ## Pull request contract
 
@@ -61,6 +61,10 @@ A ready-for-review PR is the author's claim that the change is complete, underst
 
 ## Local validation and hooks
 
+The suite uses Bun 1.4.0 (`testRunnerBun`) while the shipped runtime is 1.4.2.
+`scripts/test.ts` finds a 1.4.0 binary on PATH or in `~/.bun/bin`, or uses
+`OCX_TEST_RUNNER_BUN`; install that version locally if it is missing.
+
 Run `bun run test` before review readiness. If the full local suite is too costly
 for the task or available resources, run at least focused regression tests for
 the changed behavior. Document the reason, commands, results, and remaining

Dockerfile

@@ -1,7 +1,12 @@
 # syntax=docker/dockerfile:1
 
 # Keep the runtime aligned with package.json and pin the multi-platform image index.
-ARG BUN_IMAGE=oven/bun:1.4.0@sha256:5ff609364c049b54eb0ff560ec96319729a972078ef2c755d758f0c6ef89c2d6
+# Runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming; CI tests stay on 1.4.0
+# because 1.4.2 segfaults reloading preloads in multi-file --isolate (#4821;
+# #6713 run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9). Rejoin after the
+# upstream crash fix passes a unified-version lane=all dispatch, then delete
+# package.json's testRunnerBun pin and setup-project-bun's role input.
+ARG BUN_IMAGE=oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895
 
 FROM ${BUN_IMAGE} AS manifest
 WORKDIR /home/bun/app

README.md

@@ -320,7 +320,7 @@ OpenCodex tracks process-retained state in the categories below. Each has a docu
   store, which is pinned and never evicted.
 - **4 observed buffers** (translator accumulators, image/OAuth/Grok tails) are
   monitored for in-flight byte pressure without eviction.
-- **28 state-store registrations** handle expiry sweeps (60 s interval) and
+- **31 state-store registrations** handle expiry sweeps (60 s interval) and
   config-generation reconciliation so stale provider/account keys are removed.
 - **Path and fingerprint memos** (workspace metadata, hardened identities, installation
   salts, mode-hint capabilities) use insertion-order LRU caps (8–128 entries).
@@ -458,8 +458,8 @@ Acknowledging a report is not the same as triaging it, and no first-response tar
 
 ## Development
 
-Source development requires the `bun` CLI on your `PATH`. This is separate from the published npm
-package's bundled Bun runtime, which is used only by installed `ocx` commands.
+Source development requires the `bun` CLI on your `PATH`. The published npm package bundles its own
+Bun runtime for installed `ocx` commands; package scripts may also resolve Bun through that bundled dependency.
 
 ```bash
 git clone https://github.com/lidge-jun/opencodex.git

desktop/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "opencodex-desktop"
-version = "2.80.0"
+version = "2.81.0"
 description = "OpenCodex desktop shell"
 authors = ["OpenCodex contributors"]
 license = "MIT"

desktop/src-tauri/src/provider_icons.rs

@@ -24,6 +24,7 @@ macro_rules! svg {
 
 const ALIASES: &[(&str, &str)] = &[
     ("anthropic", "claude-color.svg"),
+    ("anthropic2", "claude-green.svg"),
     ("anthropic-apikey", "claude-color.svg"),
     ("claude-cli", "claude-color.svg"),
     ("azure-openai", "openai.svg"),
@@ -152,6 +153,7 @@ fn svg(file: &str) -> Option<&'static str> {
         "bizrouter.svg" => svg!("bizrouter.svg"),
         "cerebras.svg" => svg!("cerebras.svg"),
         "claude-color.svg" => svg!("claude-color.svg"),
+        "claude-green.svg" => svg!("claude-green.svg"),
         "cline-color.svg" => svg!("cline-color.svg"),
         "cloudflare-ai-gateway-color.svg" => svg!("cloudflare-ai-gateway-color.svg"),
         "commandcode-color.svg" => svg!("commandcode-color.svg"),

desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "OpenCodex",
-  "version": "2.80.0",
+  "version": "2.81.0",
   "identifier": "com.opencodex.desktop",
   "build": {
     "frontendDist": "../ui",