build: make Bun the primary runtime - #1970
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
50b4919 to
caec73c
Compare
|
Rebased onto current Conflict resolution:
Post-rebase Bun 1.4.0 validation passed in clean Docker: static/build checks, all three official coding-agent shards, process stress 19/19, kernel-heavy 23/23, CPython 269/269, AI/TUI/agent packages, and compiled artifact smoke 5/5. An independent rebase audit found no actionable integration issues. The prior review-fix commit |
|
Macroscope skipped reviewing this pull request. Per-review cost limit exceeded (workspace setting). This review would cost an estimated $10.85, which exceeds your per-review limit of $10.00. The top 3 files driving up this estimate:
Tip To get this pull request reviewed, you can:
|
|
Addressed both post-rebase Cursor findings in
Validation: root checks passed; installer suite passed 23/23 locally and in clean Bun 1.4.0 Linux Docker. Both threads have evidence replies and are resolved. Hosted checks are restarting. |
# Conflicts: # packages/coding-agent/test/suite/agent-session-compaction.test.ts
- semantic-edges: replace vi.spyOn(accessor) with Object.defineProperty + Reflect.deleteProperty restoration (Bun does not support getter spy) - bun-installer: use realpathSync(tmp) instead of shell spawn for /var -> /private/var canonicalization - session-lease: create guard directory with future mtime to prevent proper-lockfile stale-reclaim during Bun's slow Atomics.wait
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…injection Never rm -rf any pre-existing final path entity (file, symlink, or directory) in fresh install or update. Check with `-e` and `-L` before any operation. Reuse a healthy existing target after layout+smoke validation. Stage to a collision-checked repair directory (bounded deterministic counter, no RANDOM) when existing target is unhealthy. Never pre-delete destination; fail closed on collision. Track owned paths via _owned_dest for cleanup; delete only what this invocation staged (not pre-existing paths). Rewrite atomic symlink test to use execFileSync argv (CodeQL fix). Add 14 tests: healthy reuse, unhealthy repair, active repair, collision retry, symlink/file collision, bounded failure, activation failure recycling old target, and no pre-existing dir deletion for both install and update.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5259609. Configure here.
| } | ||
| _owned_dest="$_repair_dir" | ||
| prime_agent_binary_repair_copy "$_repair_dir" | ||
| fi |
There was a problem hiding this comment.
Owned dest survives install interrupt
Medium Severity
_owned_dest is cleaned only on the explicit activation-failure paths. The EXIT trap still tracks only staging and download. An interrupt during prime_agent_binary_repair_copy leaves a half-written directory that this publisher will never replace, so later same-version installs are forced onto new repair paths and the canonical slot stays broken.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 5259609. Configure here.
|
Installer hardening is now complete in |
3 participants
Linear: https://linear.app/primeintellect/issue/RES-1242/make-bun-the-primary-prime-agent-runtime
Summary
1.4.0exactly and make it the primary installer, package manager, development runtime, test runner, bundler, compiler, and CI/release tool.Runtime and test migration
Bun.build.Binary and installer safety
~/.primeuser state.Release behavior
main.darwin-arm64,darwin-x64,linux-arm64, andlinux-x64release layouts.concurrency.queue: maxso release runs remain FIFO-serialized.Validation
tsgo --noEmit, installer rendering, and browser smoke: passed.--versionand--help.0.9.1passed manifest, tarball, and entry-point checks.All process-heavy validation ran in Docker with isolated writable dependency volumes.
Paired Docker benchmark
Linux arm64, 4 CPUs, 8 GB RAM. Baseline:
origin/main@81ae3cb34d, Node 22.23.2/npm 10.9.8. Bun:1.4.0+34cbb9a40with minification, bytecode, and lazy Bedrock loading.End-user installation
Five real installer trials used a controlled local release server. Node was already installed and npm's third-party cache was warm, which favors npm. Bun ran checksum verification, extraction, smoke testing, and atomic activation.
--helpDeveloper loop
node_modulesModel latency and subagent completion time were not measured.
Note
High Risk
This changes the end-user install/update path, release artifact format, and entire CI/release pipeline; mistakes could break downloads, upgrades, or production publishes.
Overview
Makes Bun 1.4.0 the repo-wide toolchain by adding
.bun-version,bun.lock, andbunfig.toml(7-dayminimumReleaseAgereplaces.npmrc), and switching Husky,AGENTS.md, and all GitHub Actions from Node/npm tooven-sh/setup-bun,bun install --frozen-lockfile, andbun run(includingcheck:bun-version). CI splits former matrix extras into dedicated process-stress, kernel-heavy, runtime-python, and artifact-smoke jobs; uv is pinned viasetup-uv@0.12.4.Release and distribution move from npm tarballs to Bun-compiled artifacts. The build workflow cross-compiles
packages/coding-agentfordarwin-arm64,darwin-x64,linux-arm64, andlinux-x64, copies binary sidecar assets, packs withbun run release:pack, smoke-tests by extracting the host*.tar.gzand running--version, and publishes*.tar.gzto R2 instead of*.tgz. The npm 12 installer smoke test is removed.install.shis rewritten for binary-only installs: downloads platformprime-agent-{version}-{platform}.tar.gz, verifies SHA256SUMS, installs into immutable version directories under XDG paths, activates via atomic symlinks with install locks and rollback, supports--update, rejects--method, and drops Node/npm bootstrap, kernel-on-install prompts, and globalnpm install -g. PATH setup targets~/.local/bininstead of npm’s global bin.Reviewed by Cursor Bugbot for commit 5259609. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Replace Node/npm/tsx with Bun as the primary runtime
bun.lockandbunfig.toml, and pins Bun version via.bun-version.install.shfrom an npm-package installer to a compiled-binary installer that downloads, verifies, and atomically activates platform-specific Bun-compiled archives with rollback support; removes all Node.js/npm installation logic and the--methodflag.bun:testwith a preload compatibility shim (bun-test-preload.ts) providing fake timers,waitFor,expect.poll, and module mocking viacreateRequire; convertsvi.mockfactories to synchronouscreateRequire-based mocks across all test files.createCliSubprocessLaunchSpecto centralize subprocess launch logic for compiled binaries, installed launchers, and direct runtime execution; replaces tsx-based CLI launches throughout.install.shrejects--method, musl Linux, and Windows; daemon sockets now flush before close with a 1-second forced-destroy timeout;console.log/info/debugredirect to stderr during stdout takeover in Bun;detectInstallMethodno longer classifies all Bun runs asbun-binary;assertNodeVersionno longer skips validation for Bun runtimes;defaultDaemonSocketDirhonorsTMPDIR/TMP/TEMP.Changes since #1970 opened
Macroscope summarized 7163e9c.