@code-yeongyu/senpi-codemode 2026.10.31-1 → 2026.10.31-2

package/src/skill/bun-1-4/references/security.md

@@ -1,52 +0,0 @@
-# Bun 1.4 Security Tightening
-
-Blog: [#security](https://bun.com/blog/bun-v1.4#security)
-
-1.4 tightened TLS/parsing defaults. **A connection that worked on 1.3 can now fail with a verification error — that is usually the fix working, not a bug.** Diagnose before loosening.
-
-## checkServerIdentity runs BEFORE fetch() sends [v1.4.0]
-
-```ts
-await fetch("https://api.example.com/upload", {
-  method: "POST",
-  body: secretPayload,
-  tls: {
-    checkServerIdentity(hostname, cert) {
-      if (cert.fingerprint256 !== PINNED) return new Error("pin mismatch");
-    },
-  },
-});
-// nothing is sent until the callback returns undefined; re-runs on each redirect hop
-```
-
-If you pin a cert and the URL redirects through another host, the callback sees that cert too — accept every hop or use `redirect: "manual"`.
-
-## tls.connect defaults servername to host [v1.3.13]
-
-`tls.connect({ host, port })` without `servername` uses `host` for SNI + identity check (matches Node). Connecting by IP or `localhost` to a cert issued for another name now fails with `ERR_TLS_CERT_ALTNAME_INVALID` — including through drivers like `pg`/`ioredis`. Fix: pass the cert's name as `servername`, or `checkServerIdentity: () => undefined` if trusting by CA alone.
-
-```ts
-tls.connect({ host: "10.0.0.12", port: 5432, ca, servername: "db.internal" });
-```
-
-## Bun.connect / Bun.listen enforce rejectUnauthorized [v1.4.0]
-
-`Bun.connect({ tls })`, `socket.upgradeTLS()`, and `Bun.listen()` with `requestCert: true` default to `rejectUnauthorized: true`. A self-signed dev server with no `ca` does NOT throw — the `handshake` handler runs with `socket.authorized === false`, writes return `-1`, and the socket closes without data. Pass the CA in `tls`, or `rejectUnauthorized: false` (`NODE_TLS_REJECT_UNAUTHORIZED=0` honored).
-
-## RedisClient verifies TLS hostname [v1.3.14]
-
-`rediss://` checks the server cert against the URL host; first command rejects with `ERR_TLS_CERT_ALTNAME_INVALID` on mismatch. Connect by the certificate's name, or pass `tls: { rejectUnauthorized: false }`.
-
-## HTTP request parsing hardening in Bun.serve [v1.3.4]
-
-More malformed `Content-Length` / `Transfer-Encoding` / chunked bodies get `400` + connection close, without calling your `fetch` handler or logging. Browsers/curl/proxies never send these; if a hand-written client starts seeing 400s, fix its framing headers.
-
-## Tarball extraction hardening [v1.3.6]
-
-`github:`/URL dependencies and `bun create` templates skip tar entries that would land outside the package directory. A post-upgrade `Cannot find module` for such a package usually means the repo has a symlink pointing outside the package — replace it with a real file or relative link.
-
-## Also
-
-- Registry credentials stay scoped to their configured host: never sent cross-origin, never downgraded to `http://`, never printed in errors/verbose output.
-- `tls.createServer({ requestCert: true })` now rejects unverified client certs by default; only a literal `rejectUnauthorized: false` disables verification (`null` no longer counts).
-- Full list: [Security hardening](https://bun.com/blog/bun-v1.4#security-hardening) in the changelog; advisories at <https://github.com/oven-sh/bun/security/advisories>.

package/src/skill/bun-1-4/references/test.md

@@ -1,103 +0,0 @@
-# bun test in 1.4
-
-Composable CI recipe:
-
-```bash
-bun test --changed=main                                   # only what your branch touches
-bun test --parallel --timings=timings.json --update-timings
-bun test --parallel --shard=1/3 --timings=timings.json    # in CI, per machine
-```
-
-## --parallel: worker processes [v1.3.13, improved v1.4.0]
-
-Blog: [#bun-test-parallel](https://bun.com/blog/bun-v1.4#bun-test-parallel)
-
-```bash
-bun test --parallel          # N = CPU count
-bun test --parallel=4
-```
-
-- Files go to whichever worker frees up next. Coverage and JUnit output merged across workers; `--bail` stops every worker.
-- `--parallel` implies `--isolate`; `--no-isolate` opts out.
-- Workers expose 1-indexed `JEST_WORKER_ID` / `BUN_TEST_WORKER_ID`, so Jest setups keying DBs/ports off worker id work unchanged.
-- Preload scripts with top-level `await` complete before any worker runs tests.
-
-## --isolate: fresh global per file [v1.3.13, hardened v1.4.0]
-
-Blog: [#bun-test-isolate](https://bun.com/blog/bun-v1.4#bun-test-isolate)
-
-```bash
-bun test --isolate
-```
-
-Between files, Bun creates a new `globalThis`, clears ESM/CJS module registries, closes leaked servers/sockets/watchers/subprocesses, cancels timers, restores fake timers, and re-runs `--preload`. Transpiled source/bytecode stay cached process-wide, so only top-level code re-runs. This is how Jest/Vitest behave by default — use it to kill "passes alone, fails in the full suite" bugs. v1.4 fixed the 1.3.13 stability issues (fake-timer leaks, module-scope subprocess leaks, `process.chdir` bleed, N-API across files, debugger breakpoints).
-
-## --shard: split across CI machines [v1.3.13]
-
-Blog: [#bun-test-shard](https://bun.com/blog/bun-v1.4#bun-test-shard)
-
-```bash
-bun test --shard=1/3   # deterministic, round-robin, 1-based (matches Jest/Vitest/Playwright)
-```
-
-Works with `--changed` and `--randomize`; an empty shard exits 0.
-
-## --timings: balance by wall time [v1.4.0]
-
-Blog: [#bun-test-timings](https://bun.com/blog/bun-v1.4#bun-test-timings)
-
-```bash
-bun test --timings=timings.json --update-timings   # record per-file durations
-bun test --shard=1/3 --timings=timings.json        # shards cut by equal time, not file count
-bun test --parallel --timings=timings.json         # workers start slowest file first (LPT scheduling)
-```
-
-The timings file is written slowest-first, so it doubles as a slow-test report. Files sharing imports stay together (warm module cache).
-
-## --changed: only affected tests [v1.3.13]
-
-Blog: [#bun-test-changed](https://bun.com/blog/bun-v1.4#bun-test-changed)
-
-```bash
-bun test --changed             # uncommitted (unstaged + staged + untracked)
-bun test --changed=main        # diff against branch/commit/tag
-bun test --changed --watch     # re-filters on every restart
-```
-
-Bun scans test imports, asks git what changed, walks the import graph backwards. tsconfig `paths` aliases (`@/*`) work. Vitest-compatible flag.
-
-## --retry and repeats [v1.3.3]
-
-Blog: [#bun-test-retry](https://bun.com/blog/bun-v1.4#bun-test-retry)
-
-```ts
-test("flaky network call", async () => { await fetch("https://example.com"); }, { retry: 5 });
-test("stress", () => { if (Math.random() < 0.1) throw new Error("uh oh!"); }, { repeats: 20 });
-```
-
-`bun test --retry <N>` sets a suite-wide default. NOTE: prefer fixing the flake; retry is a containment tool.
-
-## jest.useFakeTimers() [v1.3.4, improved v1.4.0]
-
-Blog: [#jest-usefaketimers](https://bun.com/blog/bun-v1.4#jest-usefaketimers)
-
-```ts
-import { jest, test, expect } from "bun:test";
-test("debounce", () => {
-  jest.useFakeTimers();
-  let called = 0;
-  setTimeout(() => called++, 1000);
-  jest.advanceTimersByTime(1000);
-  expect(called).toBe(1);
-  jest.useRealTimers();
-});
-```
-
-- Controls `setTimeout`, `setInterval`, `Date`. `jest.setSystemTime()` works with `advanceTimersByTime()`.
-- `@testing-library/react`'s `waitFor` detects fake timers and advances instead of sleeping. `Bun.cron` schedules can be driven by the fake clock.
-
-## Behavior changes in 1.4 (test-related)
-
-- `jest.resetAllMocks()` now drops implementations too (matches Jest); use `clearAllMocks()` for history-only.
-- `expect().toContain()` compares with `===` not `Object.is` (`[NaN]` no longer contains `NaN`).
-- `toEqual()` compares `Temporal` objects by value.