@code-yeongyu/senpi-codemode 2026.10.31-1 → 2026.11.2-1

package/src/skill/bun-1-4/references/http-networking.md

@@ -1,113 +0,0 @@
-# Bun 1.4 HTTP & Networking
-
-## Serve files & folders (replaces express.static, serve-static, sirv) [v1.4.0]
-
-Docs: <https://bun.com/docs/runtime/http/routing> · Blog: [#serve-files-folders](https://bun.com/blog/bun-v1.4#serve-files-folders)
-
-```ts
-Bun.serve({
-  routes: {
-    "/static/*": { dir: "./public" },
-  },
-});
-```
-
-- Files stream with `sendfile`; `Content-Type`, `ETag`, `Last-Modified`, `304`, and `Range` handled automatically; `index.html` served for directories.
-- Path traversal is blocked: paths normalized, and on Linux files open with `openat2` + `O_RESOLVE_BENEATH` so symlinks can't escape the directory.
-
-## Range and conditional requests [v1.3.13, improved v1.4.0]
-
-Blog: [#range-and-conditional-requests](https://bun.com/blog/bun-v1.4#range-and-conditional-requests)
-
-```ts
-Bun.serve({
-  routes: { "/video.mp4": new Response(Bun.file("./video.mp4")) },
-});
-// curl -H 'Range: bytes=0-1023' → 206 Partial Content
-// curl -H 'If-None-Match: "..."' → 304 Not Modified
-```
-
-Static routes and `Bun.file()` bodies handle `Range` (206), `If-None-Match`/`If-Modified-Since` (304), `If-Match`/`If-Unmodified-Since` (412). Video seeking and resumable downloads work out of the box.
-
-## HTTP/3 in Bun.serve() — EXPERIMENTAL [v1.3.14, improved v1.4.0]
-
-Docs: <https://bun.com/docs/runtime/http/server> · Blog: [#http-3-in-bun-serve-experimental](https://bun.com/blog/bun-v1.4#http-3-in-bun-serve-experimental)
-
-```ts
-Bun.serve({
-  port: 443,
-  tls: { /* cert, key */ },
-  http3: true,      // also listen on UDP/443
-  // h1: false,     // optional: HTTP/3 only
-  fetch(req) { return new Response("hi"); },
-});
-```
-
-- HTTP/1.1 keeps working over TCP; `Alt-Svc` header advertises H3 so browsers upgrade themselves. 2.7x faster than HTTPS/1.1 on static routes.
-- **Do not ship `http3: true` to production yet**: 0-RTT resumption disabled, `server.upgrade()` returns `false` over H3, `unix:` sockets skip the H3 listener.
-
-## HTTP/2 & HTTP/3 in fetch() — EXPERIMENTAL [v1.3.14, improved v1.4.0]
-
-Blog: [#http-2-http-3-in-fetch-experimental](https://bun.com/blog/bun-v1.4#http-2-http-3-in-fetch-experimental)
-
-```ts
-const [a, b] = await Promise.all([
-  fetch(url1, { protocol: "http2" }),  // concurrent same-origin requests share one connection
-  fetch(url2, { protocol: "http2" }),
-]);
-const res = await fetch(url3, { protocol: "http3" });
-```
-
-- Redirects, decompression, streaming behave as over HTTP/1.1.
-- Global opt-in: `BUN_FEATURE_FLAG_EXPERIMENTAL_HTTP2_CLIENT=1` or `--experimental-http3-fetch` (Bun remembers per-origin H3 support).
-
-## fetch() request compression [v1.4.0]
-
-Blog: [#fetch-request-compression](https://bun.com/blog/bun-v1.4#fetch-request-compression)
-
-```ts
-await fetch(url, {
-  method: "POST",
-  body: largeJsonString,
-  compress: "gzip", // or true, "deflate", "br", "zstd", { encoding, level }
-});
-```
-
-Buffered bodies (string, ArrayBuffer, TypedArray, Blob) are compressed and `Content-Encoding`/`Content-Length` set automatically; streaming bodies pass through unchanged.
-
-## fetch() proxy headers [v1.3.4]
-
-Blog: [#fetch-proxy-headers](https://bun.com/blog/bun-v1.4#fetch-proxy-headers)
-
-```ts
-await fetch(url, {
-  proxy: {
-    url: "http://proxy.example.com:8080",
-    headers: { "Proxy-Authorization": "Bearer token" },
-  },
-});
-```
-
-## TLS session resumption + connection reuse [v1.3.10-v1.4.0]
-
-Blog: [#tls-session-resumption](https://bun.com/blog/bun-v1.4#tls-session-resumption), [#connection-reuse](https://bun.com/blog/bun-v1.4#connection-reuse)
-
-- Second cold connection to an origin resumes at 1 RTT (32-entry per-origin LRU of BoringSSL client sessions).
-- `fetch()` reuses connections through HTTPS proxies and for requests with custom TLS options (client cert, custom CA). No code change needed.
-
-## HTML routes: sourcemaps off in production [v1.4.0]
-
-Blog: [#html-routes-sourcemaps-disabled-in-production](https://bun.com/blog/bun-v1.4#html-routes-sourcemaps-disabled-in-production)
-
-Production `Bun.serve` no longer serves sourcemaps for HTML routes (dev mode still does). Override in `bunfig.toml`:
-
-```toml
-[serve.static]
-sourcemap = "linked"
-```
-
-## Server lifecycle changes worth knowing (v1.4)
-
-- `server.stop()` now closes idle keep-alive connections immediately, waits for in-flight responses, and resolves when the last connection closes. `server.stop(true)` force-closes stalled ones.
-- `server.publish()` / `ws.publish()` return `0` (dropped/no subscribers) or `-1` (backpressure) instead of always the byte count.
-- Per-method route objects (`{ GET }`) answer `HEAD` with the GET handler automatically.

package/src/skill/bun-1-4/references/install.md

@@ -1,93 +0,0 @@
-# bun install & package management in 1.4
-
-## Global virtual store: up to 7x faster installs [v1.3.14]
-
-Blog: [#global-virtual-store-up-to-7x-faster-installs](https://bun.com/blog/bun-v1.4#global-virtual-store-up-to-7x-faster-installs)
-
-```toml
-# bunfig.toml
-[install]
-linker = "isolated"
-```
-
-With the isolated linker, packages extract once into Bun's global cache and are symlinked into `node_modules/.bun/` (one `symlink()` per package instead of one `clonefileat()`). Warm-cache CI installs of 1,400 packages: 7x faster. Opt-in for existing projects; **new monorepos default to isolated** (see below).
-
-## New subcommands [v1.4.0]
-
-Blog anchors: [#bun-pm-diff](https://bun.com/blog/bun-v1.4#bun-pm-diff), [#bun-audit-fix](https://bun.com/blog/bun-v1.4#bun-audit-fix), [#bun-dedupe](https://bun.com/blog/bun-v1.4#bun-dedupe), [#bun-prune](https://bun.com/blog/bun-v1.4#bun-prune), [#bun-pm-licenses](https://bun.com/blog/bun-v1.4#bun-pm-licenses)
-
-```bash
-bun pm diff react                    # lockfile version → latest; un-minifies before diffing;
-bun pm diff react@18.2.0 19.0.0      # summary flags new install scripts + new child_process/fs/net/vm imports
-bun pm diff ./vendored-pkg pkg@2.1.0
-
-bun audit fix                        # upgrade vulnerable packages to safe versions; --latest allows majors; --dry-run
-bun dedupe                           # collapse duplicate versions in bun.lock; --check fails CI on dupes
-bun prune --production               # delete node_modules entries not in bun.lock; --production drops devDeps
-bun pm licenses --prod --json        # dependency license inventory
-```
-
-Docker pattern: build with devDeps, ship without:
-
-```dockerfile
-RUN bun install --frozen-lockfile
-COPY . .
-RUN bun run build
-RUN bun prune --production
-```
-
-## bun update: transitive + patterns [v1.4.0]
-
-Blog: [#bun-update-updates-transitive-dependencies](https://bun.com/blog/bun-v1.4#bun-update-updates-transitive-dependencies)
-
-```bash
-bun update                    # now updates deps-of-deps too
-bun update zod                # updates zod everywhere it appears
-bun update '@types/*' --latest
-```
-
-`bun update <name>` errors (exit 1) if nothing depends on it (no longer silently adds).
-
-## Monorepo: --filter and --catalog [v1.4.0]
-
-Blog: [#bun-add-filter](https://bun.com/blog/bun-v1.4#bun-add-filter), [#bun-add-catalog](https://bun.com/blog/bun-v1.4#bun-add-catalog)
-
-```bash
-bun add zod --filter api          # add to one workspace from the repo root
-bun run --filter 'web...' build   # web + its dependencies; '...web' = its dependents
-bun add react --catalog           # add to root catalog, write "catalog:" in the workspace
-```
-
-Plain `bun add x` in a workspace whose default catalog lists `x` writes `catalog:` automatically.
-
-## Nested overrides [v1.4.0]
-
-Blog: [#nested-overrides](https://bun.com/blog/bun-v1.4#nested-overrides)
-
-```json
-{
-  "overrides": {
-    "express": { "qs": "6.13.0" },
-    "lodash@<4.17.21": "4.17.21"
-  }
-}
-```
-
-npm nested form, yarn `a/b`, pnpm `a>b` all work; overrides can be version-scoped. Lockfiles using these become `lockfileVersion: 3` (older Bun can't read them).
-
-## Supply-chain hardening
-
-- **Lockfile integrity** [v1.3.10]: `bun.lock` records SHA-512 for GitHub and tarball deps, like npm packages.
-- **`trustedDependencies` auto-trust is npm-registry-only** [v1.3.5]: a `git:`/`github:`/`file:` package named `esbuild` gets NO trust from the default list — list it yourself. Names match exactly (not by hash).
-- **`nativeDependencies`** [v1.3.2]: for packages shipping prebuilt binaries as per-platform optionalDependencies, Bun links the right binary directly instead of running postinstall. **`ignoreScripts`** skips a package's lifecycle scripts even if trusted.
-
-```json
-{ "nativeDependencies": ["esbuild"], "ignoreScripts": ["sharp"] }
-```
-
-## Defaults changed in 1.4 (see also breaking-changes.md)
-
-- New monorepos default to `linker: "isolated"` (`configVersion: 1` in bun.lock). Existing lockfiles keep hoisted. Pin `linker = "hoisted"` to opt out.
-- `bun.lock` is `lockfileVersion: 2`: out-of-registry tarballs need integrity hashes; git entries validated against path traversal. Run `bun install` to migrate.
-- A project's `bunfig.toml` now overrides `.npmrc` for the same key.
-- `bun init` writes `typescript ^7`; non-TTY `bun init` behaves as `-y`.

package/src/skill/bun-1-4/references/security.md

@@ -1,52 +0,0 @@
-# Bun 1.4 Security Tightening
-
-Blog: [#security](https://bun.com/blog/bun-v1.4#security)
-
-1.4 tightened TLS/parsing defaults. **A connection that worked on 1.3 can now fail with a verification error — that is usually the fix working, not a bug.** Diagnose before loosening.
-
-## checkServerIdentity runs BEFORE fetch() sends [v1.4.0]
-
-```ts
-await fetch("https://api.example.com/upload", {
-  method: "POST",
-  body: secretPayload,
-  tls: {
-    checkServerIdentity(hostname, cert) {
-      if (cert.fingerprint256 !== PINNED) return new Error("pin mismatch");
-    },
-  },
-});
-// nothing is sent until the callback returns undefined; re-runs on each redirect hop
-```
-
-If you pin a cert and the URL redirects through another host, the callback sees that cert too — accept every hop or use `redirect: "manual"`.
-
-## tls.connect defaults servername to host [v1.3.13]
-
-`tls.connect({ host, port })` without `servername` uses `host` for SNI + identity check (matches Node). Connecting by IP or `localhost` to a cert issued for another name now fails with `ERR_TLS_CERT_ALTNAME_INVALID` — including through drivers like `pg`/`ioredis`. Fix: pass the cert's name as `servername`, or `checkServerIdentity: () => undefined` if trusting by CA alone.
-
-```ts
-tls.connect({ host: "10.0.0.12", port: 5432, ca, servername: "db.internal" });
-```
-
-## Bun.connect / Bun.listen enforce rejectUnauthorized [v1.4.0]
-
-`Bun.connect({ tls })`, `socket.upgradeTLS()`, and `Bun.listen()` with `requestCert: true` default to `rejectUnauthorized: true`. A self-signed dev server with no `ca` does NOT throw — the `handshake` handler runs with `socket.authorized === false`, writes return `-1`, and the socket closes without data. Pass the CA in `tls`, or `rejectUnauthorized: false` (`NODE_TLS_REJECT_UNAUTHORIZED=0` honored).
-
-## RedisClient verifies TLS hostname [v1.3.14]
-
-`rediss://` checks the server cert against the URL host; first command rejects with `ERR_TLS_CERT_ALTNAME_INVALID` on mismatch. Connect by the certificate's name, or pass `tls: { rejectUnauthorized: false }`.
-
-## HTTP request parsing hardening in Bun.serve [v1.3.4]
-
-More malformed `Content-Length` / `Transfer-Encoding` / chunked bodies get `400` + connection close, without calling your `fetch` handler or logging. Browsers/curl/proxies never send these; if a hand-written client starts seeing 400s, fix its framing headers.
-
-## Tarball extraction hardening [v1.3.6]
-
-`github:`/URL dependencies and `bun create` templates skip tar entries that would land outside the package directory. A post-upgrade `Cannot find module` for such a package usually means the repo has a symlink pointing outside the package — replace it with a real file or relative link.
-
-## Also
-
-- Registry credentials stay scoped to their configured host: never sent cross-origin, never downgraded to `http://`, never printed in errors/verbose output.
-- `tls.createServer({ requestCert: true })` now rejects unverified client certs by default; only a literal `rejectUnauthorized: false` disables verification (`null` no longer counts).
-- Full list: [Security hardening](https://bun.com/blog/bun-v1.4#security-hardening) in the changelog; advisories at <https://github.com/oven-sh/bun/security/advisories>.

package/src/skill/bun-1-4/references/test.md

@@ -1,103 +0,0 @@
-# bun test in 1.4
-
-Composable CI recipe:
-
-```bash
-bun test --changed=main                                   # only what your branch touches
-bun test --parallel --timings=timings.json --update-timings
-bun test --parallel --shard=1/3 --timings=timings.json    # in CI, per machine
-```
-
-## --parallel: worker processes [v1.3.13, improved v1.4.0]
-
-Blog: [#bun-test-parallel](https://bun.com/blog/bun-v1.4#bun-test-parallel)
-
-```bash
-bun test --parallel          # N = CPU count
-bun test --parallel=4
-```
-
-- Files go to whichever worker frees up next. Coverage and JUnit output merged across workers; `--bail` stops every worker.
-- `--parallel` implies `--isolate`; `--no-isolate` opts out.
-- Workers expose 1-indexed `JEST_WORKER_ID` / `BUN_TEST_WORKER_ID`, so Jest setups keying DBs/ports off worker id work unchanged.
-- Preload scripts with top-level `await` complete before any worker runs tests.
-
-## --isolate: fresh global per file [v1.3.13, hardened v1.4.0]
-
-Blog: [#bun-test-isolate](https://bun.com/blog/bun-v1.4#bun-test-isolate)
-
-```bash
-bun test --isolate
-```
-
-Between files, Bun creates a new `globalThis`, clears ESM/CJS module registries, closes leaked servers/sockets/watchers/subprocesses, cancels timers, restores fake timers, and re-runs `--preload`. Transpiled source/bytecode stay cached process-wide, so only top-level code re-runs. This is how Jest/Vitest behave by default — use it to kill "passes alone, fails in the full suite" bugs. v1.4 fixed the 1.3.13 stability issues (fake-timer leaks, module-scope subprocess leaks, `process.chdir` bleed, N-API across files, debugger breakpoints).
-
-## --shard: split across CI machines [v1.3.13]
-
-Blog: [#bun-test-shard](https://bun.com/blog/bun-v1.4#bun-test-shard)
-
-```bash
-bun test --shard=1/3   # deterministic, round-robin, 1-based (matches Jest/Vitest/Playwright)
-```
-
-Works with `--changed` and `--randomize`; an empty shard exits 0.
-
-## --timings: balance by wall time [v1.4.0]
-
-Blog: [#bun-test-timings](https://bun.com/blog/bun-v1.4#bun-test-timings)
-
-```bash
-bun test --timings=timings.json --update-timings   # record per-file durations
-bun test --shard=1/3 --timings=timings.json        # shards cut by equal time, not file count
-bun test --parallel --timings=timings.json         # workers start slowest file first (LPT scheduling)
-```
-
-The timings file is written slowest-first, so it doubles as a slow-test report. Files sharing imports stay together (warm module cache).
-
-## --changed: only affected tests [v1.3.13]
-
-Blog: [#bun-test-changed](https://bun.com/blog/bun-v1.4#bun-test-changed)
-
-```bash
-bun test --changed             # uncommitted (unstaged + staged + untracked)
-bun test --changed=main        # diff against branch/commit/tag
-bun test --changed --watch     # re-filters on every restart
-```
-
-Bun scans test imports, asks git what changed, walks the import graph backwards. tsconfig `paths` aliases (`@/*`) work. Vitest-compatible flag.
-
-## --retry and repeats [v1.3.3]
-
-Blog: [#bun-test-retry](https://bun.com/blog/bun-v1.4#bun-test-retry)
-
-```ts
-test("flaky network call", async () => { await fetch("https://example.com"); }, { retry: 5 });
-test("stress", () => { if (Math.random() < 0.1) throw new Error("uh oh!"); }, { repeats: 20 });
-```
-
-`bun test --retry <N>` sets a suite-wide default. NOTE: prefer fixing the flake; retry is a containment tool.
-
-## jest.useFakeTimers() [v1.3.4, improved v1.4.0]
-
-Blog: [#jest-usefaketimers](https://bun.com/blog/bun-v1.4#jest-usefaketimers)
-
-```ts
-import { jest, test, expect } from "bun:test";
-test("debounce", () => {
-  jest.useFakeTimers();
-  let called = 0;
-  setTimeout(() => called++, 1000);
-  jest.advanceTimersByTime(1000);
-  expect(called).toBe(1);
-  jest.useRealTimers();
-});
-```
-
-- Controls `setTimeout`, `setInterval`, `Date`. `jest.setSystemTime()` works with `advanceTimersByTime()`.
-- `@testing-library/react`'s `waitFor` detects fake timers and advances instead of sleeping. `Bun.cron` schedules can be driven by the fake clock.
-
-## Behavior changes in 1.4 (test-related)
-
-- `jest.resetAllMocks()` now drops implementations too (matches Jest); use `clearAllMocks()` for history-only.
-- `expect().toContain()` compares with `===` not `Object.is` (`[NaN]` no longer contains `NaN`).
-- `toEqual()` compares `Temporal` objects by value.