@code-yeongyu/senpi 2026.8.30-3 → 2026.8.31

package/docs/rpc.md

@@ -1,5 +1,7 @@
 # RPC Mode
 
+Shared-host clients may advertise the `rendered_components` capability to receive factory-rendered widget, header, and footer records. In a shared session, component rendering uses the minimum width reported by currently attached connections, defaulting to 80 when none report a width; disconnected connections no longer contribute.
+
 The shared Unix socket host uses `<agentDir>/rpc-host-daemon/host.pid` and `settings.json` as its ownership state. Clients attach to a compatible existing host regardless of which client surface started it; only incompatible unmanaged owners are refused.
 
 RPC mode enables headless operation of the coding agent via a JSON protocol over stdin/stdout. This is useful for embedding the agent in other applications, IDEs, or custom UIs.
@@ -61,6 +63,18 @@ every open session, each tagged with its routing `sessionId`. Correlated respons
 only to the connection that issued the command. This lets a non-owner observe a foreign turn without requiring a
 separate subscription protocol.
 
+### Client information and rendered components
+
+Clients may send `set_client_info` with `{ sessionId, width, capabilities? }`. Advertising `rendered_components` registers
+that connection to receive factory-rendered `setWidget`, `setHeader`, and `setFooter` records. Those records are filtered
+per connection; array/undefined widget records and dialog requests retain their existing delivery semantics. Width is
+shared per session using the minimum of attached clients, and a closed or dropped connection no longer contributes its
+width or capability registration. Snapshot replay preserves rendered-component provenance and applies the same capability
+filter to late joiners; a client that registers `rendered_components` while a snapshot is active receives its retained
+factory-rendered records. On a shared socket host, `rendered_components` is registration-only: it is never inherited from the host environment and must be sent in `set_client_info` for each client connection. Registration applies to the sessions attached by that connection; closing one session removes only that session's width and capability association, while socket disposal removes all associations. Clients must re-register `width` and `capabilities` after every reconnect. When the last
+capable connection leaves a still-attached binding, live component renderers and footer data providers are disposed but
+their factories are retained; a later capable connection recreates and re-renders them.
+
 ### Session auto-titling
 
 Auto-generated session titles are on by default only for interactive launches. RPC hosts opt in with
@@ -126,12 +140,37 @@ internal directory. The supervisor also exports `SENPI_RPC_HOST_WATCH_PPID` as a
 set only by the supervisor: a host started any other way (plain `senpi --mode rpc --listen …`, embedders, hand-started
 hosts) sees neither variable and is unaffected. A host whose supervisor is alive is never touched by this binding.
 
+### Shared host occupancy (idle eviction, session cap, empty-host exit)
+
+Every open session owns a complete runtime (a lone idle session measures 340-510 MB RSS), so the host enforces three
+occupancy bounds itself, independent of the supervisor and of client cooperation:
+
+- **Idle eviction**: a session with no routed command and no session-owned work for
+  `SENPI_RPC_SESSION_IDLE_EVICTION_MS` (default 30 minutes) is closed through the exact `close_session` sequence
+  (abort → waitForIdle → dispose, all attachments drained, path reservation released) and every attached connection
+  receives that handle's `session_closed` broadcast plus a final `close_session` response record. "Session-owned
+  work" is the complete activity contract, not just a streaming turn: an agent run, a running bash command,
+  background terminal jobs and any other published wake source (terminal monitors, loop-guard holds), compaction,
+  and barrier-held session work all defer eviction, and the idle clock restarts when that work settles. An evicted
+  session resumes like any other: the next `open_session` with the same `sessionPath` reopens it.
+- **Session cap**: `open_session` beyond `SENPI_RPC_MAX_SESSIONS` concurrently opening/open sessions (default 8)
+  fails with `too_many_sessions`. Attaching to an already-hosted session (`attached: true`) adds no runtime and never
+  counts against the cap, so resume and second-surface flows keep working while at it.
+- **Empty-host exit**: when the registry holds zero sessions AND no client is connected, continuously for
+  `SENPI_RPC_HOST_EMPTY_EXIT_MS` (default 15 minutes), the host exits through its clean shutdown path (flush, socket
+  removal), for stdio and `--listen` hosts alike. A connected client counts as occupancy even with no session open,
+  so the host never drops a live socket under itself. Supervised hosts stay clean either way: a supervisor reads a
+  child exit of 0 without a signal as an intentional idle stop and exits 0 with the same cleanup, not as a crash.
+
+Values are positive integers; invalid values fall through to the defaults. These bounds run inside the host process,
+so they hold even for embedders and hand-started hosts that have no supervisor.
+
 ### D1 normative table (multi-session mode)
 
 | Command | Params | Success data | Notes |
 | --- | --- | --- | --- |
 | `get_protocol_info` | - | `{ protocolVersion: 1, serverVersion: string, capabilities: string[], mode: "classic"\|"multi" }` | Answered in BOTH modes; side-effect-free; the capability probe. Multi-session hosts include `multi_session` plus the negotiated launch capabilities. |
-| `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. |
+| `open_session` | `sessionPath?`, `cwd?`, `provider?`, `modelId?`, `thinkingLevel?`, `permissionPreset?` (all optional; paths MUST be absolute) | `{ sessionId, state: RpcSessionState, attached?: true }` | `sessionPath` = today's `--session` semantics (open-if-exists else create persisting there, `session-manager.ts:926-940`); `provider`/`modelId` applied only on create (resume restores the session's model — mirrors `SenpiSessionRuntime.ts:198-200`); params form the immutable launch profile (D8). When the path is already held by a fully-open session, the open ATTACHES to it: same routing handle, `attached: true`, one more attachment counted; the runtime is torn down only when the last attachment closes. Fails with `too_many_sessions` at the occupancy cap (see [Shared host occupancy](#shared-host-occupancy-idle-eviction-session-cap-empty-host-exit)); idle sessions past the eviction window are closed by the host itself. |
 | `close_session` | `sessionId` | `{}` | Aborts active work, awaits agent idle + settled persistence, flushes queued events, detaches subscriptions; its response is the LAST record tagged with that handle — no events after (test-pinned). |
 | `list_sessions` | - | `{ sessions: [{ sessionId, durableSessionId, sessionPath, cwd, name, status }] }` | Includes `opening`/`closing` entries with their status. |
 | every existing command | + `sessionId` (REQUIRED in multi mode) | unchanged | Routed to that session. |
@@ -150,6 +189,7 @@ In the response `error` field, machine-matchable:
 - `missing_session_id` (session-scoped command without `sessionId` in multi mode)
 - `multi_session_disabled` (`open_session` in classic mode)
 - `invalid_path` (relative `sessionPath`/`cwd`)
+- `too_many_sessions` (`open_session` while `SENPI_RPC_MAX_SESSIONS` sessions are already opening/open; attaching to a live session never fails this way)
 - `open_failed: <detail>`
 
 ### Tagging
@@ -1668,13 +1708,13 @@ Extensions can request user interaction via `ctx.ui.select()`, `ctx.ui.confirm()
 There are two categories of extension UI methods:
 
 - **Dialog methods** (`select`, `confirm`, `input`, `editor`): emit an `extension_ui_request` on stdout and block until the client sends back an `extension_ui_response` on stdin with the matching `id`.
-- **Fire-and-forget methods** (`notify`, `setStatus`, `setWidget`, `setTitle`, `set_editor_text`): emit an `extension_ui_request` on stdout but do not expect a response. The client can display the information or ignore it.
+- **Fire-and-forget methods** (`notify`, `setStatus`, `setWidget`, `setHeader`, `setFooter`, `setTitle`, `set_editor_text`): emit an `extension_ui_request` on stdout but do not expect a response. The client can display the information or ignore it.
 
 If a dialog method includes a `timeout` field, the agent-side will auto-resolve with a default value when the timeout expires. The client does not need to track timeouts.
 
 Some `ExtensionUIContext` methods are not supported or degraded in RPC mode because they require direct TUI access:
 - `custom()` returns `undefined`
-- `setWorkingMessage()`, `setWorkingIndicator()`, `setFooter()`, `setHeader()`, `setEditorComponent()`, `setToolsExpanded()` are no-ops
+- `setWorkingMessage()`, `setWorkingIndicator()`, `setEditorComponent()`, `setToolsExpanded()` are no-ops. `setFooter()` and `setHeader()` render factory components for clients advertising `rendered_components`.
 - `getEditorText()` returns `""`
 - `getToolsExpanded()` returns `false`
 - `pasteToEditor()` delegates to `setEditorText()` (no paste/collapse handling)
@@ -1801,7 +1841,22 @@ Set or clear a widget (block of text lines) displayed above or below the editor.
 }
 ```
 
-Send `widgetLines: undefined` (or omit it) to clear the widget. The `widgetPlacement` field is `"aboveEditor"` (default) or `"belowEditor"`. Only string arrays are supported in RPC mode; component factories are ignored.
+Send `widgetLines: undefined` (or omit it) to clear the widget. The `widgetPlacement` field is `"aboveEditor"` (default) or `"belowEditor"`. Component factories are rendered by the host using the attached client's terminal width.
+
+#### setHeader / setFooter
+
+Set or clear the extension header or footer using rendered text lines. Clients that do not understand these additive methods ignore them.
+
+```json
+{
+  "type": "extension_ui_request",
+  "id": "uuid-10",
+  "method": "setHeader",
+  "widgetLines": ["Header line"]
+}
+```
+
+Omit `widgetLines` to restore the built-in surface. Attached clients send `set_client_info` with their terminal width after attach and on resize; hosts default to width 80 when no width is supplied.
 
 #### setTitle
 

package/docs/sdk.md

@@ -36,7 +36,7 @@ await session.prompt("What files are in the current directory?");
 ## Installation
 
 ```bash
-npm install @earendil-works/pi-coding-agent
+bun add @earendil-works/pi-coding-agent
 ```
 
 The SDK is included in the main package. No separate installation needed.

package/docs/skills.md

@@ -132,7 +132,7 @@ description: What this skill does and when to use it. Be specific.
 
 Run once before first use:
 ```bash
-cd /path/to/skill && npm install
+cd /path/to/skill && bun install
 ```
 
 ## Usage
@@ -249,7 +249,7 @@ description: Web search and content extraction via Brave Search API. Use for sea
 ## Setup
 
 ```bash
-cd /path/to/brave-search && npm install
+cd /path/to/brave-search && bun install
 ```
 
 ## Search

package/docs/terminal-tools.md

@@ -50,7 +50,7 @@ server. Nothing outlives the watch, so no cleanup.
 
 ```js
 monitor({ description: "full test suite",
-  command: "if npx vitest run; then printf 'OK\n'; else code=$?; printf 'FAILED_%s\n' \"$code\"; exit \"$code\"; fi",
+  command: "if bunx vitest run; then printf 'OK\n'; else code=$?; printf 'FAILED_%s\n' \"$code\"; exit \"$code\"; fi",
   filter: "^(OK|FAILED_)" })
 ```
 

package/docs/termux.md

@@ -17,7 +17,7 @@ pkg update && pkg upgrade
 pkg install nodejs termux-api git
 
 # Install senpi
-npm install -g @code-yeongyu/senpi
+bun add -g @code-yeongyu/senpi
 
 # Create config directory
 mkdir -p ~/.senpi/agent

package/docs/tui.md

@@ -472,7 +472,7 @@ interface MyTheme {
 Set `PI_TUI_WRITE_LOG` to capture the raw ANSI stream written to stdout.
 
 ```bash
-PI_TUI_WRITE_LOG=/tmp/tui-ansi.log npx tsx packages/tui/test/chat-simple.ts
+PI_TUI_WRITE_LOG=/tmp/tui-ansi.log bunx tsx packages/tui/test/chat-simple.ts
 ```
 
 ## Performance

package/examples/AGENTS.md

@@ -48,5 +48,5 @@ Largest examples carry real complexity, not toy scope: `extensions/overlay-qa-te
 ## VALIDATION
 
 - Run the focused tests for the public API demonstrated by the example.
-- Typecheck examples through root `npm run check`.
+- Typecheck examples through root `bun run check`.
 - Interactive examples require real CLI or visual QA when their behavior changes.

package/examples/sdk/README.md

@@ -26,7 +26,7 @@ The runtime example shows how to build a recreate function that closes over proc
 
 ```bash
 cd packages/coding-agent
-npx tsx examples/sdk/01-minimal.ts
+bunx tsx examples/sdk/01-minimal.ts
 ```
 
 ## Quick Reference

package/node_modules/@code-yeongyu/senpi-codemode/CHANGELOG.md

@@ -12,6 +12,22 @@
 
 ### Removed
 
+## [2026.8.31] - 2026-08-31
+
+### Breaking Changes
+
+### Added
+
+- The codemode extension now bundles the `bun-1-4` skill and contributes it via `resources_discover` only
+  when the js eval kernel itself runs bun >= 1.4 (`process.versions.bun`); node-kernel sessions never
+  receive the skill, regardless of any bun binary on PATH.
+
+### Changed
+
+### Fixed
+
+### Removed
+
 ## [2026.8.30-3] - 2026-08-30
 
 ### Breaking Changes

package/node_modules/@code-yeongyu/senpi-codemode/README.md

@@ -202,10 +202,10 @@ namespace to prevent recursive execution.
 
 ```bash
 cd packages/senpi-codemode
-npm test
+bun run test
 
 cd ../..
-npm run check
+bun run check
 ```
 
 Direct real-surface QA drivers live in `scripts/qa-*.ts`: kernel cells

package/node_modules/@code-yeongyu/senpi-codemode/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/senpi-codemode",
-	"version": "2026.8.30-3",
+	"version": "2026.8.31",
 	"private": true,
 	"description": "Source-only senpi extension package for codemode evaluation tools",
 	"type": "module",
@@ -31,14 +31,14 @@
 	},
 	"dependencies": {
 		"@babel/parser": "8.0.4",
-		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.8.30-3",
+		"@earendil-works/pi-ai": "npm:@code-yeongyu/senpi-ai@2026.8.31",
 		"typebox": "1.3.18"
 	},
 	"peerDependencies": {
-		"@code-yeongyu/senpi": "2026.8.30-3"
+		"@code-yeongyu/senpi": "2026.8.31"
 	},
 	"devDependencies": {
-		"@code-yeongyu/senpi": "2026.8.30-3"
+		"@code-yeongyu/senpi": "2026.8.31"
 	},
 	"keywords": [
 		"senpi",

package/node_modules/@code-yeongyu/senpi-codemode/src/extension/skill-contribution.ts

@@ -0,0 +1,71 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const BUN_SKILL_BASE_DIR = dirname(fileURLToPath(import.meta.url));
+
+let loggedMissingBunSkill = false;
+
+export const BUN_SKILL_MIN_VERSION = "1.4.0";
+
+/** Reads the js eval kernel's bun version; undefined on a node kernel. */
+export type BunKernelVersionSource = () => string | undefined;
+
+const kernelBunVersion: BunKernelVersionSource = () => process.versions.bun;
+
+/**
+ * True when the version is at least `BUN_SKILL_MIN_VERSION`: parses the leading
+ * `<major>.<minor>` integers of the string and gates on major > 1 || (major === 1 && minor >= 4).
+ * Unparseable or missing versions never enable the skill.
+ */
+export function bunVersionSupportsSkill(version: string | undefined): boolean {
+	if (version === undefined) return false;
+	const match = /^(\d+)\.(\d+)/.exec(version);
+	if (match === null) return false;
+	const major = Number.parseInt(match[1]!, 10);
+	const minor = Number.parseInt(match[2]!, 10);
+	return major > 1 || (major === 1 && minor >= 4);
+}
+
+/** Absolute path of the bundled bun-1-4 SKILL.md, or undefined (logged once) when it is not shipped. */
+export function bundledBunSkillPath(baseDir: string = BUN_SKILL_BASE_DIR): string | undefined {
+	const candidate = join(baseDir, "..", "skill", "bun-1-4", "SKILL.md");
+	if (existsSync(candidate)) return candidate;
+	if (!loggedMissingBunSkill) {
+		loggedMissingBunSkill = true;
+		console.debug(`[senpi-codemode] bundled bun-1-4 skill not found at ${candidate}; skipping contribution`);
+	}
+	return undefined;
+}
+
+/**
+ * Builds the `resources_discover` handler that contributes the bundled bun-1-4 skill
+ * only when the in-process js eval kernel itself runs bun >= 1.4 (`process.versions.bun`).
+ * A node kernel never receives the skill, regardless of any bun binary on PATH.
+ */
+export function createBunSkillDiscoverHandler(
+	getKernelBunVersion: BunKernelVersionSource = kernelBunVersion,
+	baseDir?: string,
+): () => { skillPaths: string[] } | undefined {
+	return () => {
+		if (!bunVersionSupportsSkill(getKernelBunVersion())) return undefined;
+		const skillPath = bundledBunSkillPath(baseDir);
+		return skillPath === undefined ? undefined : { skillPaths: [skillPath] };
+	};
+}
+
+export function registerBunSkillContribution(
+	pi: {
+		on(
+			event: "resources_discover",
+			handler: (
+				event: unknown,
+				ctx: unknown,
+			) => Promise<{ skillPaths?: string[] } | undefined> | { skillPaths?: string[] } | undefined,
+		): void;
+	},
+	getKernelBunVersion?: BunKernelVersionSource,
+	baseDir?: string,
+): void {
+	pi.on("resources_discover", createBunSkillDiscoverHandler(getKernelBunVersion, baseDir));
+}

package/node_modules/@code-yeongyu/senpi-codemode/src/index.ts

@@ -16,6 +16,7 @@ import {
 import { jsRuntimeInfo, jsRuntimeLabel } from "./extension/runtime-info.ts";
 import type { CodemodeSessionManager, CreateCodemodeSessionManagerOptions } from "./extension/session-manager.ts";
 import { SessionManagerProxy } from "./extension/session-manager-proxy.ts";
+import { registerBunSkillContribution } from "./extension/skill-contribution.ts";
 import { WAKE_SOURCE_STATE_EVENT, type WakeSourceState } from "./extension/wake-source-state.ts";
 import { EvalDetachedCellManager, type EvalDetachedCellStatusEntry } from "./tool/detached-cell-manager.ts";
 import {
@@ -40,7 +41,7 @@ type CodemodeEvent = SessionLifecycleEvent | "model_select";
 export interface CodemodeExtensionAPI {
 	registerTool(tool: ReturnType<typeof createEvalTool>): void;
 	registerRemovedToolHint(name: string, hint: string): void;
-	on(event: CodemodeEvent, handler: (event: unknown, ctx: ExtensionContext) => Promise<void> | void): void;
+	on(event: CodemodeEvent | "resources_discover", handler: (event: unknown, ctx: ExtensionContext) => unknown): void;
 	executeTool: AgentExecuteTool;
 	getActiveTools(): string[];
 	getAllTools(): readonly EvalSchemaToolInfo[];
@@ -168,6 +169,7 @@ export default function senpiCodemode(pi: CodemodeExtensionAPI, options: SenpiCo
 		"wait",
 		'wait was removed; detached eval cells notify when complete. Use eval({ action: "peek"|"stop", cell_id }) to inspect or stop one.',
 	);
+	registerBunSkillContribution(pi);
 
 	pi.on("session_start", async (event, ctx) => {
 		const previousCells = activeCells;

package/node_modules/@code-yeongyu/senpi-codemode/src/skill/bun-1-4/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: bun-1-4
+description: "MUST USE whenever writing or running JavaScript/TypeScript with Bun — including JS through the eval tool, bun -e one-liners, scratch scripts, servers, CLIs, tests, bundling, or package management. Bun 1.4 replaced 15+ npm deps with builtins: consult BEFORE npm-installing sharp, puppeteer/playwright (scraping), marked, node-cron, node-pty, concurrently, serve-static, tar, json5, fast-xml-parser, string-width — Bun ships it. Triggers: bun, Bun.serve, bun test, bun build, bun install, bun run, JS 스크립트, 번들링, 이미지 리사이즈, 헤드리스 브라우저, 크론, PTY, eval js."
+---
+
+# Bun 1.4 — Use the Builtins First
+
+Bun 1.4 (2026) ships builtins that replace most utility npm packages. **Before adding a dependency or writing a workaround, check the capability map below — if Bun ships it, use the builtin.** This skill is loaded because this session's `eval` js kernel runs Bun >= 1.4; on other machines or pinned projects, confirm with `bun --version` ([v1.3.x]/[v1.4.0] tags in the references give exact minimums). Release post: <https://bun.com/blog/bun-v1.4>
+
+## Capability map — what you can do now
+
+| You want to... | Use | Replaces | Ref = `references/<name>.md` |
+|---|---|---|---|
+| Resize/convert/rotate images | `Bun.file(p).image().resize().webp().write()` | sharp | runtime-apis |
+| Headless browser: navigate, click, screenshot, evaluate, CDP | `new Bun.WebView()` | puppeteer, playwright (scraping) | runtime-apis |
+| Markdown → HTML / React / ANSI | `Bun.markdown.html() / .react() / .render()` | marked, react-markdown | runtime-apis |
+| Schedule cron jobs | `Bun.cron()` | node-cron | runtime-apis |
+| Drive a PTY (bash, vim, TUIs) from JS | `Bun.spawn([...], { terminal })` | node-pty | runtime-apis |
+| Run package scripts concurrently, glob-matched | `bun run --parallel "build:*"` | concurrently, npm-run-all | runtime-apis |
+| Parse JSON5 / JSONL / JSONC / XML / TOML; tarballs | `Bun.JSON5/.JSONL/.JSONC/.XML/.TOML`, `Bun.Archive` | json5, ndjson, jsonc-parser, fast-xml-parser, @iarna/toml, tar | runtime-apis |
+| ANSI-aware terminal text: width, slice, wrap | `Bun.stringWidth()`, `Bun.sliceAnsi()`, `Bun.wrapAnsi()` | string-width, slice-ansi, wrap-ansi | runtime-apis |
+| Call C libraries 3x faster, plain strings back | `bun:ffi` (`buffer_length`, `cstring`) | — | runtime-apis |
+| Serve a static dir (ETag/Range/304 handled) | `Bun.serve({ routes: { "/x/*": { dir } } })` | express.static, serve-static, sirv | http-networking |
+| HTTP/3 server; `fetch` protocol/compress/proxy | `http3: true`, `fetch(url, { protocol, compress, proxy })` | — | http-networking |
+| Tests across CPU workers / CI shards / changed files / flaky retry | `bun test --parallel --shard=1/3 --changed=main --retry` | jest/vitest infra | test |
+| Kill "passes alone, fails in suite" bugs | `bun test --isolate` | vitest default behavior | test |
+| React Compiler auto-memoization | `bun build --react-compiler` | babel-plugin-react-compiler | build |
+| Embed assets/dirs into a single-file executable | `bun build --compile --asset ./public` | pkg hacks | build |
+| Compile-time feature flags, in-memory bundling, metafile | `bun:bundle feature()`, `files:{}`, `metafile: true` | esbuild define/plugins | build |
+| Diff package versions, fix vulns, dedupe/prune, license audit | `bun pm diff`, `bun audit fix`, `bun dedupe`, `bun prune`, `bun pm licenses` | npm-diff, npm audit fix | install |
+| 7x faster CI installs (global virtual store) | `linker = "isolated"` in bunfig.toml | pnpm store | install |
+| Profile CPU/heap/bundle as grep-able Markdown | `bun --cpu-prof-md`, `--heap-prof-md`, `bun build --metafile-md` | Chrome DevTools round-trip | dev-tooling |
+| Native REPL; render Markdown in terminal | `bun repl`, `bun ./README.md` | node repl, glow | runtime-apis |
+| Run Playwright, vitest, Next.js 16, OpenTelemetry, dd-trace | they now just work | Node.js | node-compat-platforms |
+
+Free wins (no code change): 2x lower CPU, 13-48% less server memory, 2-2.5x faster startup — full numbers in [performance](references/performance.md).
+
+## Operating rules
+
+1. **Eval-first.** The `eval` js kernel runs on Bun (that is why this skill is present): call `Bun.*` APIs directly inside js cells. Reach for `bash` or a spawned `bun <file>` / `bun -e` only for CLI surfaces (`bun test`, `bun build`, `bun pm`) or work that needs a separate process.
+2. **Builtin-first.** The Replaces column above is a ban list for new dependencies, in production code, test helpers, and one-off scripts alike.
+3. **Read the matching reference before using an unfamiliar API** — signatures and caveats (e.g. `Bun.markdown` HTML is unsanitized, HTTP/3 is experimental) live there, not here.
+4. **Upgrading a project to 1.4 or debugging behavior that changed?** Read [breaking-changes](references/breaking-changes.md) first — YAML/TOML strictness, `.xml`/`.css` import semantics, `Bun.$` globbing, fetch header combining, and WebSocket close timing all changed.
+5. **TLS errors after upgrade are usually intentional** — 1.4 tightened certificate verification across `fetch`, `tls.connect`, `Bun.connect`, `RedisClient`. See [security](references/security.md) before loosening anything.

package/node_modules/@code-yeongyu/senpi-codemode/src/skill/bun-1-4/references/breaking-changes.md

@@ -0,0 +1,75 @@
+# Upgrading to Bun 1.4 — Behavior Changes
+
+Blog: [#upgrading-to-1-4](https://bun.com/blog/bun-v1.4#upgrading-to-1-4). Most code is unaffected. Scan the Top 5, then the table for whatever subsystem you touched.
+
+## Top 5 most likely to bite
+
+1. **Node.js 26**: `NODE_MODULE_VERSION` is 147 (native addons need a 147 build); `res.writeHeader()` removed → use `res.writeHead()`; paused-mode `readable.read()` returns ONE chunk → loop until `null`.
+2. **New monorepos default to the isolated linker** (`configVersion: 1`). Existing lockfiles keep hoisted. Opt out: `linker = "hoisted"` in bunfig.toml.
+3. **Bun invoked as `node`** (`bun --bun`, `bunx --bun`, node symlink) no longer loads `.env` files. Pass `--env-file` to keep them.
+4. **`Bun.YAML` is YAML 1.2**: `yes`/`no`/`on`/`off` are strings. GitHub Actions `on:` parses as `"on"`.
+5. **`Bun.TOML` / `bunfig.toml` are strict**: unquoted strings, missing newlines, ints past `MAX_SAFE_INTEGER` → `SyntaxError` at startup. Quote your values.
+
+## Module resolution / loaders
+
+| Change | Migration |
+|---|---|
+| `.xml` imports return the parsed document (was: file path) | `--loader .xml:file` to keep the path |
+| `.css` imports at runtime export `{}` (was: absolute path) | — |
+| `import "."` / `".."` resolve as directories (index/main), matching Node | name the sibling file explicitly |
+| `"jsx": "react-jsx"` emits `jsx` (was: `jsxDEV` unless production) | use `"react-jsxdev"` for the dev runtime |
+| `useDefineForClassFields: false` now honored like tsc | remove the option to keep old output |
+
+## Bun APIs
+
+| Change | Migration |
+|---|---|
+| `Bun.$` globs only patterns written in the template — `${...}` interpolated globs are literal | write the pattern in the template: `` $`echo **/*` `` |
+| `Bun.cron.parse()` / in-process `Bun.cron()` use LOCAL time (was UTC) | pass `{ tz: "UTC" }` |
+| `Bun.Socket#setKeepAlive(true, delay)`: `delay` is milliseconds now | pass ms, not seconds |
+| `Bun.mmap({ offset })`: view starts at `offset` exactly (was page-rounded) | remove `offset % pageSize` compensation |
+| `bun:ffi`: `cstring` values are plain strings; `CString` has no `.ptr` | keep the original pointer to free |
+| `Bun.serve({ inspector })` removed | `bun --inspect` |
+| `server.publish()`/`ws.publish()` return `0` (dropped) / `-1` (backpressure) | treat 0/-1 specially |
+| `server.stop()` waits for in-flight requests, closes idle connections | `stop(true)` to force |
+| `Bun.sql`: MySQL `DATETIME`/`TIMESTAMP` decoded as UTC; MariaDB 10.5+ JSON columns parsed to objects | remove offset corrections and `JSON.parse()` calls |
+| `Bun.randomUUIDv7()`, `Bun.udpSocket()`, `Bun.password`, `Bun.spawn` timeout/killSignal/argv0 | invalid inputs now throw instead of silently clamping |
+
+## fetch / WebSocket / HTTP
+
+| Change | Migration |
+|---|---|
+| Duplicate headers combined with `, ` per Fetch spec (was: last wins) | parse combined values |
+| `clone()` throws after body read (`Body is disturbed or locked`) | clone BEFORE reading |
+| Network errors are `TypeError` (`.code` still set); failed body read sets `bodyUsed` | retry with a NEW fetch() |
+| `redirect: "error"` rejects only on 301/302/303/307/308 (304 resolves now) | — |
+| global `WebSocket` no longer accepts `agent` (ws module's does) | import from "ws" |
+| `WebSocket#close()` queues the close event — `readyState` is CLOSING when it returns | await the `close` event |
+| `close()`/`ping()`/`pong()` validate codes/reason/payload sizes | shorten/fix values |
+| Handshake fails (1002) when requested subprotocol isn't negotiated | fix server echo or drop `protocols` |
+
+## node: modules
+
+| Change | Migration |
+|---|---|
+| `fs.rmdir` rejects `{ recursive: true }` | `fs.rm(path, { recursive: true, force: true })` |
+| `dns.lookup()` uses the system resolver (getaddrinfo) on Linux — split-DNS/VPN names now resolve | `Bun.dns.lookup(name, { backend: "c-ares" })` for old behavior |
+| fs/dns/pbkdf2 callback exceptions are `uncaughtException` (was unhandledRejection) | move the handler |
+| `dgram`: second `bind()` and post-`close()` calls throw synchronously | try/catch |
+| `tls.createServer({ requestCert: true })` rejects unverified client certs by default | `rejectUnauthorized: false` to admit them |
+| `X509Certificate` serial/modulus are UPPERCASE hex | normalize case when pinning |
+| `child_process.spawn()` ignores `options.encoding` (always Buffers) | `child.stdout.setEncoding()` |
+| `process.title` defaults to `argv[0]`; warnings print as `(node:PID) [CODE] ...` | — |
+
+## bun test
+
+- `jest.resetAllMocks()` drops implementations (matches Jest) — use `clearAllMocks()` for history-only.
+- `toContain()` uses `===` (not `Object.is`); `toEqual()` compares Temporal by value.
+
+## Misc
+
+- x64 builds are baseline-only (no more separate haswell build; `-baseline` URLs still work).
+- `Temporal` defined by default (`BUN_JSC_useTemporal=0` to disable).
+- `bun.lock` is `lockfileVersion: 2`; nested/version-scoped overrides produce v3 (older Bun can't read v3).
+- `bun feedback` removed; `Bun.password.hash()` argon2 requires `memoryCost >= 8`.
+- Full exhaustive list: [Other behavior changes](https://bun.com/blog/bun-v1.4#other-behavior-changes) and the [Changelog](https://bun.com/blog/bun-v1.4#changelog).

package/node_modules/@code-yeongyu/senpi-codemode/src/skill/bun-1-4/references/build.md

@@ -0,0 +1,114 @@
+# bun build / Bun.build() in 1.4
+
+## Built-in React Compiler [v1.4.0]
+
+Blog: [#built-in-react-compiler](https://bun.com/blog/bun-v1.4#built-in-react-compiler)
+
+```ts
+await Bun.build({ entrypoints: ["./src/index.tsx"], outdir: "./dist", reactCompiler: true });
+// or: bun build --react-compiler
+```
+
+React's auto-memoization compiler runs inside Bun's parser — no Babel/SWC round-trip. On ~860 components: +71ms build cost, ~20x faster than the Babel plugin (9.15s); full `--compile` build 3.6x faster.
+
+## Barrel import optimization [v1.3.10]
+
+Blog: [#barrel-import-optimization](https://bun.com/blog/bun-v1.4#barrel-import-optimization)
+
+```ts
+await Bun.build({ entrypoints: ["./src/index.tsx"], optimizeImports: ["antd", "@mui/material"] });
+```
+
+`import { Button } from "antd"` skips the hundreds of files behind names you didn't import. Automatic for packages with `"sideEffects": false`; opt others in with `optimizeImports`.
+
+## Compile-time feature flags: bun:bundle [v1.3.5]
+
+Blog: [#compile-time-feature-flags-with-bun-bundle](https://bun.com/blog/bun-v1.4#compile-time-feature-flags-with-bun-bundle)
+
+```ts
+import { feature } from "bun:bundle";
+if (feature("SUPER_SECRET")) { console.log("enabled"); }
+// bun build --feature=SUPER_SECRET index.ts   (also works in bun run and bun test)
+// Bun.build({ features: ["SUPER_SECRET"] })
+```
+
+Becomes `true`/`false` at build time; dead branch removed.
+
+## In-memory files [v1.3.6]
+
+Blog: [#in-memory-files-in-bun-build](https://bun.com/blog/bun-v1.4#in-memory-files-in-bun-build)
+
+```ts
+await Bun.build({
+  entrypoints: ["/app/index.ts"],
+  files: {
+    "/app/index.ts": `import { greet } from "./greet.ts"; console.log(greet("World"));`,
+    "/app/greet.ts": `export function greet(n: string) { return "Hello, " + n; }`,
+  },
+});
+```
+
+Strings, Blobs, or TypedArrays; virtual paths override disk. Ideal for codegen and stubbing modules in tests.
+
+## Single-file HTML [v1.3.10]
+
+Blog: [#single-file-html-with-compile-target-browser](https://bun.com/blog/bun-v1.4#single-file-html-with-compile-target-browser)
+
+```bash
+bun build ./index.html --compile --target=browser --outdir=dist
+# → dist/index.html — every script/stylesheet/asset inlined, opens from file://
+```
+
+## --asset: embed files/dirs into executables [v1.4.0]
+
+Blog: [#asset](https://bun.com/blog/bun-v1.4#asset)
+
+```bash
+bun build ./build/index.js --compile \
+    --asset ./build/client --asset ./build/prerendered \
+    --outfile server
+./server   # every route + static asset served from the binary
+```
+
+Keeps original filenames; `path.join(import.meta.dir, ...)` works. `node:fs` treats `/$bunfs/` as a real tree (`existsSync`, `readdirSync` recursive/withFileTypes, ...), so static-file servers run unmodified inside the binary.
+
+## Bytecode for ES modules [v1.3.9]
+
+Blog: [#bytecode-compilation-for-es-modules](https://bun.com/blog/bun-v1.4#bytecode-compilation-for-es-modules)
+
+`--bytecode --format=esm` (requires `--compile`) enables top-level await, `import.meta`, dynamic imports, and code splitting in bytecode-compiled binaries (previously CJS-only).
+
+## metafile: true and --metafile-md [v1.3.6 / v1.3.8]
+
+Blog: [#metafile-true](https://bun.com/blog/bun-v1.4#metafile-true), [#metafile-md](https://bun.com/blog/bun-v1.4#metafile-md)
+
+```ts
+const result = await Bun.build({ entrypoints: ["./index.js"], metafile: true });
+result.metafile.inputs; result.metafile.outputs; // esbuild metafile format — works with esbuild.github.io/analyze
+```
+
+```bash
+bun build entry.js --metafile-md=analysis.md --outdir=dist   # Markdown bundle report: largest modules,
+                                                             # per-entry breakdowns, dependency chains — grep it or hand to an LLM
+```
+
+## Standard TC39 decorators [v1.3.10]
+
+Blog: [#standard-tc39-decorators](https://bun.com/blog/bun-v1.4#standard-tc39-decorators)
+
+```ts
+function logged(value, { kind, name }) {
+  if (kind === "method") return function (...args) { console.log(`calling ${name}`); return value.call(this, ...args); };
+}
+class C { @logged greet() {} }
+```
+
+Active when `experimentalDecorators` is off in tsconfig. Classes, methods, fields, accessors, private members; passes esbuild's decorator test suite.
+
+## Code splitting: 14x faster on huge graphs [v1.4.0]
+
+Reachability walk is now BFS O(V+E); a 20,000-module DAG links in 320ms (was 4.65s). Tree-shaking/TLA/CSS-order passes use explicit stacks, so linear chains of thousands of modules link without stack growth.
+
+## Compile gotcha (v1.3.4 change)
+
+`bun build --compile` binaries no longer auto-load `tsconfig.json` / `package.json` from the runtime cwd. Opt back in with `--compile-autoload-tsconfig` / `--compile-autoload-package-json`. `.env` and `bunfig.toml` still auto-load.

package/node_modules/@code-yeongyu/senpi-codemode/src/skill/bun-1-4/references/dev-tooling.md

@@ -0,0 +1,34 @@
+# Bun 1.4 Dev Tooling & Observability
+
+Blog: [#dev-tooling](https://bun.com/blog/bun-v1.4#dev-tooling), [#observability](https://bun.com/blog/bun-v1.4#observability)
+
+## Markdown profilers — built for terminals and LLMs
+
+```bash
+bun --cpu-prof-md ./app.ts     # CPU profile as Markdown: hot functions by self time,
+                               # call tree, who-calls-whom. grep it, paste into a bug or an LLM.
+bun --heap-prof-md ./app.ts    # heap profile as Markdown: total size, types by retained size,
+                               # largest objects, retention chains. Includes grep recipes in the header.
+bun build ./src/index.ts --outdir ./dist --metafile-md=./dist/meta.md   # bundle-size analysis as Markdown
+```
+
+- `bun --cpu-prof` / `--heap-prof` still write `.cpuprofile` / V8-compatible `.heapsnapshot` for Chrome DevTools / VS Code.
+- `BUN_CPU_PROFILE=1` turns on the CPU profiler for a process you cannot pass flags to (e.g. a framework-spawned worker).
+- **Agent workflow: when a Bun process is slow or leaking, run the `-md` variants and read the report directly — no DevTools round-trip.**
+
+## Async stack traces [v1.4.0]
+
+Errors from async native APIs (`fs.promises`, `Bun.file()`, S3, DNS, crypto, `fetch`) point at the `await` in your code, not native frames.
+
+## Process lifetime & env flags
+
+```bash
+bun --no-orphans app.ts    # exit when parent dies; SIGKILL every descendant on exit (Linux/macOS/Windows)
+bun --no-env-file app.ts   # skip automatic .env loading (or env = false in bunfig.toml) — use in prod/CI
+```
+
+## APM / tracing works now
+
+- **`node:inspector`**: a `Session` can start/stop CPU profiles while the app runs (`Profiler.start`/`Profiler.stop`).
+- **Datadog**: `dd-trace` traces requests; `@datadog/pprof` profiles continuously (required V8 C++ APIs implemented).
+- **OpenTelemetry**: `@opentelemetry/instrumentation-http` and `-fs` export spans; `shimmer` and `require-in-the-middle` can patch bundled code.