Repository navigation
ci: update shared Bun fork and WebKit pin - #178224
Conversation
Advance the shared Bun 1.4.4 fork to ef37c31de3 and WebKit a2976f02e6, including the upstream sync and native lint/format improvements. Keep the release pin byte-identical to the qualified manifest and document the engine update.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
openclaw-barnacle
Bot
added
docs
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. What this changesThis PR updates the shared six-platform Bun fork pin and documents its newer WebKit engine and native tooling improvements. Example: A developer runs Bun's native lint command in a repository with a lint package script.
Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open: this maintainer-directed runtime refresh is absent from current main, and the pinned diff has no actionable findings. Priority: P2 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherThe shared manifest supplies runtime identities and checksums to CI setup, local tooling, installers, and app packaging; existing consumers verify and stage the selected Bun executable. flowchart TD
A[Shared Bun pin] --> B[Runtime resolver]
A --> C[Checksum verifying stager]
D[Published Bun release] --> C
B --> C
C --> E[CI and local tooling]
C --> F[App runtime packaging]
Technical reviewBest possible solution: Advance the existing shared pin and matching documentation while preserving checksum verification and the recorded qualification limitations. Do we have a high-confidence way to reproduce the issue? This is a dependency refresh rather than a single bug report; its recorded qualification exercises the candidate runtime, and no target code was executed during this read-only review. Is this the best way to solve the issue? Updating the existing manifest is the smallest complete change: runtime identity, artifact hashes, and documentation advance together without adding machinery or competing owners. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against a4a0223bc9bc. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
PR surfaceDocs +3, Other 0. Total +3 across 2 files. Added test files: 0. View PR surface stats
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 20, 2026, 3:39 AM ET / 07:39 UTC. |
|
Merged via squash.
|
Advance the shared Bun 1.4.4 fork to ef37c31de3 and WebKit a2976f02e6, including the upstream sync and native lint/format improvements. Keep the release pin byte-identical to the qualified manifest and document the engine update.
What Problem This Solves
Updates the shared OpenClaw Bun fork pin after upstream runtime and engine qualification, including native lint/format performance fixes and explicit package-script bypass with
--no-script.User Impact
The shared pin advances from
7bd4fdff3dtoef37c31de3, retaining Bun 1.4.4 and updating WebKit fromf8521bb454toa2976f02e6. Linux qualification and the qualified macOS gate passed, with the retained observations described below. The six-platform pin JSON is copied exactly from the supplied release conversion.Why This Change Was Made
The upstream sync imports 58 oven-sh/bun commits from
f2405c38throughad4089bf, including upstream native lint/format performance work and--no-script. The new WebKit release replays the 16 fork patches onto upstream WebKit87ee10da, with all 14 required exports qualified on ten targets.Fork repairs reattach
normalize_sourcebehavior, correct Bake's pathless built-in entry, preserve iterator-aware Headers conversion and native WebSocket close scheduling inserver.upgrade, and restrict the runtime-only auto-install flag to runtime commands. The macOS native realpath test expectations now follow Node's native macOS results; the descriptor-free implementation is unchanged.The inherited call-start stack columns and sourcemap segments, bytecode fingerprints, external-require output, namespace/export behavior, strict Worker argv floor, package-parser behavior, percent-path annotation error, invoked symlink spelling, virtual TypeScript loader limitations, Node-compatible
ppiddescriptor and manifest-pinned WebKit layout remain preserved. The upstream sync retains the narrow POSIX trailing-directory-backslashpath.relative()difference, malformed/unreadable entry-adjacent package configuration failing before user code, and npmwsover TLS losing queued frames on termination inside a large-write callback.Existing TLS differences include pre-connect
setServername, earlyclose_notify, fatal Duplex transport-close timing, nested reset notifications and portions of livesetSecureContext. Array holes overprocess.env, repeated Worker throwing-stack getter evaluation, HTTP2 backpressure fixture preconditions and the earlier one-off install-staging observation remain documented follow-ups. This update does not claim broad Node/upstream parity.The one upstream SQLite native
node:vmtimeout failure on macOS 15 with the new engine remains unresolved and not reproduced. The next macOS CI run and 36 local macOS runs passed; those observations do not erase the original failure. No SQLite test or timeout was changed.Evidence
The Linux paired replay completed all 201 selections, including all Bun-admitted CI groups and the explicit JSC/Worker-memory supplements. It retained every completed comparison and found no unclassified candidate-only regression. S2 recorded 190,954 passing / 47 failing / 1,350 skipped assertion observations; S3 recorded 190,940 / 61 / 1,350. The complete difference is 14
SHARED_LEAK_PATHsession-sharing failures, plus onePRODUCT_BUG_EXPOSEDdev-gateway failure, minus one S2-only first-signin failure. Both product defects are fixed on the required base. All 16 differing identities were reconciled, and shared failures remain recorded.The targeted matrix completed 660 calls with 4,155 passing assertions and five shared skips per Bun runtime. The Node 24.19.0 control recorded ten failed assertions across five scheduled runs in
src/infra/owned-directory-observation.test.ts(duplicate watch call and watch-path mismatch), classifiedNODE_CONTROL_ONLY; both Bun arms passed that file. No control retry was run. The preinstall supplement passed 225 assertions per runtime, and the actual Node-hidden smoke passed all ten stages without attempting Node. Thetest/scripts/run-node-lifecycle.test.tsnative-watch confirmation passed five runs per Bun under its declared rule, yieldingINHERITED_OR_ENVIRONMENTAL; the original observation remains unattributed and retained.The dual-all trial passed its count criterion: two Bun-only failures versus four on the prior pin, with zero incomplete shards across 410 paired shards. The two failures are the classified OpenClaw lifecycle/retained-read bugs. The prepared base contains both fixes: #177066 (
4cba3b50298f) and #176913 (2a49c621e7f7). Fresh-main dev-gateway acceptance at5a85669bb331bf1ccc291897b66743411478fd62passed all 15 calls, 40 assertions per runtime, with its own dependency installation.The completed quiet-Linux performance gates passed:
The macOS gate is a qualified PASS: all 70 historical paired files were accounted for, native and Rosetta targeted coverage passed, and the VM-timeout probe produced all 48 expected timeout outcomes per runtime. The retained initial catalog-retention failure did not reproduce in the prescribed five-run confirmation on either runtime (
INHERITED_RETENTION_FLAKE); the catalog-performance timeout passed its allowed quiet reversed-order pair. Native Worker root RSS ratio was 1.028997 (limit 1.10), and VM messaging RSS ratio was 0.990239 (limit 1.05). Signing, notarization and the native darwin-x64 release smoke passed. These qualifications retain the original observations.The original 30-file memory pair stopped under a zero-tolerance RSS rule: 4,051,341,312 bytes on S2 and 4,060,192,768 on S3. Before further data, the five-pair confirmation rule was declared: median paired ratio ≤1.02, no pair >1.05. The original pair was retained; the complete five-pair/five-Node-control cohort passed with median 1.000588457 and maximum 1.006253031. Every run had the same 279 passes and one predeclared inherited sessionless-media failure. No candidate-only assertion was lost.
Native tooling passed on clean main
c34e0c9c9621b8007dd5ef69d5272e41a9b5e3f5.bun lint --no-scriptwas accepted and matched oxlint 1.87.0's 4,476 findings across 49,637 files, with identical location tuples, severity and labels at both thread settings. Exit 1 reflects the same existing findings.bun fmt --check --no-scriptmatched oxfmt 0.72.0 with zero differences across 52,479 files, including empty list-different output.The exact plain lint invocation took 2.169781 seconds. Times are single observations. Pin resolver tests passed 24/24 under Node and 24/24 under the pinned Bun; the Linux stager's functional reports passed 11/11 per runtime. That supplementary wrapper's raw-Git-diff equality post-check did not pass, so no post-run source-equivalence pass is claimed for it; the full Gate A source-custody audit passed separately. The initial local macOS stager retains one Rosetta timeout in a generated x64 C fixture (10 other assertions passed); the actual S3 Darwin arm64 release staged with its expected hash. The changed-file check retains the same test-root budget error reproduced on the untouched base (727/721/727 roots versus 720). P2 code review found no actionable issue in the pin/documentation diff.
pinned-bun.test.ts, macOS arm64stage-openclaw-bun.test.ts, Linux x64stage-openclaw-bun.test.ts, macOS