[luvs01]

Summary

The bundled Bun dependency is pinned to 1.4.4, but automatic PATH fallback still accepts older patches from the same minor release. If bundled-runtime preparation is unavailable, it can therefore select Bun 1.4.2 despite the security update.

Require an automatic PATH candidate to be at least the complete package pin, while retaining the same-major restriction. Below-floor entries are skipped so a later suitable entry can still be selected. Update the existing regression tests and English/Korean installation and architecture documentation.

This addresses the remaining PATH fallback finding on #7606. Explicit runtime overrides, bundle selection, installer recovery, probe deadlines and identity/trust checks retain their existing behavior.

Verification

Current public head: f84a72e43ef83eed5ca31df9c476023ef4d8db74, after the maintainer's integration of dev c2f3d8b4. Current-head automatic CI is running and full cross-platform CI is queued. The earlier validation below remains attributed to its named candidate and does not establish current-head success.

• A focused test imports the actual baseline and candidate modules and substitutes only filesystem/process I/O: 30 passed, 0 failed, 262 assertions with official Bun 1.4.4. The baseline accepts 1.4.2 at pin 1.4.4; the candidate rejects it, including lower-patch build-metadata variants. At-floor and newer same-major versions, later PATH entries and future-pin cases pass.
• An independent read-only review found no concrete bypass or regression in the candidate diff or direct caller. The source diff passes whitespace checks and is limited to six files.
• At author head 6da019275eabf4f696196a58653bb325b01e09e6, CI 40243590429 passed, including Typecheck, all four Ubuntu test shards, structure validation, and a fresh dependency installation and build of the documentation site.
• Local repository validation used official Windows Bun 1.4.4: the existing PATH-policy/validation cases passed 68 tests with 4 platform skips, and bun-runtime.test.ts passed 20 tests. The real repository preload and home guard were active. TypeScript --noEmit, structure, privacy and file-size checks passed. All nine validation commands exited 0 with both streams complete, no remaining direct child, unchanged source hashes and verified temporary-environment cleanup.

The full local suite and unfiltered test:changed were not repeated because concurrent Windows worktrees share the validation host; unfiltered selection would also repeat broader launcher activation fixtures. Focused checks cover the changed version boundary, and the exact-head Ubuntu job ran the changed launcher and runtime files, including the new floor cases. The earlier candidate validation did not include a full hosted Windows/macOS run; the current integrated head's full run is pending. The isolated substitute does not validate real TLS or old Bun binaries, and no deployed installation was exercised. No live service, account or certificate configuration was changed.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Bun version checks now require a stable release to match the pinned major version and meet or exceed the full pinned version. Older releases within the same major are skipped in favor of an eligible version.

• Documentation

  • Updated installation and runtime guidance to reflect the Bun version requirement.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: dev
• File: .coderabbit.yaml
• Commit: c2f3d8b
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 14b4e555-19a6-4cf4-a922-6fae8d94b227

Commits

Reviewing files that changed from the base of the PR and between 6da0192 and f84a72e.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: dev
• File: .coderabbit.yaml
• Commit: 8ebe46b
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c915ae3b-08ca-4d91-896e-cb99f10221ee

Commits

Reviewing files that changed from the base of the PR and between 8ebe46b and 6da0192.

Files selected for processing: 6

• docs-site/src/content/docs/getting-started/installation.md
• docs-site/src/content/docs/ko/getting-started/installation.md
• src/lib/bun-path-runtime.mjs
• structure/ops/docs-and-release.md
• structure/runtime.md
• tests/cli/ocx-launcher-runtime.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The PATH Bun check now requires a stable candidate on the pinned major that meets the full pinned version. Tests cover the updated threshold, and the English and Korean installation guides and runtime documentation describe the policy.

Changes: Bun PATH Version Policy

Layer / File(s)	Summary
PATH candidate version floor src/lib/bun-path-runtime.mjs:128-129, tests/cli/ocx-launcher-runtime.test.ts:406-774, docs-site/src/content/docs/getting-started/installation.md:41-42, docs-site/src/content/docs/ko/getting-started/installation.md:29-30, structure/ops/docs-and-release.md:348, structure/runtime.md:107	findPathBun requires a candidate version on the pinned major to meet the full pinned version. Tests cover below-floor rejection, eligible candidates, and candidate fallback. The documentation describes the updated minimum version policy.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related issues

• lidge-jun/opencodex#7612: Updates the Korean installation guide’s Bun version floor and PATH fallback policy.
• lidge-jun/opencodex#7578: Changes PATH fallback tests, but does not change the reported test timeout.

Possibly related PRs

• lidge-jun/opencodex#7606: Updates the Bun dependency pin to 1.4.4, which this PR uses as the PATH fallback threshold.
• lidge-jun/opencodex#7616: Updates the Korean installation guide for the 1.4.4 pin; this PR updates its documented fallback minimum.

Merge Risk: Minimal · up to 6da01

The Bun PATH version-floor change is ready to merge based on the verified implementation and coverage.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (4 skipped: 4…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately and concisely describes the main change: automatic PATH fallback now enforces the pinned Bun patch floor.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (4 skipped: 4 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration decision (v2.93.0 release lane L-A, admin decision authority granted by the repository owner): MERGE into dev.

• Exact head f84a72e43ef83eed5ca31df9c476023ef4d8db74 (current dev c2f3d8b42b merged in; the only change vs the reviewed author head is that clean merge).
• PR CI on the exact head: Cross-platform CI 40274221034 success (typecheck, Ubuntu 4/4, structure, docs build), Catalog async contracts 40274220958 success, enforce-target 40274218236 / hygiene 40274218262 success.
• Full-platform lane=all dispatch on the exact head: 40274235489 success (Windows 9/9, macOS 3/3 + control, keyring, desktop shell, widget).
• Independent security review (gpt-6.1-sol, role=review): PASS, 0 blocking. Confirmed the only production caller (bin/ocx.mjs) reads the 1.4.4 pin from package.json, below-pin patches are skipped in favour of later PATH entries, and the new floor cases fail against the previous policy.
• Combined tree with current dev 415078c343 (clean merge): bun x tsc --noEmit pass, structure:check pass, launcher PATH-policy + layout + file-size ratchet tests 71 pass / 4 platform skips / 0 fail (Bun 1.4.4, Windows).
• Non-blocking follow-up noted by the reviewer, outside this PR: .github/workflows/cleanup-orphaned-workflows.yml:40 still pins Bun 1.4.2.