[marius-kilocode]

What Problem This Solves

The VS Code unit-test job intermittently failed when a real git subprocess in packages/kilo-vscode/tests/unit/agent-project-paths.test.ts aborted with:

EBADF: bad file descriptor, epoll_ctl

This is not a test-logic failure. It originates in Bun child-process descriptor handling.

Why This Change Was Made

Bun 1.3.14 can double-close the parent end of an extra stdio pipe (fd >= 3). The kernel then recycles the descriptor, so a later unrelated subprocess call fails. Bun fixed that fd ownership bug after 1.3.14 (oven-sh/bun#34785).

This pins the runtime that contains the fix instead of rewriting the Git tests or reducing coverage. It also aligns @types/bun / bun-types and the documented minimum Bun version.

User Impact

No user-facing behavior change. CI and local development move from Bun 1.3.14 to 1.4.2.

Evidence

• On 1.3.14, 500 child_process.spawn calls with a 5-entry stdio array repeatedly fail with Failed to connect.
• The same script on 1.4.2 passes 500/500.
• agent-project-paths.test.ts passes 1,100/1,100 on 1.4.2.
• Full packages/kilo-vscode unit suite on 1.4.2: 6,732 pass, 2 skip, 0 fail.
• packages/kilo-vscode typecheck and bun install --frozen-lockfile pass on 1.4.2.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​bun@​1.3.14 ⏵ 1.4.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm bun-types under LGPL-2.0 License: LGPL-2.0 - The applicable license policy does not permit this license (5) (package/docs/project/license.mdx) From: package.json → npm/drizzle-orm@1.0.0-rc.2 → npm/@types/bun@1.4.2 → npm/bun-types@1.4.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/bun-types@1.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• .changeset/bun-runtime-1-4-2.md
• bunfig.toml
• nix/bun.nix
• packages/containers/bun-node/Dockerfile
• packages/kilo-vscode/docs/mercury-next-edit-testing.html
• packages/opencode/src/bun-compat.d.ts
• patches/@ff-labs%2Ffff-bun@0.9.4.patch

Previous Review Summary (commit 9e0a77e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 9e0a77e)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
package.json	7	Bumping packageManager to bun@1.4.2 without updating nix/bun.nix hashes breaks nix builds; also re-pins the release build runtime that was rolled back from 1.4.0 (terminal startup).

SUGGESTION

File	Line	Issue
package.json	39	bunfig.toml minimumReleaseAgeExcludes no longer lists @types/bun / bun-types; fresh install of @types/bun@1.4.2 may be blocked by the release-age quarantine.

Related consistency notes (unchanged files, no inline comment)

• packages/containers/bun-node/Dockerfile:9 still defaults BUN_VERSION=1.3.14. The container build script passes --build-arg BUN_VERSION from package.json, so the default is only a fallback, but it is now stale.
• packages/kilo-vscode/docs/mercury-next-edit-testing.html:279 still says Bun ≥ 1.3.14.
• packages/opencode/script/build.ts keeps splitting: false to work around a Bun 1.3.14 codegen bug that the comment says is fixed post-1.3.14; it may be re-enableable on 1.4.2, but that is an optimization, not a defect.

Files Reviewed (5 files)

• CONTRIBUTING.md - no issues
• bun.lock - no issues
• package.json - 2 issues
• packages/kilo-docs/pages/contributing/development-environment.md - no issues
• script/upstream/package.json - no issues

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 86.9K · Output: 26.3K · Cached: 1.4M}

_{Review guidance: REVIEW.md from base branch main}