build: migrate the package manager from pnpm to Bun

.agents/skills/agent-core-dev/config.md

@@ -287,7 +287,7 @@ When `KIMI_MODEL_NAME` is set, the `kosongConfig` wrapper's `kimiModelEnvOverlay
 The authoritative, always-current list of registered sections — rendered in the on-disk `config.toml` shape, with owner file, scope, defaults, env bindings, and schema fields — is generated from the live registry:
 
 - `packages/agent-core-v2/docs/config-manifest.toml` (checked in; do not edit by hand).
-- Regenerate with `pnpm --filter @moonshot-ai/agent-core-v2 gen:config-manifest` (add `--check` for a freshness check; `test/app/config/configManifest.test.ts` enforces it in CI).
+- Regenerate with `(cd packages/agent-core-v2 && bun run gen:config-manifest)` (add `--check` for a freshness check; `test/app/config/configManifest.test.ts` enforces it in CI).
 
 `config` must not import from any of these owner domains; that is the whole reason the schemas, TOML normalization, and env overlays live with their owners.
 

.agents/skills/agent-core-dev/server-align.md

@@ -204,11 +204,11 @@ Where the route mirrors v1, the test is the regression guard for the schema-fide
 
 ### 7. Verify
 
-- `pnpm -C packages/kap-server test` — server routes green.
-- `pnpm -C packages/kap-server test` — server routes green (incl. any wire-schema guards).
-- `pnpm -C packages/agent-core-v2 test` — native + Legacy Service tests green.
-- `pnpm -C packages/agent-core-v2 run lint:imports` — the import boundaries (v1 ban, kosong subtree) still hold for a LegacyService.
-- `pnpm -C packages/klient test` (optionally with `KIMI_SERVER_URL` for the live legacy suites) when a v1 parity scenario exists.
+- `(cd packages/kap-server && bun run test)` — server routes green.
+- `(cd packages/kap-server && bun run test)` — server routes green (incl. any wire-schema guards).
+- `(cd packages/agent-core-v2 && bun run test)` — native + Legacy Service tests green.
+- `(cd packages/agent-core-v2 && bun run lint:imports)` — the import boundaries (v1 ban, kosong subtree) still hold for a LegacyService.
+- `(cd packages/klient && bun run test)` (optionally with `KIMI_SERVER_URL` for the live legacy suites) when a v1 parity scenario exists.
 
 ## Worked example — porting v1 `/sessions/:sid/prompts`
 

.agents/skills/agent-core-dev/verify.md

@@ -4,11 +4,11 @@ Run the guards and re-scan the red lines before submitting.
 
 ## Commands
 
-Run from the package (or with `--filter @moonshot-ai/agent-core-v2`):
+Run from the package (or with `bun run --filter @moonshot-ai/agent-core-v2 <script>`):
 
-- `pnpm --filter @moonshot-ai/agent-core-v2 lint:imports` — import-boundary guard (`scripts/check-import-boundaries.mjs`). Catches v1 imports (`@moonshot-ai/agent-core`) and kosong subtree violations.
-- `pnpm --filter @moonshot-ai/agent-core-v2 typecheck` — `tsc -p tsconfig.json --noEmit`.
-- `pnpm --filter @moonshot-ai/agent-core-v2 test` — `vitest run`.
+- `cd packages/agent-core-v2 && bun run lint:imports` — import-boundary guard (`scripts/check-import-boundaries.mjs`). Catches v1 imports (`@moonshot-ai/agent-core`) and kosong subtree violations.
+- `cd packages/agent-core-v2 && bun run typecheck` — `tsc -p tsconfig.json --noEmit`.
+- `cd packages/agent-core-v2 && bun run test` — `vitest run`.
 
 ## Changesets (when the change ships through the CLI)
 

.agents/skills/translate-docs/SKILL.md

@@ -48,7 +48,7 @@ When non-changelog pages change in either locale, sync the mirror before release
 4. **Verify**
 
    - `git diff docs/` — scan for terminology drift or punctuation regressions.
-   - Run the docs build if available (`pnpm --filter docs run build` or equivalent) to catch broken links and Markdown errors.
+   - Run the docs build if available (`cd docs && bun run build` or equivalent) to catch broken links and Markdown errors.
 
 ## Rules and conventions
 

.changeset/README.md

@@ -4,7 +4,7 @@ This repository uses [changesets](https://github.com/changesets/changesets) to m
 
 ## Package Publishing Strategy
 
-This repository uses an **independent, manually-selected publishing** strategy. When generating a changeset, only select the publishable packages that this change actually affects. The repository's `.changeset/config.json` already filters out internal workspace packages via `ignore`, so only the publishable packages listed below should appear in the `pnpm changeset` prompt.
+This repository uses an **independent, manually-selected publishing** strategy. When generating a changeset, only select the publishable packages that this change actually affects. The repository's `.changeset/config.json` already filters out internal workspace packages via `ignore`, so only the publishable packages listed below should appear in the `bun run changeset` prompt.
 
 Current publishable packages:
 
@@ -72,7 +72,7 @@ Complete code, tests, and documentation changes as usual. A changeset is require
 From the repository root:
 
 ```sh
-pnpm changeset
+bun run changeset
 ```
 
 Follow the prompts to choose:
@@ -102,37 +102,37 @@ Once the changeset file is merged into `main`, `.github/workflows/release.yml` u
 
 The release PR runs:
 
-- `pnpm changeset version`: bumps publishable package versions and updates changelogs;
+- `bun run changeset version`: bumps publishable package versions and updates changelogs;
 - Deletes the consumed `.changeset/*.md` files;
 - Uses the title `[CI]: Release packages`.
 
 ### 5. Merge the release PR
 
 Once the release PR is merged into `main`, the same workflow runs:
 
-- `pnpm install --frozen-lockfile`
-- `pnpm build`
-- `pnpm changeset publish`
+- `bun install --frozen-lockfile`
+- `bun run build`
+- `bun run changeset publish`
 
 The packages are then published via npm Trusted Publishing, and a GitHub Release is created.
 
 ## Manual Publishing (Not Recommended)
 
-Only publish manually when CI is unavailable. Before publishing manually, make sure you are logged into npm locally and using the Node.js and pnpm versions required by the repository.
+Only publish manually when CI is unavailable. Before publishing manually, make sure you are logged into npm locally and using the Node.js and Bun versions required by the repository.
 
 ```sh
-pnpm run version
-pnpm run publish
+bun run version
+bun run publish
 ```
 
 The underlying changesets commands are:
 
 ```sh
-pnpm changeset version
-pnpm changeset publish
+bun run changeset version
+bun run changeset publish
 ```
 
-The root-level `pnpm run publish` first runs typecheck, lint, sherif, test, build, and package lint, then runs `changeset publish`.
+The root-level `bun run publish` first runs typecheck, lint, sherif, test, build, and package lint, then runs `changeset publish`.
 
 ## Notes
 

.changeset/bun-no-autoload-bytecode-off.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Bun single-file binaries no longer autoload `.env`/`bunfig.toml` from the current directory at runtime, and Bun bytecode is no longer embedded by default; set `KIMI_CODE_BUN_ENABLE_BYTECODE=1` to opt back in.

.changeset/bun-nodepty-bindings.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Ship node-pty with its PTY bindings through the packaged-build asset pipeline and load it from the extracted cache in single-file builds on both engines; the release smoke now dlopens the binding.

.changeset/bun-pitui-helper.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Restore native terminal input handling in packaged single-file builds by resolving pi-tui's platform helper from the extracted asset cache at load time.

.changeset/bun-self-update.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix the built-in updater refusing to download updates in Bun single-file builds.

.changeset/bun-status-runtime-row.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Show the packaging engine and native-tools implementation on the `/status` report (`Runtime  bun · rust`), and clean up superseded Bun entry extractions left behind by older versions.

.changeset/bun-terminal-utf8.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Fix garbled multi-byte characters in terminal session output when running on the Bun runtime.

.changeset/bun-updater-engine-aware.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Make the staged self-updater engine-aware: a Bun packaged binary now downloads the release's Bun build from the manifest's optional `bun` section and refuses to silently swap itself to the Node SEA binary when that release ships none.

.changeset/bun-webfetch-undici.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Keep built-in URL-fetch SSRF guard semantics identical across Node and Bun runtimes by defaulting to the bundled undici fetch, whose pinned-DNS dispatcher option Bun's global fetch silently ignores.

.changeset/read-folds-in-media.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": minor
+---
+
+Merged image and video reading into the Read tool: Read now accepts `region` and `full_resolution` for images, and the separate media-read tool is no longer offered (existing sessions and permission rules keep working).