chore: take upstream pi's toolchain split for install, checks, and tests

.github/dependabot.yml

@@ -2,6 +2,13 @@
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Every ecosystem below declares `cooldown`. `npm ci` installs package-lock.json
+# verbatim, so the `min-release-age=2` gate in the committed .npmrc only binds
+# when the lockfile is *updated*. Without a matching cooldown here an automated
+# bump could open a PR against a release younger than the local gate would ever
+# install, and merging it would write that version into the lockfile. The two
+# controls express the same policy from opposite sides and must stay in step.
 
 version: 2
 updates:
@@ -10,22 +17,26 @@ updates:
       directory: "/"
       schedule:
           interval: "weekly"
+      cooldown:
+          default-days: 2
       commit-message:
           prefix: "ci"
       labels:
           - "dependencies"
           - "github-actions"
 
-    # Bun packages (root)
-    - package-ecosystem: "bun"
+    # npm packages (root workspace)
+    - package-ecosystem: "npm"
       directory: "/"
       schedule:
           interval: "weekly"
+      cooldown:
+          default-days: 2
       commit-message:
           prefix: "deps"
       labels:
           - "dependencies"
-          - "bun"
+          - "npm"
       ignore:
           # @types/node is pinned via a root `overrides` entry to match
           # upstream Pi's resolved lockfile (see #1489); bumps here are no-ops.
@@ -36,8 +47,10 @@ updates:
       directory: "/"
       schedule:
           interval: "weekly"
+      cooldown:
+          default-days: 2
       commit-message:
           prefix: "deps"
       labels:
           - "dependencies"
-          - "rust"
+          - "rust"

.github/workflows/publish.yml

@@ -110,7 +110,7 @@ jobs:
           bun-version: 1.3.14
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 22
       # rustup needs the bare target; Linux's napi build separately receives the
       # glibc-suffixed target consumed by cargo-zigbuild.
       - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
@@ -125,7 +125,7 @@ jobs:
           toolchain_bin="$(dirname "$(rustup which cargo)")"
           echo "$toolchain_bin" >> "$GITHUB_PATH"
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: npm ci --ignore-scripts
       - name: Resolve explicit native build target
         id: target
         shell: bash
@@ -238,7 +238,7 @@ jobs:
           bun-version: 1.3.14
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 22
       - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         timeout-minutes: 4
         with:
@@ -282,7 +282,7 @@ jobs:
           bun-version: 1.3.14
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 22
       - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         timeout-minutes: 4
         with:
@@ -329,12 +329,12 @@ jobs:
           bun-version: 1.3.14
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 22
           registry-url: https://registry.npmjs.org
       - name: Install dependencies and verify shrinkwrap
         run: |
-          bun install --frozen-lockfile
-          bun run check:shrinkwrap
+          npm ci --ignore-scripts
+          npm run check:shrinkwrap
       - name: Download native bindings
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -445,7 +445,7 @@ jobs:
           path: payload
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 22
           registry-url: https://registry.npmjs.org
       - name: Upgrade npm for trusted publishing
         run: npm install -g npm@11.16.0 --ignore-scripts

.github/workflows/test.yml

@@ -57,33 +57,37 @@ jobs:
         with:
           lfs: true
           fetch-depth: 0
+      # Bun is still a declared engine: it compiles the release binaries and runs
+      # scripts/*.ts, including the flaky-suite wrapper invoked below. It no
+      # longer installs dependencies or runs any suite.
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           # Pinned to match publish.yml; `latest` cannot be cached by setup-bun.
           bun-version: 1.3.14
-      # Node is required by installed-package-node-extensions.test.ts, which
-      # smoke-tests the built npm package under the Node runtime.
+      # Node now installs dependencies and runs every suite, so it is required
+      # here rather than only by installed-package-node-extensions.test.ts.
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24
+          node-version: 22
+          cache: npm
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: npm ci --ignore-scripts
       # Both suites below consume this build. test/unit/pi-0.82.1-artifacts.test.ts
       # silently degrades to test.skip when packages/coding-agent/dist is absent,
       # so moving the unit suite out of this job would lose coverage without
       # failing anything.
       - name: Build @bastani/atomic package
         working-directory: packages/coding-agent
-        run: bun run build
+        run: npm run build
       - name: Unit tests (one bounded flake retry)
         run: >-
           bun run scripts/run-flaky-test-suite.ts --label "unit tests (${{ matrix.binary_platform }})"
           --no-retry-file flaky-test-suite-runner.test.ts
-          -- bun run test:unit
+          -- npm run test:unit
       - name: Integration tests (one bounded flake retry)
         run: >-
           bun run scripts/run-flaky-test-suite.ts --label "integration tests (${{ matrix.binary_platform }})"
-          -- bun run test:integration
+          -- npm run test:integration
         env:
           # Hard-require the installed-package Node smoke where the package
           # build above guarantees dist/ exists on both supported hosts.
@@ -129,25 +133,30 @@ jobs:
         with:
           lfs: true
           fetch-depth: 0
+      # Bun still compiles binaries and runs scripts/*.ts, including the wrapper.
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
       - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         timeout-minutes: 4
         with:
           # Required once pinned by SHA: the version otherwise comes from the ref.
           toolchain: stable
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: npm ci --ignore-scripts
       # packages/coding-agent/test/native-binding-exports.test.ts is hard-required
       # by ATOMIC_REQUIRE_NATIVE_BINDING_SMOKE below, so the vitest suite must
       # stay behind this build.
       - name: Build native bindings for package tests
-        run: bun run --cwd packages/natives build
+        run: npm run build --workspace=@bastani/atomic-natives
       - name: coding-agent vitest suite (one bounded flake retry)
         run: >-
           bun run scripts/run-flaky-test-suite.ts --label "coding-agent tests (${{ matrix.binary_platform }})"
-          -- bun run --cwd packages/coding-agent --bun test
+          -- npm run test --workspace=@bastani/atomic
         env:
           ATOMIC_REQUIRE_NATIVE_BINDING_SMOKE: "1"
       - name: Upload flaky-test diagnostics
@@ -187,9 +196,14 @@ jobs:
         with:
           lfs: true
           fetch-depth: 0
+      # `bun build --compile` is still the binary compiler, exactly as upstream.
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
       # scripts/build-binaries.sh reuses packages/natives/native/*.node when they
       # exist and otherwise builds them, so this job needs the Rust toolchain and
       # pays the native build again rather than waiting on agent-suite. That is a
@@ -199,10 +213,10 @@ jobs:
         with:
           toolchain: stable
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: npm ci --ignore-scripts
       - name: Build @bastani/atomic package
         working-directory: packages/coding-agent
-        run: bun run build
+        run: npm run build
       - name: Build native release binary
         shell: bash
         run: ./scripts/build-binaries.sh --skip-install --skip-package-build --platform "${{ matrix.binary_platform }}"
@@ -310,36 +324,50 @@ jobs:
 
   static-checks:
     name: static-checks (linux-x64)
-    # Platform-independent checks. They cost 30s in total and need neither the
-    # Rust toolchain nor Node, so they run once on Linux instead of twice.
+    # Platform-independent checks. They need no Rust toolchain, so they run once
+    # on Linux instead of twice.
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 6
     steps:
       - uses: useblacksmith/checkout@01ab2a058dd0d41e292217b76582a6f9867c02ce # v1.0.0-beta
         with:
           lfs: true
           fetch-depth: 0
+      # Still required here: packages/coding-agent's docs:check is a Bun
+      # TypeScript script, and scripts/*.ts run under Bun by design.
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
       - name: Install dependencies
-        run: bun install --frozen-lockfile
-      - name: Typecheck
-        run: bun run typecheck
+        run: npm ci --ignore-scripts
+      - name: Check
+        run: npm run check
       - name: Docs link validation
         working-directory: packages/coding-agent
-        run: bun run docs:check
+        run: npm run docs:check
       - name: Mintlify docs validation
         if: github.event_name == 'pull_request'
         working-directory: packages/coding-agent/docs
         # Pinned: mintlify@4.2.732 pulls a package missing from the registry.
         # Unpin once upstream publishes a resolvable release.
+        #
+        # Run through `bunx --bun`, not npx: mintlify refuses to start on Node 25+
+        # and this job installs no Node toolchain, so npx picks up whatever the
+        # runner ships. Bun hosts it regardless of the runner's Node version.
         timeout-minutes: 5
         run: |
           bunx --bun mintlify@4.2.731 validate
           bunx --bun mintlify@4.2.731 broken-links
+      # pi parity: repository scripts that Node can run are tested with Node's
+      # own runner rather than through the workspace suites.
+      - name: Script tests
+        run: npm run test:scripts
       - name: Deterministic CI and release contracts
-        run: bun run test:ci-contracts
+        run: npm run test:ci-contracts
 
   # Result gate. This job exists to carry the two contexts required by
   # repository ruleset 9310196:

.gitignore

@@ -292,3 +292,8 @@ evals/jobs/
 
 # CI flake-retry and duration-headroom artifacts (uploaded from CI, never tracked)
 .ci-diagnostics/
+
+# Scratch workspaces test/unit/flaky-test-suite-runner.test.ts creates under the
+# repository root, so vitest and node_modules resolve by the ordinary upward
+# walk. Removed on success; ignored so an interrupted run leaves nothing tracked.
+.tmp-flake-real-*/

.npmrc

@@ -0,0 +1,5 @@
+# Committed so the supply-chain gate binds every contributor's install, not just
+# CI. Mirrors upstream pi's .npmrc, and replaces the `[install]` block bunfig.toml
+# carried before the toolchain moved to npm.
+save-exact=true
+min-release-age=2