🧆 fix: Align Bun Runtime Pins And Response Outcome Logging

.github/workflows/ci.yml

@@ -93,15 +93,15 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Cache Bun packages
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.bun/install/cache
-          key: ${{ runner.os }}-codeapi-api-bun-1.4.2-${{ hashFiles('api/bun.lock') }}
+          key: ${{ runner.os }}-codeapi-api-bun-1.4.4-${{ hashFiles('api/bun.lock') }}
           restore-keys: |
-            ${{ runner.os }}-codeapi-api-bun-1.4.2-
+            ${{ runner.os }}-codeapi-api-bun-1.4.4-
 
       - name: Install dependencies
         run: bun ci
@@ -149,7 +149,7 @@ jobs:
             --workdir /work/api \
             --env SANDBOX_CLEANUP_TMPFS_TEST=1 \
             --env SANDBOX_LOG_LEVEL=error \
-            oven/bun:1.4.2-debian \
+            oven/bun:1.4.4-debian \
             bun test src/cleanup.integration.test.ts
 
   nsjail-ipc-tests:
@@ -164,7 +164,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
       - name: Render native sandbox policy
         working-directory: api
         run: |
@@ -271,15 +271,15 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Cache Bun packages
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.bun/install/cache
-          key: ${{ runner.os }}-codeapi-service-bun-1.4.2-${{ hashFiles('service/bun.lock') }}
+          key: ${{ runner.os }}-codeapi-service-bun-1.4.4-${{ hashFiles('service/bun.lock') }}
           restore-keys: |
-            ${{ runner.os }}-codeapi-service-bun-1.4.2-
+            ${{ runner.os }}-codeapi-service-bun-1.4.4-
 
       - name: Install dependencies
         run: bun ci
@@ -395,7 +395,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
 
       - name: Install service dependencies
         working-directory: service
@@ -467,7 +467,7 @@ jobs:
           docker buildx inspect --bootstrap
 
       - name: Build Lambda MicroVM runner image
-        # The target pins Bun 1.4.2 and installs api/bun.lock frozen. Building
+        # The target pins Bun 1.4.4 and installs api/bun.lock frozen. Building
         # natively catches architecture-specific package and Docker layer
         # failures without retaining a second multi-gigabyte image copy.
         run: |

api/Dockerfile

@@ -50,7 +50,7 @@ ENV SANDBOX_PIPE_ADDON=/usr/local/lib/anonymous-pipes.node
 COPY docker/python-runtime /python-runtime
 RUN python3 /python-runtime/install.py
 COPY --from=node:22.23.4-slim /usr/local/bin/node /usr/local/bin/node
-COPY --from=oven/bun:1.4.2-debian /usr/local/bin/bun /usr/local/bin/bun
+COPY --from=oven/bun:1.4.4-debian /usr/local/bin/bun /usr/local/bin/bun
 
 # ============================================================================
 # Stage 1b: Build language runtime packages (only consumed by sandbox-runner-baked)
@@ -64,7 +64,7 @@ FROM buildpack-deps:bookworm AS package-builder
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PYTHON_VERSION=3.14.4
-ENV BUN_VERSION=1.4.2
+ENV BUN_VERSION=1.4.4
 
 COPY docker/apt-install.sh /usr/local/bin/apt-install
 RUN chmod +x /usr/local/bin/apt-install
@@ -87,7 +87,7 @@ RUN chmod +x /package-init.sh && FORCE_REBUILD=true /package-init.sh
 # ============================================================================
 # Stage 2: Build sandbox rootfs
 # ============================================================================
-FROM oven/bun:1.4.2-debian AS sandbox-build
+FROM oven/bun:1.4.4-debian AS sandbox-build
 
 ENV DEBIAN_FRONTEND=noninteractive
 

api/src/package-init.test.ts

@@ -28,7 +28,7 @@ for (const oldRuntimeExists of [false, true]) {
                     args: ['hello world', '--version'],
                 },
                 {
-                    directory: 'bun/1.4.2',
+                    directory: 'bun/1.4.4',
                     binary: 'bun',
                     args: ['run', 'hello world', '--version'],
                 },
@@ -131,7 +131,7 @@ for (const oldRuntimeExists of [false, true]) {
                 FORCE_REBUILD: 'false',
                 PYTHON_VERSION: '3.14.4',
                 NODE_VERSION: '24.22.1',
-                BUN_VERSION: '1.4.2',
+                BUN_VERSION: '1.4.4',
                 BASH_PACKAGE_VERSION: '5.2.0',
                 JS_PACKAGE_MANIFEST: manifest,
             };

build-packages.sh

@@ -10,7 +10,7 @@
 # Environment Variables:
 #   PYTHON_VERSION=3.14.4    # Python version to install
 #   NODE_VERSION=24.22.1     # Node.js version to install
-#   BUN_VERSION=1.4.2       # Bun version to install
+#   BUN_VERSION=1.4.4       # Bun version to install
 #   BASH_PACKAGE_VERSION=5.2.0 # Bash package registration version (semver-like x.y.z)
 #   SKIP_PYTHON_PACKAGES=1   # Skip Python pip packages
 #   SKIP_JS_PACKAGES=1       # Skip JavaScript npm packages for Node/Bun
@@ -28,7 +28,7 @@ cd "$SCRIPT_DIR"
 
 PYTHON_VERSION="${PYTHON_VERSION:-3.14.4}"
 NODE_VERSION="${NODE_VERSION:-24.22.1}"
-BUN_VERSION="${BUN_VERSION:-1.4.2}"
+BUN_VERSION="${BUN_VERSION:-1.4.4}"
 PACKAGES_DIR="./data/pkgs"
 JS_PACKAGE_MANIFEST="${JS_PACKAGE_MANIFEST:-${SCRIPT_DIR}/javascript-packages.txt}"
 

docker/Dockerfile.worker-sandbox

@@ -68,7 +68,7 @@ FROM buildpack-deps:bookworm AS package-builder
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PYTHON_VERSION=3.14.4
-ENV BUN_VERSION=1.4.2
+ENV BUN_VERSION=1.4.4
 
 COPY docker/apt-install.sh /usr/local/bin/apt-install
 RUN chmod +x /usr/local/bin/apt-install
@@ -91,7 +91,7 @@ RUN chmod +x /package-init.sh && FORCE_REBUILD=true /package-init.sh
 # ============================================================================
 # Stage 2: Build worker
 # ============================================================================
-FROM oven/bun:1.4.2 AS worker-builder
+FROM oven/bun:1.4.4 AS worker-builder
 WORKDIR /app
 COPY service/package.json service/bun.lock ./
 RUN bun install --frozen-lockfile
@@ -104,7 +104,7 @@ RUN bun build ./src/worker-server.ts --minify --outdir .build --target bun --ext
 # ============================================================================
 # Stage 3: Build sandbox API
 # ============================================================================
-FROM oven/bun:1.4.2 AS sandbox-builder
+FROM oven/bun:1.4.4 AS sandbox-builder
 WORKDIR /app
 COPY api/package.json ./
 RUN bun install --frozen-lockfile
@@ -117,7 +117,7 @@ RUN bun build ./src/index.ts --minify --outdir .build --target bun --external '@
 # ============================================================================
 # Stage 4: Build sandbox rootfs (full OS layer for the microVM guest)
 # ============================================================================
-FROM oven/bun:1.4.2-debian AS sandbox-rootfs
+FROM oven/bun:1.4.4-debian AS sandbox-rootfs
 
 ENV DEBIAN_FRONTEND=noninteractive
 

docker/package-init.sh

@@ -21,7 +21,7 @@ PYTHON_ALIAS="python${PYTHON_SITE_VERSION}"
 PYTHON_PACKAGE_INSTALLER="${PYTHON_PACKAGE_INSTALLER:-uv}"
 UV_VERSION="${UV_VERSION:-0.11.26}"
 NODE_VERSION="${NODE_VERSION:-24.22.1}"
-BUN_VERSION="${BUN_VERSION:-1.4.2}"
+BUN_VERSION="${BUN_VERSION:-1.4.4}"
 BASH_PACKAGE_VERSION="${BASH_PACKAGE_VERSION:-5.2.0}"
 INSTALL_FAILED=false
 JS_PACKAGE_MANIFEST="${JS_PACKAGE_MANIFEST:-${SCRIPT_DIR}/javascript-packages.txt}"

docs/SECURITY-MAINTENANCE.md

@@ -120,7 +120,7 @@ does not mount. The namespace-disabled native policy tests cover those APIs
 when shared memory exists, not their availability in the default jail.
 
 With runtime packages built by `build-packages.sh` (or a compatible `/pkgs`
-tree containing Python 3.14.4 and Bun 1.4.2), run from the repository root:
+tree containing Python 3.14.4 and Bun 1.4.4), run from the repository root:
 
 ```sh
 bun service/scripts/dump-pipe-preamble.ts > /tmp/codeapi-pipe-client.py
@@ -180,7 +180,7 @@ Remaining service audit findings at this change:
 - `braces` (GHSA-vfj7-8cjw-p6xm): development-only dependency with no published
   fix. Do not feed untrusted patterns to build tooling; track an upstream fix.
 
-Bun 1.4.2 subprocess spawning with piped stdio also uses socketpairs and is
+Bun 1.4.4 subprocess spawning with piped stdio also uses socketpairs and is
 denied by this policy. Basic JS/TS execution remains supported. Replacing Bun
 subprocess IPC requires a separate runtime change; do not re-enable socketpairs
 to provide that compatibility.

helm/codeapi/values.yaml

@@ -311,7 +311,7 @@ workerSandbox:
         pullPolicy: Always
       pythonVersion: "3.14.4"
       nodeVersion: "24.22.1"
-      bunVersion: "1.4.2"
+      bunVersion: "1.4.4"
       bashPackageVersion: "5.2.0"
       backoffLimit: 2
       ttlSecondsAfterFinished: 3600

launcher/Dockerfile

@@ -49,7 +49,7 @@ RUN gcc -shared -fPIC -O2 -Wall -Wextra -Werror -I/usr/local/include/node -o /us
     && gcc -O2 -static -o /usr/local/bin/sandbox-rootfs-setup /tmp/rootfs-setup.c \
     && chmod 0111 /usr/local/bin/spec-guard /usr/local/bin/sandbox-rootfs-setup
 
-FROM oven/bun:1.4.2-debian AS sandbox-build
+FROM oven/bun:1.4.4-debian AS sandbox-build
 
 ENV DEBIAN_FRONTEND=noninteractive
 

service/Dockerfile

@@ -1,5 +1,5 @@
 # File Server Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -27,15 +27,15 @@ RUN bun build ./src/worker-server.ts --minify --outdir .build-worker --target bu
 RUN bun build ./src/egress-gateway.ts --minify --outdir .build-egress-gateway --target bun --external '@opentelemetry/*'
 
 # File server production
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
 COPY --from=builder /app/.build ./.build
 CMD ["bun", "run", ".build/file-server.js"]
 
 # API server (HTTP on port 3112)
-FROM oven/bun:1.4.2 AS api
+FROM oven/bun:1.4.4 AS api
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
@@ -45,7 +45,7 @@ COPY --from=builder /app/src/*.py ./src/
 CMD ["bun", "run", ".build-api/api-server.js"]
 
 # Worker server (job processor, health on port 3113)
-FROM oven/bun:1.4.2 AS worker
+FROM oven/bun:1.4.4 AS worker
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules
@@ -54,7 +54,7 @@ COPY --from=builder /app/src/*.py ./src/
 CMD ["bun", "run", ".build-worker/worker-server.js"]
 
 # Egress gateway (sandbox outbound delegation)
-FROM oven/bun:1.4.2 AS egress-gateway
+FROM oven/bun:1.4.4 AS egress-gateway
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules

service/Dockerfile.api

@@ -1,7 +1,7 @@
 # API-Only Server Dockerfile
 # This builds the HTTP API server without workers
 # Scale this based on HTTP traffic
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -27,7 +27,7 @@ RUN bun build ./src/api-server.ts --minify --outdir .build --target bun --extern
 RUN bun build ./scripts/rehydrate-session-cache.ts --minify --outdir .build-migrations --target bun --external '@opentelemetry/*'
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 # Install curl for healthcheck (not included in bun base image)

service/Dockerfile.bun

@@ -1,5 +1,5 @@
 # Base stage
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /usr/src/app
 
 # Install dependencies

service/Dockerfile.egress-gateway

@@ -1,5 +1,5 @@
 # Egress Gateway Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 FROM base AS install
@@ -11,7 +11,7 @@ RUN mkdir -p /temp/prod
 COPY service/package.json service/bun.lock /temp/prod/
 RUN cd /temp/prod && bun install --frozen-lockfile --production
 
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*

service/Dockerfile.local

@@ -1,5 +1,5 @@
 # Local development Dockerfile - no authentication required
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -22,7 +22,7 @@ COPY service/tsconfig.json ./
 RUN bun build ./src/local-api.ts --minify --outdir .build --target bun --external '@opentelemetry/*'
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules

service/Dockerfile.service

@@ -1,5 +1,5 @@
 # Service API Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /usr/src/app
 
 # Install dependencies

service/Dockerfile.tool-call-server

@@ -1,5 +1,5 @@
 # Tool Call Server Dockerfile
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -13,7 +13,7 @@ COPY service/package.json service/bun.lock /temp/prod/
 RUN cd /temp/prod && bun install --frozen-lockfile --production
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 COPY --from=install /temp/prod/node_modules ./node_modules

service/Dockerfile.worker

@@ -2,7 +2,7 @@
 # This builds the job processing worker without HTTP server
 # Deploy alongside a sandbox sidecar for execution
 # Scale this based on queue depth
-FROM oven/bun:1.4.2 AS base
+FROM oven/bun:1.4.4 AS base
 WORKDIR /app
 
 # Install dependencies
@@ -25,7 +25,7 @@ COPY service/tsconfig.json ./
 RUN bun build ./src/worker-server.ts --minify --outdir .build --target bun --external '@opentelemetry/*'
 
 # Production stage
-FROM oven/bun:1.4.2 AS production
+FROM oven/bun:1.4.4 AS production
 ENV NODE_ENV=production
 WORKDIR /app
 # Install curl for healthcheck

service/src/config.spec.ts

@@ -80,15 +80,15 @@ describe('runtime version configuration', () => {
     });
   });
 
-  it('maps Bun JavaScript and TypeScript requests to Bun 1.4.2', () => {
+  it('maps Bun JavaScript and TypeScript requests to Bun 1.4.4', () => {
     expect(languageConfig[Languages.js]).toMatchObject({
       language: 'bun-js',
-      version: '1.4.2',
+      version: '1.4.4',
       fileName: 'index.js',
     });
     expect(languageConfig[Languages.ts]).toMatchObject({
       language: 'bun-ts',
-      version: '1.4.2',
+      version: '1.4.4',
       fileName: 'main.ts',
     });
   });

service/src/config.ts

@@ -11,10 +11,10 @@ import { BRIDGE_WORKSPACE_IMPORT_FILE_DEFAULT_MAX_BYTES } from '../../packages/c
 
 export const languageConfig: Record<Languages | string, t.LanguageConfig | undefined> = {
   [Languages.bash]: { language: 'bash', version: '5.2.0', fileName: 'script.sh' },
-  [Languages.js]: { language: 'bun-js', version: '1.4.2', fileName: 'index.js' },
+  [Languages.js]: { language: 'bun-js', version: '1.4.4', fileName: 'index.js' },
   [Languages.node]: { language: 'node', version: '24.22.1', fileName: 'index.js' },
   [Languages.py]: { language: 'python', version: '3.14.4', fileName: 'main.py' },
-  [Languages.ts]: { language: 'bun-ts', version: '1.4.2', fileName: 'main.ts' },
+  [Languages.ts]: { language: 'bun-ts', version: '1.4.4', fileName: 'main.ts' },
 };
 
 const languageAliases: Record<string, Languages> = {