Install
$ agentstack add skill-xobotyi-cc-foundry-bun ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ● Shell / process execution Used
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Bun
Use Bun APIs, not Node.js polyfills. If Bun provides a native API for it, use it.
Bun is a batteries-included JavaScript runtime. It replaces Node.js, npm, Jest, and webpack with a single tool. Prefer Bun-native APIs (Bun.serve, Bun.file, Bun.$, bun:sqlite, bun:test) over Node.js equivalents unless portability is an explicit requirement.
References
- HTTP server — [
${CLAUDE_SKILL_DIR}/references/server.md]: Route types, file response patterns, WebSocket
pub/sub, server config
- File I/O and processes — [
${CLAUDE_SKILL_DIR}/references/io-and-processes.md]: File I/O details, shell API,
child processes, workers
- Testing — [
${CLAUDE_SKILL_DIR}/references/testing.md]: Test modifiers, parametrized tests, mocking, snapshots,
CLI flags
- SQLite, bundler, plugins — [
${CLAUDE_SKILL_DIR}/references/ecosystem.md]: SQLite API, bundler options, plugins,
macros
- Configuration — [
${CLAUDE_SKILL_DIR}/references/config-and-compat.md]: bunfig.toml sections, Node.js
compatibility, env vars
Prefer Bun-Native APIs
Rule: if Bun.* or bun:* has it, use it. Fall back to node:* only when there's no Bun-native alternative or when portability to Node.js is required.
Core mappings: Bun.serve() over http.createServer(), Bun.file()/Bun.write() over node:fs, Bun.$ over child_process.exec, bun:sqlite over better-sqlite3, bun:test over Jest/Vitest, Bun.password over bcrypt, Bun.sleep() over setTimeout wrappers, Bun.spawn() over child_process.spawn. Use node:fs for directory ops — no Bun API yet. Use Web Streams API over node:stream.
Full API preference table: see ${CLAUDE_SKILL_DIR}/references/io-and-processes.md.
HTTP Server
Routing
- Use
routesobject (v1.2.3+) for declarative path matching. Preferred overfetch-based routing. - Route types: exact (
"/users/all", highest priority), parameterized ("/users/:id",req.params.id), wildcard
("/api/*"), per-method ({ GET: handler, POST: handler }).
- Precedence: exact > parameterized > wildcard > global catch-all.
fetchhandler as fallback for unmatched routes, not primary routing.- Always implement
errorhandler inBun.serve(). development: truein dev for built-in error pages.
Static Responses
- Use static
Responseobjects for health checks, redirects, fixed JSON — they are zero-allocation after init,
cached for server lifetime.
- Call
server.reload()to update static responses at runtime.
Request Object
- Route handlers receive
BunRequest(extendsRequest) withparams(auto URL-decoded) andcookies
(auto-tracked CookieMap).
- TypeScript infers param shape when route is a string literal.
- Cookie changes are auto-tracked —
Set-Cookieheaders added automatically when usingreq.cookies.set()/
.delete().
WebSocket
- Upgrade via
server.upgrade(req, { data })in thefetchhandler. - Use native pub/sub for topic-based broadcasting:
ws.subscribe("topic"),ws.publish("topic", data). - Type
ws.datavia thedataproperty on thewebsockethandler object.
WebSocket limits, server configuration, file response patterns, HTML imports, and server lifecycle details: see ${CLAUDE_SKILL_DIR}/references/server.md.
File I/O
Bun.file()is lazy. Creating aBunFiledoes not read from disk. It conforms toBlob.- Read with
.text(),.json(),.bytes(),.stream(),.arrayBuffer()onBunFile. - Check existence:
await file.exists(). Accessfile.sizeandfile.type. Bun.write()handles all types — string, Blob, Response, ArrayBuffer, BunFile. Uses fastest syscall per platform
(copy_file_range, sendfile, clonefile).
- Incremental writing: use
file.writer()(FileSink). Call.flush()to flush buffer,.end()to flush + close
(required to let process exit).
- Built-in stdio references:
Bun.stdin(readonly),Bun.stdout,Bun.stderr. - Use
node:fsfor directory ops —mkdir,readdir. No Bun-specific API yet. import.meta.dirgives the directory of the current file.
Shell API — Bun.$
Cross-platform bash-like shell with JavaScript interop. Runs in-process (not /bin/sh).
$tagged template for shell commands. Interpolated values are auto-escaped — injection-safe by default.- Read output:
.text()(string, auto-quiets),.json()(parsed),.lines()(async iterator),.blob(), or
await $\...\`for{ stdout, stderr }` Buffers.
.quiet()to suppress stdout/stderr output.- Non-zero exit codes throw
ShellErrorby default. Use.nothrow()to handle exit codes manually. Configure
globally: $.nothrow() or $.throws(false).
- Piping and redirection work:
|,>,2>&1,({ ... }))** for module mocking. Works for ESM and CJS.
Test modifiers, parametrized tests, mocking details, snapshots, CLI flags, and bunfig.toml test config: see ${CLAUDE_SKILL_DIR}/references/testing.md.
SQLite, Bundler, Plugins, Macros
- SQLite: use
bun:sqlite— native, synchronous, 3-6x faster thanbetter-sqlite3. Enable WAL mode. Use prepared
statements and transactions.
- Bundler:
Bun.build()with targets"bun","browser","node". Checkresult.successand iterate
result.logs on failure.
- Plugins:
Bun.plugin()withsetup(build)— extend module resolver and loader. Register via bunfig.toml
preload.
- Macros: compile-time code execution via
{ type: "macro" }import. Return value inlined; must be
JSON-serializable.
Full SQLite API, bundler options, plugin patterns, and macro constraints: see ${CLAUDE_SKILL_DIR}/references/ecosystem.md.
Utilities
Hashing & Passwords
Bun.password.hash(pw)— argon2id default. Also supports"bcrypt".Bun.password.verify(pw, hash)— auto-detects algorithm.Bun.hash("data")— fast non-crypto (Wyhash).new Bun.CryptoHasher("sha256")— crypto hashing.
Sleep & Timing
await Bun.sleep(ms)— async.Bun.sleepSync(ms)— blocking.Bun.nanoseconds()— high-resolution timer.
Comparison & Inspection
Bun.deepEquals(a, b)— deep equality.Bun.deepMatch(subset, obj)— partial match.Bun.inspect(obj)—console.logformat as string.Bun.peek(promise)— read without awaiting.
Compression
- Gzip:
Bun.gzipSync(data)/Bun.gunzipSync(data). - Deflate:
Bun.deflateSync(data)/Bun.inflateSync(data). - Zstd:
Bun.zstdCompressSync(data)/Bun.zstdDecompressSync(data).
Paths, UUIDs, Streams
Bun.randomUUIDv7()— time-ordered.crypto.randomUUID()— standard v4.- Stream helpers:
Bun.readableStreamToText/JSON/Bytes/Blob/Array/ArrayBuffer(stream). Bun.escapeHTML(""),Bun.stringWidth("hello").
Environment & Metadata
Bun.version,Bun.revision(git hash),Bun.env(alias forprocess.env),Bun.main(entrypoint path).import.meta.dir,import.meta.file,import.meta.path— current file info.
HTMLRewriter
- Cloudflare-compatible HTML streaming transformer. Works on
Responseobjects and strings.
Package Manager — bun install
Drop-in replacement for npm/yarn/pnpm. ~25x faster.
- Lockfile:
bun.lock(text, default since v1.2) orbun.lockb(binary). - Does NOT run
postinstallof dependencies by default (security). Add totrustedDependenciesinpackage.json
to allow.
- Workspaces supported via
package.jsonworkspacesfield. - Auto-install: when no
node_modulesfound, Bun resolves packages on the fly. bunx: execute package binaries without installing (likenpx).bun install --productionskips devDependencies.
Configuration & Compatibility
bunfig.toml sections, environment variable loading, and Node.js API compatibility details: see ${CLAUDE_SKILL_DIR}/references/config-and-compat.md.
Application
When writing Bun code:
- Apply all conventions silently — don't narrate each rule being followed.
- If an existing codebase uses Node.js patterns, follow codebase style but flag that Bun-native alternatives exist.
- For new projects, use Bun-native APIs throughout.
When reviewing Bun code:
- Cite the specific Node.js-to-Bun migration and show the fix inline.
- Don't lecture — state what's suboptimal and how to fix it.
Integration
The javascript skill governs language choices; this skill governs Bun runtime and toolchain decisions. Activate typescript alongside both when working with TypeScript.
Use Bun APIs, not Node.js polyfills. When in doubt, check if Bun has a native API.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: xobotyi
- Source: xobotyi/cc-foundry
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.