AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Bun

skill-xobotyi-cc-foundry-bun · by xobotyi

>-

No reviews yet
0 installs
31 views
0.0% view→install

Install

$ agentstack add skill-xobotyi-cc-foundry-bun

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access Used
  • Filesystem access No
  • Shell / process execution Used
  • Environment & secrets Used
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-xobotyi-cc-foundry-bun)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
2mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Bun? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Bun

Use Bun APIs, not Node.js polyfills. If Bun provides a native API for it, use it.

Bun is a batteries-included JavaScript runtime. It replaces Node.js, npm, Jest, and webpack with a single tool. Prefer Bun-native APIs (Bun.serve, Bun.file, Bun.$, bun:sqlite, bun:test) over Node.js equivalents unless portability is an explicit requirement.

References

  • HTTP server — [${CLAUDE_SKILL_DIR}/references/server.md]: Route types, file response patterns, WebSocket

pub/sub, server config

  • File I/O and processes — [${CLAUDE_SKILL_DIR}/references/io-and-processes.md]: File I/O details, shell API,

child processes, workers

  • Testing — [${CLAUDE_SKILL_DIR}/references/testing.md]: Test modifiers, parametrized tests, mocking, snapshots,

CLI flags

  • SQLite, bundler, plugins — [${CLAUDE_SKILL_DIR}/references/ecosystem.md]: SQLite API, bundler options, plugins,

macros

  • Configuration — [${CLAUDE_SKILL_DIR}/references/config-and-compat.md]: bunfig.toml sections, Node.js

compatibility, env vars

Prefer Bun-Native APIs

Rule: if Bun.* or bun:* has it, use it. Fall back to node:* only when there's no Bun-native alternative or when portability to Node.js is required.

Core mappings: Bun.serve() over http.createServer(), Bun.file()/Bun.write() over node:fs, Bun.$ over child_process.exec, bun:sqlite over better-sqlite3, bun:test over Jest/Vitest, Bun.password over bcrypt, Bun.sleep() over setTimeout wrappers, Bun.spawn() over child_process.spawn. Use node:fs for directory ops — no Bun API yet. Use Web Streams API over node:stream.

Full API preference table: see ${CLAUDE_SKILL_DIR}/references/io-and-processes.md.

HTTP Server

Routing

  • Use routes object (v1.2.3+) for declarative path matching. Preferred over fetch-based routing.
  • Route types: exact ("/users/all", highest priority), parameterized ("/users/:id", req.params.id), wildcard

("/api/*"), per-method ({ GET: handler, POST: handler }).

  • Precedence: exact > parameterized > wildcard > global catch-all.
  • fetch handler as fallback for unmatched routes, not primary routing.
  • Always implement error handler in Bun.serve().
  • development: true in dev for built-in error pages.

Static Responses

  • Use static Response objects for health checks, redirects, fixed JSON — they are zero-allocation after init,

cached for server lifetime.

  • Call server.reload() to update static responses at runtime.

Request Object

  • Route handlers receive BunRequest (extends Request) with params (auto URL-decoded) and cookies

(auto-tracked CookieMap).

  • TypeScript infers param shape when route is a string literal.
  • Cookie changes are auto-trackedSet-Cookie headers added automatically when using req.cookies.set() /

.delete().

WebSocket

  • Upgrade via server.upgrade(req, { data }) in the fetch handler.
  • Use native pub/sub for topic-based broadcasting: ws.subscribe("topic"), ws.publish("topic", data).
  • Type ws.data via the data property on the websocket handler object.

WebSocket limits, server configuration, file response patterns, HTML imports, and server lifecycle details: see ${CLAUDE_SKILL_DIR}/references/server.md.

File I/O

  • Bun.file() is lazy. Creating a BunFile does not read from disk. It conforms to Blob.
  • Read with .text(), .json(), .bytes(), .stream(), .arrayBuffer() on BunFile.
  • Check existence: await file.exists(). Access file.size and file.type.
  • Bun.write() handles all types — string, Blob, Response, ArrayBuffer, BunFile. Uses fastest syscall per platform

(copy_file_range, sendfile, clonefile).

  • Incremental writing: use file.writer() (FileSink). Call .flush() to flush buffer, .end() to flush + close

(required to let process exit).

  • Built-in stdio references: Bun.stdin (readonly), Bun.stdout, Bun.stderr.
  • Use node:fs for directory opsmkdir, readdir. No Bun-specific API yet.
  • import.meta.dir gives the directory of the current file.

Shell API — Bun.$

Cross-platform bash-like shell with JavaScript interop. Runs in-process (not /bin/sh).

  • $ tagged template for shell commands. Interpolated values are auto-escaped — injection-safe by default.
  • Read output: .text() (string, auto-quiets), .json() (parsed), .lines() (async iterator), .blob(), or

await $\...\`for{ stdout, stderr }` Buffers.

  • .quiet() to suppress stdout/stderr output.
  • Non-zero exit codes throw ShellError by default. Use .nothrow() to handle exit codes manually. Configure

globally: $.nothrow() or $.throws(false).

  • Piping and redirection work: |, >, 2>&1, ({ ... }))** for module mocking. Works for ESM and CJS.

Test modifiers, parametrized tests, mocking details, snapshots, CLI flags, and bunfig.toml test config: see ${CLAUDE_SKILL_DIR}/references/testing.md.

SQLite, Bundler, Plugins, Macros

  • SQLite: use bun:sqlite — native, synchronous, 3-6x faster than better-sqlite3. Enable WAL mode. Use prepared

statements and transactions.

  • Bundler: Bun.build() with targets "bun", "browser", "node". Check result.success and iterate

result.logs on failure.

  • Plugins: Bun.plugin() with setup(build) — extend module resolver and loader. Register via bunfig.toml

preload.

  • Macros: compile-time code execution via { type: "macro" } import. Return value inlined; must be

JSON-serializable.

Full SQLite API, bundler options, plugin patterns, and macro constraints: see ${CLAUDE_SKILL_DIR}/references/ecosystem.md.

Utilities

Hashing & Passwords

  • Bun.password.hash(pw) — argon2id default. Also supports "bcrypt".
  • Bun.password.verify(pw, hash) — auto-detects algorithm.
  • Bun.hash("data") — fast non-crypto (Wyhash).
  • new Bun.CryptoHasher("sha256") — crypto hashing.

Sleep & Timing

  • await Bun.sleep(ms) — async. Bun.sleepSync(ms) — blocking.
  • Bun.nanoseconds() — high-resolution timer.

Comparison & Inspection

  • Bun.deepEquals(a, b) — deep equality. Bun.deepMatch(subset, obj) — partial match.
  • Bun.inspect(obj)console.log format as string. Bun.peek(promise) — read without awaiting.

Compression

  • Gzip: Bun.gzipSync(data) / Bun.gunzipSync(data).
  • Deflate: Bun.deflateSync(data) / Bun.inflateSync(data).
  • Zstd: Bun.zstdCompressSync(data) / Bun.zstdDecompressSync(data).

Paths, UUIDs, Streams

  • Bun.randomUUIDv7() — time-ordered. crypto.randomUUID() — standard v4.
  • Stream helpers: Bun.readableStreamToText/JSON/Bytes/Blob/Array/ArrayBuffer(stream).
  • Bun.escapeHTML(""), Bun.stringWidth("hello").

Environment & Metadata

  • Bun.version, Bun.revision (git hash), Bun.env (alias for process.env), Bun.main (entrypoint path).
  • import.meta.dir, import.meta.file, import.meta.path — current file info.

HTMLRewriter

  • Cloudflare-compatible HTML streaming transformer. Works on Response objects and strings.

Package Manager — bun install

Drop-in replacement for npm/yarn/pnpm. ~25x faster.

  • Lockfile: bun.lock (text, default since v1.2) or bun.lockb (binary).
  • Does NOT run postinstall of dependencies by default (security). Add to trustedDependencies in package.json

to allow.

  • Workspaces supported via package.json workspaces field.
  • Auto-install: when no node_modules found, Bun resolves packages on the fly.
  • bunx: execute package binaries without installing (like npx).
  • bun install --production skips devDependencies.

Configuration & Compatibility

bunfig.toml sections, environment variable loading, and Node.js API compatibility details: see ${CLAUDE_SKILL_DIR}/references/config-and-compat.md.

Application

When writing Bun code:

  • Apply all conventions silently — don't narrate each rule being followed.
  • If an existing codebase uses Node.js patterns, follow codebase style but flag that Bun-native alternatives exist.
  • For new projects, use Bun-native APIs throughout.

When reviewing Bun code:

  • Cite the specific Node.js-to-Bun migration and show the fix inline.
  • Don't lecture — state what's suboptimal and how to fix it.

Integration

The javascript skill governs language choices; this skill governs Bun runtime and toolchain decisions. Activate typescript alongside both when working with TypeScript.

Use Bun APIs, not Node.js polyfills. When in doubt, check if Bun has a native API.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.