Replace standalone quality tools with Bun native commands

.bun-version

@@ -0,0 +1 @@
+1.4.4

.github/instructions/bug-fixing.instructions.md

@@ -61,8 +61,8 @@ For bugs in `tui.ts` or `api.ts` (side-effectful code), a test may not be practi
 
 ```bash
 bun test               # the previously failing test now passes; full suite still green
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no formatting diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no formatting diff
 bun run knip           # no unused exports or imports
 bun run build.ts       # binary compiles without errors
 ```

.github/instructions/documentation.instructions.md

@@ -96,7 +96,7 @@ Before opening a PR for any docs change:
 
 ```bash
 bun run docs:build           # must complete without errors or dead-link warnings
-bun run format:check         # oxfmt — no formatting diff
+bun run format:check         # bun fmt --check — no formatting diff
 ```
 
 - All internal links must resolve (VitePress reports dead links on build).

.github/instructions/github-actions.instructions.md

@@ -49,6 +49,12 @@ Actions that appear in multiple workflows (e.g. `actions/checkout`, `oven-sh/set
 always reference **the same commit SHA** across all files. Use `grep` to find all usages before
 opening a PR.
 
+Every `oven-sh/setup-bun` step must use `bun-version-file: .bun-version`, including
+release, documentation and browser-test jobs. Keep `.bun-version` at Bun 1.4.4 or
+newer: quality checks use native `bun fmt` / `bun check`, not standalone tools.
+Use `bun run typecheck` and `bun run format:check` in CI; `bun run lint` is only a
+compatibility alias for type checking, not an equivalent linter.
+
 ```bash
 grep -r "oven-sh/setup-bun" .github/workflows/
 ```

.github/instructions/implement-feature.instructions.md

@@ -58,8 +58,8 @@ Before opening the pull request, ensure every item passes:
 
 ```bash
 bun test               # all tests green
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no formatting diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no formatting diff
 bun run knip           # no unused exports or imports
 bun run build.ts       # binary compiles without errors
 ```

.github/instructions/refactoring.instructions.md

@@ -67,8 +67,8 @@ Remove dead code rather than leaving it commented out.
 
 ```bash
 bun test               # full suite passes — same behaviour before and after
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no formatting diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no formatting diff
 bun run knip           # no unused exports or imports
 bun run build.ts       # binary compiles without errors
 ```

.github/instructions/release.instructions.md

@@ -104,8 +104,8 @@ Do **not** create the GitHub Release manually — the CD pipeline handles it.
 
 ```bash
 bun test               # full suite green
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no diff
 bun run knip           # no unused exports
 bun run build.ts       # binary compiles
 ```
@@ -117,7 +117,8 @@ bun run build.ts       # binary compiles
 - [ ] `bun run docs:build` succeeds locally (spot-check the new blog entry)
   - The **version badge** in the hero (`VersionBadge.vue`) reads `version` from `package.json` at
     build time via `vite.define` — no manual update needed. It auto-points to the new blog post
-    slug (`release-vX-Y-Z`) derived from the version. Verify it shows the new version after deploy.
+    slug (`release-vX-Y-Z`) derived from the version, or to the GitHub Release page when no blog
+    post exists (e.g. patch releases). Verify it shows the new version after deploy.
 - [ ] `CHANGELOG.md` has no `_pending_` entries
 - [ ] For **major** releases: versioned docs snapshot available at `/github-code-search/vX/`
 

.github/skills/bug-fixing.md

@@ -121,8 +121,8 @@ Document manual repro steps in the PR description:
 
 ```bash
 bun test               # the previously failing test now passes; full suite still green
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no formatting diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no formatting diff
 bun run knip           # no unused exports or imports
 bun run build.ts       # binary compiles without errors
 ```

.github/skills/documentation.md

@@ -158,5 +158,5 @@ bun run docs:build:a11y      # build for a11y audit
 bun run docs:preview -- --port 4173 &
 bun run docs:a11y            # 0 pa11y violations
 bun run docs:test:responsive # 20/20 Playwright tests green
-bun run format:check         # oxfmt — no formatting diff
+bun run format:check         # bun fmt --check — no formatting diff
 ```

.github/skills/feature.md

@@ -121,8 +121,8 @@ Conventions:
 
 ```bash
 bun test               # all tests green (including new ones)
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no diff
 bun run knip           # no unused exports / imports
 bun run build.ts       # binary compiles without errors
 ```

.github/skills/github-actions.md

@@ -13,14 +13,22 @@ repository. Read this before writing or modifying any `.github/workflows/*.yaml`
     start-preview-server/     ← composite reusable action (shared server start logic)
       action.yml
   workflows/
-    ci.yaml                   ← unit tests, format, lint, knip + coverage PR comment
+    ci.yaml                   ← unit tests, native format/type checks, knip + coverage PR comment
     cd.yaml                   ← binary build + GitHub Release on tag push
     docs.yaml                 ← VitePress Pages deploy + versioned snapshot
     a11y.yaml                 ← WCAG 2.1 AA audit via pa11y-ci
     lighthouse.yaml           ← Lighthouse CI eco-design budgets + PR comment
     responsive.yaml           ← Playwright mobile viewport checks
 ```
 
+All Bun setup steps use `bun-version-file: .bun-version` (Bun 1.4.4 or newer).
+Update that single pin rather than using `latest` or per-workflow versions.
+CI and release checks use `bun run typecheck` (`bun check`) and
+`bun run format:check` (`bun fmt --check .`). `bun run lint` is retained only as a
+compatibility alias: TypeScript checking does not enforce the retired oxlint rules.
+Documentation audit path filters include `.bun-version`, `package.json` and
+`bun.lock` so runtime/dependency changes are verified too.
+
 ### Composite action: `start-preview-server`
 
 Shared by `a11y.yaml` and `responsive.yaml`. Starts `bun run docs:preview --port <port>`

.github/skills/refactoring.md

@@ -115,8 +115,8 @@ bun run knip
 
 ```bash
 bun test               # full suite passes — same behaviour before and after
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no formatting diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no formatting diff
 bun run knip           # no unused exports or imports
 bun run build.ts       # binary compiles without errors
 ```

.github/skills/release.md

@@ -77,7 +77,7 @@ Pushing `vX.Y.Z` triggers the release pipeline automatically:
 
 ## Version badge
 
-`VersionBadge.vue` reads `version` from `package.json` at build time via `vite.define`. It auto-derives the blog post slug (`release-vX-Y-Z`) from the version — no manual update needed. Verify it shows correctly after the docs deploy (~5 min after tag push).
+`VersionBadge.vue` reads `version` from `package.json` at build time via `vite.define`. It auto-derives the blog post slug (`release-vX-Y-Z`) from the version and falls back to the GitHub Release page when that post does not exist (optional for patch releases) — no manual update needed. Verify it shows correctly after the docs deploy (~5 min after tag push).
 
 ---
 
@@ -160,8 +160,8 @@ The version selector in the VitePress nav (`themeConfig.versionSelector`) reads
 
 ```bash
 bun test               # full suite green
-bun run lint           # oxlint — zero errors
-bun run format:check   # oxfmt — no diff
+bun run typecheck      # bun check — zero type errors
+bun run format:check   # bun fmt --check — no diff
 bun run knip           # no unused exports
 bun run build.ts       # binary compiles for current platform
 

.github/workflows/a11y.yaml

@@ -24,6 +24,9 @@ on:
   pull_request:
     paths:
       - "docs/**"
+      - ".bun-version"
+      - "package.json"
+      - "bun.lock"
       - ".github/workflows/a11y.yaml"
       - ".pa11yci.json"
   workflow_dispatch:
@@ -51,7 +54,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/cd.yaml

@@ -1,3 +1,5 @@
+# Validate and compile release tags for each supported target, then publish
+# the self-contained binaries and compatibility aliases in a GitHub Release.
 name: CD
 
 on:
@@ -55,11 +57,17 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Type check (bun check)
+        run: bun run typecheck
+
+      - name: Check formatting (bun fmt)
+        run: bun run format:check
+
       - name: Run tests
         run: bun test
 

.github/workflows/ci.yaml

@@ -1,3 +1,5 @@
+# Validate pull requests and manually dispatched snapshot branches with tests,
+# native Bun formatting/type checking and knip; retain the coverage PR report.
 name: CI
 
 on:
@@ -12,11 +14,20 @@ on:
   # evaluation.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
+    # Keep the existing status-check name for branch protection compatibility.
     name: Test · Format · Lint · Dead code
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
 
     steps:
@@ -26,7 +37,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -42,11 +53,11 @@ jobs:
           lcov-file: coverage/lcov.info
         continue-on-error: true
 
-      - name: Check formatting (oxfmt)
+      - name: Check formatting (bun fmt)
         run: bun run format:check
 
-      - name: Lint (oxlint)
-        run: bun run lint
+      - name: Type check (bun check)
+        run: bun run typecheck
 
       - name: Dead code detection (knip)
         run: bun run knip

.github/workflows/docs.yaml

@@ -9,6 +9,9 @@ on:
     branches: [main]
     paths:
       - "docs/**"
+      - ".bun-version"
+      - "package.json"
+      - "bun.lock"
       - ".github/workflows/docs.yaml"
     tags:
       # Glob pattern (not regex): matches v1.0.0, v2.0.0, v10.0.0 …
@@ -66,7 +69,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -158,7 +161,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/lighthouse.yaml

@@ -32,6 +32,9 @@ on:
   pull_request:
     paths:
       - "docs/**"
+      - ".bun-version"
+      - "package.json"
+      - "bun.lock"
       - ".github/workflows/lighthouse.yaml"
       - ".lhci.config.cjs"
       - "scripts/generate-lhci-report.ts"
@@ -60,7 +63,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -98,8 +101,12 @@ jobs:
       # Uses marocchino/sticky-pull-request-comment which upserts the comment
       # (one create, then updates on every subsequent push to the PR).
       # Reads the report written by the previous step via the `path:` input.
+      # continue-on-error: fork PRs get a read-only GITHUB_TOKEN, so posting the
+      # comment can fail even when the audit passes. The job summary and the
+      # "Fail if LHCI assertions failed" step below still reflect the result.
       - name: Post / update Lighthouse report on PR
         if: github.event_name == 'pull_request'
+        continue-on-error: true
         uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: lighthouse-ci

.github/workflows/responsive.yaml

@@ -8,6 +8,9 @@ on:
   pull_request:
     paths:
       - "docs/**"
+      - ".bun-version"
+      - "package.json"
+      - "bun.lock"
       - "playwright.config.ts"
       - "scripts/responsive.pw.ts"
       - ".github/workflows/responsive.yaml"
@@ -28,6 +31,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
 
       - name: Install dependencies
         run: bun install --frozen-lockfile