You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
"deno is to go and bun is the way we are going, put it first everywhere unless not possible and explain why if not"
This repo's .claude/CLAUDE.md is what an agent reads first. Correcting hyperpolymath/standards (#655) fixes one copy of ~372 — agents read the local one.
What this PR actually changes
Every line below was verified present in this PR's own diff — nothing is claimed that isn't here.
change
in this diff
ALLOWED: Deno row → Bun, tier 1
✅
BANNED: | Bun | Deno | row removed
✅
BANNED: Deno added, replacement Bun
✅
BANNED: Node.js/npm/pnpm/yarn → Bun
✅
rule: manifest now required (package.json + bun.lock)
✅
rule: bun install --production replaces the node_modules rule
✅
pkg mgmt: JS deps → Bun, bunx --no-install --bun
✅
repaired blanking scar: Only where cannot → Only where AffineScript cannot
✅
repaired blanking scar: | **** | → AffineScript
✅
⚠ An earlier revision of this description listed blanking-scar repairs generically, including some this repo did not need. codacy-production correctly flagged that as a description/diff mismatch. The table above is now generated from the diff itself.
Review feedback addressed
No TypeScript at all (codacy raised the contradiction; the owner then ruled it outright). The Bun row advertised "Executes .ts directly" inside a file that bans TypeScript. Owner ruling: TypeScript should not exist at all — so every .ts reference is gone from the row, including JS/TS in its label. It now reads JS runtime, running compiled ESM/JS.
Deno missing from BANNED (codacy): added — the ruling was only half expressed without it.
Unpinned bunx (coderabbitai, Security & Privacy): a bare bunx <tool> can fetch a package outside bun.lock and can start Node via a shebang. Guidance now requires a declared devDependency plus bunx --no-install --bun.
Not taken:"a npm-compatible" (LanguageTool is wrong — "an" is correct before a vowel sound); "--frozen-lockfile is redundant" (correct, and no such flag was added); the Nix → Guix point (real, but a separate ruling — deliberately not folded into a Deno/Bun change).
Scope
Policy text only — no code, no workflows, no build files.
Related: #655 (governing document), #658 (Deno→Bun assessment: 18 repos blocked on @affinescript/* npm packages that do not exist), #659 (policy duplicated into ~372 copies).
Owner ruling 2026-08-26: "deno is to go and bun is the way we are going, put it
first everywhere unless not possible and explain why if not".
This file is what an agent reads FIRST and it listed Bun as BANNED with Deno as
its replacement. Correcting hyperpolymath/standards (#655) fixes one copy of
~372 - agents read the local one. This is that local copy.
ALLOWED **Deno** "Replaces Node/npm/bun" -> **Bun** tier 1
BANNED | Bun | Deno | -> row REMOVED
BANNED Node.js / npm / pnpm/yarn -> Deno -> -> Bun
rule "No package.json for runtime deps - use deno.json imports"
-> Use package.json + bun.lock; a manifest is REQUIRED
rule "No node_modules in production"
-> bun install --production, pinned via bun.lock
pkg JS deps: Deno -> JS deps: Bun (package.json + bun.lock), bunx
WHY THE MANIFEST RULE MATTERS MOST. "No package.json for runtime deps" did not
express a preference - it told repos not to declare their dependencies at all.
hyperpolymath/ubicity imported zod and glob, shipped NO manifest of any kind,
and could not build under ANY toolchain. Fixed in ubicity#107; the rule that
caused it is fixed here.
ALSO REPAIRED - blanking scars from the ReScript purge, which substituted the
token with an EMPTY STRING rather than removing the text:
| | AffineScript | -> | ReScript | AffineScript |
1. **No new files** ... -> **No new ReScript files** ...
| **JavaScript** | Only where cannot | -> Only where AffineScript cannot
Restoring the NAME in a policy table does not reintroduce the language. Same
root cause as the rm -rf /lib found in wordpress-tools#62.
Policy text only - no code, no workflows, no build files. 1 file(s).
NOT FOLDED IN: "Fallback: Nix (flake.nix)" is stale (Guix superseded Nix per
ADR-2026-STACK-MIGRATION) but that is a separate ruling; flagged, not changed.
Reviewing files that changed from the base of the PR and between 2385518 and c5726c0.
📒 Files selected for processing (1)
.claude/CLAUDE.md
📝 Walkthrough
Summary by CodeRabbit
Chores
Updated tooling guidance to use Bun as the standard runtime and package manager.
Added requirements for package.json and bun.lock manifests.
Updated installation and package management instructions to use Bun commands.
Clarified supported and prohibited JavaScript tooling.
Walkthrough
The project guidance changes the JavaScript toolchain from Deno to Bun. It updates allowed and banned tools, manifest requirements, frozen installation rules, and commands for running development tools.
Changes
Bun policy migration
Layer / File(s)
Summary
Runtime and dependency guidance .claude/CLAUDE.md
The guidance defines Bun as the default runtime and package manager. It updates JavaScript and AffineScript references, bans ReScript and legacy tools, requires package.json with bun.lock, and specifies frozen production installation and bunx tool execution.
A rabbit hops where Deno ran,
Bun now guides the build plan. bun.lock rests beside the chart,
Frozen installs do their part.
Tools start clean, with paths in view,
The rabbit says, “Bun will do!”
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR updates the .claude/CLAUDE.md policy to establish Bun as the Tier 1 JS/TS runtime, replacing Deno and mandating the use of package.json and bun.lock (or bun.lockb). Codacy results indicate the PR is up to standards with no new quality issues detected.
There are significant alignment gaps regarding the 'ReScript' restoration mentioned in the PR description; Rule #1 still refers to TypeScript instead of ReScript as claimed. Furthermore, the instructions for Bun on line 27 introduce logic contradictions by mentioning direct .ts execution and a 'no build step' environment, which conflict with the project's explicit ban on TypeScript and the requirement to compile AffineScript to ESM. These issues should be resolved to ensure the AI assistant receives clear, non-contradictory instructions.
About this PR
The PR does not fully implement the restoration of ReScript labels described in the PR summary. Rule #1 and the policy tables still lack the promised ReScript entries, which may leave the 'blanking scars' unaddressed.
Test suggestions
Verify Bun is listed as Tier 1 in the ALLOWED table
Verify Deno is replaced by Bun in the BANNED tools mapping
Verify requirement for package.json and bun.lock is explicitly stated in Enforcement Rules
Verify restoration of ReScript labels in policy tables (as claimed in description)
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify restoration of ReScript labels in policy tables (as claimed in description)
| **AffineScript** | Primary application code | Affine-typed, compiles to typed-wasm or ESM |
| **Bun** | JS/TS runtime & package management (tier 1) | Default for all new work. Executes `.ts` directly, no build step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
The mention of direct .ts execution and 'no build step' contradicts the project-wide TypeScript ban (line 45) and the requirement to compile AffineScript (line 26). This ambiguity can lead to the generation of prohibited code or the omission of necessary build steps. Additionally, the policy refers to 'bun.lock', whereas Bun's default binary lockfile is 'bun.lockb'.
Try running the following prompt in your coding agent:
In .claude/CLAUDE.md, replace all occurrences of 'bun.lock' with 'bun.lockb'. Then, revise the notes for Bun on line 27 to remove references to '.ts' execution and 'no build step' to align with the TypeScript ban and the AffineScript compilation requirement.
Review feedback from codacy-production and coderabbitai on the policy wave.
Three substantive points, all accepted:
1. ".ts CONTRADICTION" (codacy, MEDIUM, raised on most of the wave). The Bun row
said "Executes .ts directly, no build step" in a file whose BANNED table bans
TypeScript. OWNER RULING: TypeScript "should not exist at all", so advertising
Bun's TypeScript capability is wrong regardless of whether it is true. Every
.ts reference is removed from the row, including "JS/TS" in its label.
2. "DENO MISSING FROM BANNED" (codacy, raised repeatedly). The wave removed Deno
from ALLOWED but never added it to BANNED, so the ruling was only half
expressed. Added | Deno | Bun |.
3. "UNPINNED bunx" (coderabbitai, Security & Privacy). A bare `bunx <tool>` can
fetch a package outside package.json/bun.lock, and can start Node via a
shebang - both contrary to estate SHA-pinning doctrine and the Node ban.
Guidance now requires a declared devDependency plus
`bunx --no-install --bun <tool>`.
NOT taken: "a npm-compatible" (LanguageTool is wrong, "an" is correct before a
vowel sound); "--frozen-lockfile is redundant" (correct - no change needed, and
none made); the Nix->Guix point (real, but a separate ruling, deliberately not
folded into a Deno/Bun change).
Addresses the two live static-analysis findings on this PR.
ReScript was absent from the BANNED table although canon bans it (destination
AffineScript), so the table read as permitting it.
Enforcement Rule 3 said `bun install --production` with no `--frozen-lockfile`,
so a lockfile mismatch silently re-resolved instead of failing, which defeats
the point of committing `bun.lock`.
Enforcement Rule 1 is deliberately untouched: standards#655 records that
collision as not resolvable unilaterally.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Owner ruling, 2026-08-26:
This repo's
.claude/CLAUDE.mdis what an agent reads first. Correctinghyperpolymath/standards(#655) fixes one copy of ~372 — agents read the local one.What this PR actually changes
Every line below was verified present in this PR's own diff — nothing is claimed that isn't here.
| Bun | Deno |row removedpackage.json+bun.lock)bun install --productionreplaces the node_modules rulebunx --no-install --bunOnly where cannot→ Only where AffineScript cannot| **** |→ AffineScriptReview feedback addressed
.tsdirectly" inside a file that bans TypeScript. Owner ruling: TypeScript should not exist at all — so every.tsreference is gone from the row, including JS/TS in its label. It now reads JS runtime, running compiled ESM/JS.bunx(coderabbitai, Security & Privacy): a barebunx <tool>can fetch a package outsidebun.lockand can start Node via a shebang. Guidance now requires a declared devDependency plusbunx --no-install --bun.Not taken: "a npm-compatible" (LanguageTool is wrong — "an" is correct before a vowel sound); "
--frozen-lockfileis redundant" (correct, and no such flag was added); the Nix → Guix point (real, but a separate ruling — deliberately not folded into a Deno/Bun change).Scope
Policy text only — no code, no workflows, no build files.
Related: #655 (governing document), #658 (Deno→Bun assessment: 18 repos blocked on
@affinescript/*npm packages that do not exist), #659 (policy duplicated into ~372 copies).