Switch to Bun for dependency installs, fix RESEARCH env typos, allow X/Twitter URLs

[jongan69]

Summary

• Dockerfile: install Bun (curl script, symlinked into /usr/local/bin) and replace npm install --production with bun install --frozen-lockfile --production; copy bun.lock instead of package-lock.json. Node remains the runtime for scripts/web/server.mjs.
• scripts/deploy/oracle-setup.sh: install Bun on first run if missing, then use the same frozen-lockfile production install.
• .env.example: fix RESEACH_* -> RESEARCH_* for all research settings so example values match the env vars actually read by scripts/ai-config.mjs and scripts/doctor.mjs (previously the example values were silently ignored).
• scripts/web/security.mjs + .env.example: add X/Twitter (x.com, twitter.com with www variants) to the video host allowlist.
• scripts/pipeline.mjs: const -> let for domain before the fallback reassignment.

Audit notes

• bun.lock is committed; package-lock.json no longer exists, matching the new copy/install steps.
• curl and ca-certificates were already installed in the Dockerfile apt layer, so the Bun install script works.
• Host allowlist validation does exact-hostname matching; the new entries follow the same pattern as existing YouTube/Vimeo entries. yt-dlp supports X/Twitter URLs natively.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f00df03-7200-473d-b7aa-150fc08a495d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}