Bun 1.4.2 everywhere CI and setup pin the tested version

Bun 1.4.0 on Windows aborts about 3% of free-suite shards with native
bad-handle errors (main too; #3037); the same head on 1.4.2 had none in 180
shard runs. Every current 1.4.0 pin moves together, as bun-version-drift
requires: setup-bun in every workflow (CSO orchestration included), the eval
image (sha256 from bun-v1.4.2's SHASUMS256.txt, re-hashed locally), GitLab,
the Ubicloud free-suite setup, gstack-bun-version.sh's tested version,
engines.bun and @types/bun, the install hint in generated skills, the Dia and
cookie native-qualification pins, and docs and tests that state the current
pin. Recorded 1.4.0 observations, fixtures, CHANGELOG history and the CSO
images' oven/bun:1.3.10 base stay.

.github/scripts/dia-launch-driver.mjs

@@ -46,7 +46,7 @@ export function compareDiaLaunchReceipts(left, right) {
       || qualification.isolation?.sharedRegisteredHome !== true || qualification.artifact?.signatureVerified !== true
       || qualification.artifact?.gatekeeperNotarized !== true || qualification.artifact?.macosCompatibility?.compatible !== true
       || qualification.platform?.os !== 'darwin' || qualification.platform?.architecture !== 'arm64'
-      || qualification.platform?.bun !== '1.4.0' || qualification.platform?.playwright !== '1.62.1'
+      || qualification.platform?.bun !== '1.4.2' || qualification.platform?.playwright !== '1.62.1'
       || !/^\d+(?:\.\d+){1,2}$/.test(qualification.artifact.macosCompatibility.hostVersion)
       || qualification.artifact?.architectures?.includes('arm64') !== true
       || ['serviceStopped', 'userDomainStopped', 'userProcessesStopped', 'accountRemoved', 'groupRemoved', 'stagingRemoved'].some(key => receipt.launcherCleanup?.[key] !== true)
@@ -63,7 +63,7 @@ export function compareDiaLaunchReceipts(left, right) {
         || policy?.mockKeychainFlag !== false || policy?.passwordStoreFlag !== false || policy?.firstRunSuppressed !== false
         || policy?.headlessFlag !== true || policy?.expectedProfile !== true || policy?.detached !== true || policy?.shellDisabled !== true
         || policy?.stdioCount !== 5 || policy?.extraPipeDescriptors !== true || policy?.profileArgumentCount !== 1
-        || result.driver?.runtime !== runtime || result.driver?.version !== (runtime === 'bun' ? '1.4.0' : '24.18.0')
+        || result.driver?.runtime !== runtime || result.driver?.version !== (runtime === 'bun' ? '1.4.2' : '24.18.0')
         || result.driver?.os !== 'darwin' || result.driver?.architecture !== 'arm64' || result.driver?.playwright !== '1.62.1'
         || result.driver?.release !== qualification.platform.release
         || result.driver?.executableSha256 !== config.executableSha256 || result.driver?.driverSha256 !== config.driverSha256
@@ -176,7 +176,7 @@ async function main() {
   const account = readFreshAccountConfiguration(process.argv[2], 'comparison-driver');
   const config = account.launchComparison;
   const runtimeVersion = process.versions.bun ?? process.versions.node;
-  if ((config.runtime === 'bun' ? process.versions.bun !== '1.4.0' : Boolean(process.versions.bun) || runtimeVersion !== '24.18.0')
+  if ((config.runtime === 'bun' ? process.versions.bun !== '1.4.2' : Boolean(process.versions.bun) || runtimeVersion !== '24.18.0')
     || process.arch !== 'arm64' || require('playwright/package.json').version !== '1.62.1') throw new Error('invalid_driver_runtime');
   if (await sha256(process.execPath) !== config.executableSha256 || await sha256(import.meta.filename) !== config.driverSha256
     || await sha256(path.join(import.meta.dirname, 'qualify-dia-macos.ts')) !== config.helpersSha256) throw new Error('driver_inputs_changed');

.github/scripts/qualify-dia-macos.ts

@@ -179,7 +179,7 @@ export async function runDiaLaunchComparison(account: FreshAccount, purpose: 'co
       'argvSha256', 'environmentSha256', 'rootCount', 'launchAttempts', 'rootsBeforeCleanup', 'stderrBeforeCleanup', 'stderrAfterCleanup', 'rootsAfterCleanup', 'driver'];
     if (!response || !safeDiaComparisonResponse(response) || Object.keys(response).some(key => !keys.includes(key)) || response.protocol !== 1 || response.purpose !== purpose
       || response.samplingEnabled !== false || response.driver?.runtime !== config.runtime
-      || response.driver?.version !== (config.runtime === 'bun' ? '1.4.0' : '24.18.0') || response.driver?.architecture !== 'arm64'
+      || response.driver?.version !== (config.runtime === 'bun' ? '1.4.2' : '24.18.0') || response.driver?.architecture !== 'arm64'
       || response.driver?.os !== 'darwin' || response.driver?.playwright !== '1.62.1'
       || response.driver?.executableSha256 !== config.executableSha256 || response.driver?.driverSha256 !== config.driverSha256
       || response.driver?.helpersSha256 !== config.helpersSha256 || typeof response.ready !== 'boolean'
@@ -931,7 +931,7 @@ export async function qualifyDia(isolation: { root: string; configFile: string }
   validateQualificationHost(process.env);
   const account = readFreshAccountConfiguration(isolation.configFile);
   if (account.guiReadiness || !account.destinationExecutable || !account.destinationSha256) throw new Error('browser_qualification_authority_required');
-  if (Bun.version !== '1.4.0' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
+  if (Bun.version !== '1.4.2' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
   const runnerTemp = realpathSync(process.env.RUNNER_TEMP!);
   const output = path.join(runnerTemp, 'dia-native-qualification.json');
   if (existsSync(output)) throw new Error('fresh_receipt_path_required');
@@ -1383,7 +1383,7 @@ if (import.meta.main) {
       if (process.argv[2] !== '--fresh-account' || !process.argv[3]) throw new Error('fresh_account_configuration_required');
       const account = readFreshAccountConfiguration(process.argv[3]);
       if (account.guiReadiness) throw new Error('browser_qualification_authority_required');
-      if (Bun.version !== '1.4.0' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
+      if (Bun.version !== '1.4.2' || require('playwright/package.json').version !== '1.62.1') throw new Error('pinned_runtimes_required');
       const originalHome = account.home;
       const originalHomeEnvironment = process.env.HOME;
       const runnerTemp = realpathSync(process.env.RUNNER_TEMP!);

.github/scripts/run-dia-native-qualification.ts

@@ -406,7 +406,7 @@ async function freshWorker(configFile: string) {
     if (await digest(account.bun) !== account.bunSha256 || await digest(account.destinationExecutable) !== account.destinationSha256) throw new Error('staged_executable_changed');
     receipt.reason = 'fresh_dependency_install';
     run(account.bun, ['install', '--frozen-lockfile', '--ignore-scripts'], 180_000);
-    if (Bun.version !== '1.4.0' || require(path.join(account.snapshot, 'node_modules/playwright/package.json')).version !== '1.62.1') throw new Error('pinned_runtime_mismatch');
+    if (Bun.version !== '1.4.2' || require(path.join(account.snapshot, 'node_modules/playwright/package.json')).version !== '1.62.1') throw new Error('pinned_runtime_mismatch');
     mkdirSync(probe, { mode: 0o700 });
     receipt.reason = 'background_keychain_preflight';
     snapshot = captureUserKeychains(env, [account.home, account.temporary]);
@@ -538,7 +538,7 @@ export async function runFreshAccountQualification(comparisonRuntime?: 'bun' | '
   validateQualificationHost(process.env);
   if (comparisonRuntime !== undefined && !['bun', 'node'].includes(comparisonRuntime)) throw new Error('invalid_comparison_runtime');
   if (guiReadinessOnly && comparisonRuntime !== undefined) throw new Error('conflicting_diagnostic_modes');
-  if (process.getuid?.() === 0 || Bun.version !== '1.4.0') throw new Error('run_as_unprivileged_pinned_ci_runner');
+  if (process.getuid?.() === 0 || Bun.version !== '1.4.2') throw new Error('run_as_unprivileged_pinned_ci_runner');
   const outputRoot = realpathSync(process.env.RUNNER_TEMP!);
   const output = path.join(outputRoot, 'dia-native-qualification.json');
   if (existsSync(output)) throw new Error('fresh_output_required');