Fix: Updated to bun 1.4.0

Fixed bun 1.4.0 issues
Pinned CI and build to bun 1.4.0

Author: TriDefender

.github/workflows/ci.yml

@@ -28,7 +28,11 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1"
+          # PINNED: a floating "latest" silently drifted the release runtime
+          # away from local dev (v4.5.2 exe = Bun 1.4.0 keep-alive timer
+          # semantics local 1.3.14 never exercised — see AGENTS.md #37).
+          # Bump deliberately, together with local dev environments.
+          bun-version: "1.4.0"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/release.yml

@@ -54,7 +54,10 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1"
+          # PINNED (keep all 3 jobs + ci.yml in sync): the release runtime
+          # must not drift from dev/CI — a floating "latest" shipped v4.5.2
+          # on Bun 1.4.0 semantics local 1.3.14 never exercised (AGENTS.md #37).
+          bun-version: "1.4.0"
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Type check
@@ -83,7 +86,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1"
+          bun-version: "1.4.0" # pinned — see verify job comment
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Build binary
@@ -105,7 +108,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1"
+          bun-version: "1.4.0" # pinned — see verify job comment
       - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:

src/proxy/captcha-happy.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { makeDualConsole } from "./captcha-happy.js";
+import {
+  installGlobalWindowAlias,
+  makeDualConsole,
+  makeDualTimers,
+  removeGlobalWindowAlias,
+} from "./captcha-happy.js";
 
 describe("dual console (guest spam guard)", () => {
   test("drops every console method's call while the guest predicate holds", () => {
@@ -34,3 +39,136 @@ describe("dual console (guest spam guard)", () => {
     }
   });
 });
+
+describe("dual timers (host unref contract vs guest window registry)", () => {
+  type Fn = (...args: unknown[]) => unknown;
+
+  function makeFixture() {
+    const hostCalls: string[] = [];
+    const winCalls: string[] = [];
+    const hostTimer = { unref() {}, ref() {} };
+    const host: Record<string, Fn> = {
+      setTimeout: (...a: unknown[]) => { hostCalls.push("setTimeout:" + a[1]); return hostTimer; },
+      setInterval: (...a: unknown[]) => { hostCalls.push("setInterval:" + a[1]); return hostTimer; },
+      clearTimeout: (...a: unknown[]) => { hostCalls.push("clearTimeout"); },
+      clearInterval: (...a: unknown[]) => { hostCalls.push("clearInterval"); },
+    };
+    const win: Record<string, unknown> = {
+      setTimeout: (...a: unknown[]) => { winCalls.push("setTimeout:" + a[1]); return 0; },
+      setInterval: (...a: unknown[]) => { winCalls.push("setInterval:" + a[1]); return 0; },
+      clearTimeout: (...a: unknown[]) => { winCalls.push("clearTimeout"); },
+      clearInterval: (...a: unknown[]) => { winCalls.push("clearInterval"); },
+    };
+    return { host, win, hostCalls, winCalls, hostTimer };
+  }
+
+  test("host-stack calls keep the host timer objects (the .unref() contract)", () => {
+    const { host, win, hostCalls, winCalls, hostTimer } = makeFixture();
+    const dual = makeDualTimers(win, host, () => false);
+    const t = dual.setTimeout(() => {}, 500) as { unref(): void };
+    expect(hostCalls).toEqual(["setTimeout:500"]);
+    expect(winCalls).toEqual([]);
+    expect(t).toBe(hostTimer);
+    expect(typeof t.unref).toBe("function");
+    dual.clearTimeout(t);
+    expect(hostCalls).toEqual(["setTimeout:500", "clearTimeout"]);
+  });
+
+  test("guest-stack calls land on the window registry, reading it live", () => {
+    const { host, win, hostCalls, winCalls } = makeFixture();
+    const dual = makeDualTimers(win, host, () => true);
+    expect(dual.setTimeout(() => {}, 16)).toBe(0);
+    // Guest hooks of window.setTimeout apply to guest callers (pe-VM
+    // scheduler behavior), including hooks installed AFTER the dual was
+    // built — the window function is resolved per call.
+    win.setTimeout = () => 42;
+    expect(dual.setTimeout(() => {}, 1)).toBe(42);
+    expect(hostCalls).toEqual([]);
+    expect(winCalls).toEqual(["setTimeout:16"]);
+  });
+
+  test("the crash shape: a window timer without unref never reaches host callers", () => {
+    const { host, win } = makeFixture();
+    // Simulate the v4.5.2 field crash preconditions: the pe-VM hooks the
+    // window's setTimeout into a wrapper that loses the handle, and Bun's
+    // node:_http_server finishes a response and arms its keep-alive timer
+    // through the aliased global setTimeout, then calls .unref() on the
+    // result.
+    win.setTimeout = (() => 0) as unknown;
+    const dual = makeDualTimers(win, host, () => false);
+    const timer = dual.setTimeout(() => {}, 5000) as { unref?: () => void };
+    expect(typeof timer?.unref).toBe("function");
+    expect(() => timer.unref!()).not.toThrow();
+  });
+
+  test("dispatchers look native to guest toString sweeps", () => {
+    const { host, win } = makeFixture();
+    const dual = makeDualTimers(win, host, () => false);
+    expect(dual.setTimeout.name).toBe("setTimeout");
+    expect(String(dual.setTimeout)).toBe("function setTimeout() { [native code] }");
+    expect(String(dual.clearInterval)).toBe("function clearInterval() { [native code] }");
+  });
+});
+
+describe("alias lifecycle (install/remove descriptor contract)", () => {
+  const TIMER_PROPS = ["setTimeout", "setInterval", "clearTimeout", "clearInterval"];
+
+  function makeSandbox() {
+    // Sentinel the pristine host fns return — the dual's host lane must
+    // surface it untouched even when the window's timers are hostile.
+    const pristine = { marker: "pristine-host-timer" };
+    const g: Record<string, unknown> = {};
+    for (const p of TIMER_PROPS) {
+      g[p] = () => pristine;
+    }
+    // Window stub whose timers are hooked/lossy (pe-VM scheduler shape).
+    const w: Record<string, unknown> = {
+      setTimeout: () => 0,
+      setInterval: () => 0,
+      clearTimeout: () => {},
+      clearInterval: () => {},
+    };
+    return { g, w, pristine };
+  }
+
+  test("host lane serves the PRISTINE timers, not the generic-alias getters (capture-order regression)", () => {
+    const { g, w, pristine } = makeSandbox();
+    installGlobalWindowAlias(g, w);
+    // A host-stack call (this test's stack has no guest CDN frames) through
+    // the aliased global must return the pristine fn's return value. Under
+    // the capture-order bug the host lane fell back to g[prop], which the
+    // generic props loop had already turned into a window-forwarding
+    // accessor — this would read 0 from the hooked window stub instead.
+    const hostLane = g.setTimeout as (...a: unknown[]) => unknown;
+    expect(hostLane(() => {}, 1)).toBe(pristine);
+    removeGlobalWindowAlias(g, w);
+  });
+
+  test("remove restores the pre-install descriptors byte-identically", () => {
+    const { g, w } = makeSandbox();
+    const before = Object.fromEntries(
+      TIMER_PROPS.map((p) => [p, Object.getOwnPropertyDescriptor(g, p)]),
+    );
+    installGlobalWindowAlias(g, w);
+    expect(Object.getOwnPropertyDescriptor(g, "setTimeout")?.get).toBeDefined();
+    removeGlobalWindowAlias(g, w);
+    for (const p of TIMER_PROPS) {
+      expect(Object.getOwnPropertyDescriptor(g, p)).toEqual(before[p]);
+      expect(g[p]).toBe(before[p]!.value);
+    }
+  });
+
+  test("concurrent installs restore exactly once, on the last remove", () => {
+    const { g } = makeSandbox();
+    const w1: Record<string, unknown> = { setTimeout: () => 1, setInterval: () => 1, clearTimeout: () => {}, clearInterval: () => {} };
+    const w2: Record<string, unknown> = { setTimeout: () => 2, setInterval: () => 2, clearTimeout: () => {}, clearInterval: () => {} };
+    const orig = g.setTimeout;
+    installGlobalWindowAlias(g, w1);
+    installGlobalWindowAlias(g, w2);
+    removeGlobalWindowAlias(g, w1); // refcount 2→1: no restore yet
+    expect(typeof Object.getOwnPropertyDescriptor(g, "setTimeout")?.get).toBe("function");
+    expect(g.setTimeout).not.toBe(orig);
+    removeGlobalWindowAlias(g, w2); // refcount 1→0: restore
+    expect(g.setTimeout).toBe(orig);
+  });
+});

src/proxy/captcha-happy.ts

@@ -924,8 +924,11 @@ function applyPolyfills(w) {
       interval = 16;
     };
 
-  w.requestIdleCallback = w.requestIdleCallback || ((cb) => setTimeout(() => cb({ didTimeout: false, timeRemaining: () => 10 }), 1));
-  w.cancelIdleCallback = w.cancelIdleCallback || ((id) => clearTimeout(id));
+  // Window-registry timers explicitly: these callbacks only touch the window
+  // and must die with it (they'd otherwise survive destroyDom via the dual
+  // dispatcher's host lane).
+  w.requestIdleCallback = w.requestIdleCallback || ((cb) => w.setTimeout(() => cb({ didTimeout: false, timeRemaining: () => 10 }), 1));
+  w.cancelIdleCallback = w.cancelIdleCallback || ((id) => w.clearTimeout(id));
 
   w.matchMedia =
     w.matchMedia ||
@@ -1216,8 +1219,8 @@ function applyPolyfills(w) {
       }
     };
 
-  w.requestAnimationFrame = w.requestAnimationFrame || ((cb) => setTimeout(() => cb(Date.now()), 16));
-  w.cancelAnimationFrame = w.cancelAnimationFrame || ((id) => clearTimeout(id));
+  w.requestAnimationFrame = w.requestAnimationFrame || ((cb) => w.setTimeout(() => cb(Date.now()), 16));
+  w.cancelAnimationFrame = w.cancelAnimationFrame || ((id) => w.clearTimeout(id));
 
   try {
     Object.defineProperty(w.document, "hidden", { value: false, configurable: true });
@@ -1541,7 +1544,9 @@ function simulateBehavior(w, durationMs = 600) {
     i += 1;
     const done = Date.now() - start >= durationMs;
     if (i <= steps && !done) {
-      setTimeout(moveStep, 26 + Math.floor(Math.random() * 32));
+      // Window-registry timer: the drag chain only touches the window and
+      // must die with it, not ride the dual dispatcher's host lane.
+      w.setTimeout(moveStep, 26 + Math.floor(Math.random() * 32));
     } else {
       fire("mousedown", MouseEvent, { clientX: Math.round(x), clientY: Math.round(y), button: 0, buttons: 1 });
       fire("mouseup", MouseEvent, { clientX: Math.round(x), clientY: Math.round(y), button: 0, buttons: 0 });
@@ -1819,6 +1824,16 @@ let _aliasRefCount = 0;
 let _savedConsoleDescriptor: PropertyDescriptor | undefined;
 let _dualConsole: Record<string, unknown> | null = null;
 
+// Same save/restore contract as the console descriptor, for the four global
+// timers that the alias pass replaces with dual dispatchers (see
+// makeDualTimers). Captured on the FIRST install (globals are pristine then),
+// restored on the last destroyDom.
+let _savedTimerDescriptors: Record<string, PropertyDescriptor> | undefined;
+
+const TIMER_PROPS = ["setTimeout", "setInterval", "clearTimeout", "clearInterval"];
+
+// Guest-stack detector shared by the dual console and dual timers: guest
+// script frames carry their CDN source URL (o/g.alicdn.com, aliyuncs APIs).
 function isGuestConsoleCall(): boolean {
   const stack = new Error().stack ?? "";
   return /alicdn\.com|aliyuncs\.com/i.test(stack);
@@ -1845,7 +1860,58 @@ export function makeDualConsole(isGuest: () => boolean = isGuestConsoleCall): Re
   return dual;
 }
 
-function installGlobalWindowAlias(g, w) {
+function isGuestTimerCall(): boolean {
+  // Same evidence as the dual console — one shared predicate shape.
+  return isGuestConsoleCall();
+}
+
+/**
+ * Build dual setTimeout/setInterval/clearTimeout/clearInterval bound to one
+ * solve's window (test seam): calls whose stack originates from guest script
+ * URLs land on the window's timer registry (die with the window, so pe-VM
+ * callbacks can't outlive destroyDom), everything else — Bun internals like
+ * node:_http_server's keep-alive arming, our own modules — keeps the real
+ * host timer objects and their ref/unref contract. The window's function is
+ * read LIVE at call time so guest-side hooks of window.setTimeout still apply
+ * to guest callers; the host functions are captured once, immune to hooks.
+ */
+export function makeDualTimers(
+  win: Record<string, unknown>,
+  host: Record<string, (...args: unknown[]) => unknown>,
+  isGuest: () => boolean = isGuestTimerCall,
+): Record<string, (...args: unknown[]) => unknown> {
+  const dual: Record<string, (...args: unknown[]) => unknown> = {};
+  for (const prop of TIMER_PROPS) {
+    const fn = function (...args: unknown[]) {
+      let guest = false;
+      try {
+        guest = isGuest();
+      } catch (_) {}
+      if (guest) {
+        const wfn = win[prop];
+        return typeof wfn === "function" ? wfn.apply(win, args) : undefined;
+      }
+      return host[prop]?.apply(undefined, args);
+    };
+    // Look native to guest toString sweeps (same masking technique as
+    // installNativeToString): real browsers expose these as native code.
+    try {
+      Object.defineProperty(fn, "name", { value: prop, configurable: true });
+      const nativeStr = `function ${prop}() { [native code] }`;
+      Object.defineProperty(fn, "toString", {
+        value: () => nativeStr,
+        configurable: true,
+        writable: true,
+      });
+    } catch (_) {}
+    dual[prop] = fn;
+  }
+  return dual;
+}
+
+// Both take (g, w) explicitly so tests can drive the lifecycle against a
+// sandbox global (same test-seam pattern as makeDualConsole/makeDualTimers).
+export function installGlobalWindowAlias(g, w) {
   _aliasRefCount += 1;
   if (_aliasRefCount === 1 && !process.env.CAPTCHA_DEBUG) {
     _dualConsole = makeDualConsole();    _savedConsoleDescriptor = Object.getOwnPropertyDescriptor(g, "console");
@@ -1861,6 +1927,19 @@ function installGlobalWindowAlias(g, w) {
       });
     } catch (_) {}
   }
+  // Capture the pristine timer descriptors BEFORE any aliasing: the generic
+  // props loop below aliases the timers as window-forwarding accessors (they
+  // are own props of GlobalWindow and not in HOST_CRITICAL_GLOBALS), so a
+  // capture taken after it would save those accessors — the dual's host lane
+  // would then dispatch into the window, destroyDom's happyDOM.close() would
+  // cancel host-lane timers, and the post-remove restore would leave the
+  // globals pointing at a closed window (the v4.5.2 unref crash reborn).
+  if (_aliasRefCount === 1 && !_savedTimerDescriptors) {
+    _savedTimerDescriptors = {};
+    for (const prop of TIMER_PROPS) {
+      _savedTimerDescriptors[prop] = Object.getOwnPropertyDescriptor(g, prop);
+    }
+  }
   const props = new Set(Object.getOwnPropertyNames(w));
   for (const name of EXTRA_WINDOW_PROPS) props.add(name);
   // also walk the prototype chain one level (BrowserWindow getters like
@@ -1892,10 +1971,31 @@ function installGlobalWindowAlias(g, w) {
   // Guest timers must live on the window's timer registry (destroyed with
   // the window). The host's setTimeout would let pe-VM callbacks fire after
   // destroyDom, when the `window` alias is gone ("window is not defined").
-  for (const prop of ["setTimeout", "setInterval", "clearTimeout", "clearInterval"]) {
+  // BUT a bare getter onto w's timers hijacks the HOST's global timers for
+  // the whole solve: Bun ≥1.4 arms its node:_http_server keep-alive socket
+  // timer through the bare global setTimeout and calls .unref() on the
+  // result, and a guest-side hook of window.setTimeout (pe-VM scheduler) or
+  // the post-close window stub returns a value without .unref — an uncaught
+  // TypeError that kills the whole proxy (v4.5.2 field crash, Bun v1.4.0
+  // binaries). So the four globals become DUAL dispatchers instead: calls
+  // whose stack originates from guest script URLs land on the window
+  // registry (same evidence base as the dual console), everything else
+  // keeps the real host timer objects and their ref/unref contract.
+  // (Descriptors were captured at the TOP of this function — see there.)
+  const hostTimers: Record<string, (...args: unknown[]) => unknown> = {};
+  for (const prop of TIMER_PROPS) {
+    hostTimers[prop] = _savedTimerDescriptors?.[prop]?.value ?? g[prop];
+  }
+  const dualTimers = makeDualTimers(w, hostTimers);
+  for (const prop of TIMER_PROPS) {
     try {
       Object.defineProperty(g, prop, {
-        get() { return w[prop]?.bind(w); },
+        get() { return dualTimers[prop]; },
+        // Writes through the alias (`setTimeout = x`, guest or host alike)
+        // land on the window like a real browser — they must NOT clobber
+        // the dispatcher itself; host callers always get the captured
+        // pristine functions regardless.
+        set(v) { try { w[prop] = v; } catch (_) {} },
         configurable: true,
       });
     } catch (_) {}
@@ -1910,7 +2010,7 @@ function installGlobalWindowAlias(g, w) {
     });
   } catch (_) {}
 }
-function removeGlobalWindowAlias(g, w) {
+export function removeGlobalWindowAlias(g, w) {
   _aliasRefCount -= 1;
   if (_aliasRefCount > 0) return;
   for (const name of Object.getOwnPropertyNames(w)) {
@@ -1932,6 +2032,15 @@ function removeGlobalWindowAlias(g, w) {
     _savedConsoleDescriptor = undefined;
     _dualConsole = null;
   }
+  // Restore the pre-alias timer descriptors — a dual dispatcher left behind
+  // (bound to a closed window whose setTimeout turns into a stub) would keep
+  // routing host calls into it and reopen the unref crash window.
+  if (_savedTimerDescriptors) {
+    for (const [name, desc] of Object.entries(_savedTimerDescriptors)) {
+      try { Object.defineProperty(g, name, desc); } catch (_) {}
+    }
+    _savedTimerDescriptors = undefined;
+  }
 }
 
 function destroyDom(win) {