fix(scripts): detect modern bun.lock, ignore stray root lockfiles

Bun switched its default lockfile from the binary bun.lockb to the
text-based bun.lock, but detectFromLockFile() only ever checked for
bun.lockb — a project using modern Bun would never be detected as
using Bun at all.

Added bun.lock as the primary lockfile with bun.lockb kept as a
recognized legacy alias, so either format is detected correctly.

Also ignore stray bun.lock/bun.lockb at the repo root: yarn is this
repo's canonical package manager (package.json "packageManager"), so
a lockfile from someone running `bun install` locally shouldn't get
picked up by git status.

.gitignore

@@ -99,6 +99,11 @@ ecc2/target/
 # Generated lock files in tool subdirectories
 .opencode/package-lock.json
 .opencode/node_modules/
+
+# yarn is the canonical package manager for this repo (see package.json
+# "packageManager"); ignore stray lockfiles from running another manager locally
+/bun.lock
+/bun.lockb
 assets/images/security/badrudi-exploit.mp4
 
 .aider*

scripts/lib/package-manager.js

@@ -43,7 +43,10 @@ const PACKAGE_MANAGERS = {
   },
   bun: {
     name: 'bun',
-    lockFile: 'bun.lockb',
+    lockFile: 'bun.lock',
+    // Bun switched its default lockfile from the binary bun.lockb to the
+    // text-based bun.lock. Keep recognizing the legacy file too.
+    lockFileAliases: ['bun.lockb'],
     installCmd: 'bun install',
     runCmd: 'bun run',
     execCmd: 'bunx',
@@ -92,9 +95,9 @@ function saveConfig(config) {
 function detectFromLockFile(projectDir = process.cwd()) {
   for (const pmName of DETECTION_PRIORITY) {
     const pm = PACKAGE_MANAGERS[pmName];
-    const lockFilePath = path.join(projectDir, pm.lockFile);
+    const lockFileNames = [pm.lockFile, ...(pm.lockFileAliases || [])];
 
-    if (fs.existsSync(lockFilePath)) {
+    if (lockFileNames.some(lockFileName => fs.existsSync(path.join(projectDir, lockFileName)))) {
       return pmName;
     }
   }

tests/lib/package-manager.test.js

@@ -131,7 +131,7 @@ function runTests() {
   })) passed++;
   else failed++;
 
-  if (test('detects bun from bun.lockb', () => {
+  if (test('detects bun from bun.lockb (legacy binary lockfile)', () => {
     const testDir = createTestDir();
     try {
       fs.writeFileSync(path.join(testDir, 'bun.lockb'), '');
@@ -143,6 +143,18 @@ function runTests() {
   })) passed++;
   else failed++;
 
+  if (test('detects bun from bun.lock (modern text lockfile)', () => {
+    const testDir = createTestDir();
+    try {
+      fs.writeFileSync(path.join(testDir, 'bun.lock'), '');
+      const result = pm.detectFromLockFile(testDir);
+      assert.strictEqual(result, 'bun');
+    } finally {
+      cleanupTestDir(testDir);
+    }
+  })) passed++;
+  else failed++;
+
   if (test('returns null when no lock file exists', () => {
     const testDir = createTestDir();
     try {