@llblab/pi-actors 0.22.5 → 0.24.0

package/lib/command-templates.ts

@@ -193,7 +193,7 @@ function getLeafCommandTemplateWarnings(
       ? "shell command strings"
       : "shell scripts";
     warnings.push(
-      `${config.label ?? command}: invokes ${command}; ${shellContent} are trusted executable content and are not sandboxed by command-template argv splitting.`,
+      `${config.label ?? command}: invokes ${command}; ${shellContent} are trusted executable content and are not sandboxed by command-template argv splitting. Mitigation: keep scripts local, reviewed, and parameterized with explicit placeholders.`,
     );
   }
   if (
@@ -201,7 +201,7 @@ function getLeafCommandTemplateWarnings(
     hasAnyFlag(args, ["-e", "--eval"])
   ) {
     warnings.push(
-      `${config.label ?? command}: invokes ${command} eval mode; code strings are trusted executable content and are not sandboxed.`,
+      `${config.label ?? command}: invokes ${command} eval mode; code strings are trusted executable content and are not sandboxed. Mitigation: prefer a checked-in script file or keep eval input fixed and reviewed.`,
     );
   }
   if (
@@ -209,7 +209,7 @@ function getLeafCommandTemplateWarnings(
     hasAnyFlag(args, ["-c", "-e"])
   ) {
     warnings.push(
-      `${config.label ?? command}: invokes ${command} code-eval mode; code strings are trusted executable content and are not sandboxed.`,
+      `${config.label ?? command}: invokes ${command} code-eval mode; code strings are trusted executable content and are not sandboxed. Mitigation: prefer a checked-in script file or keep eval input fixed and reviewed.`,
     );
   }
   if (
@@ -218,12 +218,12 @@ function getLeafCommandTemplateWarnings(
       hasRiskyPathArg(args))
   ) {
     warnings.push(
-      `${config.label ?? command}: removes filesystem paths; verify placeholders and paths before running trusted destructive commands.`,
+      `${config.label ?? command}: removes filesystem paths; verify placeholders and paths before running trusted destructive commands. Mitigation: constrain path placeholders and consider dry-run or explicit confirmation.`,
     );
   }
   if (["mv", "cp", "rsync"].includes(command) && hasRiskyPathArg(args)) {
     warnings.push(
-      `${config.label ?? command}: mutates broad filesystem paths; verify placeholders and paths before running trusted commands.`,
+      `${config.label ?? command}: mutates broad filesystem paths; verify placeholders and paths before running trusted commands. Mitigation: constrain path placeholders and prefer narrow source/destination paths.`,
     );
   }
   return warnings;

package/lib/conformance.ts

@@ -0,0 +1,46 @@
+/**
+ * Internal conformance runner logic.
+ * Zones: CI/release validation, protocol regression suite selection
+ */
+
+import { spawnSync } from "node:child_process";
+
+export const conformanceSuites = [
+  "tests/protocol-examples.test.ts",
+  "tests/recipe-discovery.test.ts",
+  "tests/registry.test.ts",
+  "tests/runtime-registry.test.ts",
+  "tests/async-runs.test.ts",
+  "tests/actor-rooms.test.ts",
+  "tests/tools.test.ts",
+];
+
+export interface ConformanceReport {
+  code: number;
+  output: string;
+  summary: string;
+  suites: number;
+}
+
+export function runConformance(cwd = new URL("..", import.meta.url)): ConformanceReport {
+  const result = spawnSync(
+    process.execPath,
+    ["--experimental-strip-types", "--test", ...conformanceSuites],
+    { cwd, encoding: "utf8", stdio: "pipe" },
+  );
+
+  const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+  const summary = output
+    .split("\n")
+    .filter((line) =>
+      /^ℹ (tests|pass|fail|cancelled|skipped|todo|duration_ms) /.test(line),
+    )
+    .join("\n");
+
+  return {
+    code: result.status ?? 1,
+    output,
+    summary,
+    suites: conformanceSuites.length,
+  };
+}