fix(auto-pin-latest): handle auto-pin-latest

Author: unadlib

packages/cli/src/index.ts

@@ -688,7 +688,7 @@ async function collectRuntimePlanBareSpecifiers(
     }
   }
 
-  for (const specifier of plan.capabilities.allowedModules ?? []) {
+  for (const specifier of plan.capabilities?.allowedModules ?? []) {
     if (isBareModuleSpecifier(specifier)) {
       specifiers.add(specifier);
     }

packages/core/src/codegen.ts

@@ -147,7 +147,10 @@ export class DefaultCodeGenerator implements CodeGenerator {
       return false;
     }
 
-    return typeof plan.capabilities === "object" && plan.capabilities !== null;
+    return (
+      plan.capabilities === undefined ||
+      (typeof plan.capabilities === "object" && plan.capabilities !== null)
+    );
   }
 
   async transformPlan(

packages/ir/src/index.ts

@@ -168,7 +168,7 @@ export interface RuntimePlan {
   id: string;
   version: number;
   root: RuntimeNode;
-  capabilities: RuntimeCapabilities;
+  capabilities?: RuntimeCapabilities;
   state?: RuntimeStateModel;
   imports?: string[];
   moduleManifest?: RuntimeModuleManifest;
@@ -539,7 +539,10 @@ export function isRuntimePlan(value: unknown): value is RuntimePlan {
     return false;
   }
 
-  if (!isRuntimeCapabilities(value.capabilities)) {
+  if (
+    value.capabilities !== undefined &&
+    !isRuntimeCapabilities(value.capabilities)
+  ) {
     return false;
   }
 

packages/runtime/src/manager.ts

@@ -226,16 +226,16 @@ export class DefaultRuntimeManager implements RuntimeManager {
       };
     }
 
+    const capabilities = plan.capabilities ?? {};
     const frame: ExecutionFrame = {
       startedAt: nowMs(),
-      maxExecutionMs:
-        plan.capabilities.maxExecutionMs ?? this.defaultMaxExecutionMs,
+      maxExecutionMs: capabilities.maxExecutionMs ?? this.defaultMaxExecutionMs,
       maxComponentInvocations:
-        plan.capabilities.maxComponentInvocations ??
+        capabilities.maxComponentInvocations ??
         this.defaultMaxComponentInvocations,
       componentInvocations: 0,
       executionProfile:
-        plan.capabilities.executionProfile ?? this.defaultExecutionProfile,
+        capabilities.executionProfile ?? this.defaultExecutionProfile,
     };
 
     const dependencies = await this.preflightPlanDependencies(
@@ -284,21 +284,21 @@ export class DefaultRuntimeManager implements RuntimeManager {
 
     const state = this.resolveState(plan, stateOverride);
     const appliedActions: RuntimeAction[] = [];
+    const capabilities = plan.capabilities ?? {};
 
     const frame: ExecutionFrame = {
       startedAt: nowMs(),
-      maxExecutionMs:
-        plan.capabilities.maxExecutionMs ?? this.defaultMaxExecutionMs,
+      maxExecutionMs: capabilities.maxExecutionMs ?? this.defaultMaxExecutionMs,
       maxComponentInvocations:
-        plan.capabilities.maxComponentInvocations ??
+        capabilities.maxComponentInvocations ??
         this.defaultMaxComponentInvocations,
       componentInvocations: 0,
       executionProfile:
-        plan.capabilities.executionProfile ?? this.defaultExecutionProfile,
+        capabilities.executionProfile ?? this.defaultExecutionProfile,
       signal,
     };
 
-    const maxImports = plan.capabilities.maxImports ?? this.defaultMaxImports;
+    const maxImports = capabilities.maxImports ?? this.defaultMaxImports;
     const imports = plan.imports ?? [];
 
     if (this.enableDependencyPreflight) {

packages/security/src/index.ts

@@ -283,7 +283,7 @@ export class DefaultSecurityChecker implements SecurityChecker {
     }
 
     const capabilityResult = this.checkCapabilities(
-      plan.capabilities,
+      plan.capabilities ?? {},
       moduleManifest,
     );
     issues.push(...capabilityResult.issues);
@@ -658,7 +658,7 @@ export class DefaultSecurityChecker implements SecurityChecker {
       }
     }
 
-    for (const specifier of plan.capabilities.allowedModules ?? []) {
+    for (const specifier of plan.capabilities?.allowedModules ?? []) {
       if (this.isBareSpecifier(specifier)) {
         requiredSpecifiers.add(specifier);
       }

tests/codegen.test.ts

@@ -36,7 +36,7 @@ test("codegen parses RuntimePlan JSON output directly", async () => {
   assert.equal(plan.version, 3);
   assert.equal(plan.specVersion, "runtime-plan/v1");
   assert.equal(plan.state?.initial.count, 0);
-  assert.equal(plan.capabilities.maxExecutionMs, 1200);
+  assert.equal(plan.capabilities?.maxExecutionMs, 1200);
   assert.equal(plan.metadata?.sourcePrompt, "Counter plan");
 });
 
@@ -53,7 +53,7 @@ test("codegen falls back to section root when no JSON payload exists", async ()
     throw new Error("expected fallback element node");
   }
   assert.equal(plan.root.tag, "section");
-  assert.equal(plan.capabilities.domWrite, true);
+  assert.equal(plan.capabilities?.domWrite, true);
   assert.equal(plan.specVersion, "runtime-plan/v1");
 });
 

tests/ir.test.ts

@@ -102,6 +102,13 @@ test("runtime plan/type guards validate structures", () => {
   assert.equal(isRuntimeCapabilities(plan.capabilities), true);
   assert.equal(isRuntimeStateModel(plan.state), true);
   assert.equal(isRuntimePlan(plan), true);
+  assert.equal(
+    isRuntimePlan({
+      ...plan,
+      capabilities: undefined,
+    }),
+    true,
+  );
   assert.equal(
     isRuntimePlan({
       ...plan,

tests/runtime.test.ts

@@ -596,6 +596,25 @@ test("renderPlanInBrowser renders runtime node HTML without mount target", async
   assert.equal(result.security.safe, true);
 });
 
+test("renderPlanInBrowser accepts plans without capabilities", async () => {
+  const plan: RuntimePlan = {
+    specVersion: DEFAULT_RUNTIME_PLAN_SPEC_VERSION,
+    id: "embed_runtime_plan_without_capabilities",
+    version: 1,
+    root: createElementNode("section", undefined, [createTextNode("hello")]),
+  };
+
+  const result = await renderPlanInBrowser(plan, {
+    runtimeOptions: {
+      browserSourceSandboxMode: "none",
+    },
+  });
+
+  assert.match(result.html, /<section>/);
+  assert.match(result.html, /hello/);
+  assert.equal(result.security.safe, true);
+});
+
 test("renderPlanInBrowser rejects plan when security policy fails", async () => {
   const plan: RuntimePlan = {
     specVersion: DEFAULT_RUNTIME_PLAN_SPEC_VERSION,

tests/security.test.ts

@@ -13,7 +13,9 @@ import {
   listSecurityProfiles,
 } from "../packages/security/src/index";
 
-function createPlan(rootTag = "section"): RuntimePlan {
+function createPlan(rootTag = "section"): RuntimePlan & {
+  capabilities: NonNullable<RuntimePlan["capabilities"]>;
+} {
   return {
     specVersion: DEFAULT_RUNTIME_PLAN_SPEC_VERSION,
     id: "plan_security_test",