feat: pitty — PTY-based CLI testing framework

[kexi]

Summary

• PTY-based CLI testing framework: runs a program inside a real pseudo-terminal, simulates keystrokes/stdin, and asserts on streamed output, file changes, and process state — all driven by declarative YAML scenarios.
• Assertions: expect/expect_regex/expect_not, expect_file_*, expect_exit/expect_running, plus structured expect_json (dotted + bracket paths), expect_snapshot, and expect_semantic (lexical).
• Run modes: run, list, init, matrix (multi-axis Cartesian product with a cell-count cap), and bench (duration stats + flaky detection).
• Stable v1 scenario format (versioned, deny_unknown_fields at top level) with a hand-written JSON Schema and contract tests; secret masking across every output sink; single-trust model.
• GitHub Actions integration: step-summary + annotations, a composite action (uses: kexi/pitty@v1), and tag-driven prebuilt-binary release automation.

Test plan

• nix develop --command cargo test (unit + contract) passes
• cargo test --test e2e -- --ignored (real-PTY dogfood) passes
• cargo clippy --all-targets -- -D warnings and cargo fmt --check clean
• pitty run e2e/scenarios/positive exits 0; pitty matrix/pitty bench work end to end
• CI green on Linux + macOS gates

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	thiserror@​1.0.69
	serde@​1.0.228
	serde_json@​1.0.150
	clap@​4.6.1
	portable-pty@​0.8.1
	regex@​1.12.3
	serde_norway@​0.9.42
	tempfile@​3.27.0
	similar@​2.7.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report