movehat 0.1.9 → 0.2.1

package/src/core/deployments.ts

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join } from "path";
+import { logger } from "../ui/index.js";
 
 export interface DeploymentInfo {
   address: string;
@@ -7,8 +8,8 @@ export interface DeploymentInfo {
   network: string;
   deployer: string;
   timestamp: number;
-  txHash?: string;
-  blockNumber?: string;
+  txHash?: string | undefined;
+  blockNumber?: string | undefined;
 }
 
 /**
@@ -30,34 +31,29 @@ export function validateSafeName(name: string, type: "network" | "module"): void
     );
   }
 
-  // Only allow alphanumeric, hyphens, underscores
-  const safePattern = /^[a-zA-Z0-9_-]+$/;
-  if (!safePattern.test(name)) {
+  // Reject hidden-file names first so the error message is specific
+  // (otherwise the alphanumeric check below would fire generically).
+  if (name.startsWith(".")) {
     throw new Error(
       `Invalid ${type} name: "${name}"\n` +
-      `Only alphanumeric characters, hyphens (-), and underscores (_) are allowed.`
+      `Names cannot start with a dot (.) to prevent hidden file creation.`
     );
   }
 
-  // Additional check: prevent starting with dot (hidden files)
-  if (name.startsWith(".")) {
+  // Only allow alphanumeric, hyphens, underscores
+  const safePattern = /^[a-zA-Z0-9_-]+$/;
+  if (!safePattern.test(name)) {
     throw new Error(
       `Invalid ${type} name: "${name}"\n` +
-      `Names cannot start with a dot (.) to prevent hidden file creation.`
+      `Only alphanumeric characters, hyphens (-), and underscores (_) are allowed.`
     );
   }
 }
 
-/**
- * Get the deployments directory path
- */
 function getDeploymentsDir(): string {
   return join(process.cwd(), "deployments");
 }
 
-/**
- * Get the network-specific deployments directory
- */
 function getNetworkDeploymentsDir(network: string): string {
   // Validate network name to prevent path traversal
   validateSafeName(network, "network");
@@ -76,9 +72,6 @@ function getNetworkDeploymentsDir(network: string): string {
   return networkDir;
 }
 
-/**
- * Save a deployment
- */
 export function saveDeployment(deployment: DeploymentInfo): void {
   // Validate both network and module name
   validateSafeName(deployment.network, "network");
@@ -89,8 +82,8 @@ export function saveDeployment(deployment: DeploymentInfo): void {
 
   try {
     writeFileSync(filePath, JSON.stringify(deployment, null, 2), "utf-8");
-    console.log(
-      `💾 Deployment saved: deployments/${deployment.network}/${deployment.moduleName}.json`
+    logger.success(
+      `Deployment saved: deployments/${deployment.network}/${deployment.moduleName}.json`
     );
   } catch (error) {
     console.error(
@@ -101,9 +94,6 @@ export function saveDeployment(deployment: DeploymentInfo): void {
   }
 }
 
-/**
- * Load a deployment
- */
 export function loadDeployment(network: string, moduleName: string): DeploymentInfo | null {
   // Validate both network and module name
   validateSafeName(network, "network");

package/src/core/movementProfile.ts

@@ -0,0 +1,179 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "fs";
+import { readFile } from "fs/promises";
+import { dirname } from "path";
+import { randomUUID } from "crypto";
+import * as yaml from "js-yaml";
+
+/**
+ * Shared helpers for working with the Movement CLI's `~/.aptos/config.yaml`
+ * profile file and the SIGINT/SIGTERM cleanup pipeline.
+ *
+ * Extracted from `core/Publisher.ts` so both the existing `move publish`
+ * flow (`Publisher`) and the new `move deploy-object` / `upgrade-object`
+ * flows (`harness/codeObject.ts`) can share the bug #36 / #37 / #43
+ * hardening without duplicating it.
+ *
+ * @internal — not exported from `src/index.ts`.
+ */
+
+/**
+ * In-process serializer for `~/.aptos/config.yaml` mutations. Without it,
+ * two concurrent profile writes would race in the read-modify-write cycle
+ * and the second writer would silently drop the first's profile. See #37.
+ */
+let yamlLock: Promise<unknown> = Promise.resolve();
+export function withYamlLock<T>(fn: () => Promise<T>): Promise<T> {
+  const prev = yamlLock;
+  // .then(success, failure) — continue even if the previous holder rejected,
+  // so a failure in one deploy doesn't poison the lock for the others.
+  const next = prev.then(
+    () => fn(),
+    () => fn()
+  );
+  yamlLock = next.catch(() => {}); // swallow on the shared chain; caller still gets the original
+  return next;
+}
+
+export interface ProfileData {
+  private_key: string;
+  public_key: string;
+  account: string;
+  rest_url: string;
+}
+
+interface AptosConfigYaml {
+  profiles?: Record<string, ProfileData>;
+  [key: string]: unknown;
+}
+
+/**
+ * Atomic write: write payload to a temp sibling → chmod the temp to 0o600
+ * → rename over the target. The chmod-before-rename order eliminates a
+ * window where the target file could be observable with default umask
+ * perms (typically 0o644) while carrying the private key.
+ */
+function atomicWriteYaml(path: string, content: string): void {
+  const tmpPath = `${path}.tmp.${randomUUID().slice(0, 8)}`;
+  writeFileSync(tmpPath, content, { mode: 0o600 });
+  chmodSync(tmpPath, 0o600); // defense in depth in case umask filtered the open mode
+  renameSync(tmpPath, path);
+}
+
+/** Add the deploy's profile to ~/.aptos/config.yaml. Creates the file if absent. */
+export async function addProfile(
+  configPath: string,
+  name: string,
+  data: ProfileData
+): Promise<void> {
+  const configDir = dirname(configPath);
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  }
+  let yamlObj: AptosConfigYaml = {};
+  if (existsSync(configPath)) {
+    const raw = await readFile(configPath, "utf-8");
+    yamlObj = (yaml.load(raw) as AptosConfigYaml) || {};
+  }
+  if (!yamlObj.profiles) yamlObj.profiles = {};
+  yamlObj.profiles[name] = data;
+  atomicWriteYaml(configPath, yaml.dump(yamlObj));
+}
+
+/**
+ * Remove the deploy's profile from ~/.aptos/config.yaml. Idempotent —
+ * a missing file or missing profile is a no-op. If removal leaves the
+ * yaml with only an empty `profiles:` block, the whole file is unlinked
+ * to preserve the "didn't exist before" semantic for the first-ever deploy.
+ */
+export async function removeProfile(configPath: string, name: string): Promise<void> {
+  if (!existsSync(configPath)) return;
+  const raw = await readFile(configPath, "utf-8");
+  const yamlObj: AptosConfigYaml = (yaml.load(raw) as AptosConfigYaml) || {};
+  if (!yamlObj.profiles || !(name in yamlObj.profiles)) return;
+  delete yamlObj.profiles[name];
+
+  const profilesEmpty = Object.keys(yamlObj.profiles).length === 0;
+  const onlyProfilesKey =
+    Object.keys(yamlObj).length === 1 && "profiles" in yamlObj;
+  if (profilesEmpty && onlyProfilesKey) {
+    // We created this file fresh; remove it.
+    try {
+      unlinkSync(configPath);
+    } catch {
+      // best-effort
+    }
+    return;
+  }
+  atomicWriteYaml(configPath, yaml.dump(yamlObj));
+}
+
+/**
+ * Synchronous twin of `removeProfile` for the SIGINT/SIGTERM handler.
+ * The event loop is dead by the time the handler runs — we cannot
+ * await. Bypasses the async mutex because signal handlers are
+ * sequential by construction; the operation is idempotent so a
+ * benign double-delete (handler then finally, or vice versa) is fine.
+ */
+export function removeProfileSync(configPath: string, name: string): void {
+  try {
+    if (!existsSync(configPath)) return;
+    const raw = readFileSync(configPath, "utf-8");
+    const yamlObj: AptosConfigYaml = (yaml.load(raw) as AptosConfigYaml) || {};
+    if (!yamlObj.profiles || !(name in yamlObj.profiles)) return;
+    delete yamlObj.profiles[name];
+
+    const profilesEmpty = Object.keys(yamlObj.profiles).length === 0;
+    const onlyProfilesKey =
+      Object.keys(yamlObj).length === 1 && "profiles" in yamlObj;
+    if (profilesEmpty && onlyProfilesKey) {
+      unlinkSync(configPath);
+      return;
+    }
+    atomicWriteYaml(configPath, yaml.dump(yamlObj));
+  } catch {
+    // Signal handlers should never throw — swallow and exit. Better to
+    // leave a stale profile (recoverable by re-running the deploy) than
+    // to crash the parent process mid-shutdown.
+  }
+}
+
+/**
+ * Process-level signal handling. A single registered handler iterates
+ * the per-deploy cleanup callbacks. Install-once because multiple
+ * concurrent deploys share the same parent process — installing per
+ * deploy would re-add the listener and exceed Node's max-listeners
+ * warning threshold under heavy parallelism.
+ */
+export const cleanupCallbacks = new Set<() => void>();
+let signalHandlerInstalled = false;
+
+export function ensureSignalHandler(): void {
+  if (signalHandlerInstalled) return;
+  signalHandlerInstalled = true;
+  const handler = (sig: NodeJS.Signals) => {
+    // Synchronous cleanup of every active deploy's profile entry.
+    for (const cb of [...cleanupCallbacks]) {
+      try {
+        cb();
+      } catch {
+        /* sync best-effort */
+      }
+    }
+    // Defer the actual exit one tick so other listeners (vitest's own
+    // SIGINT handler, app-level shutdown hooks) still get to run.
+    // Without this we'd stomp on vitest's afterEach if a dev Ctrl+C'd
+    // a test run mid-suite.
+    const code = sig === "SIGTERM" ? 143 : 130;
+    setImmediate(() => process.exit(code));
+  };
+  process.on("SIGINT", handler);
+  process.on("SIGTERM", handler);
+}

package/src/core/shell.ts

@@ -16,19 +16,20 @@ export function escapeShellArg(arg: string): string {
 }
 
 /**
- * Validates that a path is safe (no command injection characters)
- * and returns the escaped version
+ * Validates that a path is safe (no command injection characters) and
+ * returns it unchanged. Use this for callers that pass paths to spawn-with-
+ * args (no shell), where shell quoting would be incorrect.
  *
- * @param path - The path to validate and escape
+ * @param path - The path to validate
  * @param name - Name for error messages (e.g., "package directory")
- * @returns The escaped path safe for shell execution
+ * @returns The original path, after validation
  */
-export function validateAndEscapePath(path: string, name: string = "path"): string {
+export function validatePathSafety(path: string, name: string = "path"): string {
   if (!path || typeof path !== "string") {
     throw new Error(`Invalid ${name}: must be a non-empty string`);
   }
 
-  // Check for obvious command injection attempts
+  // Check for obvious command injection attempts.
   const dangerousChars = /[;&|`$(){}[\]<>]/;
   if (dangerousChars.test(path)) {
     throw new Error(
@@ -38,22 +39,32 @@ export function validateAndEscapePath(path: string, name: string = "path"): stri
     );
   }
 
-  // Escape for shell safety
-  return escapeShellArg(path);
+  return path;
 }
 
 /**
- * Validates that a profile name is safe
+ * Validates a path and returns the shell-escaped form. Wraps
+ * `validatePathSafety` for callers that pass paths into shell-style
+ * commands (e.g. `exec`).
  *
- * @param profile - The profile name to validate
- * @returns The escaped profile name
+ * @param path - The path to validate and escape
+ * @param name - Name for error messages
+ * @returns The escaped path safe for shell execution
  */
-export function validateAndEscapeProfile(profile: string): string {
+export function validateAndEscapePath(path: string, name: string = "path"): string {
+  return escapeShellArg(validatePathSafety(path, name));
+}
+
+/**
+ * Validates that a profile name is safe and returns it unchanged. Mirrors
+ * `validatePathSafety` — use this for callers that pass the profile to
+ * spawn-with-args (no shell), where shell quoting would be incorrect.
+ */
+export function validateProfileSafety(profile: string): string {
   if (!profile || typeof profile !== "string") {
     throw new Error("Invalid profile name: must be a non-empty string");
   }
 
-  // Profile names should only contain alphanumeric, hyphens, underscores
   const safePattern = /^[a-zA-Z0-9_-]+$/;
   if (!safePattern.test(profile)) {
     throw new Error(
@@ -62,5 +73,14 @@ export function validateAndEscapeProfile(profile: string): string {
     );
   }
 
-  return escapeShellArg(profile);
+  return profile;
+}
+
+/**
+ * Validates a profile and returns the shell-escaped form. Wraps
+ * `validateProfileSafety` for callers that pass the profile into shell-style
+ * commands (e.g. `exec`).
+ */
+export function validateAndEscapeProfile(profile: string): string {
+  return escapeShellArg(validateProfileSafety(profile));
 }

package/src/errors.ts

@@ -19,3 +19,63 @@ export class ModuleAlreadyDeployedError extends Error {
     }
   }
 }
+
+import { redactSecrets } from './utils/redact.js';
+import type { DeploymentInfo } from './core/deployments.js';
+
+/**
+ * Thrown when the on-chain publish succeeded but a subsequent local
+ * step (saveDeployment, profile cleanup, etc.) failed.
+ *
+ * Distinct from `CliExecutionError`: by the time this error fires, the
+ * module IS deployed on-chain. Callers that want to recover can read
+ * `deployment` and re-attempt the local-side persistence manually
+ * (e.g. write the JSON to `deployments/{network}/{moduleName}.json`).
+ *
+ * Without this distinction, the same outer catch would surface a
+ * post-publish filesystem failure as "Failed to publish module",
+ * inviting an accidental redeploy that wastes gas.
+ */
+export class PostPublishError extends Error {
+  constructor(
+    message: string,
+    public readonly deployment: DeploymentInfo,
+    public readonly cause: Error
+  ) {
+    super(message);
+    this.name = 'PostPublishError';
+
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, PostPublishError);
+    }
+  }
+}
+
+/**
+ * Thrown by runCli when a spawned process exits with a non-zero status.
+ *
+ * `stderr`, `stdoutPreview`, and each entry in `args` are redacted of
+ * well-known secret shapes (private keys, etc.) in the constructor, so the
+ * error is safe to log regardless of how it was raised. Redaction is
+ * idempotent.
+ */
+export class CliExecutionError extends Error {
+  public readonly args: readonly string[];
+
+  constructor(
+    message: string,
+    public readonly command: string,
+    args: readonly string[],
+    public readonly exitCode: number,
+    public readonly stderr: string,
+    public readonly stdoutPreview: string
+  ) {
+    super(message);
+    this.name = 'CliExecutionError';
+    this.args = args.map(redactSecrets);
+
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, CliExecutionError);
+    }
+  }
+}