movehat 0.2.0 → 0.2.2

package/src/commands/__tests__/compile.toml-mutation.test.ts

@@ -0,0 +1,77 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { vol, fs as memfsFs } from "memfs";
+
+vi.mock("fs", () => {
+  return {
+    default: memfsFs,
+    ...memfsFs,
+  };
+});
+
+import { updateMoveToml } from "../compile.js";
+
+/**
+ * F7 — `movehat compile` mutates `Move.toml` when it detects a named
+ * address that isn't declared yet. This test pins down the current
+ * behavior so a future change (introducing a `--write` flag, moving
+ * the mutation to a dedicated `movehat update-toml` command, etc.)
+ * MUST update this test alongside the source change.
+ *
+ * Audit finding F7 is marked "no concluyente — requires product
+ * decision": the mutation may be the right UX default for the
+ * Hardhat-style workflow, but the asymmetry (compile reading + writing)
+ * deserves to be a deliberate choice. See ROADMAP follow-up.
+ */
+describe("F7 — updateMoveToml mutates Move.toml on disk (current behavior captured)", () => {
+  beforeEach(() => vol.reset());
+  afterEach(() => vol.reset());
+
+  it("writes new named addresses into [addresses] and [dev-addresses] when missing", () => {
+    const before = `[package]
+name = "captured"
+version = "1.0.0"
+
+[addresses]
+existing = "_"
+
+[dev-addresses]
+existing = "0xcafe"
+
+[dependencies]
+`;
+    vol.fromJSON({ "/move/Move.toml": before });
+
+    const detected = new Set(["existing", "audit_module"]);
+    const added = updateMoveToml("/move", detected);
+
+    expect(added).toEqual(["audit_module"]);
+
+    // Source-of-truth assertion: the on-disk file CHANGED. F7 is the
+    // observation that a "compile" verb has a side effect on the user's
+    // working tree. The behavior is captured here so an unintended
+    // regression (or a deliberate revisit) cannot land silently.
+    const after = vol.readFileSync("/move/Move.toml", "utf-8") as string;
+    expect(after).not.toBe(before);
+    expect(after).toContain("audit_module = \"_\"");
+  });
+
+  it("returns an empty list and leaves Move.toml byte-identical when all named addresses are already declared", () => {
+    const before = `[package]
+name = "captured"
+
+[addresses]
+existing = "_"
+
+[dev-addresses]
+existing = "0xcafe"
+`;
+    vol.fromJSON({ "/move/Move.toml": before });
+
+    const added = updateMoveToml("/move", new Set(["existing"]));
+    expect(added).toEqual([]);
+    // No mutation in the no-op path — the asymmetry only triggers when
+    // detected ⊄ declared. Useful boundary for the F7 product decision.
+    const after = vol.readFileSync("/move/Move.toml", "utf-8") as string;
+    expect(after).toBe(before);
+  });
+});

package/src/commands/__tests__/init.test.ts

@@ -13,7 +13,8 @@ vi.mock("../../helpers/banner.js", () => ({
   printMovehatBanner: () => undefined,
 }));
 
-const { default: initCommand } = await import("../init.js");
+const initModule = await import("../init.js");
+const { default: initCommand, resolveProjectNames, InvalidProjectNameError } = initModule;
 
 /**
  * Strategy: real tmpdir + real fs ops (matches §6.1's example-as-canonical
@@ -28,10 +29,38 @@ const { default: initCommand } = await import("../init.js");
  * to `src/templates/` cleanly. No bundling step required.
  */
 
+describe("resolveProjectNames", () => {
+  const cases: Array<[
+    string,
+    { dirName: string; npmName: string; moveName: string; sanitized: boolean }
+  ]> = [
+    ["my_project", { dirName: "my_project", npmName: "my_project", moveName: "my_project", sanitized: false }],
+    ["my-project", { dirName: "my-project", npmName: "my-project", moveName: "my_project", sanitized: true }],
+    ["/tmp/my-project", { dirName: "/tmp/my-project", npmName: "my-project", moveName: "my_project", sanitized: true }],
+    ["123abc", { dirName: "123abc", npmName: "123abc", moveName: "pkg_123abc", sanitized: true }],
+    ["_underscore", { dirName: "_underscore", npmName: "_underscore", moveName: "_underscore", sanitized: false }],
+    ["UPPER", { dirName: "UPPER", npmName: "UPPER", moveName: "UPPER", sanitized: false }],
+    ["  spaced  ", { dirName: "spaced", npmName: "spaced", moveName: "spaced", sanitized: false }],
+    ["with spaces", { dirName: "with spaces", npmName: "with spaces", moveName: "with_spaces", sanitized: true }],
+  ];
+
+  it.each(cases)("derives names for %j", (input, expected) => {
+    expect(resolveProjectNames(input)).toEqual(expected);
+  });
+
+  it.each(["", "   ", ".", "..", "/", "////"])(
+    "rejects %j as an invalid project name",
+    (input) => {
+      expect(() => resolveProjectNames(input)).toThrow(InvalidProjectNameError);
+    }
+  );
+});
+
 describe("initCommand", () => {
   let tmpParent: string;
   let origCwd: string;
   let exitSpy: ReturnType<typeof vi.spyOn>;
+  let warnSpy: ReturnType<typeof vi.spyOn>;
 
   beforeEach(() => {
     promptsMock.mockReset();
@@ -48,6 +77,7 @@ describe("initCommand", () => {
       }) as never);
     vi.spyOn(console, "log").mockImplementation(() => undefined);
     vi.spyOn(console, "error").mockImplementation(() => undefined);
+    warnSpy = vi.spyOn(console, "warn").mockImplementation(() => undefined);
   });
 
   afterEach(() => {
@@ -59,9 +89,9 @@ describe("initCommand", () => {
   });
 
   it("happy path: scaffolds a project from the canonical template", async () => {
-    await initCommand("my-test-project");
+    await initCommand("my_test_project");
 
-    const target = join(tmpParent, "my-test-project");
+    const target = join(tmpParent, "my_test_project");
     expect(existsSync(target)).toBe(true);
     // Canonical files at the project root.
     expect(existsSync(join(target, "package.json"))).toBe(true);
@@ -78,32 +108,37 @@ describe("initCommand", () => {
     // Excluded template-development directory.
     expect(existsSync(join(target, "types"))).toBe(false);
     expect(existsSync(join(target, ".vscode"))).toBe(false);
+    // Move.toml gets a valid Move identifier.
+    const moveToml = readFileSync(join(target, "move", "Move.toml"), "utf-8");
+    expect(moveToml).toContain('name = "my_test_project"');
+    expect(moveToml).not.toContain("{{movePackageName}}");
+    expect(moveToml).not.toContain("{{projectName}}");
   });
 
   it("substitutes {{projectName}} placeholders inside template files", async () => {
-    await initCommand("substituted-project");
+    await initCommand("substituted_project");
 
     const pkg = readFileSync(
-      join(tmpParent, "substituted-project", "package.json"),
+      join(tmpParent, "substituted_project", "package.json"),
       "utf-8"
     );
-    expect(pkg).toContain("substituted-project");
+    expect(pkg).toContain("substituted_project");
     expect(pkg).not.toContain("{{projectName}}");
 
     const readme = readFileSync(
-      join(tmpParent, "substituted-project", "README.md"),
+      join(tmpParent, "substituted_project", "README.md"),
       "utf-8"
     );
-    expect(readme).toContain("substituted-project");
+    expect(readme).toContain("substituted_project");
   });
 
   it("prompts for project name when none is provided", async () => {
-    promptsMock.mockResolvedValueOnce({ projectName: "from-prompt" });
+    promptsMock.mockResolvedValueOnce({ projectName: "from_prompt" });
 
     await initCommand();
 
     expect(promptsMock).toHaveBeenCalledTimes(1);
-    expect(existsSync(join(tmpParent, "from-prompt"))).toBe(true);
+    expect(existsSync(join(tmpParent, "from_prompt"))).toBe(true);
   });
 
   it("exits 0 when the user Ctrl+Cs the prompt (no project created)", async () => {
@@ -116,10 +151,60 @@ describe("initCommand", () => {
   it("exits 1 when the template copy step hits an unwriteable target", async () => {
     // Plant a directory where the command will try to write package.json
     // as a file — fs.writeFile rejects with EISDIR.
-    const targetName = "blocked-project";
+    const targetName = "blocked_project";
     mkdirSync(join(tmpParent, targetName, "package.json"), { recursive: true });
 
     await expect(initCommand(targetName)).rejects.toThrow("__test_exit_1__");
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
+
+  it("sanitizes Move.toml for hyphenated names but keeps package.json original", async () => {
+    await initCommand("my-project");
+
+    const target = join(tmpParent, "my-project");
+    expect(existsSync(target)).toBe(true);
+    // package.json keeps the original (npm allows hyphens).
+    const pkg = readFileSync(join(target, "package.json"), "utf-8");
+    expect(pkg).toContain('"my-project"');
+    // Move.toml gets the sanitized identifier.
+    const moveToml = readFileSync(join(target, "move", "Move.toml"), "utf-8");
+    expect(moveToml).toContain('name = "my_project"');
+    expect(moveToml).not.toContain('"my-project"');
+    // Warning was emitted.
+    expect(warnSpy).toHaveBeenCalled();
+    const warningText = warnSpy.mock.calls.flat().join(" ");
+    expect(warningText).toContain("my-project");
+    expect(warningText).toContain("my_project");
+  });
+
+  it("with a path argument, creates the dir at the full path and sanitizes Move.toml", async () => {
+    const nestedPath = join(tmpParent, "nested", "sub-project");
+
+    await initCommand(nestedPath);
+
+    expect(existsSync(nestedPath)).toBe(true);
+    const moveToml = readFileSync(join(nestedPath, "move", "Move.toml"), "utf-8");
+    expect(moveToml).toContain('name = "sub_project"');
+    const pkg = readFileSync(join(nestedPath, "package.json"), "utf-8");
+    expect(pkg).toContain('"sub-project"');
+  });
+
+  it("prefixes Move.toml package name with pkg_ for names that start with a digit", async () => {
+    await initCommand("123abc");
+
+    const moveToml = readFileSync(
+      join(tmpParent, "123abc", "move", "Move.toml"),
+      "utf-8"
+    );
+    expect(moveToml).toContain('name = "pkg_123abc"');
+    expect(warnSpy).toHaveBeenCalled();
+  });
+
+  it.each([".", "..", "/", "   "])(
+    "rejects %j as an invalid project name and exits 1",
+    async (input) => {
+      await expect(initCommand(input)).rejects.toThrow("__test_exit_1__");
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    }
+  );
 });

package/src/commands/__tests__/run.test.ts

@@ -179,9 +179,9 @@ describe("runCommand — orchestrator", () => {
   // the workspace's own node_modules from __dirname's perspective, so the
   // fallback never throws. Patching `module.createRequire` to inject a
   // failing resolver fails with "Cannot redefine property" because the
-  // ESM-imported `node:module` is read-only. The branch is exercised by
-  // the existing "tsx not found" runtime failure in CI when tsx is
-  // accidentally missing from a published consumer. M4 integration covers.
+  // ESM-imported `node:module` is read-only. The branch is exercised
+  // by the integration suite via the "tsx not found" runtime failure
+  // when tsx is missing from a published consumer.
 
   it("catches and exits 1 when runCli throws (spawn-time failure)", async () => {
     runCliMock.mockRejectedValueOnce(new Error("ENOENT: node not found"));

package/src/commands/init.ts

@@ -8,6 +8,60 @@ import { logger, createSpinnerChain, formatCommand } from "../ui/index.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+export class InvalidProjectNameError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidProjectNameError";
+  }
+}
+
+export interface ProjectNames {
+  /** User input as-is (after trim) — used for the filesystem target. */
+  dirName: string;
+  /** Basename of the resolved path — used for package.json + README.md. */
+  npmName: string;
+  /** Valid Move identifier — used for Move.toml. */
+  moveName: string;
+  /** True when moveName had to diverge from npmName to satisfy Move identifier rules. */
+  sanitized: boolean;
+}
+
+/**
+ * Derive filesystem, npm, and Move identifier names from a single user input.
+ *
+ * Move identifiers must match `[a-zA-Z_][a-zA-Z0-9_]*`. npm package names are
+ * looser (hyphens allowed). The filesystem accepts almost anything. Rather
+ * than reject inputs that would compile fine for npm but not for Move, we
+ * sanitize the Move identifier and leave the npm name + dir unchanged.
+ */
+export function resolveProjectNames(input: string): ProjectNames {
+  const trimmed = input.trim();
+  if (
+    trimmed === "" ||
+    trimmed === "." ||
+    trimmed === ".." ||
+    /^\/+$/.test(trimmed)
+  ) {
+    throw new InvalidProjectNameError(
+      `Project name '${input}' must include at least one character besides path separators.`
+    );
+  }
+
+  const dirName = trimmed;
+  const npmName = path.basename(path.resolve(trimmed));
+  let moveName = npmName.replace(/[^a-zA-Z0-9_]/g, "_");
+  if (!/^[a-zA-Z_]/.test(moveName)) {
+    moveName = `pkg_${moveName}`;
+  }
+
+  return {
+    dirName,
+    npmName,
+    moveName,
+    sanitized: moveName !== npmName,
+  };
+}
+
 /**
  * Initialize a new Movehat project with template files
  *
@@ -49,8 +103,25 @@ export default async function initCommand(projectName?: string) {
     projectName = response.projectName;
   }
 
-  const targetDir = projectName!;
-  const projectPath = path.resolve(process.cwd(), targetDir);
+  let names: ProjectNames;
+  try {
+    names = resolveProjectNames(projectName!);
+  } catch (error) {
+    if (error instanceof InvalidProjectNameError) {
+      logger.error(error.message);
+      process.exit(1);
+    }
+    throw error;
+  }
+
+  const { dirName, npmName, moveName, sanitized } = names;
+  const projectPath = path.resolve(process.cwd(), dirName);
+
+  if (sanitized) {
+    logger.warning(
+      `'${npmName}' is not a valid Move identifier; using '${moveName}' for move/Move.toml. (package.json keeps '${npmName}'.)`
+    );
+  }
 
   logger.newline();
   logger.info(`Initializing new Movehat project in ${projectPath}...`);
@@ -67,7 +138,7 @@ export default async function initCommand(projectName?: string) {
       await copyFile(
         path.join(templatesDir, "package.json"),
         path.join(projectPath, "package.json"),
-        { projectName: projectName! }
+        { projectName: npmName }
       );
 
       await copyFile(
@@ -98,7 +169,7 @@ export default async function initCommand(projectName?: string) {
       await copyFile(
         path.join(templatesDir, "README.md"),
         path.join(projectPath, "README.md"),
-        { projectName: projectName! }
+        { projectName: npmName }
       );
     });
 
@@ -107,7 +178,7 @@ export default async function initCommand(projectName?: string) {
       await copyDir(
         path.join(templatesDir, "move"),
         path.join(projectPath, "move"),
-        { projectName: projectName! }
+        { projectName: npmName, movePackageName: moveName }
       );
     });
 
@@ -136,7 +207,7 @@ export default async function initCommand(projectName?: string) {
 
     // Next steps
     logger.section('Next steps');
-    logger.item(formatCommand(`cd ${projectName}`), 2);
+    logger.item(formatCommand(`cd ${dirName}`), 2);
     logger.item(formatCommand('cp .env.example .env'), 2);
     logger.plain('     # Edit .env with your credentials');
     logger.item(formatCommand('npm install'), 2);

package/src/core/AccountManager.ts

@@ -1,14 +1,13 @@
 import {
   Account,
   Ed25519PrivateKey,
+  PrivateKey,
+  PrivateKeyVariants,
 } from "@aptos-labs/ts-sdk";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import { MovehatConfig } from "../types/config.js";
 
-/**
- * Represents a stored account in the pool
- */
 export interface StoredAccount {
   label?: string | undefined;
   privateKey: string;
@@ -16,9 +15,6 @@ export interface StoredAccount {
   createdAt: number;
 }
 
-/**
- * Account pool storage structure
- */
 interface AccountPool {
   accounts: StoredAccount[];
   labelMap: Record<string, string>; // label → address
@@ -31,10 +27,18 @@ interface AccountPool {
  * Provides a pool of reusable test accounts with labels for better test readability.
  */
 export class AccountManager {
+  // Class-static maps: shared across every consumer in the same Node
+  // process (e.g. two Harness instances). Re-using a label across
+  // "sessions" overwrites the labelMap entry. Documented + fixed by
+  // contract in `AccountManager.global-state.test.ts` (audit F8).
   private static pool: Map<string, Account> = new Map(); // address → Account
   private static privateKeys: Map<string, string> = new Map(); // address → privateKey hex
   private static labelMap: Map<string, string> = new Map(); // label → address
   private static poolLoaded = false;
+  // `defaultPoolPath` is captured ONCE at module-import time. A later
+  // `process.chdir(...)` does NOT redirect the save destination — pass
+  // an explicit `poolPath` to `saveAccountPool`/`loadAccountPool` when
+  // per-test isolation matters. See audit finding F8.
   private static defaultPoolPath = join(process.cwd(), ".movehat", "accounts");
 
   /**
@@ -49,7 +53,6 @@ export class AccountManager {
    * const randomAccount = AccountManager.getTestAccount();
    */
   static getTestAccount(label?: string): Account {
-    // If label provided, try to get existing labeled account
     if (label) {
       const existingAccount = this.getAccountByLabel(label);
       if (existingAccount) {
@@ -57,7 +60,6 @@ export class AccountManager {
       }
     }
 
-    // Create new account with optional label
     return this.createAccount(label, false);
   }
 
@@ -76,13 +78,9 @@ export class AccountManager {
     const account = Account.generate();
     const address = account.accountAddress.toString();
 
-    // Add to pool
     this.pool.set(address, account);
-
-    // Store private key
     this.privateKeys.set(address, account.privateKey.toString());
 
-    // If label provided, add to label map
     if (label) {
       this.labelMap.set(label, address);
     }
@@ -143,7 +141,14 @@ export class AccountManager {
    * const account = AccountManager.loadAccountFromPrivateKey("0xabc123...");
    */
   static loadAccountFromPrivateKey(privateKeyHex: string): Account {
-    const privateKey = new Ed25519PrivateKey(privateKeyHex);
+    // Format into AIP-80 shape (`ed25519-priv-0x…`) before constructing
+    // the SDK type. Without this, raw-hex inputs trigger a noisy
+    // deprecation warning from `@aptos-labs/ts-sdk` on every call.
+    const formatted = PrivateKey.formatPrivateKey(
+      privateKeyHex,
+      PrivateKeyVariants.Ed25519,
+    );
+    const privateKey = new Ed25519PrivateKey(formatted);
     const account = Account.fromPrivateKey({ privateKey });
     const address = account.accountAddress.toString();