movehat 0.2.1 → 0.2.2

package/src/__tests__/exports.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import * as publicSurface from "../index.js";
+
+/**
+ * Locks the public export surface of `movehat`. Adding a new symbol
+ * is a deliberate API change; removing one is a breaking change.
+ * Update this list (and the CHANGELOG) when the surface evolves.
+ */
+const EXPECTED_RUNTIME_EXPORTS = [
+  "Harness",
+  "HarnessDisposedError",
+  "ForkManager",
+  "MovementApiClient",
+  "ForkStorage",
+  "ForkServer",
+  "ModuleAlreadyDeployedError",
+  "PostPublishError",
+  "initRuntime",
+] as const;
+
+describe("public export surface (movehat root)", () => {
+  it.each(EXPECTED_RUNTIME_EXPORTS)("exports %s as a runtime value", (name) => {
+    expect(publicSurface[name as keyof typeof publicSurface]).toBeDefined();
+  });
+
+  // Type-only exports cannot be probed at runtime; the assertion is
+  // that the module imports successfully (failing types-only export
+  // would surface as a TS error in `pnpm check:example`).
+  it("imports without errors", () => {
+    expect(typeof publicSurface).toBe("object");
+  });
+});

package/src/__tests__/fixtures/sigint-deploy-harness.ts

@@ -9,9 +9,10 @@
  *      send SIGINT mid-flight.
  *   2. Drive `Publisher.deploy()` against the fake adapter using a
  *      synthetic MovehatConfig + Account read from env vars.
- *   3. Write the chosen `movehat-deploy-<uuid>` profile name to stdout
- *      as JSON (`{"profile": "..."}`) before the slow publish so the
- *      parent test knows which key to look for after SIGINT.
+ *   3. Write the temp key file path to stdout as JSON
+ *      (`{"keyFile": "/tmp/movehat-key-<uuid>"}`) before the slow
+ *      publish so the parent test knows which file to look for after
+ *      SIGINT.
  *   4. If the deploy completes naturally (test failure case), exit 0.
  *   5. When SIGINT arrives, Publisher's signal handler runs synchronous
  *      cleanup and `setImmediate(() => process.exit(130))`.
@@ -61,10 +62,10 @@ async function main() {
         return { exitCode: 0, stdout: "built", stderr: "" };
       }
       if (input.args[1] === "publish") {
-        // Surface the unique profile name to the parent BEFORE blocking.
-        const profileIdx = input.args.indexOf("--profile");
-        const profile = profileIdx >= 0 ? input.args[profileIdx + 1] : "";
-        process.stdout.write(JSON.stringify({ profile }) + "\n");
+        // Surface the temp key file path to the parent BEFORE blocking.
+        const keyFileIdx = input.args.indexOf("--private-key-file");
+        const keyFile = keyFileIdx >= 0 ? input.args[keyFileIdx + 1] : "";
+        process.stdout.write(JSON.stringify({ keyFile }) + "\n");
         // Hold long enough for the parent to deliver SIGINT.
         await new Promise((r) => setTimeout(r, 3000));
         return {

package/src/__tests__/fork/api.test.ts

@@ -77,6 +77,11 @@ function setupGetCapture(): {
 
     const fakeReq = new EventEmitter() as unknown as ClientRequest;
     (fakeReq as unknown as { end: () => void }).end = () => {};
+    // F3: api.ts now installs a setTimeout on the request and may call
+    // destroy() on overflow / timeout. Stub both so this happy-path
+    // capture mock still satisfies the new contract.
+    (fakeReq as unknown as { setTimeout: (ms: number, cb?: () => void) => void }).setTimeout = () => {};
+    (fakeReq as unknown as { destroy: () => void }).destroy = () => {};
 
     if (callback) {
       const body = JSON.stringify({

package/src/__tests__/fork/api.timeout.test.ts

@@ -0,0 +1,150 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { ClientRequest, IncomingMessage } from "node:http";
+import { EventEmitter } from "node:events";
+
+/**
+ * F3 — MovementApiClient must bound responses by time AND bytes.
+ *
+ * Without these guards a malicious / hung upstream can:
+ *   - leak the request promise forever (never emits 'end'), or
+ *   - exhaust heap by pushing unbounded `data` chunks.
+ *
+ * Strategy mirrors src/__tests__/fork/api.test.ts: vi.mock node:http
+ * and node:https, intercept `client.get(url, options, cb)`, and feed
+ * a controllable `IncomingMessage` to the callback. The fake
+ * `ClientRequest` exposes `setTimeout`, `destroy`, and emits 'error' /
+ * 'timeout' so we can drive the failure modes from the test.
+ */
+
+interface FakeReq extends EventEmitter {
+  end(): void;
+  destroy(err?: Error): void;
+  setTimeout(ms: number, cb?: () => void): void;
+  destroyed: boolean;
+}
+
+const httpsGet = vi.fn();
+const httpGet = vi.fn();
+
+vi.mock("https", () => ({ default: { get: httpsGet }, get: httpsGet }));
+vi.mock("http", () => ({ default: { get: httpGet }, get: httpGet }));
+
+function makeFakeReq(): FakeReq {
+  const req = new EventEmitter() as FakeReq;
+  req.destroyed = false;
+  let timeoutHandle: NodeJS.Timeout | undefined;
+  req.end = () => {};
+  req.destroy = (err?: Error) => {
+    req.destroyed = true;
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+    setImmediate(() => req.emit("error", err ?? new Error("destroyed")));
+  };
+  req.setTimeout = (ms: number, cb?: () => void) => {
+    timeoutHandle = setTimeout(() => {
+      req.emit("timeout");
+      if (cb) cb();
+    }, ms);
+    // Don't keep the event loop alive — Node sets this itself but the
+    // mock has no native socket to inherit from.
+    timeoutHandle.unref?.();
+  };
+  return req;
+}
+
+function makeUnresolvableResponse(): IncomingMessage {
+  const res = new EventEmitter() as unknown as IncomingMessage;
+  (res as unknown as { statusCode: number }).statusCode = 200;
+  return res;
+}
+
+function makeStreamingResponse(
+  bytesPerChunk: number,
+  chunks: number
+): IncomingMessage {
+  const res = new EventEmitter() as unknown as IncomingMessage;
+  (res as unknown as { statusCode: number }).statusCode = 200;
+  setImmediate(() => {
+    let i = 0;
+    const pump = () => {
+      if (i >= chunks) {
+        (res as unknown as EventEmitter).emit("end");
+        return;
+      }
+      (res as unknown as EventEmitter).emit(
+        "data",
+        Buffer.alloc(bytesPerChunk, 0x61)
+      );
+      i++;
+      setImmediate(pump);
+    };
+    pump();
+  });
+  return res;
+}
+
+describe("F3 — MovementApiClient timeouts and byte cap", () => {
+  beforeEach(() => {
+    httpsGet.mockReset();
+    httpGet.mockReset();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("rejects with a timeout error when the upstream never responds", async () => {
+    const fakeReq = makeFakeReq();
+    httpGet.mockImplementation(
+      (
+        _url: string,
+        options: unknown,
+        cb?: (res: IncomingMessage) => void
+      ) => {
+        const callback =
+          typeof options === "function"
+            ? (options as (r: IncomingMessage) => void)
+            : cb;
+        if (callback) callback(makeUnresolvableResponse());
+        return fakeReq as unknown as ClientRequest;
+      }
+    );
+
+    const { MovementApiClient } = await import("../../fork/api.js");
+    const client = new MovementApiClient("http://hung.example/v1", undefined, {
+      timeoutMs: 25,
+      maxBytes: 1024 * 1024,
+    });
+
+    await expect(client.getLedgerInfo()).rejects.toThrow(/timed out|timeout/i);
+    expect(fakeReq.destroyed).toBe(true);
+  });
+
+  it("rejects and destroys the request when the response exceeds maxBytes", async () => {
+    const fakeReq = makeFakeReq();
+    httpGet.mockImplementation(
+      (
+        _url: string,
+        options: unknown,
+        cb?: (res: IncomingMessage) => void
+      ) => {
+        const callback =
+          typeof options === "function"
+            ? (options as (r: IncomingMessage) => void)
+            : cb;
+        if (callback) callback(makeStreamingResponse(2048, 100));
+        return fakeReq as unknown as ClientRequest;
+      }
+    );
+
+    const { MovementApiClient } = await import("../../fork/api.js");
+    const client = new MovementApiClient("http://big.example/v1", undefined, {
+      timeoutMs: 5000,
+      maxBytes: 4096,
+    });
+
+    await expect(client.getLedgerInfo()).rejects.toThrow(
+      /maxBytes|too large|exceeded/i
+    );
+    expect(fakeReq.destroyed).toBe(true);
+  });
+});

package/src/commands/__tests__/compile.toml-mutation.test.ts

@@ -0,0 +1,77 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { vol, fs as memfsFs } from "memfs";
+
+vi.mock("fs", () => {
+  return {
+    default: memfsFs,
+    ...memfsFs,
+  };
+});
+
+import { updateMoveToml } from "../compile.js";
+
+/**
+ * F7 — `movehat compile` mutates `Move.toml` when it detects a named
+ * address that isn't declared yet. This test pins down the current
+ * behavior so a future change (introducing a `--write` flag, moving
+ * the mutation to a dedicated `movehat update-toml` command, etc.)
+ * MUST update this test alongside the source change.
+ *
+ * Audit finding F7 is marked "no concluyente — requires product
+ * decision": the mutation may be the right UX default for the
+ * Hardhat-style workflow, but the asymmetry (compile reading + writing)
+ * deserves to be a deliberate choice. See ROADMAP follow-up.
+ */
+describe("F7 — updateMoveToml mutates Move.toml on disk (current behavior captured)", () => {
+  beforeEach(() => vol.reset());
+  afterEach(() => vol.reset());
+
+  it("writes new named addresses into [addresses] and [dev-addresses] when missing", () => {
+    const before = `[package]
+name = "captured"
+version = "1.0.0"
+
+[addresses]
+existing = "_"
+
+[dev-addresses]
+existing = "0xcafe"
+
+[dependencies]
+`;
+    vol.fromJSON({ "/move/Move.toml": before });
+
+    const detected = new Set(["existing", "audit_module"]);
+    const added = updateMoveToml("/move", detected);
+
+    expect(added).toEqual(["audit_module"]);
+
+    // Source-of-truth assertion: the on-disk file CHANGED. F7 is the
+    // observation that a "compile" verb has a side effect on the user's
+    // working tree. The behavior is captured here so an unintended
+    // regression (or a deliberate revisit) cannot land silently.
+    const after = vol.readFileSync("/move/Move.toml", "utf-8") as string;
+    expect(after).not.toBe(before);
+    expect(after).toContain("audit_module = \"_\"");
+  });
+
+  it("returns an empty list and leaves Move.toml byte-identical when all named addresses are already declared", () => {
+    const before = `[package]
+name = "captured"
+
+[addresses]
+existing = "_"
+
+[dev-addresses]
+existing = "0xcafe"
+`;
+    vol.fromJSON({ "/move/Move.toml": before });
+
+    const added = updateMoveToml("/move", new Set(["existing"]));
+    expect(added).toEqual([]);
+    // No mutation in the no-op path — the asymmetry only triggers when
+    // detected ⊄ declared. Useful boundary for the F7 product decision.
+    const after = vol.readFileSync("/move/Move.toml", "utf-8") as string;
+    expect(after).toBe(before);
+  });
+});

package/src/commands/__tests__/init.test.ts

@@ -13,7 +13,8 @@ vi.mock("../../helpers/banner.js", () => ({
   printMovehatBanner: () => undefined,
 }));
 
-const { default: initCommand } = await import("../init.js");
+const initModule = await import("../init.js");
+const { default: initCommand, resolveProjectNames, InvalidProjectNameError } = initModule;
 
 /**
  * Strategy: real tmpdir + real fs ops (matches §6.1's example-as-canonical
@@ -28,10 +29,38 @@ const { default: initCommand } = await import("../init.js");
  * to `src/templates/` cleanly. No bundling step required.
  */
 
+describe("resolveProjectNames", () => {
+  const cases: Array<[
+    string,
+    { dirName: string; npmName: string; moveName: string; sanitized: boolean }
+  ]> = [
+    ["my_project", { dirName: "my_project", npmName: "my_project", moveName: "my_project", sanitized: false }],
+    ["my-project", { dirName: "my-project", npmName: "my-project", moveName: "my_project", sanitized: true }],
+    ["/tmp/my-project", { dirName: "/tmp/my-project", npmName: "my-project", moveName: "my_project", sanitized: true }],
+    ["123abc", { dirName: "123abc", npmName: "123abc", moveName: "pkg_123abc", sanitized: true }],
+    ["_underscore", { dirName: "_underscore", npmName: "_underscore", moveName: "_underscore", sanitized: false }],
+    ["UPPER", { dirName: "UPPER", npmName: "UPPER", moveName: "UPPER", sanitized: false }],
+    ["  spaced  ", { dirName: "spaced", npmName: "spaced", moveName: "spaced", sanitized: false }],
+    ["with spaces", { dirName: "with spaces", npmName: "with spaces", moveName: "with_spaces", sanitized: true }],
+  ];
+
+  it.each(cases)("derives names for %j", (input, expected) => {
+    expect(resolveProjectNames(input)).toEqual(expected);
+  });
+
+  it.each(["", "   ", ".", "..", "/", "////"])(
+    "rejects %j as an invalid project name",
+    (input) => {
+      expect(() => resolveProjectNames(input)).toThrow(InvalidProjectNameError);
+    }
+  );
+});
+
 describe("initCommand", () => {
   let tmpParent: string;
   let origCwd: string;
   let exitSpy: ReturnType<typeof vi.spyOn>;
+  let warnSpy: ReturnType<typeof vi.spyOn>;
 
   beforeEach(() => {
     promptsMock.mockReset();
@@ -48,6 +77,7 @@ describe("initCommand", () => {
       }) as never);
     vi.spyOn(console, "log").mockImplementation(() => undefined);
     vi.spyOn(console, "error").mockImplementation(() => undefined);
+    warnSpy = vi.spyOn(console, "warn").mockImplementation(() => undefined);
   });
 
   afterEach(() => {
@@ -59,9 +89,9 @@ describe("initCommand", () => {
   });
 
   it("happy path: scaffolds a project from the canonical template", async () => {
-    await initCommand("my-test-project");
+    await initCommand("my_test_project");
 
-    const target = join(tmpParent, "my-test-project");
+    const target = join(tmpParent, "my_test_project");
     expect(existsSync(target)).toBe(true);
     // Canonical files at the project root.
     expect(existsSync(join(target, "package.json"))).toBe(true);
@@ -78,32 +108,37 @@ describe("initCommand", () => {
     // Excluded template-development directory.
     expect(existsSync(join(target, "types"))).toBe(false);
     expect(existsSync(join(target, ".vscode"))).toBe(false);
+    // Move.toml gets a valid Move identifier.
+    const moveToml = readFileSync(join(target, "move", "Move.toml"), "utf-8");
+    expect(moveToml).toContain('name = "my_test_project"');
+    expect(moveToml).not.toContain("{{movePackageName}}");
+    expect(moveToml).not.toContain("{{projectName}}");
   });
 
   it("substitutes {{projectName}} placeholders inside template files", async () => {
-    await initCommand("substituted-project");
+    await initCommand("substituted_project");
 
     const pkg = readFileSync(
-      join(tmpParent, "substituted-project", "package.json"),
+      join(tmpParent, "substituted_project", "package.json"),
       "utf-8"
     );
-    expect(pkg).toContain("substituted-project");
+    expect(pkg).toContain("substituted_project");
     expect(pkg).not.toContain("{{projectName}}");
 
     const readme = readFileSync(
-      join(tmpParent, "substituted-project", "README.md"),
+      join(tmpParent, "substituted_project", "README.md"),
       "utf-8"
     );
-    expect(readme).toContain("substituted-project");
+    expect(readme).toContain("substituted_project");
   });
 
   it("prompts for project name when none is provided", async () => {
-    promptsMock.mockResolvedValueOnce({ projectName: "from-prompt" });
+    promptsMock.mockResolvedValueOnce({ projectName: "from_prompt" });
 
     await initCommand();
 
     expect(promptsMock).toHaveBeenCalledTimes(1);
-    expect(existsSync(join(tmpParent, "from-prompt"))).toBe(true);
+    expect(existsSync(join(tmpParent, "from_prompt"))).toBe(true);
   });
 
   it("exits 0 when the user Ctrl+Cs the prompt (no project created)", async () => {
@@ -116,10 +151,60 @@ describe("initCommand", () => {
   it("exits 1 when the template copy step hits an unwriteable target", async () => {
     // Plant a directory where the command will try to write package.json
     // as a file — fs.writeFile rejects with EISDIR.
-    const targetName = "blocked-project";
+    const targetName = "blocked_project";
     mkdirSync(join(tmpParent, targetName, "package.json"), { recursive: true });
 
     await expect(initCommand(targetName)).rejects.toThrow("__test_exit_1__");
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
+
+  it("sanitizes Move.toml for hyphenated names but keeps package.json original", async () => {
+    await initCommand("my-project");
+
+    const target = join(tmpParent, "my-project");
+    expect(existsSync(target)).toBe(true);
+    // package.json keeps the original (npm allows hyphens).
+    const pkg = readFileSync(join(target, "package.json"), "utf-8");
+    expect(pkg).toContain('"my-project"');
+    // Move.toml gets the sanitized identifier.
+    const moveToml = readFileSync(join(target, "move", "Move.toml"), "utf-8");
+    expect(moveToml).toContain('name = "my_project"');
+    expect(moveToml).not.toContain('"my-project"');
+    // Warning was emitted.
+    expect(warnSpy).toHaveBeenCalled();
+    const warningText = warnSpy.mock.calls.flat().join(" ");
+    expect(warningText).toContain("my-project");
+    expect(warningText).toContain("my_project");
+  });
+
+  it("with a path argument, creates the dir at the full path and sanitizes Move.toml", async () => {
+    const nestedPath = join(tmpParent, "nested", "sub-project");
+
+    await initCommand(nestedPath);
+
+    expect(existsSync(nestedPath)).toBe(true);
+    const moveToml = readFileSync(join(nestedPath, "move", "Move.toml"), "utf-8");
+    expect(moveToml).toContain('name = "sub_project"');
+    const pkg = readFileSync(join(nestedPath, "package.json"), "utf-8");
+    expect(pkg).toContain('"sub-project"');
+  });
+
+  it("prefixes Move.toml package name with pkg_ for names that start with a digit", async () => {
+    await initCommand("123abc");
+
+    const moveToml = readFileSync(
+      join(tmpParent, "123abc", "move", "Move.toml"),
+      "utf-8"
+    );
+    expect(moveToml).toContain('name = "pkg_123abc"');
+    expect(warnSpy).toHaveBeenCalled();
+  });
+
+  it.each([".", "..", "/", "   "])(
+    "rejects %j as an invalid project name and exits 1",
+    async (input) => {
+      await expect(initCommand(input)).rejects.toThrow("__test_exit_1__");
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    }
+  );
 });

package/src/commands/init.ts

@@ -8,6 +8,60 @@ import { logger, createSpinnerChain, formatCommand } from "../ui/index.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+export class InvalidProjectNameError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidProjectNameError";
+  }
+}
+
+export interface ProjectNames {
+  /** User input as-is (after trim) — used for the filesystem target. */
+  dirName: string;
+  /** Basename of the resolved path — used for package.json + README.md. */
+  npmName: string;
+  /** Valid Move identifier — used for Move.toml. */
+  moveName: string;
+  /** True when moveName had to diverge from npmName to satisfy Move identifier rules. */
+  sanitized: boolean;
+}
+
+/**
+ * Derive filesystem, npm, and Move identifier names from a single user input.
+ *
+ * Move identifiers must match `[a-zA-Z_][a-zA-Z0-9_]*`. npm package names are
+ * looser (hyphens allowed). The filesystem accepts almost anything. Rather
+ * than reject inputs that would compile fine for npm but not for Move, we
+ * sanitize the Move identifier and leave the npm name + dir unchanged.
+ */
+export function resolveProjectNames(input: string): ProjectNames {
+  const trimmed = input.trim();
+  if (
+    trimmed === "" ||
+    trimmed === "." ||
+    trimmed === ".." ||
+    /^\/+$/.test(trimmed)
+  ) {
+    throw new InvalidProjectNameError(
+      `Project name '${input}' must include at least one character besides path separators.`
+    );
+  }
+
+  const dirName = trimmed;
+  const npmName = path.basename(path.resolve(trimmed));
+  let moveName = npmName.replace(/[^a-zA-Z0-9_]/g, "_");
+  if (!/^[a-zA-Z_]/.test(moveName)) {
+    moveName = `pkg_${moveName}`;
+  }
+
+  return {
+    dirName,
+    npmName,
+    moveName,
+    sanitized: moveName !== npmName,
+  };
+}
+
 /**
  * Initialize a new Movehat project with template files
  *
@@ -49,8 +103,25 @@ export default async function initCommand(projectName?: string) {
     projectName = response.projectName;
   }
 
-  const targetDir = projectName!;
-  const projectPath = path.resolve(process.cwd(), targetDir);
+  let names: ProjectNames;
+  try {
+    names = resolveProjectNames(projectName!);
+  } catch (error) {
+    if (error instanceof InvalidProjectNameError) {
+      logger.error(error.message);
+      process.exit(1);
+    }
+    throw error;
+  }
+
+  const { dirName, npmName, moveName, sanitized } = names;
+  const projectPath = path.resolve(process.cwd(), dirName);
+
+  if (sanitized) {
+    logger.warning(
+      `'${npmName}' is not a valid Move identifier; using '${moveName}' for move/Move.toml. (package.json keeps '${npmName}'.)`
+    );
+  }
 
   logger.newline();
   logger.info(`Initializing new Movehat project in ${projectPath}...`);
@@ -67,7 +138,7 @@ export default async function initCommand(projectName?: string) {
       await copyFile(
         path.join(templatesDir, "package.json"),
         path.join(projectPath, "package.json"),
-        { projectName: projectName! }
+        { projectName: npmName }
       );
 
       await copyFile(
@@ -98,7 +169,7 @@ export default async function initCommand(projectName?: string) {
       await copyFile(
         path.join(templatesDir, "README.md"),
         path.join(projectPath, "README.md"),
-        { projectName: projectName! }
+        { projectName: npmName }
       );
     });
 
@@ -107,7 +178,7 @@ export default async function initCommand(projectName?: string) {
       await copyDir(
         path.join(templatesDir, "move"),
         path.join(projectPath, "move"),
-        { projectName: projectName! }
+        { projectName: npmName, movePackageName: moveName }
       );
     });
 
@@ -136,7 +207,7 @@ export default async function initCommand(projectName?: string) {
 
     // Next steps
     logger.section('Next steps');
-    logger.item(formatCommand(`cd ${projectName}`), 2);
+    logger.item(formatCommand(`cd ${dirName}`), 2);
     logger.item(formatCommand('cp .env.example .env'), 2);
     logger.plain('     # Edit .env with your credentials');
     logger.item(formatCommand('npm install'), 2);

package/src/core/AccountManager.ts

@@ -1,6 +1,8 @@
 import {
   Account,
   Ed25519PrivateKey,
+  PrivateKey,
+  PrivateKeyVariants,
 } from "@aptos-labs/ts-sdk";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -25,10 +27,18 @@ interface AccountPool {
  * Provides a pool of reusable test accounts with labels for better test readability.
  */
 export class AccountManager {
+  // Class-static maps: shared across every consumer in the same Node
+  // process (e.g. two Harness instances). Re-using a label across
+  // "sessions" overwrites the labelMap entry. Documented + fixed by
+  // contract in `AccountManager.global-state.test.ts` (audit F8).
   private static pool: Map<string, Account> = new Map(); // address → Account
   private static privateKeys: Map<string, string> = new Map(); // address → privateKey hex
   private static labelMap: Map<string, string> = new Map(); // label → address
   private static poolLoaded = false;
+  // `defaultPoolPath` is captured ONCE at module-import time. A later
+  // `process.chdir(...)` does NOT redirect the save destination — pass
+  // an explicit `poolPath` to `saveAccountPool`/`loadAccountPool` when
+  // per-test isolation matters. See audit finding F8.
   private static defaultPoolPath = join(process.cwd(), ".movehat", "accounts");
 
   /**
@@ -131,7 +141,14 @@ export class AccountManager {
    * const account = AccountManager.loadAccountFromPrivateKey("0xabc123...");
    */
   static loadAccountFromPrivateKey(privateKeyHex: string): Account {
-    const privateKey = new Ed25519PrivateKey(privateKeyHex);
+    // Format into AIP-80 shape (`ed25519-priv-0x…`) before constructing
+    // the SDK type. Without this, raw-hex inputs trigger a noisy
+    // deprecation warning from `@aptos-labs/ts-sdk` on every call.
+    const formatted = PrivateKey.formatPrivateKey(
+      privateKeyHex,
+      PrivateKeyVariants.Ed25519,
+    );
+    const privateKey = new Ed25519PrivateKey(formatted);
     const account = Account.fromPrivateKey({ privateKey });
     const address = account.accountAddress.toString();