movehat 0.2.1 → 0.2.3

package/dist/utils/childProcessAdapter.js

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+const DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
 class DefaultChildProcessAdapter {
     run(input) {
@@ -16,9 +17,26 @@ class DefaultChildProcessAdapter {
             });
             const stdoutChunks = [];
             const stderrChunks = [];
+            let totalBytes = 0;
+            let overflowed = false;
+            const maxBuffer = input.maxBuffer ?? DEFAULT_MAX_BUFFER;
+            const onChunk = (chunks) => (chunk) => {
+                if (overflowed)
+                    return;
+                totalBytes += chunk.length;
+                if (totalBytes > maxBuffer) {
+                    overflowed = true;
+                    clearTimer();
+                    input.signal?.removeEventListener('abort', onAbort);
+                    child.kill('SIGTERM');
+                    reject(new Error(`Command output exceeded maxBuffer (${maxBuffer} bytes): ${input.command}`));
+                    return;
+                }
+                chunks.push(chunk);
+            };
             // Streams are null when stdio is 'inherit'; the `?.` covers that.
-            child.stdout?.on('data', (chunk) => stdoutChunks.push(chunk));
-            child.stderr?.on('data', (chunk) => stderrChunks.push(chunk));
+            child.stdout?.on('data', onChunk(stdoutChunks));
+            child.stderr?.on('data', onChunk(stderrChunks));
             let timeoutHandle;
             const clearTimer = () => {
                 if (timeoutHandle)

package/dist/utils/childProcessAdapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"childProcessAdapter.js","sourceRoot":"","sources":["../../src/utils/childProcessAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+F3C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,0BAA0B;IAC9B,GAAG,CAAC,KAAe;QACjB,gEAAgE;QAChE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE3E,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;gBAClD,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;gBAC7B,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aACjE,CAAC,CAAC;YAEH,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,kEAAkE;YAClE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAEtE,IAAI,aAAyC,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,EAAE;gBACtB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC,CAAC;YAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACzB,UAAU,EAAE,CAAC;oBACb,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACjC,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAc;oBACxB,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACrD,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;YAClD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC7B,KAAK;SACN,CAAC,CAAC;QAEH,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,EAAE;YAC7F,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;gBACpE,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,CAAC,MAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACrD,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,0BAA0B,EAAE,CAAC"}
+{"version":3,"file":"childProcessAdapter.js","sourceRoot":"","sources":["../../src/utils/childProcessAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAiD3C,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAuD5C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,0BAA0B;IAC9B,GAAG,CAAC,KAAe;QACjB,gEAAgE;QAChE,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAE3E,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;gBAClD,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;gBAC7B,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aACjE,CAAC,CAAC;YAEH,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;YAExD,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;gBACtD,IAAI,UAAU;oBAAE,OAAO;gBACvB,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;oBAC3B,UAAU,GAAG,IAAI,CAAC;oBAClB,UAAU,EAAE,CAAC;oBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACpD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CACJ,IAAI,KAAK,CACP,sCAAsC,SAAS,YAAY,KAAK,CAAC,OAAO,EAAE,CAC3E,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC;YAEF,kEAAkE;YAClE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAChD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAEhD,IAAI,aAAyC,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,EAAE;gBACtB,IAAI,aAAa;oBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC,CAAC;YAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACzB,UAAU,EAAE,CAAC;oBACb,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACjC,UAAU,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAc;oBACxB,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACrD,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAiB;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;YAClD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC7B,KAAK;SACN,CAAC,CAAC;QAEH,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,EAAE;YAC7F,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;gBACpE,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,CAAC,MAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACrD,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,0BAA0B,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "movehat",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "description": "Hardhat-like development framework for Movement L1 smart contracts",
   "bin": {

package/src/__tests__/deployContract.test.ts

@@ -149,19 +149,19 @@ version = "0.0.1"
     expect(existsSync(join(tmpHome, ".aptos", "config.yaml"))).toBe(false);
   });
 
-  it("two concurrent deploys do not corrupt ~/.aptos/config.yaml (#37)", async () => {
-    // Pre-fix #37: both deploys overwrote ~/.aptos/config.yaml with the
-    // SAME profile name ("default" by default), then both restored
-    // independently. The second deploy's restore would overwrite the
-    // first's profile mid-publish → potential cross-contamination of
-    // private keys / accounts. Post-fix: each deploy uses a unique
-    // movehat-deploy-<uuid> profile name and only deletes its own key
-    // on cleanup. The user's other profiles never get touched.
-    //
-    // The mutex is what makes this safe — without it, the
-    // read-modify-write cycles would race and silently drop a profile.
-
-    // Seed the yaml with an unrelated user profile that MUST survive.
+  it("two concurrent deploys use distinct temp key files and never touch ~/.aptos/config.yaml", async () => {
+    // Each deploy writes its private key to a UUID-named temp file
+    // (see `core/movementProfile.ts:writeTempKeyFile`) and passes
+    // `--private-key-file <path>` to Movement CLI. Concurrent deploys
+    // have no shared state — no profile YAML, no mutex, no race.
+    // Asserts:
+    //   1. Each invocation records a DISTINCT --private-key-file path.
+    //   2. After both deploys finish, neither temp key file remains on
+    //      disk (cleanup ran on both happy paths).
+    //   3. ~/.aptos/config.yaml is byte-identical to what was on disk
+    //      before — the new flow doesn't touch the user's CLI config.
+
+    // Seed an unrelated user profile that MUST survive untouched.
     const aptosDir = join(tmpHome, ".aptos");
     mkdirSync(aptosDir, { recursive: true });
     const preExisting = {
@@ -176,10 +176,11 @@ version = "0.0.1"
     };
     const configPath = join(aptosDir, "config.yaml");
     writeFileSync(configPath, yaml.dump(preExisting), { mode: 0o600 });
+    const initialConfigBytes = readFileSync(configPath, "utf8");
 
-    // Set up two Publisher instances with fake adapters that record their
-    // own --profile argument and inject a small delay on publish so the
-    // critical sections overlap.
+    // Set up two Publisher instances with fake adapters that record
+    // their --private-key-file argument and inject a small delay on
+    // publish so the critical sections overlap.
     function makeDelayedAdapter(label: string): {
       adapter: ChildProcessAdapter;
       captured: { publishCall?: RunInput };
@@ -234,38 +235,41 @@ version = "0.0.1"
       }),
     ]);
 
-    // Both publish calls captured distinct --profile args.
+    // Both publish calls captured distinct --private-key-file args.
     const argsA = a.captured.publishCall!.args;
     const argsB = b.captured.publishCall!.args;
-    const profileArgA = argsA[argsA.indexOf("--profile") + 1];
-    const profileArgB = argsB[argsB.indexOf("--profile") + 1];
-    expect(profileArgA).toMatch(/^movehat-deploy-/);
-    expect(profileArgB).toMatch(/^movehat-deploy-/);
-    expect(profileArgA).not.toBe(profileArgB);
-
-    // After both deploys finish, ~/.aptos/config.yaml contains the
-    // user's original profile and zero movehat-deploy-* profiles.
-    const finalYaml: any = yaml.load(readFileSync(configPath, "utf8"));
-    expect(finalYaml.profiles).toBeDefined();
-    expect(Object.keys(finalYaml.profiles)).toEqual(["user_main"]);
-    expect(finalYaml.profiles.user_main.private_key).toBe(
-      preExisting.profiles.user_main.private_key
-    );
+    const keyFileArgA = argsA[argsA.indexOf("--private-key-file") + 1] as string;
+    const keyFileArgB = argsB[argsB.indexOf("--private-key-file") + 1] as string;
+    expect(keyFileArgA).toMatch(/movehat-key-/);
+    expect(keyFileArgB).toMatch(/movehat-key-/);
+    expect(keyFileArgA).not.toBe(keyFileArgB);
+
+    // Cleanup ran on both — neither temp file persists after the
+    // deploys finished normally.
+    expect(existsSync(keyFileArgA)).toBe(false);
+    expect(existsSync(keyFileArgB)).toBe(false);
+
+    // ~/.aptos/config.yaml byte-identical to pre-deploy state — the new
+    // flow never touches the user's CLI config.
+    expect(readFileSync(configPath, "utf8")).toBe(initialConfigBytes);
   });
 
-  it("SIGINT mid-deploy cleans the profile from ~/.aptos/config.yaml (#36)", async () => {
-    // Pre-fix #36: between the yaml write (private key persisted) and the
-    // finally block, a SIGINT would skip cleanup and leave the user's
-    // private key sitting in ~/.aptos/config.yaml at mode 0o600.
-    // Post-fix: a sync signal handler runs synchronously before exit,
-    // removing the deploy's unique profile from the yaml.
+  it("SIGINT mid-deploy unlinks the temp key file", async () => {
+    // Without sync SIGINT cleanup, the temp private-key file written
+    // by `writeTempKeyFile` would persist on disk after an abnormal
+    // exit (chmod 0o600 prevents other users from reading it, but
+    // forensic recovery from /tmp is still possible). The sync signal
+    // handler runs synchronously before process.exit and unlinks
+    // every active deploy's key file.
     //
     // This test spawns a child process running a harness that drives
     // Publisher.deploy() with a 3-second-delayed publish, then sends
     // SIGINT mid-flight. Vitest's own process is unaffected because
     // the SIGINT goes to the child.
 
-    // Seed an unrelated user profile that MUST survive.
+    // Seed an unrelated user profile that MUST be left untouched —
+    // the new flow doesn't read or write ~/.aptos/config.yaml at all,
+    // so this is an invariant check.
     const aptosDir = join(tmpHome, ".aptos");
     mkdirSync(aptosDir, { recursive: true });
     const configPath = join(aptosDir, "config.yaml");
@@ -283,6 +287,7 @@ version = "0.0.1"
       }),
       { mode: 0o600 }
     );
+    const initialConfigBytes = readFileSync(configPath, "utf8");
 
     const harnessPath = join(__dirname, "fixtures", "sigint-deploy-harness.ts");
     // Resolve tsx's CLI binary by absolute path — the test's tmp cwd has
@@ -302,8 +307,8 @@ version = "0.0.1"
       }
     );
 
-    // Wait for the harness to announce its unique profile name via stdout
-    // (it writes a JSON line `{"profile":"movehat-deploy-XXXX"}` just
+    // Wait for the harness to announce its temp key file path via stdout
+    // (it writes a JSON line `{"keyFile":"/tmp/movehat-key-XXXX"}` just
     // before entering the slow publish step).
     let announced: string | undefined;
     let stdoutBuf = "";
@@ -315,7 +320,7 @@ version = "0.0.1"
         if (!trimmed.startsWith("{")) continue;
         try {
           const parsed = JSON.parse(trimmed);
-          if (typeof parsed.profile === "string") announced = parsed.profile;
+          if (typeof parsed.keyFile === "string") announced = parsed.keyFile;
         } catch {
           /* not a JSON line we care about */
         }
@@ -333,12 +338,17 @@ version = "0.0.1"
     if (!announced) {
       child.kill("SIGKILL");
       throw new Error(
-        `harness never announced profile in 8s.\n` +
+        `harness never announced keyFile in 8s.\n` +
           `stdout so far:\n${stdoutBuf}\n---\nstderr so far:\n${stderrBuf}`
       );
     }
 
-    expect(announced).toMatch(/^movehat-deploy-/);
+    expect(announced).toMatch(/movehat-key-/);
+    // The temp key file is present on disk while the harness is in
+    // the middle of the slow publish (the JSON announcement is emitted
+    // right before the simulated 3s wait, and the file is unlinked
+    // only on cleanup).
+    expect(existsSync(announced)).toBe(true);
 
     // Deliver SIGINT mid-publish and wait for the harness to exit.
     child.kill("SIGINT");
@@ -347,13 +357,12 @@ version = "0.0.1"
     });
     expect(exitCode).toBe(130);
 
-    // The yaml on disk contains the user's original profile and NO
-    // movehat-deploy-* leftovers.
-    expect(existsSync(configPath)).toBe(true);
-    const finalYaml: any = yaml.load(readFileSync(configPath, "utf8"));
-    expect(finalYaml.profiles).toBeDefined();
-    expect(Object.keys(finalYaml.profiles).sort()).toEqual(["user_main"]);
-    expect(finalYaml.profiles.user_main.private_key).toBe("0x" + "a".repeat(64));
+    // The temp key file has been unlinked by the SIGINT handler.
+    expect(existsSync(announced)).toBe(false);
+
+    // The user's ~/.aptos/config.yaml is byte-identical to pre-deploy
+    // — the new flow never touches it.
+    expect(readFileSync(configPath, "utf8")).toBe(initialConfigBytes);
   }, 15000);
 
   it("does not mutate Move.toml during deploy (#38)", async () => {

package/src/__tests__/exports.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import * as publicSurface from "../index.js";
+
+/**
+ * Locks the public export surface of `movehat`. Adding a new symbol
+ * is a deliberate API change; removing one is a breaking change.
+ * Update this list (and the CHANGELOG) when the surface evolves.
+ */
+const EXPECTED_RUNTIME_EXPORTS = [
+  "Harness",
+  "HarnessDisposedError",
+  "ForkManager",
+  "MovementApiClient",
+  "ForkStorage",
+  "ForkServer",
+  "ModuleAlreadyDeployedError",
+  "PostPublishError",
+  "initRuntime",
+] as const;
+
+describe("public export surface (movehat root)", () => {
+  it.each(EXPECTED_RUNTIME_EXPORTS)("exports %s as a runtime value", (name) => {
+    expect(publicSurface[name as keyof typeof publicSurface]).toBeDefined();
+  });
+
+  // Type-only exports cannot be probed at runtime; the assertion is
+  // that the module imports successfully (failing types-only export
+  // would surface as a TS error in `pnpm check:example`).
+  it("imports without errors", () => {
+    expect(typeof publicSurface).toBe("object");
+  });
+});

package/src/__tests__/fixtures/sigint-deploy-harness.ts

@@ -9,9 +9,10 @@
  *      send SIGINT mid-flight.
  *   2. Drive `Publisher.deploy()` against the fake adapter using a
  *      synthetic MovehatConfig + Account read from env vars.
- *   3. Write the chosen `movehat-deploy-<uuid>` profile name to stdout
- *      as JSON (`{"profile": "..."}`) before the slow publish so the
- *      parent test knows which key to look for after SIGINT.
+ *   3. Write the temp key file path to stdout as JSON
+ *      (`{"keyFile": "/tmp/movehat-key-<uuid>"}`) before the slow
+ *      publish so the parent test knows which file to look for after
+ *      SIGINT.
  *   4. If the deploy completes naturally (test failure case), exit 0.
  *   5. When SIGINT arrives, Publisher's signal handler runs synchronous
  *      cleanup and `setImmediate(() => process.exit(130))`.
@@ -61,10 +62,10 @@ async function main() {
         return { exitCode: 0, stdout: "built", stderr: "" };
       }
       if (input.args[1] === "publish") {
-        // Surface the unique profile name to the parent BEFORE blocking.
-        const profileIdx = input.args.indexOf("--profile");
-        const profile = profileIdx >= 0 ? input.args[profileIdx + 1] : "";
-        process.stdout.write(JSON.stringify({ profile }) + "\n");
+        // Surface the temp key file path to the parent BEFORE blocking.
+        const keyFileIdx = input.args.indexOf("--private-key-file");
+        const keyFile = keyFileIdx >= 0 ? input.args[keyFileIdx + 1] : "";
+        process.stdout.write(JSON.stringify({ keyFile }) + "\n");
         // Hold long enough for the parent to deliver SIGINT.
         await new Promise((r) => setTimeout(r, 3000));
         return {

package/src/__tests__/fork/api.test.ts

@@ -77,6 +77,11 @@ function setupGetCapture(): {
 
     const fakeReq = new EventEmitter() as unknown as ClientRequest;
     (fakeReq as unknown as { end: () => void }).end = () => {};
+    // F3: api.ts now installs a setTimeout on the request and may call
+    // destroy() on overflow / timeout. Stub both so this happy-path
+    // capture mock still satisfies the new contract.
+    (fakeReq as unknown as { setTimeout: (ms: number, cb?: () => void) => void }).setTimeout = () => {};
+    (fakeReq as unknown as { destroy: () => void }).destroy = () => {};
 
     if (callback) {
       const body = JSON.stringify({

package/src/__tests__/fork/api.timeout.test.ts

@@ -0,0 +1,150 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { ClientRequest, IncomingMessage } from "node:http";
+import { EventEmitter } from "node:events";
+
+/**
+ * F3 — MovementApiClient must bound responses by time AND bytes.
+ *
+ * Without these guards a malicious / hung upstream can:
+ *   - leak the request promise forever (never emits 'end'), or
+ *   - exhaust heap by pushing unbounded `data` chunks.
+ *
+ * Strategy mirrors src/__tests__/fork/api.test.ts: vi.mock node:http
+ * and node:https, intercept `client.get(url, options, cb)`, and feed
+ * a controllable `IncomingMessage` to the callback. The fake
+ * `ClientRequest` exposes `setTimeout`, `destroy`, and emits 'error' /
+ * 'timeout' so we can drive the failure modes from the test.
+ */
+
+interface FakeReq extends EventEmitter {
+  end(): void;
+  destroy(err?: Error): void;
+  setTimeout(ms: number, cb?: () => void): void;
+  destroyed: boolean;
+}
+
+const httpsGet = vi.fn();
+const httpGet = vi.fn();
+
+vi.mock("https", () => ({ default: { get: httpsGet }, get: httpsGet }));
+vi.mock("http", () => ({ default: { get: httpGet }, get: httpGet }));
+
+function makeFakeReq(): FakeReq {
+  const req = new EventEmitter() as FakeReq;
+  req.destroyed = false;
+  let timeoutHandle: NodeJS.Timeout | undefined;
+  req.end = () => {};
+  req.destroy = (err?: Error) => {
+    req.destroyed = true;
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+    setImmediate(() => req.emit("error", err ?? new Error("destroyed")));
+  };
+  req.setTimeout = (ms: number, cb?: () => void) => {
+    timeoutHandle = setTimeout(() => {
+      req.emit("timeout");
+      if (cb) cb();
+    }, ms);
+    // Don't keep the event loop alive — Node sets this itself but the
+    // mock has no native socket to inherit from.
+    timeoutHandle.unref?.();
+  };
+  return req;
+}
+
+function makeUnresolvableResponse(): IncomingMessage {
+  const res = new EventEmitter() as unknown as IncomingMessage;
+  (res as unknown as { statusCode: number }).statusCode = 200;
+  return res;
+}
+
+function makeStreamingResponse(
+  bytesPerChunk: number,
+  chunks: number
+): IncomingMessage {
+  const res = new EventEmitter() as unknown as IncomingMessage;
+  (res as unknown as { statusCode: number }).statusCode = 200;
+  setImmediate(() => {
+    let i = 0;
+    const pump = () => {
+      if (i >= chunks) {
+        (res as unknown as EventEmitter).emit("end");
+        return;
+      }
+      (res as unknown as EventEmitter).emit(
+        "data",
+        Buffer.alloc(bytesPerChunk, 0x61)
+      );
+      i++;
+      setImmediate(pump);
+    };
+    pump();
+  });
+  return res;
+}
+
+describe("F3 — MovementApiClient timeouts and byte cap", () => {
+  beforeEach(() => {
+    httpsGet.mockReset();
+    httpGet.mockReset();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("rejects with a timeout error when the upstream never responds", async () => {
+    const fakeReq = makeFakeReq();
+    httpGet.mockImplementation(
+      (
+        _url: string,
+        options: unknown,
+        cb?: (res: IncomingMessage) => void
+      ) => {
+        const callback =
+          typeof options === "function"
+            ? (options as (r: IncomingMessage) => void)
+            : cb;
+        if (callback) callback(makeUnresolvableResponse());
+        return fakeReq as unknown as ClientRequest;
+      }
+    );
+
+    const { MovementApiClient } = await import("../../fork/api.js");
+    const client = new MovementApiClient("http://hung.example/v1", undefined, {
+      timeoutMs: 25,
+      maxBytes: 1024 * 1024,
+    });
+
+    await expect(client.getLedgerInfo()).rejects.toThrow(/timed out|timeout/i);
+    expect(fakeReq.destroyed).toBe(true);
+  });
+
+  it("rejects and destroys the request when the response exceeds maxBytes", async () => {
+    const fakeReq = makeFakeReq();
+    httpGet.mockImplementation(
+      (
+        _url: string,
+        options: unknown,
+        cb?: (res: IncomingMessage) => void
+      ) => {
+        const callback =
+          typeof options === "function"
+            ? (options as (r: IncomingMessage) => void)
+            : cb;
+        if (callback) callback(makeStreamingResponse(2048, 100));
+        return fakeReq as unknown as ClientRequest;
+      }
+    );
+
+    const { MovementApiClient } = await import("../../fork/api.js");
+    const client = new MovementApiClient("http://big.example/v1", undefined, {
+      timeoutMs: 5000,
+      maxBytes: 4096,
+    });
+
+    await expect(client.getLedgerInfo()).rejects.toThrow(
+      /maxBytes|too large|exceeded/i
+    );
+    expect(fakeReq.destroyed).toBe(true);
+  });
+});

package/src/cli.ts

@@ -50,6 +50,7 @@ program
   .version(version)
   .option('--network <name>', 'Network to use (testnet, mainnet, local, etc.)')
   .option('--redeploy', 'Force redeploy even if already deployed')
+  .option('-v, --verbose', 'Show subprocess output (movement node, aptos move) for debugging')
   .hook('preAction', (thisCommand) => {
     // Store network option in environment for commands to access
     const options = thisCommand.opts();
@@ -59,6 +60,9 @@ program
     if (options.redeploy) {
       process.env.MH_CLI_REDEPLOY = 'true';
     }
+    if (options.verbose) {
+      process.env.MOVEHAT_VERBOSE = '1';
+    }
   });
 
 program

package/src/commands/__tests__/compile.toml-mutation.test.ts

@@ -0,0 +1,77 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { vol, fs as memfsFs } from "memfs";
+
+vi.mock("fs", () => {
+  return {
+    default: memfsFs,
+    ...memfsFs,
+  };
+});
+
+import { updateMoveToml } from "../compile.js";
+
+/**
+ * F7 — `movehat compile` mutates `Move.toml` when it detects a named
+ * address that isn't declared yet. This test pins down the current
+ * behavior so a future change (introducing a `--write` flag, moving
+ * the mutation to a dedicated `movehat update-toml` command, etc.)
+ * MUST update this test alongside the source change.
+ *
+ * Audit finding F7 is marked "no concluyente — requires product
+ * decision": the mutation may be the right UX default for the
+ * Hardhat-style workflow, but the asymmetry (compile reading + writing)
+ * deserves to be a deliberate choice. See ROADMAP follow-up.
+ */
+describe("F7 — updateMoveToml mutates Move.toml on disk (current behavior captured)", () => {
+  beforeEach(() => vol.reset());
+  afterEach(() => vol.reset());
+
+  it("writes new named addresses into [addresses] and [dev-addresses] when missing", () => {
+    const before = `[package]
+name = "captured"
+version = "1.0.0"
+
+[addresses]
+existing = "_"
+
+[dev-addresses]
+existing = "0xcafe"
+
+[dependencies]
+`;
+    vol.fromJSON({ "/move/Move.toml": before });
+
+    const detected = new Set(["existing", "audit_module"]);
+    const added = updateMoveToml("/move", detected);
+
+    expect(added).toEqual(["audit_module"]);
+
+    // Source-of-truth assertion: the on-disk file CHANGED. F7 is the
+    // observation that a "compile" verb has a side effect on the user's
+    // working tree. The behavior is captured here so an unintended
+    // regression (or a deliberate revisit) cannot land silently.
+    const after = vol.readFileSync("/move/Move.toml", "utf-8") as string;
+    expect(after).not.toBe(before);
+    expect(after).toContain("audit_module = \"_\"");
+  });
+
+  it("returns an empty list and leaves Move.toml byte-identical when all named addresses are already declared", () => {
+    const before = `[package]
+name = "captured"
+
+[addresses]
+existing = "_"
+
+[dev-addresses]
+existing = "0xcafe"
+`;
+    vol.fromJSON({ "/move/Move.toml": before });
+
+    const added = updateMoveToml("/move", new Set(["existing"]));
+    expect(added).toEqual([]);
+    // No mutation in the no-op path — the asymmetry only triggers when
+    // detected ⊄ declared. Useful boundary for the F7 product decision.
+    const after = vol.readFileSync("/move/Move.toml", "utf-8") as string;
+    expect(after).toBe(before);
+  });
+});