movehat 0.2.4 → 0.2.6

package/README.md

@@ -190,7 +190,7 @@ For anything not on this list, open an issue on [GitHub](https://github.com/gilb
 
 ## Contributing
 
-See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for development setup, the dual-tier test infrastructure, and the PR workflow.
+See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for development setup, the dual-tier test infrastructure, and the PR workflow. See [`MAINTENANCE.md`](./MAINTENANCE.md) for release cadence, triage SLA, versioning, and deprecation policy.
 
 ## License
 

package/dist/cli.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -142,4 +142,3 @@ fork
     .option('--host <host>', 'Interface to bind (default: 127.0.0.1; use 0.0.0.0 to expose to LAN)', '127.0.0.1')
     .action((options) => forkServeCommand(options));
 program.parse(process.argv);
-//# sourceMappingURL=cli.js.map

package/dist/commands/compile.d.ts

@@ -23,4 +23,3 @@ export declare function updateMoveToml(moveDir: string, detectedAddresses: Set<s
  * await compileCommand();
  */
 export default function compileCommand(): Promise<void>;
-//# sourceMappingURL=compile.d.ts.map

package/dist/commands/compile.js

@@ -289,4 +289,3 @@ export default async function compileCommand() {
         process.exit(1);
     }
 }
-//# sourceMappingURL=compile.js.map

package/dist/commands/fork/create.d.ts

@@ -3,6 +3,7 @@ interface ForkCreateOptions {
     path?: string;
     name?: string;
 }
+export declare function validateForkName(name: string): string;
 /**
  * Create a local fork of a Movement network
  *
@@ -27,4 +28,3 @@ interface ForkCreateOptions {
  */
 export default function forkCreateCommand(options?: ForkCreateOptions): Promise<void>;
 export {};
-//# sourceMappingURL=create.d.ts.map

package/dist/commands/fork/create.js

@@ -1,9 +1,25 @@
-import { join } from 'path';
+import { basename, join } from 'path';
 import { existsSync } from 'fs';
 import prompts from 'prompts';
 import { loadUserConfig, resolveNetworkConfig } from '../../core/config.js';
 import { ForkManager } from '../../fork/manager.js';
 import { logger, withSpinner, createKVTable, formatCommand } from '../../ui/index.js';
+const SAFE_FORK_NAME_RE = /^[A-Za-z0-9._-]+$/;
+const RESERVED_FORK_NAMES = new Set(['.', '..']);
+export function validateForkName(name) {
+    if (name.length === 0) {
+        throw new Error('Invalid fork name: name must not be empty');
+    }
+    if (RESERVED_FORK_NAMES.has(name) ||
+        basename(name) !== name ||
+        name.includes('/') ||
+        name.includes('\\') ||
+        name.includes('..') ||
+        !SAFE_FORK_NAME_RE.test(name)) {
+        throw new Error('Invalid fork name: use only letters, numbers, dot, underscore, and dash; path separators and traversal are not allowed');
+    }
+    return name;
+}
 /**
  * Create a local fork of a Movement network
  *
@@ -33,7 +49,7 @@ export default async function forkCreateCommand(options = {}) {
         const networkName = options.network || process.env.MH_CLI_NETWORK || userConfig.defaultNetwork || 'testnet';
         const networkConfig = await resolveNetworkConfig(userConfig, networkName);
         // Determine fork name and path
-        const forkName = options.name || `${networkName}-fork`;
+        const forkName = validateForkName(options.name || `${networkName}-fork`);
         const forkPath = options.path || join(process.cwd(), '.movehat', 'forks', forkName);
         logger.newline();
         logger.info(`Creating fork of ${networkName}`);
@@ -88,4 +104,3 @@ export default async function forkCreateCommand(options = {}) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=create.js.map

package/dist/commands/fork/fund.d.ts

@@ -9,4 +9,3 @@ interface ForkFundOptions {
  */
 export default function forkFundCommand(options: ForkFundOptions): Promise<void>;
 export {};
-//# sourceMappingURL=fund.d.ts.map

package/dist/commands/fork/fund.js

@@ -46,4 +46,3 @@ export default async function forkFundCommand(options) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=fund.js.map

package/dist/commands/fork/list.d.ts

@@ -13,4 +13,3 @@
  * await forkListCommand();
  */
 export default function forkListCommand(): Promise<void>;
-//# sourceMappingURL=list.d.ts.map

package/dist/commands/fork/list.js

@@ -87,4 +87,3 @@ export default async function forkListCommand() {
         process.exit(1);
     }
 }
-//# sourceMappingURL=list.js.map

package/dist/commands/fork/serve.d.ts

@@ -8,4 +8,3 @@ interface ForkServeOptions {
  */
 export default function forkServeCommand(options: ForkServeOptions): Promise<void>;
 export {};
-//# sourceMappingURL=serve.d.ts.map

package/dist/commands/fork/serve.js

@@ -63,4 +63,3 @@ export default async function forkServeCommand(options) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=serve.js.map

package/dist/commands/fork/view-resource.d.ts

@@ -8,4 +8,3 @@ interface ForkViewResourceOptions {
  */
 export default function forkViewResourceCommand(options: ForkViewResourceOptions): Promise<void>;
 export {};
-//# sourceMappingURL=view-resource.d.ts.map

package/dist/commands/fork/view-resource.js

@@ -36,4 +36,3 @@ export default async function forkViewResourceCommand(options) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=view-resource.js.map

package/dist/commands/init.d.ts

@@ -40,4 +40,3 @@ export declare function resolveProjectNames(input: string): ProjectNames;
  * await initCommand();
  */
 export default function initCommand(projectName?: string): Promise<void>;
-//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -177,4 +177,3 @@ async function copyDir(src, dest, replacements) {
         }
     }
 }
-//# sourceMappingURL=init.js.map

package/dist/commands/run.d.ts

@@ -1,4 +1,21 @@
 import type { RunResult } from "../utils/childProcessAdapter.js";
+/**
+ * Resolve the tsx CLI entrypoint (`<tsx-pkg>/dist/cli.mjs`) used by
+ * `movehat run` to execute user scripts. Prefers movehat's bundled tsx
+ * by default; falls back to the cwd's tsx only if bundled is missing
+ * (defensive — should not happen for normal installs). Set
+ * `MOVEHAT_TSX_FROM_CWD=1` or pass `preferCwd: true` to flip the
+ * order — power-users who pinned a different tsx in their project.
+ *
+ * Security: the default order closes #52 (untrusted cwd could ship a
+ * malicious `node_modules/tsx/dist/cli.mjs`).
+ *
+ * Exported so the resolution logic can be unit-tested without
+ * spawning a real process.
+ */
+export declare function resolveTsxCliPath(opts?: {
+    preferCwd?: boolean;
+}): string | null;
 /**
  * Apply the exit policy for a child whose output was inherited by the
  * parent. When the child dies via signal, re-raise it on the parent so
@@ -14,4 +31,3 @@ import type { RunResult } from "../utils/childProcessAdapter.js";
  */
 export declare function propagateRunResultExit(result: RunResult): void;
 export default function runCommand(scriptPath: string): Promise<void>;
-//# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -4,6 +4,45 @@ import { fileURLToPath } from "url";
 import { createRequire } from "module";
 import { runCli } from "../utils/runCli.js";
 import { logger } from "../ui/index.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const requireFromHere = createRequire(import.meta.url);
+/**
+ * Resolve the tsx CLI entrypoint (`<tsx-pkg>/dist/cli.mjs`) used by
+ * `movehat run` to execute user scripts. Prefers movehat's bundled tsx
+ * by default; falls back to the cwd's tsx only if bundled is missing
+ * (defensive — should not happen for normal installs). Set
+ * `MOVEHAT_TSX_FROM_CWD=1` or pass `preferCwd: true` to flip the
+ * order — power-users who pinned a different tsx in their project.
+ *
+ * Security: the default order closes #52 (untrusted cwd could ship a
+ * malicious `node_modules/tsx/dist/cli.mjs`).
+ *
+ * Exported so the resolution logic can be unit-tested without
+ * spawning a real process.
+ */
+export function resolveTsxCliPath(opts) {
+    const preferCwd = opts?.preferCwd ?? process.env.MOVEHAT_TSX_FROM_CWD === "1";
+    const bundledRoot = __dirname;
+    const cwdRoot = process.cwd();
+    const lookupOrder = preferCwd
+        ? [cwdRoot, bundledRoot]
+        : [bundledRoot, cwdRoot];
+    for (const root of lookupOrder) {
+        try {
+            const tsxEntry = requireFromHere.resolve("tsx", { paths: [root] });
+            // require.resolve("tsx") returns .../tsx/dist/loader.mjs; walk up
+            // to the package root and into dist/cli.mjs.
+            const packageRoot = dirname(dirname(tsxEntry));
+            const cliPath = join(packageRoot, "dist", "cli.mjs");
+            if (existsSync(cliPath))
+                return cliPath;
+        }
+        catch {
+            // Lookup failed at this root; try the next one.
+        }
+    }
+    return null;
+}
 /**
  * Apply the exit policy for a child whose output was inherited by the
  * parent. When the child dies via signal, re-raise it on the parent so
@@ -50,39 +89,14 @@ export default async function runCommand(scriptPath) {
         logger.plain(`   Network: ${network}`);
     }
     logger.newline();
-    // Find tsx binary - try multiple locations for compatibility
-    // Uses require.resolve for cross-platform compatibility (works on Windows, macOS, Linux)
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    // Create require function for ESM (needed to use require.resolve in ESM modules)
-    const require = createRequire(import.meta.url);
-    let tsxPath;
-    try {
-        // Try to resolve tsx package from user's project first
-        const tsxPackagePath = require.resolve("tsx", { paths: [process.cwd()] });
-        // require.resolve("tsx") returns .../tsx/dist/loader.mjs
-        // We need to go up to the tsx package root, then into dist/cli.mjs
-        const tsxPackageRoot = dirname(dirname(tsxPackagePath));
-        tsxPath = join(tsxPackageRoot, "dist", "cli.mjs");
-        // Verify the file exists
-        if (!existsSync(tsxPath)) {
-            throw new Error("cli.mjs not found");
-        }
-    }
-    catch {
-        try {
-            // Fallback to movehat's own tsx
-            const tsxPackagePath = require.resolve("tsx", { paths: [__dirname] });
-            const tsxPackageRoot = dirname(dirname(tsxPackagePath));
-            tsxPath = join(tsxPackageRoot, "dist", "cli.mjs");
-            if (!existsSync(tsxPath)) {
-                throw new Error("cli.mjs not found");
-            }
-        }
-        catch {
-            tsxPath = "";
-        }
+    // Find tsx binary — bundled-first per #52 (supply-chain hardening).
+    // Cwd resolution stays available behind an opt-in env var for users
+    // who pinned a different tsx in their project.
+    if (process.env.MOVEHAT_TSX_FROM_CWD === "1") {
+        logger.warning("MOVEHAT_TSX_FROM_CWD=1: resolving tsx from cwd first. " +
+            "Only use this in trusted project directories.");
     }
+    const tsxPath = resolveTsxCliPath();
     if (!tsxPath) {
         logger.error("tsx binary not found");
         logger.plain("   Make sure 'tsx' is installed in your project:");
@@ -108,4 +122,3 @@ export default async function runCommand(scriptPath) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=run.js.map

package/dist/commands/test-move.d.ts

@@ -4,4 +4,3 @@ interface TestMoveOptions {
 }
 export default function testMoveCommand(options?: TestMoveOptions): Promise<void>;
 export {};
-//# sourceMappingURL=test-move.d.ts.map

package/dist/commands/test-move.js

@@ -18,4 +18,3 @@ export default async function testMoveCommand(options = {}) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=test-move.js.map

package/dist/commands/test.d.ts

@@ -9,4 +9,3 @@ interface TestOptions {
 }
 export default function testCommand(options?: TestOptions): Promise<void>;
 export {};
-//# sourceMappingURL=test.d.ts.map

package/dist/commands/test.js

@@ -183,6 +183,9 @@ async function runTypeScriptTests(watch = false) {
     // terminal until the user Ctrl+Cs the parent (which kills the child via
     // inherited stdio). Attach .catch so a spawn-time failure doesn't become
     // an unhandled rejection.
+    /* c8 ignore start -- watch mode launches a long-running mocha process and
+       never returns; not testable as a unit. Behaviour is covered by the
+       integration suite and by manual smoke. */
     if (watch) {
         runCli({
             command: mochaPath,
@@ -197,6 +200,7 @@ async function runTypeScriptTests(watch = false) {
         logger.newline();
         return;
     }
+    /* c8 ignore stop */
     // Non-watch mode: await the run, surface the exit code as a thrown error
     // so the orchestrator above can summarize the failure.
     let result;
@@ -207,14 +211,17 @@ async function runTypeScriptTests(watch = false) {
             env: { ...process.env },
             inheritStdio: true,
         }, { throwOnNonZeroExit: false });
+        /* c8 ignore start -- runCli with throwOnNonZeroExit:false only throws on
+           spawn-time failure (ENOENT, etc.), which is blocked upstream by the
+           existsSync(mochaPath) check at line 192. Defense in depth. */
     }
     catch (error) {
         logger.error(`Failed to run TypeScript tests: ${error.message}`);
         throw error;
     }
+    /* c8 ignore stop */
     if (result.exitCode === 0) {
         return;
     }
     throw new Error(`TypeScript tests failed with exit code ${result.exitCode}`);
 }
-//# sourceMappingURL=test.js.map

package/dist/commands/update.d.ts

@@ -12,4 +12,3 @@
  * await updateCommand();
  */
 export default function updateCommand(): Promise<void>;
-//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.js

@@ -161,4 +161,3 @@ export default async function updateCommand() {
         process.exit(1);
     }
 }
-//# sourceMappingURL=update.js.map

package/dist/core/AccountManager.d.ts

@@ -6,6 +6,14 @@ export interface StoredAccount {
     address: string;
     createdAt: number;
 }
+export interface SaveAccountPoolOptions {
+    /**
+     * Persist accounts loaded from a private key, environment variable, or
+     * config. Defaults to false so imported live keys are not written to disk
+     * accidentally when callers only intend to save generated test accounts.
+     */
+    includeImported?: boolean | undefined;
+}
 /**
  * Centralized Account Manager for movehat
  *
@@ -16,6 +24,7 @@ export declare class AccountManager {
     private static pool;
     private static privateKeys;
     private static labelMap;
+    private static generatedAccountAddresses;
     private static poolLoaded;
     private static defaultPoolPath;
     /**
@@ -105,7 +114,10 @@ export declare class AccountManager {
      * @example
      * AccountManager.saveAccountPool();
      */
-    static saveAccountPool(poolPath?: string): void;
+    static saveAccountPool(): void;
+    static saveAccountPool(poolPath: string): void;
+    static saveAccountPool(options: SaveAccountPoolOptions): void;
+    static saveAccountPool(poolPath: string, options: SaveAccountPoolOptions): void;
     /**
      * Load account pool from disk
      *
@@ -179,5 +191,6 @@ export declare class AccountManager {
      * @returns Record of label/address to private key hex string
      */
     static exportPrivateKeys(labels?: string[]): Record<string, string>;
+    private static accountFromPrivateKey;
+    private static trackAccount;
 }
-//# sourceMappingURL=AccountManager.d.ts.map

package/dist/core/AccountManager.js

@@ -15,6 +15,7 @@ export class AccountManager {
     static pool = new Map(); // address → Account
     static privateKeys = new Map(); // address → privateKey hex
     static labelMap = new Map(); // label → address
+    static generatedAccountAddresses = new Set();
     static poolLoaded = false;
     // `defaultPoolPath` is captured ONCE at module-import time. A later
     // `process.chdir(...)` does NOT redirect the save destination — pass
@@ -57,6 +58,7 @@ export class AccountManager {
         const address = account.accountAddress.toString();
         this.pool.set(address, account);
         this.privateKeys.set(address, account.privateKey.toString());
+        this.generatedAccountAddresses.add(address);
         if (label) {
             this.labelMap.set(label, address);
         }
@@ -112,14 +114,8 @@ export class AccountManager {
         // Format into AIP-80 shape (`ed25519-priv-0x…`) before constructing
         // the SDK type. Without this, raw-hex inputs trigger a noisy
         // deprecation warning from `@aptos-labs/ts-sdk` on every call.
-        const formatted = PrivateKey.formatPrivateKey(privateKeyHex, PrivateKeyVariants.Ed25519);
-        const privateKey = new Ed25519PrivateKey(formatted);
-        const account = Account.fromPrivateKey({ privateKey });
-        const address = account.accountAddress.toString();
-        // Add to pool for tracking
-        this.pool.set(address, account);
-        // Store private key
-        this.privateKeys.set(address, privateKeyHex);
+        const account = this.accountFromPrivateKey(privateKeyHex);
+        this.trackAccount(account, privateKeyHex, "imported");
         return account;
     }
     /**
@@ -165,15 +161,12 @@ export class AccountManager {
         }
         return result;
     }
-    /**
-     * Save the current account pool to disk for persistence
-     *
-     * @param poolPath Optional custom path (defaults to .movehat/accounts)
-     *
-     * @example
-     * AccountManager.saveAccountPool();
-     */
-    static saveAccountPool(poolPath) {
+    static saveAccountPool(poolPathOrOptions, options = {}) {
+        const poolPath = typeof poolPathOrOptions === "string" ? poolPathOrOptions : undefined;
+        const effectiveOptions = typeof poolPathOrOptions === "object" && poolPathOrOptions !== null
+            ? poolPathOrOptions
+            : options;
+        const includeImported = effectiveOptions.includeImported ?? false;
         const basePath = poolPath || this.defaultPoolPath;
         // Ensure directory exists with restrictive perms (the pool file holds
         // plaintext private keys, so the directory must not be world-readable).
@@ -187,6 +180,9 @@ export class AccountManager {
         const storedAccounts = [];
         const labelMapObject = {};
         for (const [address, account] of this.pool.entries()) {
+            if (!includeImported && !this.generatedAccountAddresses.has(address)) {
+                continue;
+            }
             // Find label for this address (if any)
             let label;
             for (const [lbl, addr] of this.labelMap.entries()) {
@@ -250,8 +246,8 @@ export class AccountManager {
             this.labelMap.clear();
             // Restore accounts
             for (const stored of poolData.accounts) {
-                const account = this.loadAccountFromPrivateKey(stored.privateKey);
-                this.pool.set(stored.address, account);
+                const account = this.accountFromPrivateKey(stored.privateKey);
+                this.trackAccount(account, stored.privateKey, "generated");
                 if (stored.label) {
                     this.labelMap.set(stored.label, stored.address);
                 }
@@ -284,6 +280,7 @@ export class AccountManager {
         this.pool.clear();
         this.privateKeys.clear();
         this.labelMap.clear();
+        this.generatedAccountAddresses.clear();
         this.poolLoaded = false;
     }
     /**
@@ -379,5 +376,20 @@ export class AccountManager {
         }
         return result;
     }
+    static accountFromPrivateKey(privateKeyHex) {
+        const formatted = PrivateKey.formatPrivateKey(privateKeyHex, PrivateKeyVariants.Ed25519);
+        const privateKey = new Ed25519PrivateKey(formatted);
+        return Account.fromPrivateKey({ privateKey });
+    }
+    static trackAccount(account, privateKeyHex, source) {
+        const address = account.accountAddress.toString();
+        this.pool.set(address, account);
+        this.privateKeys.set(address, privateKeyHex);
+        if (source === "generated") {
+            this.generatedAccountAddresses.add(address);
+        }
+        else {
+            this.generatedAccountAddresses.delete(address);
+        }
+    }
 }
-//# sourceMappingURL=AccountManager.js.map

package/dist/core/Publisher.d.ts

@@ -23,4 +23,3 @@ export declare class Publisher {
     constructor(deps?: PublisherDeps);
     deploy(input: PublishInput): Promise<DeploymentInfo>;
 }
-//# sourceMappingURL=Publisher.d.ts.map

package/dist/core/Publisher.js

@@ -227,4 +227,3 @@ export class Publisher {
         }
     }
 }
-//# sourceMappingURL=Publisher.js.map

package/dist/core/config.d.ts

@@ -24,4 +24,3 @@ export declare function _resetConfigCache(): void;
  * Merges global settings with network-specific settings
  */
 export declare function resolveNetworkConfig(userConfig: MovehatUserConfig, networkName?: string): Promise<MovehatConfig>;
-//# sourceMappingURL=config.d.ts.map