movehat 0.2.4 → 0.2.6

package/dist/helpers/semver-utils.d.ts

@@ -4,4 +4,3 @@
  * Handles variable-length versions (1.2, 1.2.3, 1.2.3.4, etc.)
  */
 export declare function isNewerVersion(currentVersion: string, newVersion: string): boolean;
-//# sourceMappingURL=semver-utils.d.ts.map

package/dist/helpers/semver-utils.js

@@ -45,4 +45,3 @@ export function isNewerVersion(currentVersion, newVersion) {
     }
     return false;
 }
-//# sourceMappingURL=semver-utils.js.map

package/dist/helpers/setup.d.ts

@@ -7,4 +7,3 @@ export interface TestEnvironment {
 }
 export declare function setupTestEnvironment(networkName?: string): Promise<TestEnvironment>;
 export declare function createTestAccount(): Account;
-//# sourceMappingURL=setup.d.ts.map

package/dist/helpers/setup.js

@@ -30,4 +30,3 @@ export async function setupTestEnvironment(networkName) {
 export function createTestAccount() {
     return AccountManager.createAccount();
 }
-//# sourceMappingURL=setup.js.map

package/dist/helpers/setupLocalTesting.d.ts

@@ -6,10 +6,8 @@ import type { LocalTestOptions } from "../types/config.js";
 /**
  * Context returned by {@link setupLocalTesting}.
  *
- * Replaces the module-scoped singletons that previously tracked the
- * "current" local node / fork server / fork manager. Each invocation now
- * owns its own handles, so two parallel `setupLocalTesting` calls in the
- * same process do not trample each other.
+ * Each invocation owns its own handles, so two parallel `setupLocalTesting`
+ * calls in the same process do not trample each other.
  *
  * @public The `runtime` and `teardown` fields are the supported surface.
  *         `localNode`, `forkServer`, and `forkManager` are exposed for
@@ -61,4 +59,3 @@ export interface LocalTestingContext {
  * ```
  */
 export declare function setupLocalTesting(options?: LocalTestOptions): Promise<LocalTestingContext>;
-//# sourceMappingURL=setupLocalTesting.d.ts.map

package/dist/helpers/setupLocalTesting.js

@@ -299,4 +299,3 @@ async function setupWithFork(options, accountLabels, autoFund, defaultBalance) {
         throw error;
     }
 }
-//# sourceMappingURL=setupLocalTesting.js.map

package/dist/helpers/testFixtures.d.ts

@@ -78,4 +78,3 @@ export declare function setupTestFixture<TModules extends readonly string[]>(mod
  * @returns Partial TestFixture (without contracts) plus a teardown closure
  */
 export declare function setupMinimalFixture(accountLabels?: string[], options?: Partial<LocalTestOptions>): Promise<Omit<TestFixture, "contracts">>;
-//# sourceMappingURL=testFixtures.d.ts.map

package/dist/helpers/testFixtures.js

@@ -142,4 +142,3 @@ export async function setupMinimalFixture(accountLabels = ["alice", "bob"], opti
         throw error;
     }
 }
-//# sourceMappingURL=testFixtures.js.map

package/dist/helpers/version-check.d.ts

@@ -14,4 +14,3 @@
  * checkForUpdates('1.0.0', 'movehat');
  */
 export declare function checkForUpdates(currentVersion: string, packageName: string): void;
-//# sourceMappingURL=version-check.d.ts.map

package/dist/helpers/version-check.js

@@ -96,4 +96,3 @@ export function checkForUpdates(currentVersion, packageName) {
         // Silently fail - never interrupt user's workflow
     }
 }
-//# sourceMappingURL=version-check.js.map

package/dist/index.d.ts

@@ -11,4 +11,3 @@ export { ModuleAlreadyDeployedError, PostPublishError } from "./errors.js";
 export { Harness, HarnessDisposedError } from "./harness/index.js";
 export type { HarnessMode } from "./harness/index.js";
 export type { DeployCodeObjectOptions, UpgradeCodeObjectOptions, CodeObjectInfo, RunViewFunctionOptions, RunMoveScriptOptions, MoveScriptResult, } from "./types/harness.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -12,4 +12,3 @@ export { ForkServer } from "./fork/server.js";
 // Export custom errors
 export { ModuleAlreadyDeployedError, PostPublishError } from "./errors.js";
 export { Harness, HarnessDisposedError } from "./harness/index.js";
-//# sourceMappingURL=index.js.map

package/dist/node/LocalNodeManager.d.ts

@@ -81,4 +81,3 @@ export declare class LocalNodeManager {
      */
     clean(): Promise<void>;
 }
-//# sourceMappingURL=LocalNodeManager.d.ts.map

package/dist/node/LocalNodeManager.js

@@ -1,6 +1,7 @@
 import { existsSync, rmSync } from "fs";
 import { join } from "path";
 import { defaultChildProcessAdapter, } from "../utils/childProcessAdapter.js";
+import { resolveMovementBinary, sanitizeMovementEnv } from "../utils/movementCli.js";
 import { logger, isVerbose, colors, symbols } from "../ui/index.js";
 import { withTimedSpinner, withSpinner } from "../ui/spinner.js";
 /**
@@ -86,9 +87,11 @@ export class LocalNodeManager {
             }
             // Start the node process via the injectable adapter.
             this.killed = false;
+            const usesDefaultAdapter = this.adapter === defaultChildProcessAdapter;
             this.spawned = this.adapter.spawn({
-                command: "movement",
+                command: usesDefaultAdapter ? resolveMovementBinary() : "movement",
                 args,
+                ...(usesDefaultAdapter ? { env: sanitizeMovementEnv() } : {}),
                 stdio: this.options.silent ? "ignore" : "pipe",
             });
             // Subprocess output handling (see §9 Console UX in CLAUDE.md):
@@ -298,4 +301,3 @@ export class LocalNodeManager {
         }
     }
 }
-//# sourceMappingURL=LocalNodeManager.js.map

package/dist/runtime.d.ts

@@ -20,4 +20,3 @@ export interface InitRuntimeOptions {
  * framework).
  */
 export declare function initRuntime(options?: InitRuntimeOptions): Promise<MovehatRuntime>;
-//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.js

@@ -107,4 +107,3 @@ export async function initRuntime(options = {}) {
     };
     return runtime;
 }
-//# sourceMappingURL=runtime.js.map

package/dist/types/config.d.ts

@@ -71,4 +71,3 @@ export interface LocalTestOptions {
     autoDeploy?: readonly string[];
     accountLabels?: readonly string[];
 }
-//# sourceMappingURL=config.d.ts.map

package/dist/types/config.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=config.js.map

package/dist/types/fork.d.ts

@@ -40,4 +40,3 @@ export interface AccountResource {
      */
     data: unknown;
 }
-//# sourceMappingURL=fork.d.ts.map

package/dist/types/fork.js

@@ -2,4 +2,3 @@
  * Fork system types for MoveHat
  */
 export {};
-//# sourceMappingURL=fork.js.map

package/dist/types/harness.d.ts

@@ -163,4 +163,3 @@ export interface MoveScriptResult {
     success?: boolean;
     vmStatus?: string;
 }
-//# sourceMappingURL=harness.d.ts.map

package/dist/types/harness.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=harness.js.map

package/dist/types/runtime.d.ts

@@ -31,4 +31,3 @@ export interface MovehatRuntime {
     getAccountByIndex: (index: number) => Account;
     switchNetwork: (networkName: string) => Promise<MovehatRuntime>;
 }
-//# sourceMappingURL=runtime.d.ts.map

package/dist/types/runtime.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=runtime.js.map

package/dist/ui/colors.d.ts

@@ -74,4 +74,3 @@ export declare const gradients: {
      */
     error: Rgb[];
 };
-//# sourceMappingURL=colors.d.ts.map

package/dist/ui/colors.js

@@ -122,4 +122,3 @@ function createNoopColors() {
         get: () => noop,
     });
 }
-//# sourceMappingURL=colors.js.map

package/dist/ui/formatters.d.ts

@@ -152,4 +152,3 @@ export declare const sectionHeader: (title: string, options?: {
  * // $ npm install
  */
 export declare const formatCommand: (command: string) => string;
-//# sourceMappingURL=formatters.d.ts.map

package/dist/ui/formatters.js

@@ -183,4 +183,3 @@ export const sectionHeader = (title, options = {}) => {
 export const formatCommand = (command) => {
     return `${colors.dim('$')} ${command}`;
 };
-//# sourceMappingURL=formatters.js.map

package/dist/ui/index.d.ts

@@ -55,4 +55,3 @@ export declare const ui: {
     table: typeof _table;
     formatters: typeof _formatters;
 };
-//# sourceMappingURL=index.d.ts.map

package/dist/ui/index.js

@@ -57,4 +57,3 @@ export const ui = {
     table: _table,
     formatters: _formatters,
 };
-//# sourceMappingURL=index.js.map

package/dist/ui/logger.d.ts

@@ -215,4 +215,3 @@ export declare const logger: {
     kv: (key: string, value: string, indent?: number) => void;
     item: (text: string, indent?: number) => void;
 };
-//# sourceMappingURL=logger.d.ts.map

package/dist/ui/logger.js

@@ -274,4 +274,3 @@ export const logger = {
     kv,
     item,
 };
-//# sourceMappingURL=logger.js.map

package/dist/ui/spinner.d.ts

@@ -128,4 +128,3 @@ export interface SpinnerChain {
  * steps.complete();
  */
 export declare const createSpinnerChain: () => SpinnerChain;
-//# sourceMappingURL=spinner.d.ts.map

package/dist/ui/spinner.js

@@ -161,4 +161,3 @@ export const createSpinnerChain = () => {
         },
     };
 };
-//# sourceMappingURL=spinner.js.map

package/dist/ui/symbols.d.ts

@@ -48,4 +48,3 @@ export type SymbolType = 'success' | 'error' | 'warning' | 'info';
  * console.log(`${coloredSymbol('error')} Build failed`);
  */
 export declare const coloredSymbol: (type: SymbolType) => string;
-//# sourceMappingURL=symbols.d.ts.map

package/dist/ui/symbols.js

@@ -67,4 +67,3 @@ export const coloredSymbol = (type) => {
             return colors.info(symbols.info);
     }
 };
-//# sourceMappingURL=symbols.js.map

package/dist/ui/table.d.ts

@@ -64,4 +64,3 @@ export declare const createTable: (config?: TableConfig) => Table.Table;
  * console.log(table.toString());
  */
 export declare const createKVTable: (data: Record<string, string | number>, preset?: TablePreset) => Table.Table;
-//# sourceMappingURL=table.d.ts.map

package/dist/ui/table.js

@@ -140,4 +140,3 @@ export const createKVTable = (data, preset = 'borderless') => {
     }
     return table;
 };
-//# sourceMappingURL=table.js.map

package/dist/utils/address.d.ts

@@ -26,4 +26,3 @@ export declare function normalizeAddressShort(input: string): string;
  * `0x` prefix followed by 1 to 64 hex characters (case insensitive).
  */
 export declare function isHexAddress(input: string): boolean;
-//# sourceMappingURL=address.d.ts.map

package/dist/utils/address.js

@@ -45,4 +45,3 @@ export function isHexAddress(input) {
         return false;
     return /^[0-9a-fA-F]+$/.test(stripped);
 }
-//# sourceMappingURL=address.js.map

package/dist/utils/childProcessAdapter.d.ts

@@ -97,4 +97,3 @@ export interface SpawnedProcess {
     }>;
 }
 export declare const defaultChildProcessAdapter: ChildProcessAdapter;
-//# sourceMappingURL=childProcessAdapter.d.ts.map

package/dist/utils/childProcessAdapter.js

@@ -1,14 +1,15 @@
 import { spawn } from 'node:child_process';
 const DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
+const TERMINATION_GRACE_MS = 5_000;
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_INHERIT_STDIO_TIMEOUT_MS = 30 * 60 * 1000;
 class DefaultChildProcessAdapter {
     run(input) {
-        // Skip the default 5-minute timeout when the caller wires stdio
-        // through to the terminal — interactive sessions (mocha, tsx scripts,
-        // `movement move test`, `pnpm install`) routinely exceed 5 minutes
-        // and SIGTERM'ing them silently would be a regression. An explicit
-        // `timeoutMs` is always honored, regardless of `inheritStdio`.
-        const timeoutMs = input.timeoutMs ?? (input.inheritStdio ? undefined : DEFAULT_TIMEOUT_MS);
+        const timeoutMs = input.timeoutMs ??
+            (input.inheritStdio ? DEFAULT_INHERIT_STDIO_TIMEOUT_MS : DEFAULT_TIMEOUT_MS);
+        if (input.signal?.aborted) {
+            return Promise.reject(new Error('Command aborted before start'));
+        }
         return new Promise((resolve, reject) => {
             const child = spawn(input.command, [...input.args], {
                 cwd: input.cwd,
@@ -20,6 +21,32 @@ class DefaultChildProcessAdapter {
             let totalBytes = 0;
             let overflowed = false;
             const maxBuffer = input.maxBuffer ?? DEFAULT_MAX_BUFFER;
+            let settled = false;
+            let pendingFailure;
+            let forceKillHandle;
+            const settleResolve = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(result);
+            };
+            const settleReject = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(error);
+            };
+            const requestTermination = (reason) => {
+                if (reason && !pendingFailure) {
+                    pendingFailure = reason;
+                }
+                child.kill('SIGTERM');
+                if (!forceKillHandle) {
+                    forceKillHandle = setTimeout(() => {
+                        child.kill('SIGKILL');
+                    }, TERMINATION_GRACE_MS);
+                }
+            };
             const onChunk = (chunks) => (chunk) => {
                 if (overflowed)
                     return;
@@ -28,8 +55,7 @@ class DefaultChildProcessAdapter {
                     overflowed = true;
                     clearTimer();
                     input.signal?.removeEventListener('abort', onAbort);
-                    child.kill('SIGTERM');
-                    reject(new Error(`Command output exceeded maxBuffer (${maxBuffer} bytes): ${input.command}`));
+                    requestTermination(new Error(`Command output exceeded maxBuffer (${maxBuffer} bytes): ${input.command}`));
                     return;
                 }
                 chunks.push(chunk);
@@ -44,30 +70,31 @@ class DefaultChildProcessAdapter {
             };
             if (timeoutMs !== undefined) {
                 timeoutHandle = setTimeout(() => {
-                    child.kill('SIGTERM');
-                    reject(new Error(`Command timed out after ${timeoutMs}ms: ${input.command}`));
+                    requestTermination(new Error(`Command timed out after ${timeoutMs}ms: ${input.command}`));
                 }, timeoutMs);
             }
             const onAbort = () => {
-                child.kill('SIGTERM');
+                requestTermination();
             };
             if (input.signal) {
-                if (input.signal.aborted) {
-                    clearTimer();
-                    child.kill('SIGTERM');
-                    reject(new Error('Command aborted before start'));
-                    return;
-                }
                 input.signal.addEventListener('abort', onAbort, { once: true });
             }
             child.on('error', (err) => {
                 clearTimer();
+                if (forceKillHandle)
+                    clearTimeout(forceKillHandle);
                 input.signal?.removeEventListener('abort', onAbort);
-                reject(err);
+                settleReject(err);
             });
             child.on('close', (code, signal) => {
                 clearTimer();
+                if (forceKillHandle)
+                    clearTimeout(forceKillHandle);
                 input.signal?.removeEventListener('abort', onAbort);
+                if (pendingFailure) {
+                    settleReject(pendingFailure);
+                    return;
+                }
                 const result = {
                     exitCode: code !== null ? code : -1,
                     stdout: Buffer.concat(stdoutChunks).toString('utf8'),
@@ -76,7 +103,7 @@ class DefaultChildProcessAdapter {
                 if (signal) {
                     result.signal = signal;
                 }
-                resolve(result);
+                settleResolve(result);
             });
             // Under inheritStdio, child.stdin is null and the parent's stdin
             // is wired through; we just skip the close call. Otherwise, end()
@@ -123,4 +150,3 @@ class DefaultChildProcessAdapter {
     }
 }
 export const defaultChildProcessAdapter = new DefaultChildProcessAdapter();
-//# sourceMappingURL=childProcessAdapter.js.map

package/dist/utils/movementCli.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveMovementBinary(options?: {
+    env?: NodeJS.ProcessEnv;
+    projectRoot?: string;
+}): string;
+export declare function sanitizeMovementEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/utils/movementCli.js

@@ -0,0 +1,91 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { delimiter, isAbsolute, resolve, sep } from "node:path";
+const MOVEMENT_ENV_OVERRIDE = "MOVEHAT_MOVEMENT_BIN";
+const SAFE_ENV_NAMES = new Set([
+    "PATH",
+    "HOME",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "CI",
+    "TERM",
+    "COLORTERM",
+    "NO_COLOR",
+    "FORCE_COLOR",
+    "MOVEHAT_VERBOSE",
+    "MOVEMENT_RPC_URL",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+]);
+const SENSITIVE_ENV_NAME = /(?:^|_)(?:PRIVATE_?KEY|SECRET|TOKEN|PASSWORD|PASS|AUTH|CREDENTIAL|SESSION|COOKIE)(?:_|$)/i;
+function normalizePathForCheck(pathname) {
+    return pathname.endsWith(sep) ? pathname : `${pathname}${sep}`;
+}
+function assertTrustedMovementPath(pathname, projectRoot) {
+    const absolute = realpathSync(pathname);
+    const project = normalizePathForCheck(realpathSync(projectRoot));
+    const normalizedAbsolute = normalizePathForCheck(absolute);
+    if (normalizedAbsolute.startsWith(project)) {
+        throw new Error(`Refusing to run Movement CLI from project-controlled path: ${absolute}. ` +
+            `Install Movement CLI outside this project or set ${MOVEMENT_ENV_OVERRIDE} to a trusted absolute path.`);
+    }
+    if (absolute.split(sep).includes("node_modules")) {
+        throw new Error(`Refusing to run Movement CLI from node_modules: ${absolute}. ` +
+            `Install Movement CLI globally or set ${MOVEMENT_ENV_OVERRIDE} to a trusted absolute path.`);
+    }
+    return absolute;
+}
+function findOnPath(command, env) {
+    const pathValue = env.PATH ?? process.env.PATH ?? "";
+    for (const dir of pathValue.split(delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = resolve(dir, command);
+        try {
+            const stat = statSync(candidate);
+            if (!stat.isFile())
+                continue;
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Keep scanning PATH.
+        }
+    }
+    return null;
+}
+export function resolveMovementBinary(options = {}) {
+    const env = options.env ?? process.env;
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const override = env[MOVEMENT_ENV_OVERRIDE];
+    if (override) {
+        if (!isAbsolute(override)) {
+            throw new Error(`${MOVEMENT_ENV_OVERRIDE} must be an absolute path, got: ${override}`);
+        }
+        accessSync(override, constants.X_OK);
+        return assertTrustedMovementPath(override, projectRoot);
+    }
+    const resolved = findOnPath("movement", env);
+    if (!resolved) {
+        throw new Error("Movement CLI not found on PATH. Install Movement CLI or set " +
+            `${MOVEMENT_ENV_OVERRIDE} to a trusted absolute path.`);
+    }
+    return assertTrustedMovementPath(resolved, projectRoot);
+}
+export function sanitizeMovementEnv(baseEnv = process.env) {
+    const env = {};
+    for (const [key, value] of Object.entries(baseEnv)) {
+        if (value === undefined)
+            continue;
+        if (SENSITIVE_ENV_NAME.test(key))
+            continue;
+        if (SAFE_ENV_NAMES.has(key)) {
+            env[key] = value;
+        }
+    }
+    return env;
+}

package/dist/utils/parseCliOutput.d.ts

@@ -6,9 +6,12 @@
 /**
  * Extract the transaction hash from a `movement` CLI subcommand's stdout.
  *
- * Tries the context-bearing pattern first (`transaction hash: 0x…`,
- * `txn hash: 0x…`, `hash: 0x…`) and falls back to any 64-char hex
- * literal in the buffer. Returns `undefined` if no candidate matches.
+ * Only the context-bearing pattern is accepted (`transaction hash: 0x…`,
+ * `txn hash: 0x…`, `hash: 0x…`). When the context is absent we log a
+ * warning and return `undefined` so callers decide whether to throw —
+ * the previous behavior of falling back to "any 64-hex literal" was
+ * fragile: a padded module address or state root printed before the
+ * actual txhash would silently corrupt the cached deployment record.
  *
  * Shared by `core/Publisher.ts` (publish), `harness/codeObject.ts`
  * (deploy-object / upgrade-object), and `harness/script.ts`
@@ -17,4 +20,3 @@
  * CLI-format change is a one-line fix.
  */
 export declare function parseTxHash(stdout: string): string | undefined;
-//# sourceMappingURL=parseCliOutput.d.ts.map

package/dist/utils/parseCliOutput.js

@@ -3,12 +3,16 @@
  *
  * @internal — not exported from `src/index.ts`.
  */
+import { logger } from '../ui/index.js';
 /**
  * Extract the transaction hash from a `movement` CLI subcommand's stdout.
  *
- * Tries the context-bearing pattern first (`transaction hash: 0x…`,
- * `txn hash: 0x…`, `hash: 0x…`) and falls back to any 64-char hex
- * literal in the buffer. Returns `undefined` if no candidate matches.
+ * Only the context-bearing pattern is accepted (`transaction hash: 0x…`,
+ * `txn hash: 0x…`, `hash: 0x…`). When the context is absent we log a
+ * warning and return `undefined` so callers decide whether to throw —
+ * the previous behavior of falling back to "any 64-hex literal" was
+ * fragile: a padded module address or state root printed before the
+ * actual txhash would silently corrupt the cached deployment record.
  *
  * Shared by `core/Publisher.ts` (publish), `harness/codeObject.ts`
  * (deploy-object / upgrade-object), and `harness/script.ts`
@@ -20,7 +24,7 @@ export function parseTxHash(stdout) {
     const withContext = stdout.match(/(?:transaction\s*(?:hash)?|txn\s*(?:hash)?|hash):\s*(0x[a-fA-F0-9]{64})\b/i);
     if (withContext?.[1])
         return withContext[1];
-    const fallback = stdout.match(/\b(0x[a-fA-F0-9]{64})\b/);
-    return fallback?.[1];
+    logger.warning(`parseTxHash: no contextual 'transaction|txn|hash: 0x…' match in ${stdout.length}-byte CLI output. ` +
+        `Returning undefined; the caller decides whether to error.`);
+    return undefined;
 }
-//# sourceMappingURL=parseCliOutput.js.map

package/dist/utils/redact.d.ts

@@ -3,8 +3,9 @@
  * stderr / stdout / CLI arguments. Each match is replaced with
  * `***REDACTED***` by `redactSecrets`.
  *
- * The labelled pattern (second entry) intentionally accepts bare `priv` and
- * `key` prefixes. Over-redaction is fine; missing a real key is not.
+ * The labelled/contextual patterns intentionally accept bare `priv` and
+ * `key` prefixes only when they are adjacent to a full 32-byte hex value.
+ * Full-length addresses without key context are left untouched.
  */
 export declare const SECRET_PATTERNS: readonly RegExp[];
 /**
@@ -12,4 +13,3 @@ export declare const SECRET_PATTERNS: readonly RegExp[];
  * Idempotent: running it on already-redacted text is a no-op.
  */
 export declare function redactSecrets(text: string): string;
-//# sourceMappingURL=redact.d.ts.map

package/dist/utils/redact.js

@@ -3,12 +3,14 @@
  * stderr / stdout / CLI arguments. Each match is replaced with
  * `***REDACTED***` by `redactSecrets`.
  *
- * The labelled pattern (second entry) intentionally accepts bare `priv` and
- * `key` prefixes. Over-redaction is fine; missing a real key is not.
+ * The labelled/contextual patterns intentionally accept bare `priv` and
+ * `key` prefixes only when they are adjacent to a full 32-byte hex value.
+ * Full-length addresses without key context are left untouched.
  */
 export const SECRET_PATTERNS = [
-    /ed25519-priv-0x[0-9a-fA-F]{64}/g,
-    /(private[_-]?key|priv[_-]?key|priv|key)\s*[:=]\s*0x[0-9a-fA-F]{32,}/gi,
+    /\b[a-z0-9]+(?:-[a-z0-9]+)*-priv-0x[0-9a-fA-F]{64,}\b/gi,
+    /(?:--)?(?:private[_-]?key|private\s+key|priv[_-]?key|priv|key)\s*(?:[:=]|\s)\s*0x[0-9a-fA-F]{64}\b/gi,
+    /\b0x[0-9a-fA-F]{64}\b(?=\s*(?:private[_-]?key|private\s+key|priv[_-]?key|priv|key)\b)/gi,
 ];
 /**
  * Replaces every match of every known secret pattern with `***REDACTED***`.
@@ -21,4 +23,3 @@ export function redactSecrets(text) {
     }
     return out;
 }
-//# sourceMappingURL=redact.js.map

package/dist/utils/runCli.d.ts

@@ -21,4 +21,3 @@ export interface RunCliOptions {
  * writes directly to the terminal rather than to a captured buffer.
  */
 export declare function runCli(input: RunInput, options?: RunCliOptions): Promise<RunResult>;
-//# sourceMappingURL=runCli.d.ts.map

package/dist/utils/runCli.js

@@ -1,5 +1,6 @@
 import { CliExecutionError } from '../errors.js';
 import { defaultChildProcessAdapter, } from './childProcessAdapter.js';
+import { resolveMovementBinary, sanitizeMovementEnv } from './movementCli.js';
 import { redactSecrets } from './redact.js';
 export { redactSecrets } from './redact.js';
 const STDOUT_PREVIEW_CHARS = 2000;
@@ -20,7 +21,15 @@ const STDOUT_PREVIEW_CHARS = 2000;
 export async function runCli(input, options = {}) {
     const adapter = options.adapter ?? defaultChildProcessAdapter;
     const throwOnNonZeroExit = options.throwOnNonZeroExit ?? true;
-    const raw = await adapter.run(input);
+    const movementResolveOptions = input.env ? { env: input.env } : {};
+    const runInput = input.command === 'movement' && options.adapter === undefined
+        ? {
+            ...input,
+            command: resolveMovementBinary(movementResolveOptions),
+            env: sanitizeMovementEnv(input.env ?? process.env),
+        }
+        : input;
+    const raw = await adapter.run(runInput);
     const result = {
         exitCode: raw.exitCode,
         stdout: redactSecrets(raw.stdout),
@@ -34,4 +43,3 @@ export async function runCli(input, options = {}) {
     }
     return result;
 }
-//# sourceMappingURL=runCli.js.map