fix: safe generated identifiers and argv-based command execution

[pyramation]

Summary

Three unrelated correctness fixes in codegen output and CLI command execution.

1. Ambiguous operation names now fail fast. transfer_nft and transferNft are distinct wire operations that both camel()-normalize to transferNft, so client/composer/builder/react-query/recoil each emitted two declarations with the same name (invalid TS, or one silently shadowing the other). getMessageProperties now detects this and throws:

Operation name collision in "ExecuteMsg": "transfer_nft" and "transferNft" both
normalize to "transferNft". Rename one of the operations so the generated members are unique.

2. Reserved words no longer leak into generated identifiers. New packages/ast/src/utils/names.ts:

varName(name)              // 'class' -> '_class', 'owner' -> 'owner'
camelVarName(prop)         // camel() + varName()
camelMethodName(underscore) // also escapes 'constructor' / 'prototype'

All generator surfaces (client, message-composer, message-builder, recoil, react-query) use camelMethodName for member names and camelVarName/varName for destructuring bindings. Wire keys are unchanged — only the TS-side identifier is renamed:

_constructor = async ({ class: _class, default: _default }: {...}) =>
  this.client.execute(..., { constructor: { class: _class, default: _default } }, ...)

createTypedObjectParams gained an inType flag: binding renames ({ class: _class }) are illegal in a TS function type position, so interface signatures fall back to a plain params: { class: string; ... } parameter when any key needs escaping.

3. Commands are executed with an argv array instead of a shell string. install.ts built exec(\mv ${src} ${dst}`)wheredstis cwd-derived, andnpm install ${pkgs} ...; create-boilerplate.tsbuiltgit clone ${repo} ${name}` from a prompt value. Paths/names containing shell metacharacters were interpreted by the shell. Now:

renameSync(src, dst)                       // + cpSync/rimraf fallback across devices
execFileSync('npm', ['install', ...pkgs, '--production', '--prefix', './smart-contracts'])
execFileSync('git', ['clone', repo, '--', name])

New tests in packages/ast/__tests__/utils/safe-names.test.ts cover the helpers, the collision error, and snapshots of generated output for a constructor operation with class/default/delete payload properties. All existing snapshots are unchanged except the one client binding line that now reads this._constructor = this._constructor.bind(this).

Link to Devin session: https://app.devin.ai/sessions/bb89d57636c84c7383305191a303b1d4
Open in Devin Desktop: https://app.devin.ai/desktop/session/bb89d57636c84c7383305191a303b1d4?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring