@lucid-agents/taskmarket 1.19.1 → 1.20.0

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   signReadAuth,
   submitTaskFiles,
   taskAccessGrantHeaders
-} from "./chunk-ICT56PNO.js";
+} from "./chunk-SQFNRMEN.js";
 import {
   ComputeCreditError,
   applyComputeCreditSetup,
@@ -36,7 +36,7 @@ import {
   refusedPaidWrite,
   releasePendingComputePurchase,
   resolvePendingComputePurchases
-} from "./chunk-M7WD6A2T.js";
+} from "./chunk-2YFJNXXA.js";
 import {
   MPP_TEMPO_DEFAULT_VALIDITY_SECONDS,
   X402PayError,
@@ -58,15 +58,16 @@ import {
   signSponsoredTempoTransfer,
   signTaskmarketFeePayment,
   signTypedData
-} from "./chunk-NRKTRQEA.js";
+} from "./chunk-SCZPZWRF.js";
 import {
   AgentMessageEnvelopeSchema,
   ApiError,
   BUG_REPORT_SEVERITIES,
   BUG_REPORT_STATUSES,
+  BUG_REPORT_VISIBILITIES,
+  BugReportMessageBodySchema,
   DEFAULT_EVALUATION_WINDOW_HOURS,
   DEFAULT_TERMS_BOUNDS,
-  GetBugReportInputSchema,
   IntentStatusResponseSchema,
   LegalAcceptanceResponseSchema,
   LegalBundleSchema,
@@ -74,7 +75,9 @@ import {
   LegalStatusResponseSchema,
   NETWORKS,
   NETWORK_NAMES,
+  PUBLIC_BUG_REPORT_SORTS,
   PenaltyTo,
+  PostBugReportMessageInputSchema,
   READ_AUTH_ADDRESS_HEADER,
   READ_AUTH_SIGNATURE_HEADER,
   REDACTED,
@@ -140,6 +143,7 @@ import {
   isInFlightApiError,
   isPendingApiError,
   isRecordingPendingResponse,
+  isTaskmarketChainId,
   isTerminalWalletBridgeStatus,
   keystoreExists,
   loadKeystore,
@@ -158,17 +162,18 @@ import {
   settlementActionExpiresAt,
   settlementActionRequiresExpiry,
   taskmarketChain,
+  taskmarketCommandFor,
   usdcToBaseUnits,
   withErrorContext,
   withIdempotentWrite
-} from "./chunk-X7AUWPZV.js";
+} from "./chunk-F7HVOUHY.js";
 import {
   channelLines
 } from "./chunk-XJOB4NMV.js";
 import "./chunk-S7SJMJ2I.js";
 
 // src/index.ts
-import { Command as Command104 } from "commander";
+import { Command as Command109 } from "commander";
 import { createRequire } from "module";
 
 // src/commands/init.ts
@@ -3436,7 +3441,7 @@ async function runAgentCommand(options) {
   try {
     const { assertAgentCompatibility } = await import("./compatibility-636WJOEX.js");
     const pi = assertAgentCompatibility();
-    const { runAgent } = await import("./launch-ZSZURLR6.js");
+    const { runAgent } = await import("./launch-CXG3JSD7.js");
     result = await runAgent({
       model: options.model,
       pi,
@@ -3495,13 +3500,13 @@ function agentManagementCommands() {
   const status = new Command48("status").description(
     "Show the agent channels (locked, charged, refundable), purchases with an unknown outcome, the sandbox and compute credit. Reads only."
   ).option("--json", "Print the versioned JSON envelope").action(async (options) => {
-    const { collectAgentStatus, statusLines } = await import("./status-BXL2F4LY.js");
+    const { collectAgentStatus, statusLines } = await import("./status-ITMQZ4W6.js");
     await run(options, () => collectAgentStatus(), statusLines);
   });
   const doctor = new Command48("doctor").description(
     "Check that the agent can start: Node and the bundled runtime, wallet and policy, channels, API, sandbox broker, host keys, xgate and RPC. Reads only."
   ).option("--json", "Print the versioned JSON envelope").action(async (options) => {
-    const { runDoctor, doctorLines } = await import("./doctor-MBM7WQHI.js");
+    const { runDoctor, doctorLines } = await import("./doctor-DO2R6HK7.js");
     const report = await run(options, () => runDoctor(), doctorLines);
     if (report && !report.ok) process.exitCode = 1;
   });
@@ -3512,7 +3517,7 @@ function agentManagementCommands() {
     "Reconcile the open purchases of this channel, as status lists it; also reaches retired channels"
   ).option("--json", "Print the versioned JSON envelope").action(
     async (invocationId, options) => {
-      const { reconcileChannelPurchases, reconcileInvocation } = await import("./reconcile-4HIIA426.js");
+      const { reconcileChannelPurchases, reconcileInvocation } = await import("./reconcile-LB2ZRNG5.js");
       const choice = { rail: options.rail, channel: options.channel };
       if (invocationId !== void 0) {
         await run(
@@ -3570,7 +3575,7 @@ function agentManagementCommands() {
             `Not a USDC amount: ${options.amount} (digits, at most 6 decimals)`
           );
         }
-        const { openAgentChannels, requestTopUp, selectRail, withdrawalHatch } = await import("./channels-7DEGKHO5.js");
+        const { openAgentChannels, requestTopUp, selectRail, withdrawalHatch } = await import("./channels-A57K7BP6.js");
         const { rails } = await openAgentChannels();
         const result = await requestTopUp(selectRail(rails, options.rail), amount);
         return {
@@ -3594,8 +3599,8 @@ function agentManagementCommands() {
       async () => {
         await requireExperimental();
         const { AGENT_VIEW_VERSION } = await import("./budget-view-J6L7X6EY.js");
-        const { closeChannel, openAgentChannels, selectChannel } = await import("./channels-7DEGKHO5.js");
-        const { reconcileLeasedPurchase } = await import("./reconcile-4HIIA426.js");
+        const { closeChannel, openAgentChannels, selectChannel } = await import("./channels-A57K7BP6.js");
+        const { reconcileLeasedPurchase } = await import("./reconcile-LB2ZRNG5.js");
         const opened = await openAgentChannels();
         const { rail, retired } = selectChannel(opened, options);
         const result = await closeChannel(
@@ -3666,7 +3671,7 @@ function agentManagementCommands() {
         options,
         async () => {
           await requireExperimental();
-          const { runPull } = await import("./sync-pull-HL2YS3EL.js");
+          const { runPull } = await import("./sync-pull-U3WGVKDX.js");
           const { terminalPrompter } = await import("./prompter-LSICEYSQ.js");
           return runPull(options, {
             interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY) && !options.json,
@@ -3947,27 +3952,51 @@ import { Command as Command56 } from "commander";
 
 // src/lib/withdrawal-pin.ts
 var WithdrawalAddressMismatchError = class extends Error {
-  constructor(pinned, server) {
+  constructor(pinned, server, chainId) {
     super(
-      `Refusing to sign: the server reports withdrawal address ${server}, but this CLI has ${pinned} pinned locally. Nothing was signed or sent. If you changed the withdrawal address yourself (for example on the web with your account recovery code), accept the new address with: taskmarket wallet sync-withdrawal-address`
+      `Refusing to sign: the server reports withdrawal address ${server} on chain ${chainId}, but this CLI has ${pinned} pinned locally for that chain. Nothing was signed or sent. If you changed the withdrawal address yourself (for example with \`taskmarket wallet change-withdrawal-address\` from another machine), accept the new address with: ${taskmarketCommandFor(chainId)} wallet sync-withdrawal-address`
     );
     this.pinned = pinned;
     this.server = server;
+    this.chainId = chainId;
     this.name = "WithdrawalAddressMismatchError";
   }
 };
-async function pinWithdrawalAddress(keystore, address) {
-  await saveKeystore({ ...keystore, withdrawalAddress: address });
+function pinnedWithdrawalAddress(keystore, chainId) {
+  return keystore.withdrawalAddresses?.[String(chainId)] ?? keystore.withdrawalAddress;
+}
+async function pinWithdrawalAddress(keystore, chainId, address) {
+  await saveKeystore({
+    ...keystore,
+    withdrawalAddresses: { ...keystore.withdrawalAddresses, [String(chainId)]: address }
+  });
 }
-async function verifyWithdrawalAddress(keystore, serverAddress, log = (line) => process.stderr.write(line + "\n")) {
-  const pinned = keystore.withdrawalAddress;
+function serverChainMismatch(requested, answered) {
+  if (answered === void 0 || answered === requested) return void 0;
+  return `Refusing to continue: the server answered for chain ${answered}, but this CLI asked for chain ${requested}. Nothing was pinned.`;
+}
+async function fetchWithdrawalAddress(address, chainId) {
+  const response = await apiGet(
+    `/api/wallet/withdrawal-address?address=${address}&chainId=${chainId}`
+  );
+  const mismatch = serverChainMismatch(chainId, response.chainId);
+  if (mismatch) throw new Error(mismatch);
+  return { withdrawalAddress: response.withdrawalAddress, chainId };
+}
+function noWithdrawalAddressMessage(chainId) {
+  return `No withdrawal address set on chain ${chainId}. The withdrawal address is per chain; run: ${taskmarketCommandFor(chainId)} wallet set-withdrawal-address <address>`;
+}
+async function verifyWithdrawalAddress(keystore, chainId, serverAddress, log = (line) => process.stderr.write(line + "\n")) {
+  const pinned = pinnedWithdrawalAddress(keystore, chainId);
   if (!pinned) {
-    await pinWithdrawalAddress(keystore, serverAddress);
-    log(`Note: pinned withdrawal address ${serverAddress} in the local keystore.`);
+    await pinWithdrawalAddress(keystore, chainId, serverAddress);
+    log(
+      `Note: pinned withdrawal address ${serverAddress} for chain ${chainId} in the local keystore.`
+    );
     return serverAddress;
   }
   if (pinned.toLowerCase() !== serverAddress.toLowerCase()) {
-    throw new WithdrawalAddressMismatchError(pinned, serverAddress);
+    throw new WithdrawalAddressMismatchError(pinned, serverAddress, chainId);
   }
   return pinned;
 }
@@ -3992,7 +4021,9 @@ var SIGNATURE_TTL_SECONDS = 5 * 60;
 function isValidAddress(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var setWithdrawalAddressCommand = new Command56("set-withdrawal-address").description("Set a withdrawal address for payment-token withdrawals (one-time, free)").argument("<address>", "Ethereum address to receive withdrawals").action(async (address) => {
+var setWithdrawalAddressCommand = new Command56("set-withdrawal-address").description(
+  "Set the withdrawal address for payment-token withdrawals on the selected network (once per chain, free)"
+).argument("<address>", "Ethereum address to receive withdrawals").action(async (address) => {
   if (!isValidAddress(address)) {
     printError("Invalid Ethereum address: must be 0x followed by 40 hex characters");
     return;
@@ -4024,12 +4055,19 @@ var setWithdrawalAddressCommand = new Command56("set-withdrawal-address").descri
     expiresAt,
     chainId
   });
-  await pinWithdrawalAddress(keystore, result.withdrawalAddress);
+  const mismatch = serverChainMismatch(chainId, result.chainId);
+  if (mismatch) {
+    printError(mismatch);
+    return;
+  }
+  const actedOn = chainId;
+  await pinWithdrawalAddress(keystore, actedOn, result.withdrawalAddress);
   printResult(
     {
+      chainId: actedOn,
       withdrawalAddress: result.withdrawalAddress,
       accountRecoveryCode: result.accountRecoveryCode,
-      warning: "SAVE THIS ACCOUNT RECOVERY CODE NOW. It will never be shown again, and there is no way to recover it if lost -- the withdrawal address could then never be changed again. Save it in more than one independent place (e.g. a password manager entry AND a printed copy)."
+      warning: `SAVE THIS ACCOUNT RECOVERY CODE NOW. It is the recovery code for chain ${actedOn} only, will never be shown again, and there is no way to recover it if lost -- this chain's withdrawal address could then never be changed again. Save it in more than one independent place (e.g. a password manager entry AND a printed copy).`
     },
     { idempotencyKey }
   );
@@ -4037,14 +4075,19 @@ var setWithdrawalAddressCommand = new Command56("set-withdrawal-address").descri
 
 // src/commands/wallet/get-withdrawal-address.ts
 import { Command as Command57 } from "commander";
-var getWithdrawalAddressCommand = new Command57("get-withdrawal-address").description("Show the currently registered withdrawal address, if any").option("--address <addr>", "Wallet address to check (defaults to own wallet)").action(async (opts) => {
+var getWithdrawalAddressCommand = new Command57("get-withdrawal-address").description(
+  "Show the withdrawal address registered on the selected network, if any (the address is per chain)"
+).option("--address <addr>", "Wallet address to check (defaults to own wallet)").action(async (opts) => {
   let address = opts.address;
   if (!address) {
     const keystore = await loadKeystore();
     address = keystore.walletAddress;
   }
-  const result = await apiGet(`/api/wallet/withdrawal-address?address=${address}`);
-  printResult(result);
+  const { chainId } = selectedNetwork();
+  const result = await apiGet(
+    `/api/wallet/withdrawal-address?address=${address}&chainId=${chainId}`
+  );
+  printResult({ ...result, chainId: result.chainId ?? chainId });
 });
 
 // src/commands/wallet/change-withdrawal-address.ts
@@ -4055,7 +4098,9 @@ function isValidAddress2(addr) {
 function isValidRecoveryCode(code) {
   return /^\d{8}$/.test(code);
 }
-var changeWithdrawalAddressCommand = new Command58("change-withdrawal-address").description("Change the withdrawal address using the account recovery code (RFC-0012)").argument("<recovery-code>", "The 8-digit account recovery code from set-withdrawal-address").argument("<new-address>", "New Ethereum address to receive withdrawals").action(async (recoveryCode, newAddress) => {
+var changeWithdrawalAddressCommand = new Command58("change-withdrawal-address").description(
+  "Change the selected network's withdrawal address using that chain's account recovery code (RFC-0012)"
+).argument("<recovery-code>", "The 8-digit account recovery code from set-withdrawal-address").argument("<new-address>", "New Ethereum address to receive withdrawals").action(async (recoveryCode, newAddress) => {
   if (!isValidRecoveryCode(recoveryCode)) {
     printError("Invalid account recovery code: must be 8 digits");
     return;
@@ -4071,17 +4116,26 @@ var changeWithdrawalAddressCommand = new Command58("change-withdrawal-address").
     printError("No keystore found. Run `taskmarket init` first.");
     return;
   }
+  const { chainId } = selectedNetwork();
   const { data: result, idempotencyKey } = await apiPost("/api/wallet/change-withdrawal-address", {
     address: keystore.walletAddress,
     accountRecoveryCode: recoveryCode,
-    newWithdrawalAddress: newAddress
+    newWithdrawalAddress: newAddress,
+    chainId
   });
-  await pinWithdrawalAddress(keystore, result.withdrawalAddress);
+  const mismatch = serverChainMismatch(chainId, result.chainId);
+  if (mismatch) {
+    printError(mismatch);
+    return;
+  }
+  const actedOn = chainId;
+  await pinWithdrawalAddress(keystore, actedOn, result.withdrawalAddress);
   printResult(
     {
+      chainId: actedOn,
       withdrawalAddress: result.withdrawalAddress,
       accountRecoveryCode: result.accountRecoveryCode,
-      warning: "SAVE THIS NEW ACCOUNT RECOVERY CODE NOW. The code you just used is no longer valid. This new one will never be shown again, and there is no way to recover it if lost. Save it in more than one independent place (e.g. a password manager entry AND a printed copy)."
+      warning: `SAVE THIS NEW ACCOUNT RECOVERY CODE NOW. It is the recovery code for chain ${actedOn} only. The code you just used is no longer valid on this chain. This new one will never be shown again, and there is no way to recover it if lost. Save it in more than one independent place (e.g. a password manager entry AND a printed copy).`
     },
     { idempotencyKey }
   );
@@ -4090,7 +4144,7 @@ var changeWithdrawalAddressCommand = new Command58("change-withdrawal-address").
 // src/commands/wallet/sync-withdrawal-address.ts
 import { Command as Command59 } from "commander";
 var syncWithdrawalAddressCommand = new Command59("sync-withdrawal-address").description(
-  "Accept the withdrawal address registered on the server as the locally pinned one (after a change made elsewhere, e.g. on the web)"
+  "Accept the selected network's withdrawal address registered on the server as the locally pinned one (after a change made elsewhere, e.g. on the web)"
 ).action(async () => {
   let keystore;
   try {
@@ -4099,18 +4153,22 @@ var syncWithdrawalAddressCommand = new Command59("sync-withdrawal-address").desc
     printError("No keystore found. Run `taskmarket init` first.");
     return;
   }
-  const { withdrawalAddress } = await apiGet(
-    `/api/wallet/withdrawal-address?address=${keystore.walletAddress}`
-  );
+  const { chainId } = selectedNetwork();
+  let withdrawalAddress;
+  try {
+    ({ withdrawalAddress } = await fetchWithdrawalAddress(keystore.walletAddress, chainId));
+  } catch (err) {
+    renderFailure(err);
+    return;
+  }
   if (!withdrawalAddress) {
-    printError(
-      "No withdrawal address set. Run: taskmarket wallet set-withdrawal-address <address>"
-    );
+    printError(noWithdrawalAddressMessage(chainId));
     return;
   }
-  const previous = keystore.withdrawalAddress ?? null;
-  await pinWithdrawalAddress(keystore, withdrawalAddress);
+  const previous = pinnedWithdrawalAddress(keystore, chainId) ?? null;
+  await pinWithdrawalAddress(keystore, chainId, withdrawalAddress);
   printResult({
+    chainId,
     previousWithdrawalAddress: previous,
     withdrawalAddress,
     changed: previous === null || previous.toLowerCase() !== withdrawalAddress.toLowerCase()
@@ -4119,7 +4177,9 @@ var syncWithdrawalAddressCommand = new Command59("sync-withdrawal-address").desc
 
 // src/commands/wallet/reveal-recovery-code.ts
 import { Command as Command60 } from "commander";
-var revealRecoveryCodeCommand = new Command60("reveal-recovery-code").description("One-time reveal of your account recovery code, if one has not been generated yet").action(async () => {
+var revealRecoveryCodeCommand = new Command60("reveal-recovery-code").description(
+  "One-time reveal of the selected network's account recovery code, if one has not been generated yet"
+).action(async () => {
   let keystore;
   try {
     keystore = await loadKeystore();
@@ -4128,16 +4188,20 @@ var revealRecoveryCodeCommand = new Command60("reveal-recovery-code").descriptio
     return;
   }
   const address = keystore.walletAddress;
-  const message = buildRevealAccountRecoveryCodeMessage(address);
+  const { chainId } = selectedNetwork();
+  const message = buildRevealAccountRecoveryCodeMessage(address, chainId);
   const signature = await signMessage(message, keystore);
   const { data: result, idempotencyKey } = await apiPost("/api/wallet/reveal-backfilled-recovery-code", {
     address,
-    signature
+    signature,
+    chainId
   });
+  const actedOn = result.chainId ?? chainId;
   printResult(
     {
+      chainId: actedOn,
       accountRecoveryCode: result.accountRecoveryCode,
-      warning: "SAVE THIS ACCOUNT RECOVERY CODE NOW. It will never be shown again, and there is no way to recover it if lost -- the withdrawal address could then never be changed again. Save it in more than one independent place (e.g. a password manager entry AND a printed copy)."
+      warning: `SAVE THIS ACCOUNT RECOVERY CODE NOW. It is the recovery code for chain ${actedOn} only, will never be shown again, and there is no way to recover it if lost -- this chain's withdrawal address could then never be changed again. Save it in more than one independent place (e.g. a password manager entry AND a printed copy).`
     },
     { idempotencyKey }
   );
@@ -4185,30 +4249,42 @@ var withdrawDreamsCommand = new Command62("withdraw-dreams").description("Withdr
     printError("Invalid Ethereum address: must be 0x followed by 40 hex characters");
     return;
   }
-  if (!destination) {
-    const addressResponse = await apiGet(
-      `/api/wallet/withdrawal-address?address=${workerAddress}`
+  const balance = await apiGet(
+    `/api/wallet/dreams-balance?address=${workerAddress}`
+  );
+  if (!balance.hookAddress || balance.chainId === void 0) {
+    printError("DREAMS rewards are not configured on this server");
+    return;
+  }
+  if (!isTaskmarketChainId(balance.chainId)) {
+    printError(
+      `Refusing to sign: the server reports the DREAMS reward hook on unknown chain ${balance.chainId}`
     );
+    return;
+  }
+  if (!destination) {
+    let addressResponse;
+    try {
+      addressResponse = await fetchWithdrawalAddress(workerAddress, balance.chainId);
+    } catch (err) {
+      renderFailure(err);
+      return;
+    }
     if (!addressResponse.withdrawalAddress) {
-      printError(
-        "No withdrawal address set. Run: taskmarket wallet set-withdrawal-address <address>"
-      );
+      printError(noWithdrawalAddressMessage(balance.chainId));
       return;
     }
     try {
-      destination = await verifyWithdrawalAddress(keystore, addressResponse.withdrawalAddress);
+      destination = await verifyWithdrawalAddress(
+        keystore,
+        balance.chainId,
+        addressResponse.withdrawalAddress
+      );
     } catch (err) {
       renderFailure(err);
       return;
     }
   }
-  const balance = await apiGet(
-    `/api/wallet/dreams-balance?address=${workerAddress}`
-  );
-  if (!balance.hookAddress || balance.chainId === void 0) {
-    printError("DREAMS rewards are not configured on this server");
-    return;
-  }
   const nonce = toHex(crypto.getRandomValues(new Uint8Array(32)));
   const validBefore = String(Math.floor(Date.now() / 1e3) + AUTHORIZATION_VALIDITY_SECONDS);
   const message = buildWithdrawDreamsMessage({
@@ -4504,26 +4580,23 @@ var withdrawCommand = new Command65("withdraw").description(
     return;
   }
   const from = keystore.walletAddress;
-  const addressResponse = await apiGet(
-    `/api/wallet/withdrawal-address?address=${from}`
-  );
+  const { chainId } = selectedNetwork();
+  const addressResponse = await fetchWithdrawalAddress(from, chainId);
   if (!addressResponse.withdrawalAddress) {
-    printError(
-      "No withdrawal address set. Run: taskmarket wallet set-withdrawal-address <address>"
-    );
+    printError(noWithdrawalAddressMessage(chainId));
     return;
   }
   let withdrawalAddress;
   try {
     withdrawalAddress = await verifyWithdrawalAddress(
       keystore,
+      chainId,
       addressResponse.withdrawalAddress
     );
   } catch (err) {
     renderFailure(err);
     return;
   }
-  const { chainId } = selectedNetwork();
   if (paymentProtocolOf(chainId) === "mpp") {
     const { data: result2, idempotencyKey: idempotencyKey2 } = await withdrawOnTempo({
       keystore,
@@ -6169,11 +6242,150 @@ emailCommand.addCommand(addressCommand2);
 emailCommand.addCommand(markReadCommand);
 
 // src/commands/bug/index.ts
-import { Command as Command82 } from "commander";
+import { Command as Command87 } from "commander";
 
-// src/commands/bug/list.ts
+// src/commands/bug/browse.ts
 import { Command as Command79 } from "commander";
-var listCommand = new Command79("list").description("List the bug reports you submitted and their status").option("--status <status>", `Only reports with this status: ${BUG_REPORT_STATUSES.join(", ")}`).option("--limit <n>", "Maximum reports to return (1-100)", "50").action(async (opts) => {
+var browseCommand = new Command79("browse").description(
+  "Browse public bug reports, to check whether a bug is already known; no wallet needed"
+).option("--query <text>", "Only reports whose title or description contains this text").option("--status <status>", `Only reports with this status: ${BUG_REPORT_STATUSES.join(", ")}`).option("--sort <order>", `Order: ${PUBLIC_BUG_REPORT_SORTS.join(", ")}`, "newest").option("--limit <n>", "Maximum reports to return (1-100)", "50").option("--offset <n>", "Skip this many reports, for paging", "0").action(
+  async (opts) => {
+    if (opts.status && !BUG_REPORT_STATUSES.includes(opts.status)) {
+      printError(`--status must be one of ${BUG_REPORT_STATUSES.join(", ")}`);
+      return;
+    }
+    if (!PUBLIC_BUG_REPORT_SORTS.includes(opts.sort)) {
+      printError(`--sort must be one of ${PUBLIC_BUG_REPORT_SORTS.join(", ")}`);
+      return;
+    }
+    const limit = Number(opts.limit);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      printError("--limit must be an integer from 1 to 100");
+      return;
+    }
+    const offset = Number(opts.offset);
+    if (!Number.isInteger(offset) || offset < 0) {
+      printError("--offset must be a whole number");
+      return;
+    }
+    const query2 = opts.query?.trim();
+    if (query2 !== void 0 && (query2.length === 0 || query2.length > 200)) {
+      printError("--query must be 1 to 200 characters");
+      return;
+    }
+    const params = new URLSearchParams({
+      sort: opts.sort,
+      limit: String(limit),
+      offset: String(offset)
+    });
+    if (opts.status) params.set("status", opts.status);
+    if (query2) params.set("query", query2);
+    try {
+      printResult(await apiGet(`/api/bug-tracker?${params.toString()}`));
+    } catch (error) {
+      return renderFailure(error);
+    }
+  }
+);
+
+// src/commands/bug/comment.ts
+import { Command as Command80 } from "commander";
+
+// src/lib/stdin.ts
+var STDIN_FIRST_BYTE_MS = 5e3;
+async function readStdin(firstByteMs) {
+  const chunks = [];
+  const iterator = process.stdin[Symbol.asyncIterator]();
+  let timer;
+  const first = await Promise.race([
+    iterator.next(),
+    ...firstByteMs === void 0 ? [] : [new Promise((resolve) => timer = setTimeout(() => resolve(null), firstByteMs))]
+  ]);
+  clearTimeout(timer);
+  if (first === null) {
+    process.stdin.destroy();
+    return null;
+  }
+  if (!first.done) {
+    chunks.push(Buffer.from(first.value));
+    for await (const chunk of { [Symbol.asyncIterator]: () => iterator }) {
+      chunks.push(Buffer.from(chunk));
+    }
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function textOrStdin(value) {
+  if (value !== void 0 && value !== "-") return value;
+  if (process.stdin.isTTY) return null;
+  return readStdin(value === "-" ? void 0 : STDIN_FIRST_BYTE_MS);
+}
+
+// src/commands/bug/report-ref.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var NUMBER = /^#?(\d+)$/;
+function parseBugReportRef(value) {
+  if (UUID.test(value)) return { kind: "id", id: value.toLowerCase() };
+  const match = NUMBER.exec(value);
+  if (match) {
+    const number = Number(match[1]);
+    if (Number.isSafeInteger(number) && number > 0) return { kind: "number", number };
+  }
+  return null;
+}
+var BUG_REPORT_REF_HELP = "Bug report: its public number (#N) or its id";
+var BUG_REPORT_REF_ERROR = "Name the bug report by its public number (#12) or its id";
+async function fetchPublicBugReport(number, headers) {
+  return await apiGet(`/api/bug-tracker/${number}`, { headers });
+}
+async function resolveBugReportId(ref) {
+  if (ref.kind === "id") return ref.id;
+  return (await fetchPublicBugReport(ref.number)).id;
+}
+
+// src/commands/bug/comment.ts
+var commentCommand = new Command80("comment").description(
+  "Comment on a public bug report. Comments are public: never include keys, seed phrases or other private data"
+).argument("<report>", BUG_REPORT_REF_HELP).argument("[message]", 'Your comment; read from stdin when omitted or "-"').option("--agent <id>", "Your agent id, shown with the comment").action(async (report, message, opts) => {
+  const ref = parseBugReportRef(report);
+  if (!ref) {
+    printError(BUG_REPORT_REF_ERROR);
+    return;
+  }
+  const text = await textOrStdin(message);
+  if (text === null) {
+    printError("Pass the comment as an argument, or pipe it on stdin");
+    return;
+  }
+  const body = BugReportMessageBodySchema.safeParse(text);
+  if (!body.success) {
+    printError(`Invalid comment: ${body.error.issues[0].message}`);
+    return;
+  }
+  if (opts.agent !== void 0 && (opts.agent.length === 0 || opts.agent.length > 128)) {
+    printError("--agent must be 1 to 128 characters");
+    return;
+  }
+  const auth = await signReadAuth();
+  if (!auth || Object.keys(auth.headers).length === 0) {
+    printError("Commenting on a bug report needs a wallet. Run `taskmarket init` first.");
+    return;
+  }
+  try {
+    const id = await resolveBugReportId(ref);
+    const { data, idempotencyKey } = await apiPost(
+      `/api/bug-reports/${id}/comments`,
+      { body: body.data, ...opts.agent ? { agentId: opts.agent } : {} },
+      { headers: auth.headers }
+    );
+    printResult(data, { idempotencyKey });
+  } catch (error) {
+    return renderFailure(error);
+  }
+});
+
+// src/commands/bug/list.ts
+import { Command as Command81 } from "commander";
+var listCommand = new Command81("list").description("List the bug reports you submitted and their status").option("--status <status>", `Only reports with this status: ${BUG_REPORT_STATUSES.join(", ")}`).option("--limit <n>", "Maximum reports to return (1-100)", "50").action(async (opts) => {
   if (opts.status && !BUG_REPORT_STATUSES.includes(opts.status)) {
     printError(`--status must be one of ${BUG_REPORT_STATUSES.join(", ")}`);
     return;
@@ -6199,27 +6411,98 @@ var listCommand = new Command79("list").description("List the bug reports you su
   }
 });
 
-// src/commands/bug/show.ts
-import { Command as Command80 } from "commander";
-var showCommand = new Command80("show").description("Show one of your bug reports, its status and any linked GitHub issue").argument("<id>", "Bug report id").action(async (id) => {
-  if (!GetBugReportInputSchema.safeParse({ id }).success) {
-    printError("Bug report id must be a UUID");
+// src/commands/bug/me-too.ts
+import { Command as Command82 } from "commander";
+var meTooCommand = new Command82("me-too").description("Say you hit a public bug report too; counted once per wallet").argument("<report>", BUG_REPORT_REF_HELP).action(async (report) => {
+  const ref = parseBugReportRef(report);
+  if (!ref) {
+    printError(BUG_REPORT_REF_ERROR);
     return;
   }
   const auth = await signReadAuth();
   if (!auth || Object.keys(auth.headers).length === 0) {
-    printError("Reading a bug report needs a wallet. Run `taskmarket init` first.");
+    printError("Saying you have this bug too needs a wallet. Run `taskmarket init` first.");
     return;
   }
   try {
-    printResult(await apiGet(`/api/bug-reports/${id}`, { headers: auth.headers }));
+    const id = await resolveBugReportId(ref);
+    const { data, idempotencyKey } = await apiPost(
+      `/api/bug-reports/${id}/affected`,
+      {},
+      { headers: auth.headers }
+    );
+    printResult(data, { idempotencyKey });
+  } catch (error) {
+    return renderFailure(error);
+  }
+});
+
+// src/commands/bug/reply.ts
+import { Command as Command83 } from "commander";
+var replyCommand2 = new Command83("reply").description(
+  "Reply to Taskmarket staff on one of your bug reports; a reply does not change its status"
+).argument("<id>", "Bug report id").argument("[message]", 'Your reply; read from stdin when omitted or "-"').action(async (id, message) => {
+  const body = await textOrStdin(message);
+  if (body === null) {
+    printError("Pass the reply as an argument, or pipe it on stdin");
+    return;
+  }
+  const parsed = PostBugReportMessageInputSchema.safeParse({ id, body });
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    printError(
+      issue.path[0] === "id" ? "Bug report id must be a UUID" : `Invalid reply: ${issue.path.join(".") || "input"}: ${issue.message}`
+    );
+    return;
+  }
+  const auth = await signReadAuth();
+  if (!auth || Object.keys(auth.headers).length === 0) {
+    printError("Replying to a bug report needs a wallet. Run `taskmarket init` first.");
+    return;
+  }
+  try {
+    const { data, idempotencyKey } = await apiPost(
+      `/api/bug-reports/${id}/messages`,
+      { body: parsed.data.body },
+      { headers: auth.headers }
+    );
+    printResult(data, { idempotencyKey });
+  } catch (error) {
+    return renderFailure(error);
+  }
+});
+
+// src/commands/bug/show.ts
+import { Command as Command84 } from "commander";
+var showCommand = new Command84("show").description(
+  "Show a public bug report by its number (#N, no wallet needed), or one of your own by its id with messages from staff"
+).argument("<report>", "Public number (#N) of any public report, or the id of one of yours").action(async (report) => {
+  const ref = parseBugReportRef(report);
+  if (!ref) {
+    printError(BUG_REPORT_REF_ERROR);
+    return;
+  }
+  const auth = await signReadAuth();
+  const signed = auth && Object.keys(auth.headers).length > 0 ? auth.headers : void 0;
+  try {
+    if (ref.kind === "number") {
+      printResult(await fetchPublicBugReport(ref.number, signed));
+      return;
+    }
+    if (!signed) {
+      printError(
+        "Reading your bug report by id needs a wallet. Run `taskmarket init` first, or use its public number."
+      );
+      return;
+    }
+    printResult(await apiGet(`/api/bug-reports/${ref.id}`, { headers: signed }));
   } catch (error) {
     return renderFailure(error);
   }
 });
 
 // src/commands/bug/submit.ts
-import { Command as Command81 } from "commander";
+import { Command as Command85 } from "commander";
 
 // src/commands/bug/context.ts
 import os from "os";
@@ -6242,47 +6525,20 @@ function cliVersionOf(command) {
 // src/commands/bug/submit.ts
 var LAST_COMMAND_MAX_CHARS = 2048;
 var LAST_ERROR_MAX_CHARS = 16 * 1024;
-var STDIN_FIRST_BYTE_MS = 5e3;
-async function readStdin(firstByteMs) {
-  const chunks = [];
-  const iterator = process.stdin[Symbol.asyncIterator]();
-  let timer;
-  const first = await Promise.race([
-    iterator.next(),
-    ...firstByteMs === void 0 ? [] : [new Promise((resolve) => timer = setTimeout(() => resolve(null), firstByteMs))]
-  ]);
-  clearTimeout(timer);
-  if (first === null) {
-    process.stdin.destroy();
-    return null;
-  }
-  if (!first.done) {
-    chunks.push(Buffer.from(first.value));
-    for await (const chunk of { [Symbol.asyncIterator]: () => iterator }) {
-      chunks.push(Buffer.from(chunk));
-    }
-  }
-  return Buffer.concat(chunks).toString("utf8");
-}
-var submitCommand = new Command81("submit").description("Report a Taskmarket bug; CLI version, OS, Node version and network are attached").requiredOption("--title <text>", "Short summary (at most 200 characters)").option(
+var PUBLIC_NOTICE = "This report is public: anyone can read it, with your wallet and agent id. Never include keys, seed phrases or other private data. Make it private with `taskmarket bug visibility <id> private`.";
+var submitCommand = new Command85("submit").description(
+  "Report a Taskmarket bug; CLI version, OS, Node version and network are attached. Reports are public unless --private"
+).requiredOption("--title <text>", "Short summary (at most 200 characters)").option(
   "--description <text>",
   'What happened and how to reproduce it; read from stdin when omitted or "-"'
-).option("--severity <level>", `How bad it is: ${BUG_REPORT_SEVERITIES.join(", ")}`, "medium").option("--task <id>", "Task the bug happened on").option("--tx <hash>", "Transaction hash involved").option(
+).option("--severity <level>", `How bad it is: ${BUG_REPORT_SEVERITIES.join(", ")}`, "medium").option("--task <id>", "Task the bug happened on").option("--tx <hash>", "Transaction hash involved").option("--private", "Keep the report private: only you and Taskmarket staff can see it").option(
   "--include-last-error",
   "Attach the last failed taskmarket command and its error (secrets already removed)"
 ).action(async function(opts) {
-  let description = opts.description;
-  if (description === void 0 || description === "-") {
-    if (process.stdin.isTTY) {
-      printError("Pass --description or pipe the description on stdin");
-      return;
-    }
-    const read = await readStdin(description === "-" ? void 0 : STDIN_FIRST_BYTE_MS);
-    if (read === null) {
-      printError("Pass --description, or pipe the description on stdin");
-      return;
-    }
-    description = read;
+  const description = await textOrStdin(opts.description);
+  if (description === null) {
+    printError("Pass --description, or pipe the description on stdin");
+    return;
   }
   const context = collectBugContext(cliVersionOf(this), { taskId: opts.task, txHash: opts.tx });
   if (opts.includeLastError) {
@@ -6310,7 +6566,8 @@ var submitCommand = new Command81("submit").description("Report a Taskmarket bug
     description,
     severity: opts.severity,
     source: "cli",
-    context
+    context,
+    visibility: opts.private ? "private" : "public"
   });
   if (!parsed.success) {
     const issue = parsed.error.issues[0];
@@ -6328,6 +6585,45 @@ var submitCommand = new Command81("submit").description("Report a Taskmarket bug
       parsed.data,
       { headers: auth.headers }
     );
+    printResult(
+      {
+        ...data,
+        visibility: parsed.data.visibility,
+        ...parsed.data.visibility === "public" ? { notice: PUBLIC_NOTICE } : {}
+      },
+      { idempotencyKey }
+    );
+  } catch (error) {
+    return renderFailure(error);
+  }
+});
+
+// src/commands/bug/visibility.ts
+import { Command as Command86 } from "commander";
+var visibilityCommand = new Command86("visibility").description(
+  "Make one of your bug reports public or private; a private report is seen only by you and staff"
+).argument("<report>", `${BUG_REPORT_REF_HELP}; a private report only by its id`).argument("<visibility>", BUG_REPORT_VISIBILITIES.join(" or ")).action(async (report, visibility) => {
+  const ref = parseBugReportRef(report);
+  if (!ref) {
+    printError(BUG_REPORT_REF_ERROR);
+    return;
+  }
+  if (!BUG_REPORT_VISIBILITIES.includes(visibility)) {
+    printError(`Visibility must be ${BUG_REPORT_VISIBILITIES.join(" or ")}`);
+    return;
+  }
+  const auth = await signReadAuth();
+  if (!auth || Object.keys(auth.headers).length === 0) {
+    printError("Changing a bug report needs a wallet. Run `taskmarket init` first.");
+    return;
+  }
+  try {
+    const id = await resolveBugReportId(ref);
+    const { data, idempotencyKey } = await apiPost(
+      `/api/bug-reports/${id}/visibility`,
+      { visibility },
+      { headers: auth.headers }
+    );
     printResult(data, { idempotencyKey });
   } catch (error) {
     return renderFailure(error);
@@ -6335,19 +6631,24 @@ var submitCommand = new Command81("submit").description("Report a Taskmarket bug
 });
 
 // src/commands/bug/index.ts
-var bugCommand = new Command82("bug").description(
-  "Report Taskmarket bugs and follow their status"
+var bugCommand = new Command87("bug").description(
+  "Report Taskmarket bugs, browse public reports, follow their status and reply to staff"
 );
 bugCommand.addCommand(submitCommand);
 bugCommand.addCommand(listCommand);
 bugCommand.addCommand(showCommand);
+bugCommand.addCommand(replyCommand2);
+bugCommand.addCommand(browseCommand);
+bugCommand.addCommand(meTooCommand);
+bugCommand.addCommand(commentCommand);
+bugCommand.addCommand(visibilityCommand);
 
 // src/commands/requester/index.ts
-import { Command as Command84 } from "commander";
+import { Command as Command89 } from "commander";
 
 // src/commands/requester/stats.ts
-import { Command as Command83 } from "commander";
-var requesterStatsCmd = new Command83("stats").description("Get requester reputation stats for an address").argument("<address>", "Wallet address of the requester").action(async (address) => {
+import { Command as Command88 } from "commander";
+var requesterStatsCmd = new Command88("stats").description("Get requester reputation stats for an address").argument("<address>", "Wallet address of the requester").action(async (address) => {
   if (!/^0x[0-9a-fA-F]{40}$/.test(address)) {
     printError("Address must be a 0x-prefixed 20-byte hex string");
     return;
@@ -6361,13 +6662,13 @@ var requesterStatsCmd = new Command83("stats").description("Get requester reputa
 });
 
 // src/commands/requester/index.ts
-var requesterCmd = new Command84("requester").description("Requester reputation commands").addCommand(requesterStatsCmd);
+var requesterCmd = new Command89("requester").description("Requester reputation commands").addCommand(requesterStatsCmd);
 
 // src/commands/x402/index.ts
-import { Command as Command88 } from "commander";
+import { Command as Command93 } from "commander";
 
 // src/commands/x402/payments.ts
-import { Command as Command85, Option as Option4 } from "commander";
+import { Command as Command90, Option as Option4 } from "commander";
 import { createInterface as createInterface4 } from "readline";
 var PAYMENT_STATES = [
   "reserved",
@@ -6393,7 +6694,7 @@ async function confirmManualResolution() {
   readline.close();
   return answer.trim().toLowerCase() === "resolve";
 }
-var x402PaymentsCommand = new Command85("payments").description(
+var x402PaymentsCommand = new Command90("payments").description(
   "Inspect and reconcile X402 Pay payment records"
 );
 x402PaymentsCommand.command("list").description("List current payment records").addOption(new Option4("--state <state>", "Filter by state").choices(PAYMENT_STATES)).action(async (options) => {
@@ -6422,7 +6723,7 @@ x402PaymentsCommand.command("resolve").description("Manually record an externall
 
 // src/commands/x402/policy.ts
 import { promises as fs4 } from "fs";
-import { Command as Command86 } from "commander";
+import { Command as Command91 } from "commander";
 import { createInterface as createInterface5 } from "readline";
 async function confirmUnattendedRule(rule) {
   if (!process.stdin.isTTY) {
@@ -6448,7 +6749,7 @@ async function confirmUnattendedRule(rule) {
   readline.close();
   return answer.trim().toLowerCase() === "authorize";
 }
-var x402PolicyCommand = new Command86("policy").description(
+var x402PolicyCommand = new Command91("policy").description(
   "Manage local X402 Pay spending policy"
 );
 x402PolicyCommand.command("init").description("Create a deny-all policy file").action(async () => {
@@ -6484,14 +6785,14 @@ for (const enabled of [true, false]) {
 }
 
 // src/commands/x402/request.ts
-import { Command as Command87, Option as Option5 } from "commander";
+import { Command as Command92, Option as Option5 } from "commander";
 function collect3(value, previous) {
   return [...previous, value];
 }
 function confirm(lines) {
   return confirmAtTerminal(lines, "use --non-interactive with policy");
 }
-var x402RequestCommand = new Command87("request").description("Request and pay for a direct x402 HTTP resource (X402 Pay)").argument("<url>", "HTTPS resource URL").addOption(new Option5("--method <method>", "HTTP method").choices(["GET", "POST"]).default("GET")).option("--json <json>", "Inline JSON POST body").option("--body-file <path>", "Read JSON POST body from a file").option("--headers-file <path>", "Read request headers from an owner-only JSON file").option(
+var x402RequestCommand = new Command92("request").description("Request and pay for a direct x402 HTTP resource (X402 Pay)").argument("<url>", "HTTPS resource URL").addOption(new Option5("--method <method>", "HTTP method").choices(["GET", "POST"]).default("GET")).option("--json <json>", "Inline JSON POST body").option("--body-file <path>", "Read JSON POST body from a file").option("--headers-file <path>", "Read request headers from an owner-only JSON file").option(
   "--header-env <header=ENV_VAR>",
   "Read one request header from an environment variable (repeatable)",
   collect3,
@@ -6539,7 +6840,7 @@ var x402RequestCommand = new Command87("request").description("Request and pay f
 );
 
 // src/commands/x402/index.ts
-var x402Command = new Command88("x402").description(
+var x402Command = new Command93("x402").description(
   "Pay x402 services with local spending policies (X402 Pay)"
 );
 x402Command.addCommand(x402RequestCommand);
@@ -6547,10 +6848,10 @@ x402Command.addCommand(x402PolicyCommand);
 x402Command.addCommand(x402PaymentsCommand);
 
 // src/commands/sponsored-task/index.ts
-import { Command as Command103 } from "commander";
+import { Command as Command108 } from "commander";
 
 // src/commands/sponsored-task/create.ts
-import { Command as Command89 } from "commander";
+import { Command as Command94 } from "commander";
 import { toHex as toHex4 } from "viem";
 
 // ../../packages/contracts/abi/generated/SponsoredTasksVault.ts
@@ -9772,7 +10073,7 @@ async function approveSponsoredTaskSpend(input) {
 function isValidAddress4(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var sponsoredTaskCreateCommand = new Command89("create").description("Create a new Sponsored Task vault for a project token").requiredOption("--factory <address>", "SponsoredTaskFactory contract address").requiredOption("--chain-id <id>", "Chain id the factory is deployed on").requiredOption("--token <address>", "Project ERC-20 token address to fund the vault with").option("--owner <address>", "Vault owner (defaults to your own wallet)").action(async (opts) => {
+var sponsoredTaskCreateCommand = new Command94("create").description("Create a new Sponsored Task vault for a project token").requiredOption("--factory <address>", "SponsoredTaskFactory contract address").requiredOption("--chain-id <id>", "Chain id the factory is deployed on").requiredOption("--token <address>", "Project ERC-20 token address to fund the vault with").option("--owner <address>", "Vault owner (defaults to your own wallet)").action(async (opts) => {
   if (!isValidAddress4(opts.factory) || !isValidAddress4(opts.token)) {
     printError("Invalid Ethereum address for --factory or --token");
     return;
@@ -9809,11 +10110,11 @@ var sponsoredTaskCreateCommand = new Command89("create").description("Create a n
 });
 
 // src/commands/sponsored-task/fund.ts
-import { Command as Command90 } from "commander";
+import { Command as Command95 } from "commander";
 function isValidAddress5(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var sponsoredTaskFundCommand = new Command90("fund").description("Fund a Sponsored Task vault with its project token (base units)").requiredOption("--vault <address>", "Vault address").requiredOption("--token <address>", "Project ERC-20 token address").requiredOption("--chain-id <id>", "Chain id the vault is deployed on").requiredOption("--amount <baseUnits>", "Amount to fund, in the token base units").action(async (opts) => {
+var sponsoredTaskFundCommand = new Command95("fund").description("Fund a Sponsored Task vault with its project token (base units)").requiredOption("--vault <address>", "Vault address").requiredOption("--token <address>", "Project ERC-20 token address").requiredOption("--chain-id <id>", "Chain id the vault is deployed on").requiredOption("--amount <baseUnits>", "Amount to fund, in the token base units").action(async (opts) => {
   if (!isValidAddress5(opts.vault) || !isValidAddress5(opts.token)) {
     printError("Invalid Ethereum address for --vault or --token");
     return;
@@ -9852,7 +10153,7 @@ var sponsoredTaskFundCommand = new Command90("fund").description("Fund a Sponsor
 });
 
 // src/commands/sponsored-task/managers.ts
-import { Command as Command91 } from "commander";
+import { Command as Command96 } from "commander";
 function isValidAddress6(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
@@ -9898,7 +10199,7 @@ async function configure(opts) {
   });
   printResult({ txHash, manager: opts.manager, spendCap: cap.toString(), active: opts.active });
 }
-var sponsoredTaskManagersCommand = new Command91("managers").description(
+var sponsoredTaskManagersCommand = new Command96("managers").description(
   "Manage authorized managers for a Sponsored Task vault"
 );
 sponsoredTaskManagersCommand.command("add").description("Authorize a manager with a token-denominated spend cap").requiredOption("--vault <address>", "Vault address").requiredOption("--chain-id <id>", "Chain id the vault is deployed on").requiredOption("--manager <address>", "Manager address to authorize").requiredOption("--cap <baseUnits>", "Spend cap, in the project token base units").action((opts) => configure({ ...opts, active: true }));
@@ -9909,8 +10210,8 @@ sponsoredTaskManagersCommand.command("list").description("List a vault authorize
 });
 
 // src/commands/sponsored-task/managed.ts
-import { Command as Command92 } from "commander";
-var sponsoredTaskManagedCommand = new Command92("managed").description(
+import { Command as Command97 } from "commander";
+var sponsoredTaskManagedCommand = new Command97("managed").description(
   "List the active Sponsored Task vaults an address can fund tasks from as an active manager (defaults to your wallet)"
 ).option("--address <address>", "Manager address (defaults to your wallet)").option("--limit <n>", "Max vaults to return (1-100)", "50").option("--cursor <vaultId>", "Pagination cursor from a previous nextCursor").action(async (opts) => {
   let address = opts.address;
@@ -9940,7 +10241,7 @@ var sponsoredTaskManagedCommand = new Command92("managed").description(
 });
 
 // src/commands/sponsored-task/fee-bank.ts
-import { Command as Command93 } from "commander";
+import { Command as Command98 } from "commander";
 function isValidAddress7(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
@@ -9952,7 +10253,7 @@ async function requireKeystore2() {
     return null;
   }
 }
-var sponsoredTaskFeeBankCommand = new Command93("fee-bank").description(
+var sponsoredTaskFeeBankCommand = new Command98("fee-bank").description(
   "Manage a manager USDC credit balance, charged by the Sponsored Task hook at task creation"
 );
 sponsoredTaskFeeBankCommand.command("deposit").description("Deposit USDC credit for creating sponsored tasks").requiredOption("--fee-bank <address>", "SponsoredTaskFeeBank contract address").requiredOption("--usdc <address>", "USDC token address").requiredOption("--chain-id <id>", "Chain id the fee bank is deployed on").requiredOption("--amount <baseUnits>", "Amount to deposit, in USDC base units (6 decimals)").action(async (opts) => {
@@ -10036,8 +10337,8 @@ sponsoredTaskFeeBankCommand.command("withdraw").description("Withdraw unused USD
 );
 
 // src/commands/sponsored-task/list.ts
-import { Command as Command94 } from "commander";
-var sponsoredTaskListCommand = new Command94("list").description("List Sponsored Task vaults").option("--limit <n>", "Max vaults to return", "50").option("--cursor <vaultId>", "Pagination cursor").option("--include-unverified", "Include vaults not yet curator-approved", false).action(async (opts) => {
+import { Command as Command99 } from "commander";
+var sponsoredTaskListCommand = new Command99("list").description("List Sponsored Task vaults").option("--limit <n>", "Max vaults to return", "50").option("--cursor <vaultId>", "Pagination cursor").option("--include-unverified", "Include vaults not yet curator-approved", false).action(async (opts) => {
   const params = new URLSearchParams({ limit: opts.limit });
   if (opts.cursor) params.set("cursor", opts.cursor);
   if (opts.includeUnverified) params.set("includeUnverified", "true");
@@ -10046,8 +10347,8 @@ var sponsoredTaskListCommand = new Command94("list").description("List Sponsored
 });
 
 // src/commands/sponsored-task/settlements.ts
-import { Command as Command95 } from "commander";
-var sponsoredTaskSettlementsCommand = new Command95("settlements").description("List the settlements a Sponsored Task vault has installed, newest first").argument("<vaultId>", "Vault id").option("--limit <n>", "Max settlements to return (1-100)", "25").option("--cursor <cursor>", "Pagination cursor from a previous nextCursor").action(async (vaultId, opts) => {
+import { Command as Command100 } from "commander";
+var sponsoredTaskSettlementsCommand = new Command100("settlements").description("List the settlements a Sponsored Task vault has installed, newest first").argument("<vaultId>", "Vault id").option("--limit <n>", "Max settlements to return (1-100)", "25").option("--cursor <cursor>", "Pagination cursor from a previous nextCursor").action(async (vaultId, opts) => {
   const limit = Number(opts.limit);
   if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
     printError("--limit must be an integer from 1 to 100");
@@ -10062,17 +10363,17 @@ var sponsoredTaskSettlementsCommand = new Command95("settlements").description("
 });
 
 // src/commands/sponsored-task/show.ts
-import { Command as Command96 } from "commander";
-var sponsoredTaskShowCommand = new Command96("show").description("Show a Sponsored Task vault by id").argument("<vaultId>", "Vault id").action(async (vaultId) => {
+import { Command as Command101 } from "commander";
+var sponsoredTaskShowCommand = new Command101("show").description("Show a Sponsored Task vault by id").argument("<vaultId>", "Vault id").action(async (vaultId) => {
   const result = await apiGet(`/api/sponsored-task-vaults/${vaultId}`);
   printResult(result);
 });
 
 // src/commands/sponsored-task/request-review.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { Command as Command97 } from "commander";
+import { Command as Command102 } from "commander";
 var REQUEST_TTL_SECONDS = 5 * 60;
-var sponsoredTaskRequestReviewCommand = new Command97("request-review").description("Ask Taskmarket curators to review a Sponsored Task vault (vault owner only)").argument("<vaultId>", "Vault id").action(async (vaultId) => {
+var sponsoredTaskRequestReviewCommand = new Command102("request-review").description("Ask Taskmarket curators to review a Sponsored Task vault (vault owner only)").argument("<vaultId>", "Vault id").action(async (vaultId) => {
   let keystore;
   try {
     keystore = await loadKeystore();
@@ -10129,18 +10430,18 @@ var sponsoredTaskRequestReviewCommand = new Command97("request-review").descript
 });
 
 // src/commands/sponsored-task/balance.ts
-import { Command as Command98 } from "commander";
-var sponsoredTaskBalanceCommand = new Command98("balance").description("Show a Sponsored Task vault funded/available/reserved balances").argument("<vaultId>", "Vault id").action(async (vaultId) => {
+import { Command as Command103 } from "commander";
+var sponsoredTaskBalanceCommand = new Command103("balance").description("Show a Sponsored Task vault funded/available/reserved balances").argument("<vaultId>", "Vault id").action(async (vaultId) => {
   const result = await apiGet(`/api/sponsored-task-vaults/${vaultId}/balance`);
   printResult(result);
 });
 
 // src/commands/sponsored-task/withdraw.ts
-import { Command as Command99 } from "commander";
+import { Command as Command104 } from "commander";
 function isValidAddress8(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var sponsoredTaskWithdrawCommand = new Command99("withdraw").description("Withdraw unreserved project tokens from a vault (owner only)").requiredOption("--vault <address>", "Vault address").requiredOption("--chain-id <id>", "Chain id the vault is deployed on").requiredOption("--amount <baseUnits>", "Amount to withdraw, in the project token base units").option("--recipient <address>", "Recipient (defaults to your own wallet)").action(async (opts) => {
+var sponsoredTaskWithdrawCommand = new Command104("withdraw").description("Withdraw unreserved project tokens from a vault (owner only)").requiredOption("--vault <address>", "Vault address").requiredOption("--chain-id <id>", "Chain id the vault is deployed on").requiredOption("--amount <baseUnits>", "Amount to withdraw, in the project token base units").option("--recipient <address>", "Recipient (defaults to your own wallet)").action(async (opts) => {
   if (!isValidAddress8(opts.vault) || opts.recipient && !isValidAddress8(opts.recipient)) {
     printError("Invalid Ethereum address for --vault or --recipient");
     return;
@@ -10170,11 +10471,11 @@ var sponsoredTaskWithdrawCommand = new Command99("withdraw").description("Withdr
 });
 
 // src/commands/sponsored-task/exit.ts
-import { Command as Command100 } from "commander";
+import { Command as Command105 } from "commander";
 function isValidAddress9(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var sponsoredTaskExitCommand = new Command100("exit").description(
+var sponsoredTaskExitCommand = new Command105("exit").description(
   "Terminally exit a vault: sweeps every reserved and unclaimed token back to you, invalidating every outstanding reservation, claim signature, and Merkle proof at once. There is no undo and no per-allocation revoke -- a worker with a pending but unclaimed entitlement gets nothing once this runs."
 ).requiredOption("--vault <address>", "Vault address").requiredOption("--chain-id <id>", "Chain id the vault is deployed on").option("--recipient <address>", "Recipient (defaults to your own wallet)").option("--yes", "Skip the confirmation prompt", false).action(async (opts) => {
   if (!isValidAddress9(opts.vault) || opts.recipient && !isValidAddress9(opts.recipient)) {
@@ -10210,7 +10511,7 @@ var sponsoredTaskExitCommand = new Command100("exit").description(
 });
 
 // src/commands/sponsored-task/claim.ts
-import { Command as Command101 } from "commander";
+import { Command as Command106 } from "commander";
 var CLAIM_TO_TYPES = {
   ClaimTo: [
     { name: "vaultId", type: "bytes32" },
@@ -10245,7 +10546,7 @@ async function postClaimWithRetry(path3, body, options = {}) {
     }
   }
 }
-var sponsoredTaskClaimCommand = new Command101("claim").description("Claim your unclaimed Sponsored Task reward for a vault task").argument("<vaultId>", "Vault id").option(
+var sponsoredTaskClaimCommand = new Command106("claim").description("Claim your unclaimed Sponsored Task reward for a vault task").argument("<vaultId>", "Vault id").option(
   "--task-id <id>",
   "Claim the entitlement for a specific task (defaults to the first unclaimed one)"
 ).action(async (vaultId, opts) => {
@@ -10257,18 +10558,25 @@ var sponsoredTaskClaimCommand = new Command101("claim").description("Claim your
     return;
   }
   const workerAddress = keystore.walletAddress;
-  const addressResponse = await apiGet(
-    `/api/wallet/withdrawal-address?address=${workerAddress}`
-  );
+  const vault = await apiGet(`/api/sponsored-task-vaults/${vaultId}`);
+  let addressResponse;
+  try {
+    addressResponse = await fetchWithdrawalAddress(workerAddress, vault.chainId);
+  } catch (err) {
+    renderFailure(err);
+    return;
+  }
   if (!addressResponse.withdrawalAddress) {
-    printError(
-      "No withdrawal address set. Run: taskmarket wallet set-withdrawal-address <address>"
-    );
+    printError(noWithdrawalAddressMessage(vault.chainId));
     return;
   }
   let destination;
   try {
-    destination = await verifyWithdrawalAddress(keystore, addressResponse.withdrawalAddress);
+    destination = await verifyWithdrawalAddress(
+      keystore,
+      vault.chainId,
+      addressResponse.withdrawalAddress
+    );
   } catch (err) {
     renderFailure(err);
     return;
@@ -10281,7 +10589,6 @@ var sponsoredTaskClaimCommand = new Command101("claim").description("Claim your
     printError("No unclaimed entitlement found for this wallet in this vault.");
     return;
   }
-  const vault = await apiGet(`/api/sponsored-task-vaults/${vaultId}`);
   const { nonce } = await apiGet(
     `/api/sponsored-task-vaults/${vaultId}/claim-nonce?workerAddress=${workerAddress}`
   );
@@ -10331,10 +10638,10 @@ var sponsoredTaskClaimCommand = new Command101("claim").description("Claim your
 });
 
 // src/commands/sponsored-task/rewards.ts
-import { Command as Command102 } from "commander";
+import { Command as Command107 } from "commander";
 var REWARD_STATES = SponsoredTaskRewardStateSchema.options;
 var CLAIM_STATUSES = SponsoredTaskWorkerRewardClaimStatusSchema.options;
-var sponsoredTaskRewardsCommand = new Command102("rewards").description("List Sponsored Task rewards across every vault (defaults to your wallet)").option("--address <address>", "Worker address (defaults to your wallet)").option("--state <state>", `Reward state: ${REWARD_STATES.join(", ")}`).option("--claim-status <status>", `Claim status: ${CLAIM_STATUSES.join(", ")}`).option("--limit <n>", "Max rewards to return (1-100)", "50").option("--cursor <cursor>", "Pagination cursor from a previous nextCursor").action(
+var sponsoredTaskRewardsCommand = new Command107("rewards").description("List Sponsored Task rewards across every vault (defaults to your wallet)").option("--address <address>", "Worker address (defaults to your wallet)").option("--state <state>", `Reward state: ${REWARD_STATES.join(", ")}`).option("--claim-status <status>", `Claim status: ${CLAIM_STATUSES.join(", ")}`).option("--limit <n>", "Max rewards to return (1-100)", "50").option("--cursor <cursor>", "Pagination cursor from a previous nextCursor").action(
   async (opts) => {
     let address = opts.address;
     if (address === void 0) {
@@ -10374,7 +10681,7 @@ var sponsoredTaskRewardsCommand = new Command102("rewards").description("List Sp
 );
 
 // src/commands/sponsored-task/index.ts
-var sponsoredTaskCommand = new Command103("sponsored-task").description(
+var sponsoredTaskCommand = new Command108("sponsored-task").description(
   "Sponsored Task vault administration and reward claims"
 );
 sponsoredTaskCommand.addCommand(sponsoredTaskCreateCommand);
@@ -10395,7 +10702,7 @@ sponsoredTaskCommand.addCommand(sponsoredTaskRewardsCommand);
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
-var program = new Command104();
+var program = new Command109();
 setLastErrorCliVersion(version);
 program.name("taskmarket").description("Taskmarket CLI for AI agents").version(version);
 program.option(