@lucid-agents/taskmarket 1.6.1 → 1.7.0

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/index.ts
-import { Command as Command62 } from "commander";
+import { Command as Command66 } from "commander";
 import { createRequire } from "module";
 
 // src/commands/init.ts
@@ -490,8 +490,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path3, errorMaps, issueData } = params;
-  const fullPath = [...path3, ...issueData.path || []];
+  const { data, path: path4, errorMaps, issueData } = params;
+  const fullPath = [...path4, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -607,11 +607,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path3, key) {
+  constructor(parent, value, path4, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path3;
+    this._path = path4;
     this._key = key;
   }
   get path() {
@@ -4198,7 +4198,7 @@ var TaskDropDirectoryResponseSchema = external_exports.object({
 
 // ../../packages/shared/dist/schemas/task.schemas.js
 var TaskMode = external_exports.enum(["bounty", "claim", "pitch", "benchmark", "auction"]);
-var TaskVisibility = external_exports.enum(["unlisted", "public"]);
+var TaskVisibility = external_exports.enum(["unlisted", "public", "private"]);
 var SubmissionVisibility = external_exports.enum(["public", "reveal_all", "winner_only", "never"]);
 var TaskStatus = external_exports.enum([
   "open",
@@ -4287,7 +4287,12 @@ var TaskCreateSchema = external_exports.object({
   appealWindowHours: external_exports.number().positive().optional(),
   disputeResolver: external_exports.string().optional(),
   taskDropId: external_exports.string().min(1).optional(),
-  taskDropCreate: TaskDropCreateInlineSchema.optional()
+  taskDropCreate: TaskDropCreateInlineSchema.optional(),
+  // Phase 3 (ADR-0030): only meaningful when taskVisibility === 'private'. At least
+  // one of the two invite mechanisms is required for a private task; either or both
+  // may be provided (requester's choice).
+  allowedViewers: external_exports.array(external_exports.string()).max(50, "Maximum 50 invited wallets at creation").optional(),
+  accessPassword: external_exports.string().min(8, "Password must be at least 8 characters").max(200).optional()
 }).superRefine((input, ctx) => {
   if (input.taskDropId && input.taskDropCreate) {
     ctx.addIssue({
@@ -4296,6 +4301,32 @@ var TaskCreateSchema = external_exports.object({
       message: "Provide taskDropId or taskDropCreate, not both"
     });
   }
+  if (input.taskVisibility === "private") {
+    const hasViewers = !!input.allowedViewers && input.allowedViewers.length > 0;
+    const hasPassword = !!input.accessPassword;
+    if (!hasViewers && !hasPassword) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["taskVisibility"],
+        message: "A private task needs at least one of allowedViewers or accessPassword"
+      });
+    }
+  } else {
+    if (input.allowedViewers && input.allowedViewers.length > 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["allowedViewers"],
+        message: "allowedViewers is only valid when taskVisibility is private"
+      });
+    }
+    if (input.accessPassword) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["accessPassword"],
+        message: "accessPassword is only valid when taskVisibility is private"
+      });
+    }
+  }
   if (input.mode !== "auction")
     return;
   const toBaseUnits = (value) => value !== void 0 && /^[0-9]+$/.test(value) ? BigInt(value) : null;
@@ -4363,6 +4394,9 @@ var TaskResponseSchema = external_exports.object({
   mode: TaskMode,
   taskVisibility: TaskVisibility.optional().default("public"),
   submissionVisibility: SubmissionVisibility.optional().default("public"),
+  // Phase 3 (ADR-0030): whether a private task has a password mechanism configured --
+  // never the hash itself, and never returned for a non-private task.
+  hasAccessPassword: external_exports.boolean().optional(),
   stakeRequired: external_exports.boolean(),
   stakeBps: external_exports.number(),
   pitchDeadline: external_exports.string().nullable(),
@@ -4447,7 +4481,11 @@ var TaskInboxInputSchema = external_exports.object({
 });
 var TaskInboxResponseSchema = external_exports.object({
   asRequester: external_exports.array(TaskResponseSchema),
-  asWorker: external_exports.array(TaskResponseSchema)
+  asWorker: external_exports.array(TaskResponseSchema),
+  // Phase 3 (ADR-0030): private tasks this address has been wallet-allowlisted onto,
+  // surfaced here (self-authed only) as the in-app invite-discovery mechanism rather
+  // than a separate notification-center feature.
+  invitedPrivateTasks: external_exports.array(TaskResponseSchema).optional().default([])
 });
 var TaskDetailResponseSchema = TaskResponseSchema.extend({
   pendingActions: PendingActionSchema.array(),
@@ -5138,6 +5176,33 @@ var LegalAcceptanceResponseSchema = external_exports.object({
   receipt: external_exports.string()
 });
 
+// ../../packages/shared/dist/schemas/task-access.schemas.js
+var VerifyTaskAccessPasswordInputSchema = external_exports.object({
+  taskId: external_exports.string(),
+  password: external_exports.string().min(1)
+});
+var VerifyTaskAccessPasswordResponseSchema = external_exports.object({
+  grant: external_exports.string(),
+  expiresAt: external_exports.string()
+});
+var AddAllowedViewerInputSchema = external_exports.object({
+  taskId: external_exports.string(),
+  viewerAddress: external_exports.string()
+});
+var RemoveAllowedViewerInputSchema = external_exports.object({
+  taskId: external_exports.string(),
+  viewerAddress: external_exports.string()
+});
+var ListAllowedViewersInputSchema = external_exports.object({
+  taskId: external_exports.string()
+});
+var AllowedViewerResponseSchema = external_exports.object({
+  viewerAddress: external_exports.string(),
+  addedBy: external_exports.string(),
+  createdAt: external_exports.string()
+});
+var ListAllowedViewersResponseSchema = external_exports.array(AllowedViewerResponseSchema);
+
 // ../../packages/shared/dist/platform.constants.js
 var USDC_DECIMALS = 6;
 
@@ -5441,6 +5506,7 @@ function buildReadAuthMessage(address) {
 }
 var READ_AUTH_ADDRESS_HEADER = "X-Taskmarket-Caller-Address";
 var READ_AUTH_SIGNATURE_HEADER = "X-Taskmarket-Caller-Signature";
+var TASK_ACCESS_GRANT_HEADER = "X-Taskmarket-Task-Access-Grant";
 function buildSubmitMessage(taskId) {
   return `taskmarket:submit:${taskId}`;
 }
@@ -5970,21 +6036,21 @@ async function keystoreExists(keystorePath) {
 // src/lib/api.ts
 var API_URL = process.env.TASKMARKET_API_URL ?? "https://api.taskmarket.dev";
 var API_ORIGIN = new URL(API_URL).origin;
-function legalReceiptHeadersForKeystore(keystore, path3, method) {
-  const canSend = keystore.legalAcceptanceApiOrigin === API_ORIGIN && (method === "POST" || path3 === "/api/legal/status");
+function legalReceiptHeadersForKeystore(keystore, path4, method) {
+  const canSend = keystore.legalAcceptanceApiOrigin === API_ORIGIN && (method === "POST" || path4 === "/api/legal/status");
   return canSend ? buildLegalReceiptHeaders(keystore.legalAcceptanceReceipt) : {};
 }
-async function legalReceiptHeaders(path3, method) {
+async function legalReceiptHeaders(path4, method) {
   try {
     const keystore = await loadKeystore();
-    return legalReceiptHeadersForKeystore(keystore, path3, method);
+    return legalReceiptHeadersForKeystore(keystore, path4, method);
   } catch {
     return {};
   }
 }
-async function apiGet(path3, options) {
-  const legalHeaders = await legalReceiptHeaders(path3, "GET");
-  const res = await fetch(`${API_URL}${path3}`, {
+async function apiGet(path4, options) {
+  const legalHeaders = await legalReceiptHeaders(path4, "GET");
+  const res = await fetch(`${API_URL}${path4}`, {
     method: "GET",
     redirect: "error",
     headers: {
@@ -5995,21 +6061,42 @@ async function apiGet(path3, options) {
   });
   const body = await res.json();
   if (!res.ok) {
-    throw new Error(`GET ${path3} failed (${res.status}): ${JSON.stringify(body)}`);
+    throw new Error(`GET ${path4} failed (${res.status}): ${JSON.stringify(body)}`);
   }
   return body;
 }
-async function apiPost(path3, body) {
-  const legalHeaders = await legalReceiptHeaders(path3, "POST");
-  const res = await fetch(`${API_URL}${path3}`, {
+async function apiPost(path4, body, options) {
+  const legalHeaders = await legalReceiptHeaders(path4, "POST");
+  const res = await fetch(`${API_URL}${path4}`, {
     method: "POST",
     redirect: "error",
-    headers: { "Content-Type": "application/json", ...legalHeaders },
+    headers: {
+      "Content-Type": "application/json",
+      ...legalHeaders,
+      ...options?.headers ?? {}
+    },
     body: JSON.stringify(body)
   });
   const result = await res.json();
   if (!res.ok) {
-    throw new Error(`POST ${path3} failed (${res.status}): ${JSON.stringify(result)}`);
+    throw new Error(`POST ${path4} failed (${res.status}): ${JSON.stringify(result)}`);
+  }
+  return result;
+}
+async function apiDelete(path4, options) {
+  const legalHeaders = await legalReceiptHeaders(path4, "POST");
+  const res = await fetch(`${API_URL}${path4}`, {
+    method: "DELETE",
+    redirect: "error",
+    headers: {
+      "Content-Type": "application/json",
+      ...legalHeaders,
+      ...options?.headers ?? {}
+    }
+  });
+  const result = await res.json();
+  if (!res.ok) {
+    throw new Error(`DELETE ${path4} failed (${res.status}): ${JSON.stringify(result)}`);
   }
   return result;
 }
@@ -6503,10 +6590,10 @@ var addressCommand = new Command3("address").description("Print the wallet addre
 import { Command as Command4 } from "commander";
 
 // src/lib/x402.ts
-async function x402Post(path3, body) {
-  const url = `${API_URL}${path3}`;
+async function x402Post(path4, body) {
+  const url = `${API_URL}${path4}`;
   const keystore = await loadKeystore();
-  const legalHeaders = legalReceiptHeadersForKeystore(keystore, path3, "POST");
+  const legalHeaders = legalReceiptHeadersForKeystore(keystore, path4, "POST");
   const r1 = await fetch(url, {
     method: "POST",
     redirect: "error",
@@ -6518,7 +6605,7 @@ async function x402Post(path3, body) {
       return r1.json();
     }
     const text = await r1.text().catch(() => "");
-    throw new Error(`POST ${path3} failed (${r1.status}): ${text}`);
+    throw new Error(`POST ${path4} failed (${r1.status}): ${text}`);
   }
   const requirements = await r1.json();
   if (!requirements.accepts || requirements.accepts.length === 0) {
@@ -6552,7 +6639,7 @@ async function x402Post(path3, body) {
   });
   const result = await r2.json();
   if (!r2.ok) {
-    throw new Error(`POST ${path3} failed after payment (${r2.status}): ${JSON.stringify(result)}`);
+    throw new Error(`POST ${path4} failed after payment (${r2.status}): ${JSON.stringify(result)}`);
   }
   return result;
 }
@@ -6617,14 +6704,20 @@ var statsCommand = new Command5("stats").description("View agent statistics").op
 });
 
 // src/commands/task/index.ts
-import { Command as Command36 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/commands/task/create.ts
 import { Command as Command6 } from "commander";
 var createCmd = new Command6("create").description("Create a new task (costs reward amount in USDC)").requiredOption("--description <text>", "Task description").requiredOption("--reward <usdc>", "Reward in USDC (e.g. 5 for 5 USDC)").requiredOption("--duration <hours>", "Task duration in hours").option("--mode <mode>", "Task mode: bounty, claim, pitch, benchmark, auction", "bounty").option(
   "--task-visibility <mode>",
-  "Task visibility: public (default) or unlisted. Unlisted only hides a task from Taskmarket's own listings/search/SEO -- it stays permanently visible on the public blockchain to anyone with the link, reading the contract directly, or running their own indexer. Not a privacy feature.",
+  "Task visibility: public (default), unlisted, or private. Unlisted only hides a task from Taskmarket's own listings/search/SEO -- it stays permanently visible on the public blockchain to anyone with the link, reading the contract directly, or running their own indexer. private is genuinely access-controlled: only the requester and invited/assigned workers can view it via listings, get, or the gated reads -- see --allowed-viewers and --access-password. Even private, the on-chain existence, reward, and participation stay publicly observable regardless.",
   "public"
+).option(
+  "--allowed-viewers <addresses>",
+  "Comma-separated wallet addresses to invite to a private task. At least one of --allowed-viewers or --access-password is required when --task-visibility is private; both may be given together. More wallets can be invited later with `task invite`."
+).option(
+  "--access-password <password>",
+  "Password (min 8 characters) granting anonymous access to a private task via `task unlock`. Set once at creation -- there is no command to change it later."
 ).option(
   "--submission-visibility <mode>",
   "Submission visibility: public (default), reveal_all, winner_only, or never. Controls who can see what workers submit while the task is live and after it ends. public matches today's behavior exactly. The other three modes hide submissions from everyone but the requester and each submitting worker while the task is active; once it ends, reveal_all shows everything, winner_only shows only the winning submission(s), and never keeps every submission hidden indefinitely. Chosen once here and locked in permanently -- there is no command to change it later.",
@@ -6655,8 +6748,11 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
     if (!Number.isFinite(duration) || duration <= 0) {
       return void printError("--duration must be a positive number of hours");
     }
-    if (opts.taskVisibility !== "public" && opts.taskVisibility !== "unlisted") {
-      return void printError("--task-visibility must be one of: public, unlisted");
+    const validTaskVisibilities = ["public", "unlisted", "private"];
+    if (!validTaskVisibilities.includes(opts.taskVisibility)) {
+      return void printError(
+        `--task-visibility must be one of: ${validTaskVisibilities.join(", ")}`
+      );
     }
     const validSubmissionVisibilities = ["public", "reveal_all", "winner_only", "never"];
     if (!validSubmissionVisibilities.includes(opts.submissionVisibility)) {
@@ -6664,6 +6760,21 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
         `--submission-visibility must be one of: ${validSubmissionVisibilities.join(", ")}`
       );
     }
+    const allowedViewers = opts.allowedViewers ? opts.allowedViewers.split(",").map((a) => a.trim()) : void 0;
+    if (opts.taskVisibility === "private") {
+      if ((!allowedViewers || allowedViewers.length === 0) && !opts.accessPassword) {
+        return void printError(
+          "--task-visibility private requires at least one of --allowed-viewers or --access-password"
+        );
+      }
+      if (opts.accessPassword && opts.accessPassword.length < 8) {
+        return void printError("--access-password must be at least 8 characters");
+      }
+    } else if (allowedViewers || opts.accessPassword) {
+      return void printError(
+        "--allowed-viewers/--access-password are only valid with --task-visibility private"
+      );
+    }
     if (opts.mode === "auction") {
       if (!opts.maxPrice) {
         return void printError("--max-price is required for auction mode");
@@ -6713,6 +6824,12 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
       stakeRequired: false,
       stakeBps: 0
     };
+    if (allowedViewers && allowedViewers.length > 0) {
+      body.allowedViewers = allowedViewers;
+    }
+    if (opts.accessPassword) {
+      body.accessPassword = opts.accessPassword;
+    }
     if (opts.pitchDeadline) {
       body.pitchDeadline = parseInt(opts.pitchDeadline, 10) * 3600;
     }
@@ -6795,6 +6912,33 @@ var createCmd = new Command6("create").description("Create a new task (costs rew
 
 // src/commands/task/search.ts
 import { Command as Command7 } from "commander";
+
+// src/lib/read-auth.ts
+async function signReadAuth() {
+  let keystore;
+  try {
+    keystore = await loadKeystore();
+  } catch {
+    return null;
+  }
+  try {
+    const account = await createWalletAccountFromKeystore(keystore);
+    const signature = await account.signMessage({
+      message: buildReadAuthMessage(keystore.walletAddress)
+    });
+    return {
+      walletAddress: keystore.walletAddress,
+      headers: {
+        [READ_AUTH_ADDRESS_HEADER]: keystore.walletAddress,
+        [READ_AUTH_SIGNATURE_HEADER]: signature
+      }
+    };
+  } catch {
+    return { walletAddress: keystore.walletAddress, headers: {} };
+  }
+}
+
+// src/commands/task/search.ts
 var listCmd = new Command7("list").alias("search").description("List available tasks").option("--status <status>", "Filter by status (e.g. open)", "open").option(
   "--phase <phase>",
   "Filter by derived lifecycle phase (active, in_review, awaiting_settlement, resolved) -- independent of --status, e.g. --phase awaiting_settlement finds tasks whose deadline has passed but are still open/claimed/worker_selected"
@@ -6817,15 +6961,58 @@ var listCmd = new Command7("list").alias("search").description("List available t
     if (opts.deadlineHours) params.set("deadlineHours", opts.deadlineHours);
     if (opts.limit) params.set("limit", opts.limit);
     if (opts.cursor) params.set("cursor", opts.cursor);
-    const result = await apiGet(`/api/tasks?${params.toString()}`);
+    const auth = await signReadAuth();
+    const result = await apiGet(`/api/tasks?${params.toString()}`, {
+      headers: auth?.headers ?? {}
+    });
     printResult({ tasks: result.tasks, hasMore: result.hasMore, nextCursor: result.nextCursor });
   }
 );
 
 // src/commands/task/get.ts
 import { Command as Command8 } from "commander";
+
+// src/lib/task-access-grants.ts
+import { promises as fs2 } from "fs";
+import os2 from "os";
+import path2 from "path";
+function getGrantsPath() {
+  return path2.join(os2.homedir(), ".taskmarket", "task-access-grants.json");
+}
+async function readGrantsFile() {
+  try {
+    const raw = await fs2.readFile(getGrantsPath(), "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function loadTaskAccessGrant(taskId) {
+  const grants = await readGrantsFile();
+  const record = grants[taskId];
+  if (!record) return null;
+  if (new Date(record.expiresAt).getTime() <= Date.now()) return null;
+  return record.grant;
+}
+async function taskAccessGrantHeaders(taskId) {
+  const grant = await loadTaskAccessGrant(taskId);
+  return grant ? { [TASK_ACCESS_GRANT_HEADER]: grant } : {};
+}
+async function saveTaskAccessGrant(taskId, grant, expiresAt) {
+  const grants = await readGrantsFile();
+  grants[taskId] = { grant, expiresAt };
+  const dir = path2.dirname(getGrantsPath());
+  await fs2.mkdir(dir, { recursive: true });
+  await fs2.writeFile(getGrantsPath(), JSON.stringify(grants, null, 2), {
+    mode: 384
+  });
+}
+
+// src/commands/task/get.ts
 var getCmd = new Command8("get").description("Get task details").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
-  const task = await apiGet(`/api/tasks/${taskId}`);
+  const auth = await signReadAuth();
+  const headers = { ...auth?.headers ?? {}, ...await taskAccessGrantHeaders(taskId) };
+  const task = await apiGet(`/api/tasks/${taskId}`, { headers });
   if (!task) {
     printError(`Task not found: ${taskId}`);
   }
@@ -7100,7 +7287,9 @@ var pitchCmd = new Command14("pitch").description("Submit a pitch for a task (co
 import { Command as Command15 } from "commander";
 var pitchesCmd = new Command15("pitches").description("List pitches for a task").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   try {
-    printResult(await apiGet(`/api/tasks/${taskId}/pitches`));
+    const auth = await signReadAuth();
+    const headers = { ...auth?.headers ?? {}, ...await taskAccessGrantHeaders(taskId) };
+    printResult(await apiGet(`/api/tasks/${taskId}/pitches`, { headers }));
   } catch (err) {
     printError(err instanceof Error ? err.message : String(err));
   }
@@ -7141,7 +7330,9 @@ var proofCmd = new Command17("proof").description("Submit a benchmark proof (cos
 import { Command as Command18 } from "commander";
 var proofsCmd = new Command18("proofs").description("List proofs for a benchmark task").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   try {
-    printResult(await apiGet(`/api/tasks/${taskId}/proofs`));
+    const auth = await signReadAuth();
+    const headers = { ...auth?.headers ?? {}, ...await taskAccessGrantHeaders(taskId) };
+    printResult(await apiGet(`/api/tasks/${taskId}/proofs`, { headers }));
   } catch (err) {
     printError(err instanceof Error ? err.message : String(err));
   }
@@ -7191,33 +7382,6 @@ var auctionAcceptCmd = new Command20("auction-accept").description("Accept curre
 
 // src/commands/task/submissions.ts
 import { Command as Command21 } from "commander";
-
-// src/lib/read-auth.ts
-async function signReadAuth() {
-  let keystore;
-  try {
-    keystore = await loadKeystore();
-  } catch {
-    return null;
-  }
-  try {
-    const account = await createWalletAccountFromKeystore(keystore);
-    const signature = await account.signMessage({
-      message: buildReadAuthMessage(keystore.walletAddress)
-    });
-    return {
-      walletAddress: keystore.walletAddress,
-      headers: {
-        [READ_AUTH_ADDRESS_HEADER]: keystore.walletAddress,
-        [READ_AUTH_SIGNATURE_HEADER]: signature
-      }
-    };
-  } catch {
-    return { walletAddress: keystore.walletAddress, headers: {} };
-  }
-}
-
-// src/commands/task/submissions.ts
 var submissionsCmd = new Command21("submissions").description("List submissions for a task").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
   const auth = await signReadAuth();
   let subs;
@@ -7635,8 +7799,82 @@ var resolveDisputeCmd = new Command35("resolve-dispute").description(
   printResult({ txHash: result.txHash });
 });
 
+// src/commands/task/unlock.ts
+import { Command as Command36 } from "commander";
+var unlockCmd = new Command36("unlock").description("Unlock a private task with its password, caching a task-scoped access grant").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--password <password>", "The private task's password").action(async (taskId, opts) => {
+  let result;
+  try {
+    result = await apiPost(`/api/tasks/${taskId}/private-access/verify`, {
+      taskId,
+      password: opts.password
+    });
+  } catch (err) {
+    printError(err instanceof Error ? err.message : "Failed to unlock task.");
+    return;
+  }
+  await saveTaskAccessGrant(taskId, result.grant, result.expiresAt);
+  printResult({ taskId, expiresAt: result.expiresAt });
+});
+
+// src/commands/task/invite.ts
+import { Command as Command37 } from "commander";
+var inviteCmd = new Command37("invite").description("Invite a wallet to view a private task (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").argument("<address>", "Wallet address to invite").action(async (taskId, address) => {
+  const auth = await signReadAuth();
+  if (!auth || Object.keys(auth.headers).length === 0) {
+    printError("No keystore found. Run `taskmarket init` first.");
+    return;
+  }
+  try {
+    const result = await apiPost(
+      `/api/tasks/${taskId}/private-access/viewers`,
+      { taskId, viewerAddress: address },
+      { headers: auth.headers }
+    );
+    printResult(result);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : "Failed to invite viewer.");
+  }
+});
+
+// src/commands/task/uninvite.ts
+import { Command as Command38 } from "commander";
+var uninviteCmd = new Command38("uninvite").description("Remove a wallet from a private task's allowlist (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").argument("<address>", "Wallet address to remove").action(async (taskId, address) => {
+  const auth = await signReadAuth();
+  if (!auth || Object.keys(auth.headers).length === 0) {
+    printError("No keystore found. Run `taskmarket init` first.");
+    return;
+  }
+  try {
+    const result = await apiDelete(
+      `/api/tasks/${taskId}/private-access/viewers/${encodeURIComponent(address)}`,
+      { headers: auth.headers }
+    );
+    printResult(result);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : "Failed to remove viewer.");
+  }
+});
+
+// src/commands/task/viewers.ts
+import { Command as Command39 } from "commander";
+var viewersCmd = new Command39("viewers").description("List a private task's wallet allowlist (requester only)").argument("<taskId>", "Task ID (0x-prefixed hex)").action(async (taskId) => {
+  const auth = await signReadAuth();
+  if (!auth || Object.keys(auth.headers).length === 0) {
+    printError("No keystore found. Run `taskmarket init` first.");
+    return;
+  }
+  try {
+    const result = await apiGet(`/api/tasks/${taskId}/private-access/viewers`, {
+      headers: auth.headers
+    });
+    printResult(result);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : "Failed to list viewers.");
+  }
+});
+
 // src/commands/task/index.ts
-var taskCommand = new Command36("task").description("Manage tasks");
+var taskCommand = new Command40("task").description("Manage tasks");
 taskCommand.addCommand(createCmd);
 taskCommand.addCommand(listCmd);
 taskCommand.addCommand(getCmd);
@@ -7667,10 +7905,14 @@ taskCommand.addCommand(appealCmd);
 taskCommand.addCommand(evaluatorTimeoutCmd);
 taskCommand.addCommand(finalizeVerdictCmd);
 taskCommand.addCommand(resolveDisputeCmd);
+taskCommand.addCommand(unlockCmd);
+taskCommand.addCommand(inviteCmd);
+taskCommand.addCommand(uninviteCmd);
+taskCommand.addCommand(viewersCmd);
 
 // src/commands/agents.ts
-import { Command as Command37 } from "commander";
-var agentsCommand = new Command37("agents").description("Browse the agent directory").option("--sort <order>", "Sort order: reputation or tasks", "reputation").option("--skill <tag>", "Filter by skill tag").option("--search <query>", "Search by agentId or wallet address").option("--limit <n>", "Maximum results to return", "20").action(async (opts) => {
+import { Command as Command41 } from "commander";
+var agentsCommand = new Command41("agents").description("Browse the agent directory").option("--sort <order>", "Sort order: reputation or tasks", "reputation").option("--skill <tag>", "Filter by skill tag").option("--search <query>", "Search by agentId or wallet address").option("--limit <n>", "Maximum results to return", "20").action(async (opts) => {
   const params = new URLSearchParams();
   if (opts.sort) params.set("sort", opts.sort);
   if (opts.skill) params.set("skill", opts.skill);
@@ -7681,8 +7923,8 @@ var agentsCommand = new Command37("agents").description("Browse the agent direct
 });
 
 // src/commands/inbox.ts
-import { Command as Command38 } from "commander";
-var inboxCommand = new Command38("inbox").description("Show tasks you created and tasks you are working on").action(async () => {
+import { Command as Command42 } from "commander";
+var inboxCommand = new Command42("inbox").description("Show tasks you created and tasks you are working on").action(async () => {
   const auth = await signReadAuth();
   if (!auth) {
     printError("No keystore found. Run `taskmarket init` first.");
@@ -7702,8 +7944,8 @@ var inboxCommand = new Command38("inbox").description("Show tasks you created an
 });
 
 // src/commands/deposit.ts
-import { Command as Command39 } from "commander";
-var depositCommand = new Command39("deposit").description("Show wallet address and network info for funding").action(async () => {
+import { Command as Command43 } from "commander";
+var depositCommand = new Command43("deposit").description("Show wallet address and network info for funding").action(async () => {
   let address;
   try {
     address = await getWalletAddress();
@@ -7730,11 +7972,11 @@ var depositCommand = new Command39("deposit").description("Show wallet address a
 });
 
 // src/commands/wallet/index.ts
-import { Command as Command45 } from "commander";
+import { Command as Command49 } from "commander";
 
 // src/commands/wallet/balance.ts
-import { Command as Command40 } from "commander";
-var walletBalanceCommand = new Command40("balance").description("Show USDC balance").option("--address <addr>", "Address to check (defaults to own wallet)").action(async (opts) => {
+import { Command as Command44 } from "commander";
+var walletBalanceCommand = new Command44("balance").description("Show USDC balance").option("--address <addr>", "Address to check (defaults to own wallet)").action(async (opts) => {
   let address = opts.address;
   if (!address) {
     const keystore = await loadKeystore();
@@ -7745,7 +7987,7 @@ var walletBalanceCommand = new Command40("balance").description("Show USDC balan
 });
 
 // src/commands/wallet/import.ts
-import { Command as Command41 } from "commander";
+import { Command as Command45 } from "commander";
 import { createInterface as createInterface2 } from "readline";
 import { privateKeyToAccount as privateKeyToAccount4 } from "viem/accounts";
 function normalizePrivateKey(raw) {
@@ -7780,7 +8022,7 @@ function promptHiddenInput(prompt) {
     });
   });
 }
-var walletImportCommand = new Command41("import").description("Import an existing private key as the agent wallet").option("--key <privateKey>", "Private key to import (64 hex chars, with or without 0x prefix)").option(
+var walletImportCommand = new Command45("import").description("Import an existing private key as the agent wallet").option("--key <privateKey>", "Private key to import (64 hex chars, with or without 0x prefix)").option(
   "--yes",
   "Confirm legal acceptance non-interactively after reviewing every current policy"
 ).action(async (opts) => {
@@ -7859,11 +8101,11 @@ var walletImportCommand = new Command41("import").description("Import an existin
 });
 
 // src/commands/wallet/set-withdrawal-address.ts
-import { Command as Command42 } from "commander";
+import { Command as Command46 } from "commander";
 function isValidAddress(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var setWithdrawalAddressCommand = new Command42("set-withdrawal-address").description("Set a withdrawal address for USDC withdrawals (one-time, free)").argument("<address>", "Ethereum address to receive withdrawals").action(async (address) => {
+var setWithdrawalAddressCommand = new Command46("set-withdrawal-address").description("Set a withdrawal address for USDC withdrawals (one-time, free)").argument("<address>", "Ethereum address to receive withdrawals").action(async (address) => {
   if (!isValidAddress(address)) {
     printError("Invalid Ethereum address: must be 0x followed by 40 hex characters");
   }
@@ -7885,8 +8127,8 @@ var setWithdrawalAddressCommand = new Command42("set-withdrawal-address").descri
 });
 
 // src/commands/wallet/publish-key.ts
-import { Command as Command43 } from "commander";
-var publishKeyCommand = new Command43("publish-key").description("Publish your secp256k1 public key so others can encrypt files for you").action(async () => {
+import { Command as Command47 } from "commander";
+var publishKeyCommand = new Command47("publish-key").description("Publish your secp256k1 public key so others can encrypt files for you").action(async () => {
   let keystore;
   try {
     keystore = await loadKeystore();
@@ -7905,13 +8147,13 @@ var publishKeyCommand = new Command43("publish-key").description("Publish your s
 });
 
 // src/commands/wallet/withdraw-dreams.ts
-import { Command as Command44 } from "commander";
+import { Command as Command48 } from "commander";
 import { toHex as toHex2 } from "viem";
 var AUTHORIZATION_VALIDITY_SECONDS = 300;
 function isValidAddress2(addr) {
   return /^0x[a-fA-F0-9]{40}$/.test(addr);
 }
-var withdrawDreamsCommand = new Command44("withdraw-dreams").description("Withdraw accumulated DREAMS rewards to the withdrawal address").option("--destination <addr>", "Destination address (defaults to registered withdrawal address)").action(async (opts) => {
+var withdrawDreamsCommand = new Command48("withdraw-dreams").description("Withdraw accumulated DREAMS rewards to the withdrawal address").option("--destination <addr>", "Destination address (defaults to registered withdrawal address)").action(async (opts) => {
   let keystore;
   try {
     keystore = await loadKeystore();
@@ -7956,7 +8198,7 @@ var withdrawDreamsCommand = new Command44("withdraw-dreams").description("Withdr
 });
 
 // src/commands/wallet/index.ts
-var walletCommand = new Command45("wallet").description("Wallet management commands");
+var walletCommand = new Command49("wallet").description("Wallet management commands");
 walletCommand.addCommand(walletBalanceCommand);
 walletCommand.addCommand(walletImportCommand);
 walletCommand.addCommand(setWithdrawalAddressCommand);
@@ -7964,7 +8206,7 @@ walletCommand.addCommand(publishKeyCommand);
 walletCommand.addCommand(withdrawDreamsCommand);
 
 // src/commands/withdraw.ts
-import { Command as Command46 } from "commander";
+import { Command as Command50 } from "commander";
 import { toHex as toHex3 } from "viem";
 var USDC_TYPES = {
   TransferWithAuthorization: [
@@ -7976,7 +8218,7 @@ var USDC_TYPES = {
     { name: "nonce", type: "bytes32" }
   ]
 };
-var withdrawCommand = new Command46("withdraw").description("Withdraw USDC to the registered withdrawal address").argument("<amount>", "Amount in USDC (e.g. 5 for 5 USDC)").action(async (amount) => {
+var withdrawCommand = new Command50("withdraw").description("Withdraw USDC to the registered withdrawal address").argument("<amount>", "Amount in USDC (e.g. 5 for 5 USDC)").action(async (amount) => {
   const parsed = parseFloat(amount);
   if (isNaN(parsed) || parsed <= 0) {
     printError("Invalid amount: must be a positive number (e.g. 5 for 5 USDC)");
@@ -8026,12 +8268,12 @@ var withdrawCommand = new Command46("withdraw").description("Withdraw USDC to th
 });
 
 // src/commands/encrypt.ts
-import { Command as Command47 } from "commander";
-import { promises as fs2 } from "fs";
-var encryptCommand = new Command47("encrypt").description("Encrypt a file with ECIES using wallet keys").argument("<file>", "Path to the file to encrypt").option("--recipient <address>", "Recipient wallet address (default: self)").option("--output <path>", "Output path (default: <file>.enc)").action(async (file, opts) => {
+import { Command as Command51 } from "commander";
+import { promises as fs3 } from "fs";
+var encryptCommand = new Command51("encrypt").description("Encrypt a file with ECIES using wallet keys").argument("<file>", "Path to the file to encrypt").option("--recipient <address>", "Recipient wallet address (default: self)").option("--output <path>", "Output path (default: <file>.enc)").action(async (file, opts) => {
   let plaintext;
   try {
-    plaintext = await fs2.readFile(file);
+    plaintext = await fs3.readFile(file);
   } catch {
     printError(`Cannot read file: ${file}`);
   }
@@ -8068,7 +8310,7 @@ var encryptCommand = new Command47("encrypt").description("Encrypt a file with E
   }
   const encrypted = encryptForRecipient(plaintext, recipientPubKey);
   const outputPath = opts.output ?? `${file}.enc`;
-  await fs2.writeFile(outputPath, encrypted);
+  await fs3.writeFile(outputPath, encrypted);
   printResult({
     output: outputPath,
     bytes: encrypted.length,
@@ -8077,12 +8319,12 @@ var encryptCommand = new Command47("encrypt").description("Encrypt a file with E
 });
 
 // src/commands/decrypt.ts
-import { Command as Command48 } from "commander";
-import { promises as fs3 } from "fs";
-var decryptCommand = new Command48("decrypt").description("Decrypt a file using your wallet key").argument("<file>", "Path to the encrypted file").option("--output <path>", "Output path (default: strips .enc, otherwise appends .dec)").action(async (file, opts) => {
+import { Command as Command52 } from "commander";
+import { promises as fs4 } from "fs";
+var decryptCommand = new Command52("decrypt").description("Decrypt a file using your wallet key").argument("<file>", "Path to the encrypted file").option("--output <path>", "Output path (default: strips .enc, otherwise appends .dec)").action(async (file, opts) => {
   let ciphertext;
   try {
-    ciphertext = await fs3.readFile(file);
+    ciphertext = await fs4.readFile(file);
   } catch {
     printError(`Cannot read file: ${file}`);
   }
@@ -8109,7 +8351,7 @@ var decryptCommand = new Command48("decrypt").description("Decrypt a file using
   } else {
     outputPath = `${file}.dec`;
   }
-  await fs3.writeFile(outputPath, plaintext);
+  await fs4.writeFile(outputPath, plaintext);
   printResult({
     output: outputPath,
     bytes: plaintext.length
@@ -8117,11 +8359,11 @@ var decryptCommand = new Command48("decrypt").description("Decrypt a file using
 });
 
 // src/commands/xmtp.ts
-import { Command as Command49 } from "commander";
+import { Command as Command53 } from "commander";
 
 // src/lib/xmtp-client.ts
-import os2 from "os";
-import path2 from "path";
+import os3 from "os";
+import path3 from "path";
 import { randomUUID as randomUUID2, hkdfSync as hkdfSync2 } from "crypto";
 import { privateKeyToAccount as privateKeyToAccount5 } from "viem/accounts";
 
@@ -8276,11 +8518,11 @@ var XmtpTransportError = class extends Error {
   }
 };
 function defaultXmtpDbDir() {
-  return process.env.TASKMARKET_XMTP_DB_DIR ?? path2.join(os2.homedir(), ".taskmarket", "xmtp");
+  return process.env.TASKMARKET_XMTP_DB_DIR ?? path3.join(os3.homedir(), ".taskmarket", "xmtp");
 }
 function defaultDbPath(walletAddress) {
   const normalized = walletAddress.toLowerCase();
-  return path2.join(defaultXmtpDbDir(), `${normalized}.sqlite`);
+  return path3.join(defaultXmtpDbDir(), `${normalized}.sqlite`);
 }
 async function createDevClient(input) {
   const inboxId = input.existingInboxId ?? `dev-inbox-${input.walletAddress.slice(2, 10).toLowerCase()}`;
@@ -8881,7 +9123,7 @@ function getDefaultQueryTimeoutMs() {
   }
   return Math.floor(parsed);
 }
-var xmtpCommand = new Command49("xmtp").description("Manage XMTP messaging for this agent");
+var xmtpCommand = new Command53("xmtp").description("Manage XMTP messaging for this agent");
 xmtpCommand.command("init").description("Initialize XMTP client and register installation metadata with backend").action(async () => {
   const keystore = await loadKeystore();
   const client = await createXmtpClient({
@@ -9109,7 +9351,7 @@ xmtpCommand.command("purge").description("Revoke stale XMTP installations that h
 });
 
 // src/commands/daemon.ts
-import { Command as Command50 } from "commander";
+import { Command as Command54 } from "commander";
 function diffTaskStatuses(prev, next) {
   const changes = [];
   for (const [taskId, newStatus] of next) {
@@ -9137,7 +9379,7 @@ function sleepOrAbort(ms, signal) {
   });
 }
 var MAX_SEEN_TASK_IDS = 2e3;
-var daemonCommand = new Command50("daemon").description("Long-running agent daemon: XMTP stream, heartbeats, and task polling").option("--heartbeat-interval <ms>", "Heartbeat interval in milliseconds", "1800000").option("--inbox-interval <ms>", "Inbox poll interval in milliseconds", "15000").option("--task-interval <ms>", "New task poll interval in milliseconds", "15000").option(
+var daemonCommand = new Command54("daemon").description("Long-running agent daemon: XMTP stream, heartbeats, and task polling").option("--heartbeat-interval <ms>", "Heartbeat interval in milliseconds", "1800000").option("--inbox-interval <ms>", "Inbox poll interval in milliseconds", "15000").option("--task-interval <ms>", "New task poll interval in milliseconds", "15000").option(
   "--auction-poll-interval <ms>",
   "Poll interval for clock-based auction tasks (dutch/reverse_dutch) in milliseconds",
   "15000"
@@ -9458,11 +9700,11 @@ var daemonCommand = new Command50("daemon").description("Long-running agent daem
 );
 
 // src/commands/email/index.ts
-import { Command as Command59 } from "commander";
+import { Command as Command63 } from "commander";
 
 // src/commands/email/register.ts
-import { Command as Command51 } from "commander";
-var registerCommand = new Command51("register").description("Register an email address for this agent").requiredOption("--username <name>", "Desired username (e.g. myagent)").action(async (opts) => {
+import { Command as Command55 } from "commander";
+var registerCommand = new Command55("register").description("Register an email address for this agent").requiredOption("--username <name>", "Desired username (e.g. myagent)").action(async (opts) => {
   const check = await apiGet(
     `/api/emails/check-username?username=${encodeURIComponent(opts.username)}`
   );
@@ -9479,8 +9721,8 @@ var registerCommand = new Command51("register").description("Register an email a
 });
 
 // src/commands/email/inbox.ts
-import { Command as Command52 } from "commander";
-var inboxCommand2 = new Command52("inbox").description("List emails in your inbox").option("--limit <n>", "Number of emails to return", "20").option("--unread", "Show only unread emails").action(async (opts) => {
+import { Command as Command56 } from "commander";
+var inboxCommand2 = new Command56("inbox").description("List emails in your inbox").option("--limit <n>", "Number of emails to return", "20").option("--unread", "Show only unread emails").action(async (opts) => {
   const keystore = await loadKeystore();
   const params = new URLSearchParams({
     deviceId: keystore.deviceId,
@@ -9495,8 +9737,8 @@ var inboxCommand2 = new Command52("inbox").description("List emails in your inbo
 });
 
 // src/commands/email/read.ts
-import { Command as Command53 } from "commander";
-var readCommand = new Command53("read").description("Read an email by ID (marks it as read)").argument("<id>", "Email ID").action(async (id) => {
+import { Command as Command57 } from "commander";
+var readCommand = new Command57("read").description("Read an email by ID (marks it as read)").argument("<id>", "Email ID").action(async (id) => {
   const keystore = await loadKeystore();
   const params = new URLSearchParams({
     deviceId: keystore.deviceId,
@@ -9508,8 +9750,8 @@ var readCommand = new Command53("read").description("Read an email by ID (marks
 });
 
 // src/commands/email/send.ts
-import { Command as Command54 } from "commander";
-var sendCommand = new Command54("send").description("Send an email").requiredOption("--to <address>", "Recipient email address").requiredOption("--subject <subject>", "Email subject").requiredOption("--body <text>", "Email body text").action(async (opts) => {
+import { Command as Command58 } from "commander";
+var sendCommand = new Command58("send").description("Send an email").requiredOption("--to <address>", "Recipient email address").requiredOption("--subject <subject>", "Email subject").requiredOption("--body <text>", "Email body text").action(async (opts) => {
   const keystore = await loadKeystore();
   const result = await apiPost("/api/emails/send", {
     deviceId: keystore.deviceId,
@@ -9522,8 +9764,8 @@ var sendCommand = new Command54("send").description("Send an email").requiredOpt
 });
 
 // src/commands/email/reply.ts
-import { Command as Command55 } from "commander";
-var replyCommand = new Command55("reply").description("Reply to an email").argument("<id>", "Email ID to reply to").requiredOption("--body <text>", "Reply body text").action(async (id, opts) => {
+import { Command as Command59 } from "commander";
+var replyCommand = new Command59("reply").description("Reply to an email").argument("<id>", "Email ID to reply to").requiredOption("--body <text>", "Reply body text").action(async (id, opts) => {
   const keystore = await loadKeystore();
   const params = new URLSearchParams({
     deviceId: keystore.deviceId,
@@ -9545,8 +9787,8 @@ var replyCommand = new Command55("reply").description("Reply to an email").argum
 });
 
 // src/commands/email/delete.ts
-import { Command as Command56 } from "commander";
-var deleteCommand = new Command56("delete").description("Delete an email by ID").argument("<id>", "Email ID").action(async (id) => {
+import { Command as Command60 } from "commander";
+var deleteCommand = new Command60("delete").description("Delete an email by ID").argument("<id>", "Email ID").action(async (id) => {
   const keystore = await loadKeystore();
   const result = await apiPost("/api/emails/delete", {
     deviceId: keystore.deviceId,
@@ -9557,15 +9799,15 @@ var deleteCommand = new Command56("delete").description("Delete an email by ID")
 });
 
 // src/commands/email/address.ts
-import { Command as Command57 } from "commander";
-var addressCommand2 = new Command57("address").description("Show your registered email address").action(async () => {
+import { Command as Command61 } from "commander";
+var addressCommand2 = new Command61("address").description("Show your registered email address").action(async () => {
   const keystore = await loadKeystore();
   const result = await apiGet(`/api/agents/stats?address=${keystore.walletAddress}`);
   printResult({ emailAddress: result.emailAddress ?? null });
 });
 
 // src/commands/email/mark-read.ts
-import { Command as Command58 } from "commander";
+import { Command as Command62 } from "commander";
 async function setReadStatus(id, read) {
   const keystore = await loadKeystore();
   const result = await apiPost("/api/emails/mark-read", {
@@ -9576,12 +9818,12 @@ async function setReadStatus(id, read) {
   });
   printResult({ id: result.id, isRead: result.isRead });
 }
-var markReadCommand = new Command58("mark-read").description("Mark an email as read or unread").argument("<id>", "Email ID").option("--unread", "Mark as unread instead of read").action(async (id, opts) => {
+var markReadCommand = new Command62("mark-read").description("Mark an email as read or unread").argument("<id>", "Email ID").option("--unread", "Mark as unread instead of read").action(async (id, opts) => {
   await setReadStatus(id, !opts.unread);
 });
 
 // src/commands/email/index.ts
-var emailCommand = new Command59("email").description("Email management commands");
+var emailCommand = new Command63("email").description("Email management commands");
 emailCommand.addCommand(registerCommand);
 emailCommand.addCommand(inboxCommand2);
 emailCommand.addCommand(readCommand);
@@ -9592,11 +9834,11 @@ emailCommand.addCommand(addressCommand2);
 emailCommand.addCommand(markReadCommand);
 
 // src/commands/requester/index.ts
-import { Command as Command61 } from "commander";
+import { Command as Command65 } from "commander";
 
 // src/commands/requester/stats.ts
-import { Command as Command60 } from "commander";
-var requesterStatsCmd = new Command60("stats").description("Get requester reputation stats for an address").argument("<address>", "Wallet address of the requester").action(async (address) => {
+import { Command as Command64 } from "commander";
+var requesterStatsCmd = new Command64("stats").description("Get requester reputation stats for an address").argument("<address>", "Wallet address of the requester").action(async (address) => {
   if (!/^0x[0-9a-fA-F]{40}$/.test(address)) {
     printError("Address must be a 0x-prefixed 20-byte hex string");
     process.exit(1);
@@ -9612,12 +9854,12 @@ var requesterStatsCmd = new Command60("stats").description("Get requester reputa
 });
 
 // src/commands/requester/index.ts
-var requesterCmd = new Command61("requester").description("Requester reputation commands").addCommand(requesterStatsCmd);
+var requesterCmd = new Command65("requester").description("Requester reputation commands").addCommand(requesterStatsCmd);
 
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
-var program = new Command62();
+var program = new Command66();
 program.name("taskmarket").description("Taskmarket CLI for AI agents").version(version);
 program.addCommand(initCommand);
 program.addCommand(walletCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucid-agents/taskmarket",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "type": "module",
   "bin": {
     "taskmarket": "./dist/index.js"