@lucid-agents/taskmarket 1.7.0 → 1.7.2

package/dist/index.js

@@ -4197,6 +4197,7 @@ var TaskDropDirectoryResponseSchema = external_exports.object({
 });
 
 // ../../packages/shared/dist/schemas/task.schemas.js
+var TASK_DESCRIPTION_MAX_LENGTH = 1e4;
 var TaskMode = external_exports.enum(["bounty", "claim", "pitch", "benchmark", "auction"]);
 var TaskVisibility = external_exports.enum(["unlisted", "public", "private"]);
 var SubmissionVisibility = external_exports.enum(["public", "reveal_all", "winner_only", "never"]);
@@ -4262,7 +4263,7 @@ var TaskAwardSchema = external_exports.object({
   rating: external_exports.number().min(0).max(100).nullable()
 });
 var TaskCreateSchema = external_exports.object({
-  description: external_exports.string().min(1, "Description is required").max(2e3, "Description is too long"),
+  description: external_exports.string().min(1, "Description is required").max(TASK_DESCRIPTION_MAX_LENGTH, "Description is too long"),
   reward: PositiveUsdcBaseUnitsSchema,
   duration: external_exports.number().positive("Duration must be positive"),
   tags: external_exports.array(external_exports.string()).max(10, "Maximum 10 tags allowed"),
@@ -4516,7 +4517,7 @@ var UpdateTaskInputSchema = external_exports.object({
   pitchDeadline: external_exports.number().int().positive().optional(),
   auctionFloorPrice: UsdcBaseUnitsSchema.optional(),
   auctionStartPrice: UsdcBaseUnitsSchema.optional(),
-  description: external_exports.string().max(2e3, "Description is too long").optional(),
+  description: external_exports.string().max(TASK_DESCRIPTION_MAX_LENGTH, "Description is too long").optional(),
   tags: external_exports.array(external_exports.string()).max(10, "Maximum 10 tags allowed").optional(),
   metricDescription: external_exports.string().max(500).optional()
 });
@@ -5507,8 +5508,8 @@ function buildReadAuthMessage(address) {
 var READ_AUTH_ADDRESS_HEADER = "X-Taskmarket-Caller-Address";
 var READ_AUTH_SIGNATURE_HEADER = "X-Taskmarket-Caller-Signature";
 var TASK_ACCESS_GRANT_HEADER = "X-Taskmarket-Task-Access-Grant";
-function buildSubmitMessage(taskId) {
-  return `taskmarket:submit:${taskId}`;
+function buildSubmitMessage(taskId, contentBindings) {
+  return contentBindings ? `taskmarket:submit:${taskId}:${contentBindings.join(",")}` : `taskmarket:submit:${taskId}`;
 }
 function buildClaimMessage(taskId) {
   return `taskmarket:claim:${taskId}`;
@@ -6011,7 +6012,8 @@ function decryptPrivateKey(deviceEncryptionKeyHex, encryptedHex) {
 async function saveKeystore(keystore, keystorePath) {
   const p = keystorePath ?? getKeystorePath();
   await fs.mkdir(path.dirname(p), { recursive: true });
-  await fs.writeFile(p, JSON.stringify(keystore, null, 2), "utf8");
+  await fs.writeFile(p, JSON.stringify(keystore, null, 2), { encoding: "utf8", mode: 384 });
+  await fs.chmod(p, 384);
 }
 async function loadKeystore(keystorePath) {
   const p = keystorePath ?? getKeystorePath();
@@ -7014,7 +7016,9 @@ var getCmd = new Command8("get").description("Get task details").argument("<task
   const headers = { ...auth?.headers ?? {}, ...await taskAccessGrantHeaders(taskId) };
   const task = await apiGet(`/api/tasks/${taskId}`, { headers });
   if (!task) {
-    printError(`Task not found: ${taskId}`);
+    printError(
+      `Task not found: ${taskId} (or this is a private task you don't have access to -- if you have a password for it, run: taskmarket task unlock ${taskId} --password <password>)`
+    );
   }
   printResult(task);
 });
@@ -7153,11 +7157,18 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
         };
       })
     );
+    const submitSignature = await signMessage(
+      buildSubmitMessage(
+        taskId,
+        artifactInputs.map((artifact) => artifact.artifactKey)
+      ),
+      keystore
+    );
     const result = await apiPost(`/api/tasks/${taskId}/submissions/from-keys`, {
       taskId,
       workerAddress: keystore.walletAddress,
       artifacts: artifactInputs,
-      signature
+      signature: submitSignature
     });
     printResult({ submissionId: result.submissionId });
   } finally {
@@ -7412,6 +7423,9 @@ var selectWinnerCmd = new Command22("select-winner").description("Permissionless
 // src/commands/task/download.ts
 import { Command as Command23 } from "commander";
 import { writeFileSync } from "fs";
+function sanitizeForTerminal(text) {
+  return text.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "");
+}
 var downloadCmd = new Command23("download").description("Download a submission file (requester or worker)").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--submission <id>", "Submission ID (from `task submissions`)").option("--artifact <id>", "Artifact ID for multi-artifact submissions").option("--output <path>", "Save to file instead of printing to stdout").action(
   async (taskId, opts) => {
     const keystore = await loadKeystore();
@@ -7444,7 +7458,15 @@ var downloadCmd = new Command23("download").description("Download a submission f
       writeFileSync(opts.output, content);
       process.stdout.write(JSON.stringify({ ok: true, data: { savedTo: opts.output } }) + "\n");
     } else {
-      process.stdout.write(content);
+      let decoded;
+      try {
+        decoded = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      } catch {
+        printError(
+          "Downloaded content is not valid UTF-8 text and cannot be safely printed to the terminal. Use --output <path> to save it to a file instead."
+        );
+      }
+      process.stdout.write(sanitizeForTerminal(decoded));
     }
   }
 );
@@ -7473,7 +7495,7 @@ var refundExpiredCmd = new Command25("refund-expired").description(
 // src/commands/task/reject-submission.ts
 import { Command as Command26 } from "commander";
 var rejectSubmissionCmd = new Command26("reject-submission").description(
-  "Reject a spam or low-quality submission (costs 0.01 USDC relay fee). Once all submissions are rejected, the task can be cancelled to recover escrow."
+  "Reject a spam or low-quality submission (costs 0.001 USDC relay fee). Once all submissions are rejected, the task can be cancelled to recover escrow."
 ).argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--worker <address>", "Worker address whose submission to reject").action(async (taskId, opts) => {
   try {
     const result = await x402Post(`/api/tasks/${taskId}/reject-submission`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucid-agents/taskmarket",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "type": "module",
   "bin": {
     "taskmarket": "./dist/index.js"
@@ -17,8 +17,8 @@
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vitest": "^2.0.0",
-    "@taskmarket/eslint-config": "0.0.0",
     "@taskmarket/prettier-config": "0.0.0",
+    "@taskmarket/eslint-config": "0.0.0",
     "@taskmarket/shared": "2.0.0"
   },
   "files": [