@lucid-agents/taskmarket 1.7.1 → 1.7.2

package/dist/index.js

@@ -5508,8 +5508,8 @@ function buildReadAuthMessage(address) {
 var READ_AUTH_ADDRESS_HEADER = "X-Taskmarket-Caller-Address";
 var READ_AUTH_SIGNATURE_HEADER = "X-Taskmarket-Caller-Signature";
 var TASK_ACCESS_GRANT_HEADER = "X-Taskmarket-Task-Access-Grant";
-function buildSubmitMessage(taskId) {
-  return `taskmarket:submit:${taskId}`;
+function buildSubmitMessage(taskId, contentBindings) {
+  return contentBindings ? `taskmarket:submit:${taskId}:${contentBindings.join(",")}` : `taskmarket:submit:${taskId}`;
 }
 function buildClaimMessage(taskId) {
   return `taskmarket:claim:${taskId}`;
@@ -6012,7 +6012,8 @@ function decryptPrivateKey(deviceEncryptionKeyHex, encryptedHex) {
 async function saveKeystore(keystore, keystorePath) {
   const p = keystorePath ?? getKeystorePath();
   await fs.mkdir(path.dirname(p), { recursive: true });
-  await fs.writeFile(p, JSON.stringify(keystore, null, 2), "utf8");
+  await fs.writeFile(p, JSON.stringify(keystore, null, 2), { encoding: "utf8", mode: 384 });
+  await fs.chmod(p, 384);
 }
 async function loadKeystore(keystorePath) {
   const p = keystorePath ?? getKeystorePath();
@@ -7156,11 +7157,18 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
         };
       })
     );
+    const submitSignature = await signMessage(
+      buildSubmitMessage(
+        taskId,
+        artifactInputs.map((artifact) => artifact.artifactKey)
+      ),
+      keystore
+    );
     const result = await apiPost(`/api/tasks/${taskId}/submissions/from-keys`, {
       taskId,
       workerAddress: keystore.walletAddress,
       artifacts: artifactInputs,
-      signature
+      signature: submitSignature
     });
     printResult({ submissionId: result.submissionId });
   } finally {
@@ -7415,6 +7423,9 @@ var selectWinnerCmd = new Command22("select-winner").description("Permissionless
 // src/commands/task/download.ts
 import { Command as Command23 } from "commander";
 import { writeFileSync } from "fs";
+function sanitizeForTerminal(text) {
+  return text.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "");
+}
 var downloadCmd = new Command23("download").description("Download a submission file (requester or worker)").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--submission <id>", "Submission ID (from `task submissions`)").option("--artifact <id>", "Artifact ID for multi-artifact submissions").option("--output <path>", "Save to file instead of printing to stdout").action(
   async (taskId, opts) => {
     const keystore = await loadKeystore();
@@ -7447,7 +7458,15 @@ var downloadCmd = new Command23("download").description("Download a submission f
       writeFileSync(opts.output, content);
       process.stdout.write(JSON.stringify({ ok: true, data: { savedTo: opts.output } }) + "\n");
     } else {
-      process.stdout.write(content);
+      let decoded;
+      try {
+        decoded = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      } catch {
+        printError(
+          "Downloaded content is not valid UTF-8 text and cannot be safely printed to the terminal. Use --output <path> to save it to a file instead."
+        );
+      }
+      process.stdout.write(sanitizeForTerminal(decoded));
     }
   }
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucid-agents/taskmarket",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "type": "module",
   "bin": {
     "taskmarket": "./dist/index.js"
@@ -17,8 +17,8 @@
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vitest": "^2.0.0",
-    "@taskmarket/eslint-config": "0.0.0",
     "@taskmarket/prettier-config": "0.0.0",
+    "@taskmarket/eslint-config": "0.0.0",
     "@taskmarket/shared": "2.0.0"
   },
   "files": [