@lucid-agents/taskmarket 1.7.1 → 1.7.3

package/dist/index.js

@@ -5508,8 +5508,8 @@ function buildReadAuthMessage(address) {
 var READ_AUTH_ADDRESS_HEADER = "X-Taskmarket-Caller-Address";
 var READ_AUTH_SIGNATURE_HEADER = "X-Taskmarket-Caller-Signature";
 var TASK_ACCESS_GRANT_HEADER = "X-Taskmarket-Task-Access-Grant";
-function buildSubmitMessage(taskId) {
-  return `taskmarket:submit:${taskId}`;
+function buildSubmitMessage(taskId, contentBindings) {
+  return contentBindings ? `taskmarket:submit:${taskId}:${contentBindings.join(",")}` : `taskmarket:submit:${taskId}`;
 }
 function buildClaimMessage(taskId) {
   return `taskmarket:claim:${taskId}`;
@@ -6012,7 +6012,8 @@ function decryptPrivateKey(deviceEncryptionKeyHex, encryptedHex) {
 async function saveKeystore(keystore, keystorePath) {
   const p = keystorePath ?? getKeystorePath();
   await fs.mkdir(path.dirname(p), { recursive: true });
-  await fs.writeFile(p, JSON.stringify(keystore, null, 2), "utf8");
+  await fs.writeFile(p, JSON.stringify(keystore, null, 2), { encoding: "utf8", mode: 384 });
+  await fs.chmod(p, 384);
 }
 async function loadKeystore(keystorePath) {
   const p = keystorePath ?? getKeystorePath();
@@ -6037,6 +6038,14 @@ async function keystoreExists(keystorePath) {
 // src/lib/api.ts
 var API_URL = process.env.TASKMARKET_API_URL ?? "https://api.taskmarket.dev";
 var API_ORIGIN = new URL(API_URL).origin;
+var ApiError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+  }
+};
 function legalReceiptHeadersForKeystore(keystore, path4, method) {
   const canSend = keystore.legalAcceptanceApiOrigin === API_ORIGIN && (method === "POST" || path4 === "/api/legal/status");
   return canSend ? buildLegalReceiptHeaders(keystore.legalAcceptanceReceipt) : {};
@@ -6062,7 +6071,7 @@ async function apiGet(path4, options) {
   });
   const body = await res.json();
   if (!res.ok) {
-    throw new Error(`GET ${path4} failed (${res.status}): ${JSON.stringify(body)}`);
+    throw new ApiError(res.status, `GET ${path4} failed (${res.status}): ${JSON.stringify(body)}`);
   }
   return body;
 }
@@ -6080,7 +6089,10 @@ async function apiPost(path4, body, options) {
   });
   const result = await res.json();
   if (!res.ok) {
-    throw new Error(`POST ${path4} failed (${res.status}): ${JSON.stringify(result)}`);
+    throw new ApiError(
+      res.status,
+      `POST ${path4} failed (${res.status}): ${JSON.stringify(result)}`
+    );
   }
   return result;
 }
@@ -6097,7 +6109,10 @@ async function apiDelete(path4, options) {
   });
   const result = await res.json();
   if (!res.ok) {
-    throw new Error(`DELETE ${path4} failed (${res.status}): ${JSON.stringify(result)}`);
+    throw new ApiError(
+      res.status,
+      `DELETE ${path4} failed (${res.status}): ${JSON.stringify(result)}`
+    );
   }
   return result;
 }
@@ -6606,7 +6621,7 @@ async function x402Post(path4, body) {
       return r1.json();
     }
     const text = await r1.text().catch(() => "");
-    throw new Error(`POST ${path4} failed (${r1.status}): ${text}`);
+    throw new ApiError(r1.status, `POST ${path4} failed (${r1.status}): ${text}`);
   }
   const requirements = await r1.json();
   if (!requirements.accepts || requirements.accepts.length === 0) {
@@ -6640,7 +6655,10 @@ async function x402Post(path4, body) {
   });
   const result = await r2.json();
   if (!r2.ok) {
-    throw new Error(`POST ${path4} failed after payment (${r2.status}): ${JSON.stringify(result)}`);
+    throw new ApiError(
+      r2.status,
+      `POST ${path4} failed after payment (${r2.status}): ${JSON.stringify(result)}`
+    );
   }
   return result;
 }
@@ -7156,11 +7174,18 @@ var submitCmd = new Command9("submit").description("Submit work for a task").arg
         };
       })
     );
-    const result = await apiPost(`/api/tasks/${taskId}/submissions/from-keys`, {
+    const submitSignature = await signMessage(
+      buildSubmitMessage(
+        taskId,
+        artifactInputs.map((artifact) => artifact.artifactKey)
+      ),
+      keystore
+    );
+    const result = await x402Post(`/api/tasks/${taskId}/submissions/from-keys`, {
       taskId,
       workerAddress: keystore.walletAddress,
       artifacts: artifactInputs,
-      signature
+      signature: submitSignature
     });
     printResult({ submissionId: result.submissionId });
   } finally {
@@ -7415,6 +7440,9 @@ var selectWinnerCmd = new Command22("select-winner").description("Permissionless
 // src/commands/task/download.ts
 import { Command as Command23 } from "commander";
 import { writeFileSync } from "fs";
+function sanitizeForTerminal(text) {
+  return text.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "");
+}
 var downloadCmd = new Command23("download").description("Download a submission file (requester or worker)").argument("<taskId>", "Task ID (0x-prefixed hex)").requiredOption("--submission <id>", "Submission ID (from `task submissions`)").option("--artifact <id>", "Artifact ID for multi-artifact submissions").option("--output <path>", "Save to file instead of printing to stdout").action(
   async (taskId, opts) => {
     const keystore = await loadKeystore();
@@ -7447,7 +7475,15 @@ var downloadCmd = new Command23("download").description("Download a submission f
       writeFileSync(opts.output, content);
       process.stdout.write(JSON.stringify({ ok: true, data: { savedTo: opts.output } }) + "\n");
     } else {
-      process.stdout.write(content);
+      let decoded;
+      try {
+        decoded = new TextDecoder("utf-8", { fatal: true }).decode(content);
+      } catch {
+        printError(
+          "Downloaded content is not valid UTF-8 text and cannot be safely printed to the terminal. Use --output <path> to save it to a file instead."
+        );
+      }
+      process.stdout.write(sanitizeForTerminal(decoded));
     }
   }
 );
@@ -9882,6 +9918,9 @@ program.addCommand(emailCommand);
 program.addCommand(requesterCmd);
 program.addCommand(legalCommand);
 program.parseAsync(process.argv).catch((err) => {
-  process.stderr.write(JSON.stringify({ ok: false, error: err.message }) + "\n");
+  const status = err instanceof ApiError ? err.status : void 0;
+  process.stderr.write(
+    JSON.stringify({ ok: false, error: err.message, ...status !== void 0 ? { status } : {} }) + "\n"
+  );
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucid-agents/taskmarket",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "type": "module",
   "bin": {
     "taskmarket": "./dist/index.js"
@@ -17,9 +17,9 @@
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vitest": "^2.0.0",
-    "@taskmarket/eslint-config": "0.0.0",
     "@taskmarket/prettier-config": "0.0.0",
-    "@taskmarket/shared": "2.0.0"
+    "@taskmarket/shared": "2.0.0",
+    "@taskmarket/eslint-config": "0.0.0"
   },
   "files": [
     "dist"