@officexapp/vidfarm-devcli 0.21.60 → 0.21.62

package/.agents/skills/vidfarm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: vidfarm
-skill_version: 0.21.60
+skill_version: 0.21.62
 description: Use Vidfarm as a director. Run a strategy **consultation** (the `brainstorm/*` chain — cold-start interview, awareness stages, persuasive angles, hooks, product placement). Answer "give me content ideas" / "what should I post" / "I need 30 videos this month" from the bundled idea banks (50 content frames x 5 awareness stages x 44 problem angles). Browse/add inspiration videos, browse the free public raws catalog BY CATEGORY (curated shelves like scroll-stoppers/greenscreen/reaction — the cheapest way to source footage for one video, and a ready-made clip pool for bulk scripting N variants), fork a template into a composition, edit it in the Trackpad Editor (timeline-based like Premiere/DaVinci), auto-decompose source video into scenes, render to MP4, approve into a shareable post, and schedule it. Includes login, provider keys, discovery, versioning, uploads/downloads, and billing. Every step is available as raw REST; `vidfarm-devcli` wraps those routes and composes the file-backed scripting flows.
 ---
 

package/SKILL.director.md

@@ -1,6 +1,6 @@
 ---
 name: vidfarm
-skill_version: 0.21.60
+skill_version: 0.21.62
 description: Use Vidfarm as a director. Run a strategy **consultation** (the `brainstorm/*` chain — cold-start interview, awareness stages, persuasive angles, hooks, product placement). Answer "give me content ideas" / "what should I post" / "I need 30 videos this month" from the bundled idea banks (50 content frames x 5 awareness stages x 44 problem angles). Browse/add inspiration videos, browse the free public raws catalog BY CATEGORY (curated shelves like scroll-stoppers/greenscreen/reaction — the cheapest way to source footage for one video, and a ready-made clip pool for bulk scripting N variants), fork a template into a composition, edit it in the Trackpad Editor (timeline-based like Premiere/DaVinci), auto-decompose source video into scenes, render to MP4, approve into a shareable post, and schedule it. Includes login, provider keys, discovery, versioning, uploads/downloads, and billing. Every step is available as raw REST; `vidfarm-devcli` wraps those routes and composes the file-backed scripting flows.
 ---
 

package/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: vidfarm
-skill_version: 0.21.60
+skill_version: 0.21.62
 description: Entry point for making, editing, and rendering short-form video with Vidfarm. Use when the task is to create a video, ad, explainer, or social clip; to edit or re-theme an existing composition; to source footage or audio; or to run a batch of video variants. Routes to the full director skill and the `vidfarm` CLI.
 ---
 

package/dist/src/devcli/marketplace-gigs.js

@@ -44,6 +44,18 @@ CLIENT (paid vidfarm plan — the key is read from your vidfarm account)
   gigs machines                    Your two standing machines + gig ids + invite links
   gigs tasks [machine]             What is waiting in the Custom Requests queue
   gigs add-task --task "<brief>"   Post a task into Custom Requests
+
+  BID AUCTION — let clippers name the price instead of taking yours
+  gigs request-bids --task "<brief>"  Post a task NOBODY can claim; they bid in the
+                                   comments. --sealed hides bids from each other,
+                                   --bell broadcasts it, --opening "$0.10".
+                                   Prints a share link that carries a gig invite,
+                                   so a clipper who never joined can join AND bid
+                                   on that one page. Price stays TBD.
+  gigs bids <task-id>              The bids on it, newest thread first
+  gigs award <task-id> --bid <id>  Reserve that SAME task for the winner and tell
+                                   them privately. Losing bidders see nothing.
+                                   Then: gigs approve <proof-id> --amount <usd>
     --price <usd>                  Price per delivered video (default 0.25; "tbd" allowed)
     --tags a,b --priority <n>      Routing hints (lower priority polls sooner)
     --angle/--hook/--url/--format  The usual brief fields
@@ -54,7 +66,10 @@ CLIENT (paid vidfarm plan — the key is read from your vidfarm account)
     --body <file.json>             Send this JSON as the whole task instead
   gigs proofs [machine]            Submitted videos, newest first
     --status <pending|approved|rejected>  --limit <n>
-  gigs approve <proof-id> [machine] [--feedback "<text>"]
+  gigs approve <proof-id> [machine] [--amount <usd>] [--feedback "<text>"]
+                                   --amount names the price for a TBD task (what
+                                   you agreed in the bid thread). Omit it on a
+                                   TBD proof and it pays the machine's base rate.
   gigs reject  <proof-id> [machine] [--tag not_selected] [--feedback "<text>"]
                                    not_selected = a pass; it costs the worker NO reputation
   gigs ring-bell --title "<t>" [--subtext "<s>"] [--machine inbound_offers]
@@ -584,6 +599,178 @@ async function cmdAddTask(auth, values) {
         console.log(`  ${DIM}Nobody knows yet — broadcast it: vidfarm gigs ring-bell --title "…" --machine custom_requests${RESET}`);
     });
 }
+// ── The bid auction ─────────────────────────────────────────────────────────
+// A normal Custom Requests task is claimed by whoever polls first, at the
+// machine's price. A BID task inverts that: it is published `view_only` so
+// nobody can claim it, clippers post their price in the comment thread, and the
+// buyer awards one by flipping that SAME task to `reserved`. One record carries
+// the whole lifecycle, so the winner reads the entire negotiation on the task
+// they are about to do.
+//
+// The price stays `tbd` throughout. The deal is plain text in the thread, and
+// the real number is named once, at approval (`gigs approve --amount`), because
+// arrangements ("$5 now $5 on completion", "$12 for three") do not fit a float.
+/**
+ * The share link for a bid task. `/task/:gig/:id` is MEMBERS ONLY — Dollar
+ * Platoon shows a stranger the gig's join link instead of the task, and it
+ * ignores ?invite=. Only `/claim/:gig/:id?invite=<token>` admits a non-member:
+ * the "you have not joined" panel becomes "you are invited" and joining returns
+ * them to this task. A view-only task simply renders without the Accept button
+ * — the brief plus the comment thread — which is exactly the bidding page.
+ */
+function bidTaskUrl(gigId, taskId, inviteUrl) {
+    let token = "";
+    try {
+        token = new URL(inviteUrl).searchParams.get("invite") ?? "";
+    }
+    catch {
+        token = "";
+    }
+    const base = `https://dollarplatoon.com/${token ? "claim" : "task"}`
+        + `/${encodeURIComponent(gigId)}/${encodeURIComponent(taskId)}`;
+    return token ? `${base}?invite=${encodeURIComponent(token)}` : base;
+}
+async function cmdRequestBids(auth, values) {
+    const task = values.task?.trim();
+    if (!task)
+        throw new Error('gigs request-bids needs --task "<what you want made>".');
+    const gigId = await resolveGigId(auth, values.machine, "custom_requests");
+    const gig = await dp(auth, `/gigs/${encodeURIComponent(gigId)}`);
+    const webhook = gig.gig?.webhook ?? gig.webhook ?? "";
+    if (!webhook)
+        throw new Error("That machine has no publisher webhook — open it on dollarplatoon.com.");
+    // --sealed => each clipper reads only their own thread (no undercutting).
+    // Default is open: bidders see each other, which is fine because discovery
+    // runs UPWARD from the opening bid, unlike a procurement reverse auction.
+    const policy = values.sealed ? "private" : "public";
+    const url = new URL(webhook);
+    url.searchParams.set("availability", "view_only");
+    url.searchParams.set("price", "tbd");
+    url.searchParams.set("tags", String(values.tags ?? "vidfarm,bid"));
+    const published = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            task,
+            ...(values.url ? { url: String(values.url) } : {}),
+            ...(values.reference ? { reference_title: String(values.reference) } : {}),
+            starting_bid: String(values.opening ?? "$0.10"),
+            bidding: policy === "public" ? "open — reply with your price" : "sealed — your reply is private"
+        })
+    });
+    const publishText = await published.text();
+    let publishBody = {};
+    try {
+        publishBody = publishText ? JSON.parse(publishText) : {};
+    }
+    catch {
+        publishBody = {};
+    }
+    if (!published.ok)
+        throw new Error(`request-bids failed: ${publishBody?.error ?? `HTTP ${published.status}`}`);
+    // ONE task answers `message_id` (a string); only a batch answers `message_ids`.
+    const taskId = publishBody.message_id ?? publishBody.message_ids?.[0] ?? "";
+    if (!taskId)
+        throw new Error("Dollar Platoon accepted the task but returned no task id.");
+    await dp(auth, `/gigs/${encodeURIComponent(gigId)}/tasks/${encodeURIComponent(taskId)}/comments-policy`, {
+        method: "PATCH",
+        body: { policy }
+    });
+    const shareUrl = bidTaskUrl(gigId, taskId, await resolveInviteUrl(auth, gigId).catch(() => ""));
+    if (values.bell) {
+        await dp(auth, `/feeds/${VIDFARM_FEED_ID}/notifications`, {
+            method: "POST",
+            body: {
+                title: `Video wanted: ${task.slice(0, 120)}`,
+                subtext: `Bidding is ${policy === "public" ? "open" : "sealed"}. Opening bid ${values.opening ?? "$0.10"}.`,
+                destination_url: shareUrl,
+                tags: ["vidfarm", "video", "bid"]
+            }
+        }).catch((error) => {
+            console.log(`${YELLOW}!${RESET} Task posted, but the bell did not ring: ${error instanceof Error ? error.message : error}`);
+        });
+    }
+    out(Boolean(values.json), { gig_id: gigId, task_id: taskId, share_url: shareUrl, comments_policy: policy }, () => {
+        console.log(`${GREEN}✓${RESET} Bid request posted — ${BOLD}nobody can claim it${RESET}, they bid in the comments.`);
+        console.log(`  ${BOLD}${taskId}${RESET}  ${DIM}${policy === "public" ? "open bidding" : "sealed bids"} · price TBD${RESET}`);
+        console.log(`  ${BOLD}Share this:${RESET} ${shareUrl}`);
+        console.log(`  ${DIM}That link carries a gig invite — a clipper who never joined can join AND bid on that one page.${RESET}`);
+        if (!values.bell)
+            console.log(`  ${DIM}Nobody was notified. Add --bell to broadcast it to the vidfarm feed.${RESET}`);
+        console.log(`  ${DIM}Next: vidfarm gigs bids ${taskId}${RESET}`);
+    });
+}
+async function cmdBids(auth, values, positionals) {
+    const taskId = positionals[0];
+    if (!taskId)
+        throw new Error("gigs bids needs a task id: vidfarm gigs bids TASK_01H…");
+    const gigId = await resolveGigId(auth, values.machine, "custom_requests");
+    const body = await dp(auth, `/gigs/${encodeURIComponent(gigId)}/tasks/${encodeURIComponent(taskId)}/comments`);
+    const comments = body.comments ?? body.items ?? [];
+    // Root comments are the bids; replies underneath are the negotiation.
+    const bids = comments.filter((c) => !c.parent_id);
+    out(Boolean(values.json), { gig_id: gigId, task_id: taskId, bids }, () => {
+        if (!bids.length) {
+            console.log(`${DIM}No bids yet on ${taskId}.${RESET}`);
+            console.log(`  ${DIM}Nobody may know it exists — vidfarm gigs request-bids … --bell, or send them the share link.${RESET}`);
+            return;
+        }
+        for (const bid of bids) {
+            // author_mailbox_id comes back ONLY to the gig owner, and only on a
+            // WORKER's comment — it is what `gigs award` reserves the task for.
+            const who = bid.author_name ?? "gigworker";
+            console.log(`  ${BOLD}${bid.id}${RESET}  ${DIM}${who}${bid.author_mailbox_id ? "" : "  (no mailbox — cannot be awarded)"}${RESET}`);
+            console.log(`      ${short(String(bid.body ?? ""), 110)}`);
+        }
+        console.log("");
+        console.log(`${DIM}Award one: vidfarm gigs award ${taskId} --bid <comment-id>${RESET}`);
+    });
+}
+async function cmdAward(auth, values, positionals) {
+    const taskId = positionals[0];
+    const bidId = values.bid?.trim();
+    if (!taskId)
+        throw new Error("gigs award needs a task id: vidfarm gigs award TASK_01H… --bid TCOMMENT_01H…");
+    if (!bidId)
+        throw new Error('gigs award needs --bid <comment-id>. See them with: vidfarm gigs bids <task-id>');
+    const gigId = await resolveGigId(auth, values.machine, "custom_requests");
+    const body = await dp(auth, `/gigs/${encodeURIComponent(gigId)}/tasks/${encodeURIComponent(taskId)}/comments`);
+    const comments = body.comments ?? body.items ?? [];
+    const winner = comments.find((c) => c.id === bidId);
+    if (!winner)
+        throw new Error(`No bid ${bidId} on ${taskId}. List them: vidfarm gigs bids ${taskId}`);
+    const mailbox = winner.author_mailbox_id ?? "";
+    if (!mailbox) {
+        throw new Error("Dollar Platoon did not identify that bidder. Only the gig OWNER sees a commenter's mailbox — check you are using the buyer's key, not a gigworker key.");
+    }
+    // The SAME task flips from view_only to reserved. No new task, so the winner
+    // reads the whole negotiation on the record they are about to work.
+    await dp(auth, `/gigs/${encodeURIComponent(gigId)}/tasks/${encodeURIComponent(taskId)}/availability`, {
+        method: "PATCH",
+        body: { availability: "reserved", reserved_for: mailbox }
+    });
+    const shareUrl = bidTaskUrl(gigId, taskId, await resolveInviteUrl(auth, gigId).catch(() => ""));
+    // A private reply has exactly two readers — its author and the person it
+    // answers — so the losing bidders never see the agreed terms.
+    await dp(auth, `/gigs/${encodeURIComponent(gigId)}/tasks/${encodeURIComponent(taskId)}/comments`, {
+        method: "POST",
+        body: {
+            body: values.message?.trim()
+                || `You won this one. It is reserved for you — accept it here: ${shareUrl}`,
+            parent_id: bidId,
+            private: true
+        }
+    });
+    out(Boolean(values.json), { gig_id: gigId, task_id: taskId, reserved_for: mailbox, share_url: shareUrl }, () => {
+        console.log(`${GREEN}✓${RESET} ${BOLD}${taskId}${RESET} reserved for ${BOLD}${winner.author_name ?? mailbox}${RESET}.`);
+        console.log(`  ${DIM}They were told privately. The other bidders saw nothing.${RESET}`);
+        console.log(`  ${DIM}${shareUrl}${RESET}`);
+        console.log("");
+        console.log(`${YELLOW}The task is still priced TBD${RESET}${DIM} — name the agreed amount when you approve their proof:${RESET}`);
+        console.log(`  ${DIM}vidfarm gigs approve <proof-id> --amount 8.00${RESET}`);
+        console.log(`  ${DIM}Approve without --amount and it silently pays the machine's base rate, not what you agreed.${RESET}`);
+    });
+}
 async function cmdProofs(auth, values, positional) {
     const gigId = await resolveGigId(auth, positional, "inbound_offers");
     const body = await dp(auth, `/gigs/${encodeURIComponent(gigId)}/proofs`, {
@@ -617,10 +804,34 @@ async function cmdReview(auth, values, positionals, action) {
         body.feedback = String(values.feedback);
     if (action === "reject")
         body.rejection_tag = values.tag ? String(values.tag) : "not_selected";
+    // --amount names the price at APPROVAL. This is the only moment a TBD task
+    // gets its real number, and a bid task is TBD by design: the deal was agreed
+    // in plain text in the comment thread, not on the record. Dollar Platoon
+    // accepts an amount only while `locked_price` is null (a TBD proof, or one
+    // carrying the worker's own asking_price) — anything else answers 409, since
+    // a price a worker already agreed to can never be lowered at review.
+    //
+    // "TBD is not $0": approving a TBD proof with NO amount silently falls back
+    // to the gig's base rate, so an $8 bid pays $0.25 and the price locks on the
+    // spot with no way back. Warn loudly rather than let that pass unnoticed.
+    let amount = null;
+    if (action === "approve" && values.amount !== undefined && String(values.amount).trim() !== "") {
+        const parsed = Number(String(values.amount).trim().replace(/^\$/, ""));
+        if (!Number.isFinite(parsed) || parsed < 0) {
+            throw new Error(`--amount must be a positive number of dollars, got "${values.amount}".`);
+        }
+        amount = Math.round(parsed * 100) / 100;
+        body.amount = amount;
+    }
     const result = await dp(auth, `/gigs/${encodeURIComponent(gigId)}/proofs/${encodeURIComponent(proofId)}`, { method: "PATCH", body });
     out(Boolean(values.json), result, () => {
         if (action === "approve") {
-            console.log(`${GREEN}✓${RESET} Approved ${BOLD}${proofId}${RESET} — it pays out on the next rollup.`);
+            const locked = typeof result?.locked_price === "number" ? result.locked_price : null;
+            console.log(`${GREEN}✓${RESET} Approved ${BOLD}${proofId}${RESET}${locked != null ? ` at ${BOLD}$${locked.toFixed(2)}${RESET}` : ""} — it pays out on the next rollup.`);
+            if (amount == null && locked != null) {
+                console.log(`  ${DIM}No --amount given, so it locked at the machine's own price.${RESET}`);
+                console.log(`  ${YELLOW}If this came from a bid, that is NOT what you agreed${RESET}${DIM} — bid tasks are priced TBD and the number lives in the comment thread. Use --amount <usd>.${RESET}`);
+            }
         }
         else {
             console.log(`${GREEN}✓${RESET} Rejected ${BOLD}${proofId}${RESET} as ${BOLD}${body.rejection_tag}${RESET}.`);
@@ -1430,6 +1641,14 @@ function options() {
         tag: { type: "string" },
         title: { type: "string" },
         subtext: { type: "string" },
+        // Bid auction (request-bids / bids / award).
+        sealed: { type: "boolean" },
+        bell: { type: "boolean" },
+        opening: { type: "string" },
+        reference: { type: "string" },
+        bid: { type: "string" },
+        message: { type: "string" },
+        amount: { type: "string" },
         registry: { type: "boolean" },
         funded: { type: "boolean" },
         name: { type: "string" },
@@ -1471,6 +1690,11 @@ export async function runGigsCommand(argv) {
         case "queue": return cmdTasks(auth, values, rest[0]);
         case "add-task":
         case "task": return cmdAddTask(auth, values);
+        case "request-bids":
+        case "request":
+        case "invite-bids": return cmdRequestBids(auth, values);
+        case "bids": return cmdBids(auth, values, rest);
+        case "award": return cmdAward(auth, values, rest);
         case "proofs":
         case "submissions": return cmdProofs(auth, values, rest[0]);
         case "approve":

package/marketplace.md

@@ -374,6 +374,52 @@ vidfarm gigs ring-bell --title "Acme wants 7 short-form ads this week" \
 
 Add `--json` to any of them for a machine-readable answer. `--body <file.json>` sends a whole task payload you built elsewhere. `vidfarm gigs help` lists every flag.
 
+### Let clippers name the price — the bid auction
+
+`add-task` sets your price and the first free gigworker takes it. Sometimes you would rather ask the
+market what a job is worth — especially for a one-off that does not fit the machine's flat rate.
+
+A **bid request** is one task published `view_only`, so nobody can claim it. Clippers post their
+price in its comment thread, you award one, and that **same task** flips to `reserved` for them. One
+record carries the whole lifecycle, so the winner reads the entire negotiation on the job they are
+about to do.
+
+```bash
+vidfarm gigs request-bids --task "30s UGC recaption for a plumbing business" \
+  --opening '$0.10' --reference "template_019fd6b0…" --bell
+# → posts a view_only task at price TBD and prints a share link:
+#   https://dollarplatoon.com/claim/GIG_01N…/TASK_01M…?invite=<token>
+
+vidfarm gigs bids TASK_01M…                       # who bid, and what they asked
+vidfarm gigs award TASK_01M… --bid TCOMMENT_01M…  # reserve it for them, privately
+vidfarm gigs approve PRF_01H… --amount 8.00       # pay what you actually agreed
+```
+
+| Flag | |
+|---|---|
+| `--sealed` | Each clipper reads only their own thread. Default is open, so bidders see each other. |
+| `--bell` | Broadcast it to the vidfarm feed. **Off by default** — the task waits quietly in the queue. |
+| `--opening` | Where the auction starts. Default `$0.10`. |
+| `--reference` | A template id the bidders should match. |
+
+**The share link carries a gig invite, and that is the point.** DollarPlatoon's plain
+`/task/:gig/:id` page is members-only — a clipper who has never joined sees the gig's join link
+*instead of* your task, with no idea what they were invited to. The `/claim/…?invite=<token>` link
+this command prints turns "you have not joined" into "you are invited", and joining returns them to
+your task. A view-only task simply renders without the Accept button, so the page is the brief plus
+the comment thread: **they join and bid on one page.** Once you award it, that same URL grows the
+Accept button for the winner.
+
+⚠️ **A bid task stays priced `TBD` on purpose.** The deal is plain text in the thread, because real
+arrangements ("$5 now $5 on completion", "$12 for three") do not fit a single number. You name the
+agreed amount once, at approval, with `--amount`. **TBD is not $0** — approve a TBD proof without
+`--amount` and it silently pays the machine's base rate, so an $8 bid pays $0.25 and the price locks
+with no way back.
+
+The same flow exists over REST for a logged-in browser session:
+`POST /marketplace/buyer/request-template` (from a template in `/discover`),
+`GET /marketplace/buyer/bids/:gigId/:taskId`, and `POST /marketplace/buyer/award-bid`.
+
 **`add-task` has no flag for `format_harness` or `reference_template_id` — use `--body`.** Those two
 fields are the ones that decide what a weak-model clipper hands back, so do not drop them just
 because there is no flag:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@officexapp/vidfarm-devcli",
-  "version": "0.21.60",
+  "version": "0.21.62",
   "description": "Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.",
   "type": "module",
   "bin": {
@@ -107,6 +107,7 @@
     "operator:template-artifact": "node scripts/platform-operator-template-artifact.mjs",
     "bootstrap:staging-templates": "tsx scripts/bootstrap-staging-template-releases.ts",
     "migrate:sqlite-to-dynamodb": "tsx scripts/migrate-sqlite-to-dynamodb.ts",
+    "onboard": "node scripts/onboard-customer.mjs",
     "deploy:prod": "bash scripts/deploy-prod.sh",
     "deploy:staging": "bash scripts/deploy-staging.sh",
     "build": "npm run build:frontend && npm run build:hyperframes-editor && npm run build:serve-shells && node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
@@ -144,6 +145,8 @@
     "pack:devcli": "npm run build && node scripts/check-devcli-pack-safe.mjs && node scripts/build-devcli-package.mjs",
     "pack:devcli:fast": "node scripts/check-devcli-pack-safe.mjs && node scripts/build-devcli-package.mjs",
     "test:render-routing": "node --import tsx --test test/render-routing.test.ts",
+    "test:onboarding": "node --import tsx --test test/onboarding.test.ts",
+    "test:dp-invites": "node --import tsx --test test/dollarplatoon-invites.test.ts",
     "test:shared-folder": "node --import tsx --test test/shared-folder.test.ts"
   },
   "dependencies": {
@@ -174,6 +177,7 @@
     "ai": "^6.0.191",
     "dotenv": "^16.5.0",
     "esbuild": "^0.28.1",
+    "ethers": "^6.17.0",
     "ffmpeg-static": "^5.3.0",
     "fontkit": "^2.0.4",
     "hono": "^4.8.3",