@candledottv/cli 0.11.23 → 0.11.25

package/README.md

@@ -1,6 +1,6 @@
 # @candledottv/cli
 
-The Candle CLI (current version 0.11.23): authorize a device from your browser, keep your own keys
+The Candle CLI (current version 0.11.25): authorize a device from your browser, keep your own keys
 in an encrypted vault on this machine, hand an agent a TEE wallet it can trade, and manage API
 keys, wallets, and setup health from the terminal. Zero runtime dependencies; the whole thing is
 one self-contained `dist/index.js` that runs under plain Node.
@@ -122,7 +122,8 @@ emergency procedure, rebinding, trusted wallets and API key access levels are al
 | `candle swap <from> <to> --amount <n>\|--percent <n> --wallet <tee> [--to <tee>] [--wait]` | Quote, confirm and swap through the TEE wallet's bound key; the first buy after a launch is this command, unless `candle launch --buy` made it. The assets decide the chain (ETH, USDG or a 0x token is Hood; SOL, USDC, CNDL or a mint is Solana). SOL or USDC to ETH or USDG, or back, is a bridge through Relay into this key's own TEE wallet on the other chain (`--to` names it when there are several); `--wait` follows it for up to ten minutes. |
 | `candle swap status <id> [--kind trade\|swap\|launch] [--wait]` | Read an operation without resending it; `--wait` follows a bridge until it ends. |
 | `candle transfer --to <address\|wallet name\|vault> --asset <SOL\|USDC\|CNDL\|ETH\|USDG>\|--mint <mint>\|--token <0x...> --amount <decimal\|max> [--wallet <tee>] [--rpc-url <url>] [--yes]` | Move funds out of a TEE wallet through its bound Withdraw key, to the wallet's own pinned vault (`--to vault`, any token, `max` allowed, one SOL transfer at most the server's backstop ceiling, 50 SOL by default) or to another of the account's wallets you linked while signed in or marked trusted (a base asset, counted against the key's caps, which must include a per-asset cap and a USD `--tx-limit`). The asset decides the chain: ETH, USDG or `--token` moves from a Hood TEE wallet. The destination and its kind are shown before you confirm; Candle builds, the relay signs, Candle broadcasts. |
-| `candle launch --name <name> --symbol <symbol> --image-url <url> --wallet <tee> [--buy <amount>] [--quote-asset <asset>] [--dex-version v3\|v4]` | Create a token from a TEE wallet. Without `--buy` it makes no first buy. `--buy <amount>` adds one from the same wallet, in whole units of the quote asset, reserved against the key's spend window before signing: in the launch transaction on Solana, as a last leg on Hood. It needs the server's `TEE_LAUNCH_BUYS_ENABLED`, which is off by default; while it is off Candle refuses the buy and nothing is built. Needs `launch:write`, `allowLaunch` turned on for the wallet by the account owner, and the Pro or Max plan. On Free, launch from the embedded wallet instead, with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood): the MCP tool `candle_launch_and_seed` or the SDK's `launch()`. The wallet decides the chain: a Hood TEE wallet launches on Hood and needs `--dex-version`. `--quote-asset` is sol, usdc or cndl on Solana, eth or usdg on Hood. |
+| `candle launch --name <name> --symbol <symbol> --image <path>\|--image-url <url> --wallet <tee> [--buy <amount>] [--quote-asset <asset>] [--dex-version v3\|v4]` | Create a token from a TEE wallet. The image is `--image-url` (an `https://` URL) or `--image <path>` (a PNG, JPEG, GIF or WebP file on this machine, at most 10MB), never both; `--image` uploads the file before the confirm prompt, which makes it public and permanent, and launches with the URL that comes back. Without `--buy` it makes no first buy. `--buy <amount>` adds one from the same wallet, in whole units of the quote asset, reserved against the key's spend window before signing: in the launch transaction on Solana, as a last leg on Hood. It needs the server's `TEE_LAUNCH_BUYS_ENABLED`, which is off by default; while it is off Candle refuses the buy and nothing is built. Needs `launch:write`, `allowLaunch` turned on for the wallet by the account owner, and the Pro or Max plan. On Free, launch from the embedded wallet instead, with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood): the MCP tool `candle_launch_and_seed` or the SDK's `launch()`. The wallet decides the chain: a Hood TEE wallet launches on Hood and needs `--dex-version`. `--quote-asset` is sol, usdc or cndl on Solana, eth or usdg on Hood. |
+| `candle image upload <path>` | Uploads a PNG, JPEG, GIF or WebP file, at most 10MB, and prints the `https://` URL Candle hosts it at, ready to be a launch's `imageUrl`. The type is read from the file's first bytes. The file becomes public and permanent. Needs `launch:write`; spends nothing and does not count against the launch cap. `--json` adds the content type and the size. |
 | `candle pnl [--profile <name>]` | P&L: realized net, fees, unrealized and total, then open positions, the same figures the console shows. Without `--profile`, the account's books (every profile, the web app and the CLI, one ledger; needs the Read scope), with a By agent table (each key, then Manual, then the account total). With `--profile <name>`, that profile's key's share of the same P&L: realized on its sales and the open positions that belong to it, with a row per wallet that sums to the total. Each wallet is its own average-cost pool, and a recorded move between the account's wallets carries its cost. Both show a Solana block, a Hood block, then the combined figure, the closed positions as money made, minus money lost, plus partial sells, and a `CHAIN` column (and `WALLET`, where the API names it) on positions. Unpriced positions are never valued at zero; dust (worth under one cent) is marked and still counted. A bridge between Solana and Hood is not a trade, and bridge and Relay costs are not netted. DAMM v2 LP positions are included: realized (withdrawals against the cost basis at the add, plus claimed fees), unrealized (open positions at their share of the pool plus unclaimed fees, against that basis) and vs holding (what the deposited tokens would be worth held); `Total` stays the console's token figure and `Total with LP` covers tokens and LP. |
 | `candle portfolio [<filter>] [--chain solana\|hood] [--rpc-url <url>] [--evm-rpc-url <url>]` | Vault, TEE and embedded wallets on Solana and Hood in one table with chain, amount, price and value, subtotals per group and per chain, and a total. Solana vault and external balances are read over your own Solana RPC; Candle is sent only the mints, for prices. EVM vault keys are read over your own Hood RPC (`--evm-rpc-url`, else `CANDLE_EVM_RPC_URL`, else the built-in Hood RPC) for ETH and USDG only, priced by asset, never by address; an RPC on another chain is refused. An unpriced Hood token shows why (`no-market-row`, `stale-mark`, ...). `--chain` shows one chain. Each TEE wallet's DAMM v2 LP positions follow the tokens, valued by Candle at the same marks, and count in the total; one whose pool could not be read is shown as not read and the total says it is partial. |
 | `candle plans` | The plans the API serves (`GET /api/v1/agent/plans`): each plan's monthly price, agent trade fee, Hyperliquid perps builder fee, the limits a new key gets, and one row per capability (buying and selling tokens not launched on Candle, self-launch, atomic launch, linked wallets, perps, limit orders). Every number is the server's; the CLI bundles none. Needs no key and sends none. `--json` is the server's body. Your own plan is `candle doctor`'s Plan row. |
@@ -134,7 +135,7 @@ emergency procedure, rebinding, trusted wallets and API key access levels are al
 | `candle profile rename <old> <new>` | Renames a profile. |
 | `candle profile remove <name> --yes` | Deletes a profile and its stored credentials. |
 | `candle profile set <name> --rpc-url <url>\|--clear-rpc-url` | Sets or clears this profile's Solana RPC, used when `--rpc-url` and `CANDLE_SOLANA_RPC_URL` are not given. Only its host is ever shown. |
-| `candle mcp [--tools <a,b,c>] [--read-only] [--print-config]` | Runs the Candle MCP server (built into this binary) with this CLI's stored API key and API URL in its environment, so an MCP client config is just `{"mcpServers": {"candle": {"command": "/Users/you/.local/bin/candle", "args": ["mcp"]}}}` -- the absolute path, because GUI hosts launch servers with the app's environment and never see your PATH. Run `--print-config` to print that block filled in for this install. `--read-only` starts it with no key and only the six keyless read tools; `--tools` pins an explicit allowlist. The server is bundled into the binary, so the host needs nothing else installed. |
+| `candle mcp [--tools <a,b,c>] [--read-only] [--print-config]` | Runs the Candle MCP server (built into this binary) with this CLI's stored API key and API URL in its environment, so an MCP client config is just `{"mcpServers": {"candle": {"command": "/Users/you/.local/bin/candle", "args": ["mcp"]}}}` -- the absolute path, because GUI hosts launch servers with the app's environment and never see your PATH. Run `--print-config` to print that block filled in for this install. `--read-only` starts it with no key and only the six keyless read tools; `--tools` pins an explicit allowlist. The server is bundled into the binary, so the host needs nothing else installed. With `CANDLE_IMAGE_DIR` set to an absolute directory path in its environment, the two launch tools accept `imagePath` for an image file inside that directory; the upload is public and permanent, on a dry run too. |
 | `candle doctor` | Runs a full health check (runtime, backend, credentials, API reachability, credential validity, wallet delegation, the install method, the account's plan and its trade fee, and whether the `candle-fido2` security key helper is beside the binary) as a PASS/FAIL/SKIP table meant for pasting into a bug report. Exits nonzero on any FAIL. |
 | `candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]` | Verifies a release asset's Sigstore bundle against the trusted root compiled into this binary. No network, no credentials, and nothing else installed: the bundle carries the certificate and the transparency-log entry. `--identity` defaults to the release identity for the version in a `latest.json` sitting beside the bundle; `--issuer` defaults to GitHub Actions'. Prints `verified: <identity>` and exits 0, or the reason on stderr and exits 1. |
 | `candle update [--check] [--to <tag>]` | Replaces this binary, and the `candle-fido2` helper beside it, with the latest signed release. Nothing is renamed until both downloads pass; the binary is renamed over the running binary only after its SHA-256 matches both SHA256SUMS and `latest.json` AND its Sigstore bundle verifies in process against that exact version's release workflow. `--check` reports what is available and installs nothing; `--to <tag>` pins a release (an older one installs, with a warning). A Homebrew or npm install is left alone, with the command that owns it printed instead. |
@@ -412,10 +413,21 @@ candle swap SOL USDC --amount 0.1 --wallet trading --client-trade-id lunch-1
 candle swap <mint> SOL --percent 25 --wallet trading --rpc-url https://your-solana-rpc --yes --json
 candle launch --name Example --symbol EX --image-url https://example.com/token.png \
   --wallet trading --rpc-url https://your-solana-rpc --client-trade-id example-launch
+candle launch --name Example --symbol EX --image ./token.png --wallet trading
+candle image upload ./token.png
 candle swap status lunch-1
 candle swap status example-launch --kind launch --json
 ```
 
+`--image <path>` launches with an image file on this machine: the CLI checks it (a PNG, JPEG,
+GIF or WebP by its first bytes, at most 10MB) before any request, uploads it to Candle, and
+builds the launch with the URL that comes back. The upload happens once, before the confirm
+prompt and before the launch id is claimed, and it is a publication: the file is pinned to public
+storage and stays there, with whatever metadata it carries, even if you decline or the launch
+fails. A failed upload leaves the launch id unused, and re-running a started launch uploads
+nothing. `candle image upload <path>` does the upload alone and prints the URL, for a launch made
+somewhere else. `--image-url` takes only an `https://` URL.
+
 `candle lp` (Meteora DAMM v2) follows the same shape: the server builds and quotes, you confirm,
 the relay signs, and this machine broadcasts over `--rpc-url` before `/confirm` writes the ledger.
 The bound key needs the opt-in `lp:write` scope. An open

package/dist/index.js

@@ -98,7 +98,10 @@ function resolveApiUrl(configuredApiUrl, env = process.env) {
   return trimTrailingSlashes(resolved);
 }
 function buildHeaders(opts) {
-  const headers = { "content-type": "application/json", accept: "application/json" };
+  const headers = {
+    "content-type": opts.raw?.contentType ?? "application/json",
+    accept: "application/json"
+  };
   if (opts.auth === "device" && opts.credentials.deviceToken) {
     headers.authorization = `Bearer ${opts.credentials.deviceToken}`;
   } else if (opts.auth === "key" && opts.credentials.apiKey) {
@@ -156,7 +159,7 @@ async function apiRequest(path, opts) {
     return { ok: false, status: 0, code: "INSECURE_API_URL", message: insecure, raw: undefined };
   }
   const headers = buildHeaders(opts);
-  const body = opts.body === undefined ? undefined : JSON.stringify(opts.body);
+  const body = opts.raw ? opts.raw.bytes : opts.body === undefined ? undefined : JSON.stringify(opts.body);
   const doFetch = opts.fetch ?? fetch;
   let response;
   try {
@@ -61132,7 +61135,7 @@ var init_convert = __esm(() => {
 });
 
 // ../mcp/src/version.ts
-var SERVER_VERSION = "0.10.11";
+var SERVER_VERSION = "0.10.12";
 
 // ../mcp/src/update-notice.ts
 function newer(a, b) {
@@ -61167,6 +61170,213 @@ var init_update_notice = __esm(() => {
   PLAIN_VERSION = /^\d+\.\d+\.\d+$/;
 });
 
+// ../mcp/src/image.ts
+import { constants as constants5 } from "node:fs";
+import { lstat as lstat2, open as open5, realpath } from "node:fs/promises";
+import { dirname as dirname11, isAbsolute as isAbsolute2, relative, sep as sep2 } from "node:path";
+function configuredImageDir(env) {
+  return env.CANDLE_IMAGE_DIR?.trim() || undefined;
+}
+function sniffImageType2(bytes) {
+  const at = (offset, signature) => signature.every((byte, i) => bytes[offset + i] === byte);
+  if (at(0, [137, 80, 78, 71, 13, 10, 26, 10]))
+    return "image/png";
+  if (at(0, [255, 216, 255]))
+    return "image/jpeg";
+  if (at(0, [71, 73, 70, 56]) && (bytes[4] === 55 || bytes[4] === 57) && bytes[5] === 97)
+    return "image/gif";
+  if (at(0, [82, 73, 70, 70]) && at(8, [87, 69, 66, 80]))
+    return "image/webp";
+  return;
+}
+function isInside(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute2(rel);
+}
+function errno(error2) {
+  return error2?.code;
+}
+async function realImageDir(imageDir, fs) {
+  const invalid = () => new ImageRefusal("IMAGE_DIR_INVALID", `CANDLE_IMAGE_DIR must be an absolute path to an existing directory, and not the filesystem root. ${NOTHING_UPLOADED2}`);
+  if (!isAbsolute2(imageDir))
+    throw invalid();
+  try {
+    const real = await fs.realpath(imageDir);
+    if (dirname11(real) === real || !(await fs.lstat(real, { bigint: true })).isDirectory())
+      throw invalid();
+    return real;
+  } catch {
+    throw invalid();
+  }
+}
+async function missingInside(dirReal, path, fs) {
+  const absent = (error2) => errno(error2) === "ENOENT" || errno(error2) === "ENOTDIR";
+  for (let current = path;; ) {
+    try {
+      await fs.lstat(current, { bigint: true });
+      return false;
+    } catch (error2) {
+      if (!absent(error2))
+        return false;
+    }
+    const parent = dirname11(current);
+    if (parent === current)
+      return false;
+    try {
+      const real = await fs.realpath(parent);
+      return real === dirReal || isInside(dirReal, real);
+    } catch (error2) {
+      if (!absent(error2))
+        return false;
+      current = parent;
+    }
+  }
+}
+async function readImageInDir(imageDir, imagePath, fs = nodeFs) {
+  if (!isAbsolute2(imagePath))
+    throw new ImageRefusal("MCP_VALIDATION", `imagePath must be an absolute path inside CANDLE_IMAGE_DIR; this server's working directory is not something a caller can know. ${NOTHING_UPLOADED2}`);
+  const dirReal = await realImageDir(imageDir, fs);
+  const outside = () => new ImageRefusal("IMAGE_OUTSIDE_DIR", OUTSIDE_IMAGE_DIR);
+  const unreadable2 = (why) => new ImageRefusal("IMAGE_UNREADABLE", `Could not read the image at imagePath: ${why}. ${NOTHING_UPLOADED2}`);
+  const tooLarge = () => new ImageRefusal("IMAGE_TOO_LARGE", `The file at imagePath is over 10MB, the largest image Candle hosts. ${NOTHING_UPLOADED2}`);
+  let fileReal;
+  try {
+    fileReal = await fs.realpath(imagePath);
+  } catch {
+    throw await missingInside(dirReal, imagePath, fs) ? unreadable2("there is no file at that path") : outside();
+  }
+  if (!isInside(dirReal, fileReal))
+    throw outside();
+  let handle;
+  try {
+    handle = await fs.open(fileReal, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0) | (constants5.O_NONBLOCK ?? 0));
+  } catch (error2) {
+    throw errno(error2) === "ELOOP" ? outside() : unreadable2("it could not be opened");
+  }
+  let bytes;
+  try {
+    const opened = await handle.stat({ bigint: true });
+    let named;
+    try {
+      if (await fs.realpath(fileReal) !== fileReal || !isInside(await realImageDir(imageDir, fs), fileReal))
+        throw outside();
+      named = await fs.lstat(fileReal, { bigint: true });
+    } catch {
+      throw outside();
+    }
+    if (named.dev !== opened.dev || named.ino !== opened.ino)
+      throw outside();
+    if (!opened.isFile())
+      throw unreadable2("it is not a regular file");
+    const chunks = [];
+    let total = 0;
+    try {
+      while (total <= MAX_IMAGE_BYTES2) {
+        const want = Math.min(READ_CHUNK_BYTES, MAX_IMAGE_BYTES2 + 1 - total);
+        const chunk = new Uint8Array(want);
+        const { bytesRead } = await handle.read(chunk, 0, want, null);
+        if (bytesRead === 0)
+          break;
+        chunks.push(chunk.subarray(0, bytesRead));
+        total += bytesRead;
+      }
+    } catch {
+      throw unreadable2("the read failed");
+    }
+    if (total > MAX_IMAGE_BYTES2)
+      throw tooLarge();
+    bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+  } finally {
+    await handle.close().catch(() => {});
+  }
+  const contentType = sniffImageType2(bytes);
+  if (!contentType)
+    throw new ImageRefusal("IMAGE_TYPE_UNSUPPORTED", `The file at imagePath is not a PNG, JPEG, GIF or WebP image. The type is read from the file's first bytes, not its name. ${NOTHING_UPLOADED2}`);
+  return { bytes, contentType };
+}
+async function resolveLaunchImage(args, imageDir, cfg, doFetch, fs = nodeFs) {
+  const { imagePath, ...rest } = args;
+  const hasPath = typeof imagePath === "string" && imagePath.length > 0;
+  const hasUrl = typeof rest.imageUrl === "string" && rest.imageUrl.length > 0;
+  const invalid = (message) => ({ refused: { code: "MCP_VALIDATION", message } });
+  if (imageDir === undefined) {
+    if (imagePath !== undefined)
+      return invalid(`imagePath is not available on this server: no CANDLE_IMAGE_DIR is configured. Pass imageUrl, an https URL. ${NOTHING_UPLOADED2}`);
+    return { args: rest };
+  }
+  if (hasPath && hasUrl)
+    return invalid(`Pass exactly one of imageUrl or imagePath, not both. ${NOTHING_UPLOADED2}`);
+  if (!hasPath && !hasUrl)
+    return invalid("Pass imageUrl (an https URL) or imagePath (an absolute path to an image file inside CANDLE_IMAGE_DIR).");
+  if (!hasPath)
+    return { args: rest };
+  if (!cfg.apiKey)
+    return invalid(`CANDLE_AGENT_API_KEY is required to upload an image; the key needs the launch:write scope. ${NOTHING_UPLOADED2}`);
+  let image;
+  try {
+    image = await readImageInDir(imageDir, imagePath, fs);
+  } catch (error2) {
+    if (error2 instanceof ImageRefusal)
+      return { refused: { code: error2.code, message: error2.message } };
+    throw error2;
+  }
+  let res;
+  try {
+    res = await doFetch(`${cfg.apiUrl.replace(/\/$/, "")}/api/v1/uploads/agent-image`, {
+      method: "POST",
+      headers: { "Content-Type": image.contentType, "x-api-key": cfg.apiKey },
+      body: image.bytes
+    });
+  } catch (error2) {
+    return {
+      refused: {
+        code: "MCP_TRANSPORT",
+        message: `The image upload failed in transit (${error2 instanceof Error ? error2.message : String(error2)}). ` + "No launch was attempted. The upload may or may not have reached Candle; if it did, the file is public."
+      }
+    };
+  }
+  noteVersionHeaders(res);
+  const text = await res.text();
+  if (!res.ok)
+    return { uploadFailed: text };
+  let uploaded;
+  try {
+    uploaded = JSON.parse(text)?.imageUrl;
+  } catch {
+    uploaded = undefined;
+  }
+  if (typeof uploaded !== "string" || !uploaded.startsWith("https://"))
+    return {
+      refused: {
+        code: "MCP_TRANSPORT",
+        message: "Candle did not return an https URL for the uploaded image. No launch was attempted."
+      }
+    };
+  return { args: { ...rest, imageUrl: uploaded }, uploaded };
+}
+function imageRefusalBody(refused, extra) {
+  return JSON.stringify({ ...extra, success: false, error: { code: refused.code, message: refused.message } });
+}
+var MAX_IMAGE_BYTES2, OUTSIDE_IMAGE_DIR = "Image files must be inside the configured CANDLE_IMAGE_DIR.", NOTHING_UPLOADED2 = "Nothing was uploaded.", READ_CHUNK_BYTES, ImageRefusal, nodeFs, UPLOADED_IMAGE_NOTE = "imagePath was uploaded to imageUrl, which is public and permanent. To retry, or to launch after a dry run, pass this imageUrl instead of imagePath, so the file is not uploaded again.";
+var init_image = __esm(() => {
+  init_update_notice();
+  MAX_IMAGE_BYTES2 = 10 * 1024 * 1024;
+  READ_CHUNK_BYTES = 256 * 1024;
+  ImageRefusal = class ImageRefusal extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+    }
+  };
+  nodeFs = { realpath, lstat: lstat2, open: open5 };
+});
+
 // ../mcp/src/orchestrate.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 function requireApiKey(cfg) {
@@ -61416,10 +61626,10 @@ async function executeTrade(args, cfg, doFetch) {
   const wrapped = JSON.stringify({ clientTradeId, resolved, api: posted.body });
   return posted.ok ? { text: wrapped } : { text: wrapped, isError: true };
 }
-async function executeLaunchAndSeed(args, cfg, doFetch) {
+async function executeLaunchAndSeed(args, cfg, doFetch, imageDir, imageFs) {
   const apiKey = requireApiKey(cfg);
   const clientLaunchId = args.clientLaunchId ?? randomUUID6();
-  const { devBuy, dryRun, buyAmount: _rawBuyAmount, ...launchFields } = args;
+  const { devBuy, dryRun, buyAmount: _rawBuyAmount, ...imageFields } = args;
   let buyAmount;
   if (devBuy !== undefined) {
     const q = quoteIdDecimals(args.quoteAsset, args.chain, { clientLaunchId });
@@ -61430,19 +61640,34 @@ async function executeLaunchAndSeed(args, cfg, doFetch) {
       return converted.err;
     buyAmount = converted.raw;
   }
+  const image = await resolveLaunchImage(imageFields, imageDir, cfg, doFetch, imageFs);
+  if ("refused" in image)
+    return { text: imageRefusalBody(image.refused, { clientLaunchId }), isError: true };
+  if ("uploadFailed" in image) {
+    let api2;
+    try {
+      api2 = JSON.parse(image.uploadFailed);
+    } catch {
+      api2 = image.uploadFailed;
+    }
+    return { text: JSON.stringify({ clientLaunchId, api: api2 }), isError: true };
+  }
+  const uploaded = image.uploaded === undefined ? {} : { imageUrl: image.uploaded, imageNote: UPLOADED_IMAGE_NOTE };
   const path = dryRun ? "/api/v1/launch/headless/dry-run" : "/api/v1/launch/headless";
   const posted = await postJson(`${base(cfg)}${path}`, apiKey, {
-    ...launchFields,
+    ...image.args,
     clientLaunchId,
     ...buyAmount !== undefined ? { buyAmount } : {}
   }, doFetch);
-  if ("thrown" in posted)
-    return transportError("clientLaunchId", clientLaunchId, posted.thrown);
+  if ("thrown" in posted) {
+    const failed = transportError("clientLaunchId", clientLaunchId, posted.thrown);
+    return image.uploaded === undefined ? failed : { ...failed, text: JSON.stringify({ ...JSON.parse(failed.text), ...uploaded }) };
+  }
   if (!posted.ok) {
-    return { text: JSON.stringify({ clientLaunchId, api: posted.body }), isError: true };
+    return { text: JSON.stringify({ clientLaunchId, ...uploaded, api: posted.body }), isError: true };
   }
   if (dryRun) {
-    return { text: JSON.stringify({ clientLaunchId, dryRun: true, api: posted.body }) };
+    return { text: JSON.stringify({ clientLaunchId, dryRun: true, ...uploaded, api: posted.body }) };
   }
   const launch2 = posted.body;
   let market = null;
@@ -61463,7 +61688,7 @@ async function executeLaunchAndSeed(args, cfg, doFetch) {
     note = "launch confirmed; the follow-up market read failed, read it via candle_get_market";
   }
   return {
-    text: JSON.stringify({ clientLaunchId, launch: launch2, market, ...note ? { note } : {} })
+    text: JSON.stringify({ clientLaunchId, ...uploaded, launch: launch2, market, ...note ? { note } : {} })
   };
 }
 async function executeSweep(args, cfg, doFetch) {
@@ -61554,7 +61779,7 @@ async function executionStatus(cfg, doFetch) {
     get("/api/v1/agent/tier"),
     get("/api/v1/agent/keys/self/limits")
   ]);
-  const unreadable = [
+  const unreadable2 = [
     ["wallets", wallets2],
     ["tier", tier],
     ["limits", limits]
@@ -61563,20 +61788,21 @@ async function executionStatus(cfg, doFetch) {
   return {
     text: JSON.stringify({
       success: true,
-      ready: unreadable.length === 0 ? true : undefined,
+      ready: unreadable2.length === 0 ? true : undefined,
       notice: tierBody?.maxExpired ? tierBody.maxExpiredNotice : undefined,
       updateAvailable: updateAvailable() ?? undefined,
-      unreadable: unreadable.length > 0 ? unreadable.map(([name2]) => name2) : undefined,
+      unreadable: unreadable2.length > 0 ? unreadable2.map(([name2]) => name2) : undefined,
       wallets: wallets2.body,
       tier: tier.body,
       limits: limits.body
     }, null, 2),
-    ...unreadable.length > 0 ? { isError: true } : {}
+    ...unreadable2.length > 0 ? { isError: true } : {}
   };
 }
 var SWEEP_BASE_ASSETS;
 var init_orchestrate = __esm(() => {
   init_convert();
+  init_image();
   init_update_notice();
   SWEEP_BASE_ASSETS = {
     solana: ["USDC", "CNDL", "SOL"],
@@ -62691,11 +62917,24 @@ function registerToolSubset(server, options) {
       return;
     server.registerTool(name2, { ...definition, ...options.metadata?.[name2] }, handler);
   };
+  const imageDir = configuredImageDir(env);
   register("candle_launch_token", {
     title: "Launch a token on Candle",
-    description: "Launch a new token via the Candle headless launch API, from the account's embedded wallet. Works on every plan, Free included. Set dryRun: true to validate without spending anything.",
-    inputSchema: launchTokenShape
-  }, async (args) => callAndRelay("candle_launch_token", args, getConfig(), doFetch));
+    description: "Launch a new token via the Candle headless launch API, from the account's embedded wallet. Works on every plan, Free included. Set dryRun: true to validate without spending anything." + (imageDir ? IMAGE_PATH_DISCLOSURE : ""),
+    inputSchema: imageDir ? localLaunchTokenShape : launchTokenShape
+  }, async (args) => {
+    const image = await resolveLaunchImage(args, imageDir, getConfig(), doFetch);
+    if ("refused" in image) {
+      return { content: [{ type: "text", text: imageRefusalBody(image.refused) }], isError: true };
+    }
+    if ("uploadFailed" in image)
+      return { content: [{ type: "text", text: image.uploadFailed }], isError: true };
+    const relayed = await callAndRelay("candle_launch_token", image.args, getConfig(), doFetch);
+    if (image.uploaded === undefined)
+      return relayed;
+    const uploaded = JSON.stringify({ imageUrl: image.uploaded, note: UPLOADED_IMAGE_NOTE });
+    return { ...relayed, content: [...relayed.content, { type: "text", text: uploaded }] };
+  });
   register("candle_get_market", {
     title: "Get market state",
     description: "Read Candle and indexed external markets, including indexed-but-not-routable tokens. No key needed. " + EXTERNAL_MARKET_DISCLOSURE + " " + "Read candleLaunched, launchpad, venue and trade.routable; jupiterOk and discovery flags are distinct. " + "Routability is stored eligibility, not a quote or permission. General quotes use POST /api/v1/trade/agent/quote. " + "Curve quotes and lifecycle describe Candle launches. MARKET_NOT_FOUND is a legacy code: read " + "error.routing.reason, error.discovery and sibling error.retryable. A curve-only 404 does not mean untradeable.",
@@ -62869,10 +63108,10 @@ MARKET_NOT_FOUND means Candle has no market for that token and this could not ru
   });
   register("candle_launch_and_seed", {
     title: "Launch a token and seed it",
-    description: "Launch a new token from the account's embedded wallet, with an optional dev-buy seed (in the " + "launch transaction on solana, a best-effort follow-up on hood). Works on every plan, Free included (this is not the atomic launch). Then " + "return the fresh market state and token links in one result. MOVES REAL FUNDS unless " + "dryRun. Seeds above the platform dev-buy ceiling are rejected (DEV_BUY_TOO_HIGH); " + "launch, then top up with candle_trade.",
-    inputSchema: launchAndSeedShape
+    description: "Launch a new token from the account's embedded wallet, with an optional dev-buy seed (in the " + "launch transaction on solana, a best-effort follow-up on hood). Works on every plan, Free included (this is not the atomic launch). Then " + "return the fresh market state and token links in one result. MOVES REAL FUNDS unless " + "dryRun. Seeds above the platform dev-buy ceiling are rejected (DEV_BUY_TOO_HIGH); " + "launch, then top up with candle_trade." + (imageDir ? IMAGE_PATH_DISCLOSURE : ""),
+    inputSchema: imageDir ? localLaunchAndSeedShape : launchAndSeedShape
   }, async (args) => {
-    const result = await executeLaunchAndSeed(args, getConfig(), doFetch);
+    const result = await executeLaunchAndSeed(args, getConfig(), doFetch, imageDir);
     return { content: [{ type: "text", text: result.text }], ...result.isError ? { isError: true } : {} };
   });
   const perpsTool = (tool) => async (args) => {
@@ -62924,10 +63163,11 @@ MARKET_NOT_FOUND means Candle has no market for that token and this could not ru
     return { content: [{ type: "text", text: result.text }], ...result.isError ? { isError: true } : {} };
   });
 }
-var TOOL_NAMES, launchTokenShape, getMarketShape, tokenForensicsShape, FEED_LIMIT_MESSAGE = "limit must be a whole number from 1 to 200", feedLimit, getFeedShape, reportActivityShape, getAgentProfileShape, getOperationShape, getFeesShape, claimFeesShape, resolveTokenShape, profileWalletsShape, profilePnlShape, profileTradesShape, setProfileWalletsShape, swapShape, tradeShape, _rawBuyAmount, seedableLaunchShape, launchAndSeedShape, transferShape, sweepShape;
+var TOOL_NAMES, launchTokenShape, getMarketShape, tokenForensicsShape, FEED_LIMIT_MESSAGE = "limit must be a whole number from 1 to 200", feedLimit, getFeedShape, reportActivityShape, getAgentProfileShape, getOperationShape, getFeesShape, claimFeesShape, resolveTokenShape, profileWalletsShape, profilePnlShape, profileTradesShape, setProfileWalletsShape, swapShape, tradeShape, _rawBuyAmount, seedableLaunchShape, seedShape, launchAndSeedShape, localImageShape, localLaunchTokenShape, localLaunchAndSeedShape, IMAGE_PATH_DISCLOSURE, transferShape, sweepShape;
 var init_tools = __esm(() => {
   init_zod();
   init_convert();
+  init_image();
   init_market_disclosure();
   init_orchestrate();
   init_perps();
@@ -63062,11 +63302,18 @@ var init_tools = __esm(() => {
     paper: exports_external.preprocess((value) => value === "true" || value === 1 || value === "1" ? true : value === "false" || value === 0 || value === "0" ? false : value, exports_external.boolean().optional().describe("Rehearse instead of trading. The request passes every admission rule a live trade passes " + "-- the same planner, spend gate, key cap and loss limits -- and records the quote, but " + "nothing is ever broadcast and no funds move. Use it to check that a strategy is admitted " + "before risking anything on it. A paper fill is optimistic by construction: it books the " + "quoted price, so the gap between a paper arm and a live one IS the execution cost. " + "A sell of a mint this key already paper-bought also closes that paper book when the " + "live wallet is empty, even if this flag is omitted."))
   };
   ({ buyAmount: _rawBuyAmount, ...seedableLaunchShape } = launchTokenShape);
-  launchAndSeedShape = {
-    ...seedableLaunchShape,
+  seedShape = {
     clientLaunchId: exports_external.string().optional().describe("Idempotency key. Auto-generated when omitted and echoed in the result."),
     devBuy: exports_external.string().optional().describe('Seed buy in DECIMAL units of the quote asset this launch selects (e.g. "0.25" SOL, or ' + "ETH on hood), bundled into the launch transaction itself on solana and sent as a follow-up " + "transaction on hood. Paid from the account's embedded wallet. Follows quoteAsset, which " + "defaults to sol on solana and eth on hood. Capped by the platform dev-buy ceiling; for " + "a larger seed, launch then follow with candle_trade.")
   };
+  launchAndSeedShape = { ...seedableLaunchShape, ...seedShape };
+  localImageShape = {
+    imageUrl: launchTokenShape.imageUrl.optional().describe(`${launchTokenShape.imageUrl.description}. Pass this or imagePath, never both`),
+    imagePath: exports_external.string().optional().describe("An absolute image path inside CANDLE_IMAGE_DIR. The file is uploaded and becomes public and permanent, " + "including on a dry run. PNG, JPEG, GIF or WebP, at most 10MB, read from the file's first bytes. " + "Uploading spends no funds and does not count against the launch cap; only the upload limit applies. " + "Pass this or imageUrl, never both. The result carries the imageUrl used: pass that on a retry, or " + "after a dry run, instead of uploading the file again. bannerUrl takes no file")
+  };
+  localLaunchTokenShape = { ...launchTokenShape, ...localImageShape };
+  localLaunchAndSeedShape = { ...seedableLaunchShape, ...localImageShape, ...seedShape };
+  IMAGE_PATH_DISCLOSURE = " With imagePath, the image file is uploaded first and becomes public and permanent, on a dry run too; " + "nothing about a dry run keeps that file private.";
   transferShape = {
     chain: exports_external.enum(["solana", "hood"]).describe("Which chain the transfer executes on"),
     asset: exports_external.enum(["SOL", "USDC", "CNDL", "ETH", "USDG"]).optional().describe("A base asset key. Pass exactly one of asset or mint."),
@@ -63159,7 +63406,7 @@ Full reference, error catalogue and end-to-end recipes: https://docs.candle.tv
 // src/index.ts
 import { spawn as spawn3 } from "node:child_process";
 import { realpathSync } from "node:fs";
-import { chmod as chmod8, readFile as readFile10, realpath, rename as rename6, unlink, writeFile as writeFile7 } from "node:fs/promises";
+import { chmod as chmod8, readFile as readFile10, realpath as realpath2, rename as rename6, unlink, writeFile as writeFile7 } from "node:fs/promises";
 import { homedir as homedir6, hostname } from "node:os";
 import { pathToFileURL } from "node:url";
 
@@ -63208,7 +63455,7 @@ init_render();
 init_secret_store();
 
 // src/version.ts
-var CLI_VERSION = "0.11.23";
+var CLI_VERSION = "0.11.25";
 
 // src/commands/auth.ts
 init_keys_embedded_wallet();
@@ -63879,15 +64126,19 @@ var HELP = {
   launch: {
     group: "Trade",
     summary: "Create a token on Solana or Hood, with an optional first buy",
-    description: "Creates a token from a TEE wallet. Without --buy it makes no first buy, so the launch and the position are two decisions, and the buy is a separate candle swap. --buy <amount> adds a first buy from the same wallet, in whole units of the quote asset (SOL, USDC or CNDL on Solana, ETH on Hood; not USDG), within the dev-buy ceilings: on Solana it rides in the launch transaction, and on Hood it is a last leg after the curve and the fee. Candle reserves the buy against the key's spend window before anything is signed. --buy needs a server with TEE_LAUNCH_BUYS_ENABLED on, which is off by default; while it is off Candle refuses the buy and nothing is built. Needs the launch:write scope and allowLaunch on the wallet, which only the account owner can turn on (candle wallets allow-launch <wallet>, over the device token; an agent key cannot). The wallet decides the chain: a Hood TEE wallet launches on Hood, needs --dex-version, and signs one leg at a time (the curve, then the fee, then the buy with --buy), each only after the one before it landed. Launching from a TEE wallet needs Pro or Max (TIER_REQUIRED otherwise; candle plans). Every plan, Free included, can launch from its embedded wallet with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood), through the MCP tool candle_launch_and_seed or the SDK's launch(); this command does not use that path.",
+    description: "Creates a token from a TEE wallet. Without --buy it makes no first buy, so the launch and the position are two decisions, and the buy is a separate candle swap. --buy <amount> adds a first buy from the same wallet, in whole units of the quote asset (SOL, USDC or CNDL on Solana, ETH on Hood; not USDG), within the dev-buy ceilings: on Solana it rides in the launch transaction, and on Hood it is a last leg after the curve and the fee. Candle reserves the buy against the key's spend window before anything is signed. --buy needs a server with TEE_LAUNCH_BUYS_ENABLED on, which is off by default; while it is off Candle refuses the buy and nothing is built. Needs the launch:write scope and allowLaunch on the wallet, which only the account owner can turn on (candle wallets allow-launch <wallet>, over the device token; an agent key cannot). The wallet decides the chain: a Hood TEE wallet launches on Hood, needs --dex-version, and signs one leg at a time (the curve, then the fee, then the buy with --buy), each only after the one before it landed. Launching from a TEE wallet needs Pro or Max (TIER_REQUIRED otherwise; candle plans). Every plan, Free included, can launch from its embedded wallet with an optional dev buy (same transaction on Solana; best-effort follow-up on Hood), through the MCP tool candle_launch_and_seed or the SDK's launch(); this command does not use that path. The image is one of two flags, never both: --image-url <https-url> for one already hosted, or --image <path> for a PNG, JPEG, GIF or WebP file on this machine, at most 10MB. With --image the file is uploaded to Candle first and the launch is made with the URL that comes back, which --json reports as imageUrl. The upload happens before the confirm prompt and cannot be undone: the file becomes public and permanent even if you then decline or the launch fails. Re-running with the same --client-trade-id resumes the launch without uploading again. --image-url takes only an https:// URL.",
     usage: [
-      "candle launch --name <name> --symbol <symbol> --image-url <url> --wallet <tee> [--buy <amount>] [--quote-asset <asset>] [--dex-version v3|v4]"
+      "candle launch --name <name> --symbol <symbol> --image <path>|--image-url <url> --wallet <tee> [--buy <amount>] [--quote-asset <asset>] [--dex-version v3|v4]"
     ],
     rows: [],
     flags: [
       { invocation: "--name <name>", description: "The token's name" },
       { invocation: "--symbol <symbol>", description: "The token's ticker" },
-      { invocation: "--image-url <url>", description: "The token image, already hosted" },
+      {
+        invocation: "--image <path>",
+        description: "The token image as a file on this machine (PNG, JPEG, GIF or WebP, at most 10MB). Uploaded before the confirm prompt; it becomes public and permanent"
+      },
+      { invocation: "--image-url <url>", description: "The token image, already hosted at an https:// URL" },
       { invocation: "--wallet <tee>", description: "The TEE wallet that creates it" },
       {
         invocation: "--buy <amount>",
@@ -63900,12 +64151,27 @@ var HELP = {
       }
     ],
     examples: [
+      "candle launch --name Demo --symbol DEMO --image ./logo.png --wallet AgentOne",
       "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet AgentOne",
       "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet HoodAgent --dex-version v4",
       "candle launch --name Demo --symbol DEMO --image-url https://example.com/d.png --wallet AgentOne --buy 0.1"
     ],
     env: ENV_API
   },
+  image: {
+    group: "Trade",
+    summary: "Host an image file from this machine and print its https URL",
+    description: "Uploads a PNG, JPEG, GIF or WebP file, at most 10MB, to Candle and prints the https URL it is hosted at, ready to be a launch's image. The type is read from the file's first bytes, not its name, and a file that is none of the four or is too large is refused before any request. The upload is a publication: Candle pins the file to public storage, the URL cannot be withdrawn, and whatever the file carries (metadata included) goes with it, so upload only an image meant to be public. It spends no funds and does not count against the daily launch cap; the key's uploads-per-minute limit applies. Needs an API key with the launch:write scope. candle launch --image <path> does this upload itself; use this command for the link alone, or to launch through the hosted connector, which cannot read a file on your machine. Candle crops the image to a square, so this hosts a token image and not a banner.",
+    usage: ["candle image upload <path> [--json]"],
+    rows: [
+      {
+        invocation: "upload <path>",
+        description: "Upload the file and print its URL; --json adds the content type and the size in bytes"
+      }
+    ],
+    examples: ["candle image upload ./logo.png", "candle image upload /Users/me/art/logo.webp --json"],
+    env: ENV_API
+  },
   portfolio: {
     group: "Account",
     summary: "Every wallet's holdings, prices and value on Solana and Hood (vault read over your own RPCs)",
@@ -69950,6 +70216,121 @@ async function help(args, ctx) {
   return 0;
 }
 
+// src/commands/image.ts
+init_args();
+init_deps();
+init_render();
+init_trading();
+init_swap();
+import { open as open4 } from "node:fs/promises";
+var UPLOAD_USAGE = "Usage: candle image upload <path> [--json]";
+var MAX_IMAGE_BYTES = 10 * 1024 * 1024;
+var IMAGE_TYPES = "PNG, JPEG, GIF or WebP";
+var NOTHING_UPLOADED = "Nothing was uploaded.";
+function sniffImageType(bytes) {
+  const at = (offset, signature) => signature.every((byte, i) => bytes[offset + i] === byte);
+  if (at(0, [137, 80, 78, 71, 13, 10, 26, 10]))
+    return "image/png";
+  if (at(0, [255, 216, 255]))
+    return "image/jpeg";
+  if (at(0, [71, 73, 70, 56]) && (bytes[4] === 55 || bytes[4] === 57) && bytes[5] === 97)
+    return "image/gif";
+  if (at(0, [82, 73, 70, 70]) && at(8, [87, 69, 66, 80]))
+    return "image/webp";
+  return;
+}
+function unreadable(path, error) {
+  const code = error.code;
+  const why = code === "ENOENT" || code === "ENOTDIR" ? "there is no file at that path" : code === "EACCES" || code === "EPERM" ? "this user may not read it" : code === "EISDIR" ? "it is not a file" : `the read failed${code ? ` (${code})` : ""}`;
+  return new TradingError("IMAGE_UNREADABLE", `Could not read ${safeText(path)}: ${why}. ${NOTHING_UPLOADED}`);
+}
+async function readLocalImage(path) {
+  const tooLarge = () => new TradingError("IMAGE_TOO_LARGE", `${safeText(path)} is over 10MB, the largest image Candle hosts. ${NOTHING_UPLOADED}`);
+  let bytes;
+  try {
+    const file = await open4(path, "r");
+    try {
+      const stat4 = await file.stat();
+      if (!stat4.isFile())
+        throw Object.assign(new Error("not a regular file"), { code: "EISDIR" });
+      if (stat4.size > MAX_IMAGE_BYTES)
+        throw tooLarge();
+      const buffer = new Uint8Array(MAX_IMAGE_BYTES + 1);
+      let total = 0;
+      while (total < buffer.length) {
+        const { bytesRead } = await file.read(buffer, total, buffer.length - total, null);
+        if (bytesRead === 0)
+          break;
+        total += bytesRead;
+      }
+      bytes = buffer.slice(0, total);
+    } finally {
+      await file.close();
+    }
+  } catch (error) {
+    throw error instanceof TradingError ? error : unreadable(path, error);
+  }
+  if (bytes.length > MAX_IMAGE_BYTES)
+    throw tooLarge();
+  const contentType = sniffImageType(bytes);
+  if (!contentType)
+    throw new TradingError("IMAGE_TYPE_UNSUPPORTED", `${safeText(path)} is not a ${IMAGE_TYPES} image. The type is read from the file's first bytes, not its name. ${NOTHING_UPLOADED}`);
+  return { path, bytes, contentType };
+}
+function uploadNotice(image) {
+  return `Uploading ${safeText(image.path)} (${image.contentType}, ${image.bytes.length} bytes). The file becomes public and permanent: Candle pins it, and the URL cannot be withdrawn.
+`;
+}
+async function uploadImage(ctx, key, image) {
+  const result = await apiRequest("/api/v1/uploads/agent-image", {
+    apiUrl: ctx.apiUrl,
+    credentials: { apiKey: key },
+    auth: "key",
+    method: "POST",
+    raw: { bytes: image.bytes, contentType: image.contentType },
+    fetch: ctx.deps.fetch,
+    env: ctx.deps.env
+  });
+  if (!result.ok)
+    throw new TradingError(result.code ?? "REQUEST_FAILED", result.message);
+  const imageUrl = result.body?.imageUrl;
+  if (typeof imageUrl !== "string" || !imageUrl.startsWith("https://"))
+    throw new TradingError("INVALID_RESPONSE", "Candle did not return an https URL for the uploaded image.");
+  return imageUrl;
+}
+async function imageUpload(args, ctx) {
+  const parsed = parseArgs(args, { pathPositionals: ["<path>"] });
+  if ("error" in parsed) {
+    writeUsageFailure(ctx.deps, parsed.error, ctx.json);
+    return 2;
+  }
+  const [path, ...rest] = parsed.positionals;
+  if (path === undefined || rest.length !== 0) {
+    writeUsageFailure(ctx.deps, UPLOAD_USAGE, ctx.json);
+    return 2;
+  }
+  try {
+    const image = await readLocalImage(path);
+    const key = await resolveApiKey(ctx.deps, ctx.profile);
+    if (!key) {
+      writeLocalFailure(ctx.deps, {
+        code: "NO_API_KEY",
+        message: `No API key available. ${NOTHING_UPLOADED}`,
+        suggestion: "Run: candle auth login, or set CANDLE_API_KEY. The key needs the launch:write scope."
+      }, ctx.json);
+      return 1;
+    }
+    ctx.deps.stderr.write(uploadNotice(image));
+    const imageUrl = safeText(await uploadImage(ctx, key, image));
+    ctx.deps.stdout.write(ctx.json ? `${JSON.stringify({ success: true, imageUrl, contentType: image.contentType, bytes: image.bytes.length })}
+` : `${imageUrl}
+`);
+    return 0;
+  } catch (error) {
+    return tradingFailure(ctx, error);
+  }
+}
+
 // src/index.ts
 init_keys();
 
@@ -70468,9 +70849,9 @@ init_render();
 init_solana_endpoint();
 init_solana_lite();
 init_trading();
-init_swap();
 import { randomUUID as randomUUID2 } from "node:crypto";
-var USAGE2 = "Usage: candle launch --name <name> --symbol <symbol> --image-url <https-url> --wallet <tee> [--buy <amount>] [--client-trade-id <id>] [--quote-asset sol|usdc|cndl|eth|usdg] [--dex-version v3|v4] [--mode <mode>] [--rpc-url <url>] [--yes]. A Hood TEE wallet launches on Hood and needs --dex-version.";
+init_swap();
+var USAGE2 = "Usage: candle launch --name <name> --symbol <symbol> --image <path>|--image-url <https-url> --wallet <tee> [--buy <amount>] [--client-trade-id <id>] [--quote-asset sol|usdc|cndl|eth|usdg] [--dex-version v3|v4] [--mode <mode>] [--rpc-url <url>] [--yes]. A Hood TEE wallet launches on Hood and needs --dex-version.";
 var QUOTE_CHAIN = {
   sol: "solana",
   usdc: "solana",
@@ -70529,6 +70910,7 @@ async function launch(args, ctx) {
     valueFlags: [
       "--name",
       "--symbol",
+      "--image",
       "--image-url",
       "--description",
       "--wallet",
@@ -70539,7 +70921,8 @@ async function launch(args, ctx) {
       "--dex-version",
       "--buy"
     ],
-    booleanFlags: ["--yes"]
+    booleanFlags: ["--yes"],
+    pathFlags: ["--image"]
   });
   if ("error" in parsed) {
     writeUsageFailure(ctx.deps, parsed.error, ctx.json);
@@ -70547,7 +70930,15 @@ async function launch(args, ctx) {
   }
   const flags = parsed.values;
   const id = flags["--client-trade-id"] ?? `launch-${randomUUID2()}`;
-  if (parsed.positionals.length || !flags["--name"] || !flags["--symbol"] || !flags["--image-url"] || !flags["--wallet"] || !validClientId(id) || flags["--dex-version"] !== undefined && flags["--dex-version"] !== "v3" && flags["--dex-version"] !== "v4") {
+  if (flags["--image"] !== undefined && flags["--image-url"] !== undefined) {
+    writeUsageFailure(ctx.deps, `Pass --image <path> or --image-url <https-url>, not both: a launch has one image. ${USAGE2}`, ctx.json);
+    return 2;
+  }
+  if (flags["--image-url"] !== undefined && !flags["--image-url"].startsWith("https://")) {
+    writeUsageFailure(ctx.deps, "--image-url takes an https:// URL; for an image file on this machine, use --image <path> instead.", ctx.json);
+    return 2;
+  }
+  if (parsed.positionals.length || !flags["--name"] || !flags["--symbol"] || flags["--image"] === undefined && flags["--image-url"] === undefined || !flags["--wallet"] || !validClientId(id) || flags["--dex-version"] !== undefined && flags["--dex-version"] !== "v3" && flags["--dex-version"] !== "v4") {
     writeUsageFailure(ctx.deps, USAGE2, ctx.json);
     return 2;
   }
@@ -70559,6 +70950,13 @@ async function launch(args, ctx) {
       writeUsageFailure(ctx.deps, `A Hood launch needs --dex-version v3|v4. ${USAGE2}`, ctx.json);
       return 2;
     }
+    let image;
+    try {
+      if (flags["--image"] !== undefined)
+        image = await readLocalImage(flags["--image"]);
+    } catch (error) {
+      return tradingFailure(ctx, error);
+    }
     const key = await tradingKey(ctx);
     const prior = await lookupOperation(ctx, key, id, "launch");
     if (prior) {
@@ -70576,14 +70974,27 @@ async function launch(args, ctx) {
       return printTradingResult(ctx, prior);
     }
     const wallet = await tradingWallet(ctx, key, flags["--wallet"], "launch:write", hinted ?? "any");
-    if (wallet.chain === "evm") {
-      if (flags["--dex-version"] === undefined)
-        throw new TradingUsage(`${wallet.address} is a Hood TEE wallet, and a Hood launch needs --dex-version v3|v4.`);
-      const buy2 = launchBuy(flags, "hood");
-      return await hoodLaunch(ctx, key, { flags, id, wallet, buy: buy2, yes: parsed.booleans.has("--yes") });
+    const chain2 = wallet.chain === "evm" ? "hood" : "solana";
+    if (chain2 === "hood" && flags["--dex-version"] === undefined)
+      throw new TradingUsage(`${wallet.address} is a Hood TEE wallet, and a Hood launch needs --dex-version v3|v4.`);
+    const buy = launchBuy(flags, chain2);
+    const solana = chain2 === "solana" ? await tradingSolanaClient(ctx, flags["--rpc-url"]) : undefined;
+    let imageUrl = flags["--image-url"] ?? "";
+    if (image) {
+      ctx.deps.stderr.write(uploadNotice(image));
+      try {
+        imageUrl = await uploadImage(ctx, key, image);
+      } catch (error) {
+        ctx.deps.stderr.write(`The launch was not started, and its id ${id} is unused.
+`);
+        return tradingFailure(ctx, error);
+      }
+      ctx.deps.stderr.write(`Image: ${safeText(imageUrl)}
+`);
     }
-    const buy = launchBuy(flags, "solana");
-    const solana = await tradingSolanaClient(ctx, flags["--rpc-url"]);
+    const used = image ? { imageUrl: safeText(imageUrl) } : {};
+    if (!solana)
+      return await hoodLaunch(ctx, key, { flags, id, wallet, buy, imageUrl, used, yes: parsed.booleans.has("--yes") });
     if (!await claimOperation(ctx, key, id, "launch"))
       throw new TradingError("OPERATION_ALREADY_STARTED", "This machine already started this launch id; no write was resent.");
     ctx.deps.stderr.write(`Operation: ${id}
@@ -70594,7 +71005,7 @@ async function launch(args, ctx) {
       buyAmount: buy ? buy.raw : 0,
       name: flags["--name"],
       symbol: flags["--symbol"],
-      imageUrl: flags["--image-url"],
+      imageUrl,
       linkedWalletId: wallet.id,
       ...flags["--description"] ? { description: flags["--description"] } : {},
       ...flags["--quote-asset"] ? { quoteAsset: flags["--quote-asset"] } : {},
@@ -70616,7 +71027,14 @@ async function launch(args, ctx) {
     };
     ctx.deps.stderr.write(buyNotice(buy, "solana"));
     if (!await confirmQuote(ctx, quote, parsed.booleans.has("--yes")))
-      return printTradingResult(ctx, { success: true, status: "cancelled", clientTradeId: id, kind: "launch", quote });
+      return printTradingResult(ctx, {
+        success: true,
+        status: "cancelled",
+        clientTradeId: id,
+        kind: "launch",
+        quote,
+        ...used
+      });
     if (!Number.isFinite(built.expiresAt) || built.expiresAt <= ctx.deps.now())
       throw new TradingError("QUOTE_EXPIRED", "The launch build expired before signing.");
     const signed = await relaySign(ctx, key, wallet, built.transaction);
@@ -70634,7 +71052,7 @@ async function launch(args, ctx) {
     ctx.deps.stderr.write(`Launch signature: ${signature}
 `);
     const result = await request(ctx, key, "/api/v1/launch/self/confirm", { clientLaunchId: id, signature });
-    return printTradingResult(ctx, { ...result, clientTradeId: id, kind: "launch", quote });
+    return printTradingResult(ctx, { ...result, clientTradeId: id, kind: "launch", quote, ...used });
   } catch (error) {
     return tradingFailure(ctx, error, id);
   }
@@ -70652,7 +71070,7 @@ async function hoodLaunch(ctx, key, args) {
     buyAmount: buy ? buy.raw : 0,
     name: flags["--name"],
     symbol: flags["--symbol"],
-    imageUrl: flags["--image-url"],
+    imageUrl: args.imageUrl,
     linkedWalletId: wallet.id,
     dexVersion: flags["--dex-version"],
     ...flags["--description"] ? { description: flags["--description"] } : {},
@@ -70698,7 +71116,8 @@ async function hoodLaunch(ctx, key, args) {
       chain: "hood",
       quote,
       operationId: first.operationId,
-      walletHeldUntil: first.expiresAt
+      walletHeldUntil: first.expiresAt,
+      ...args.used
     });
   }
   const confirmedPlan = buy ? first.plannedLegCount === 3 ? ["createCurve", "feeTransfer", "trade"] : ["createCurve", "trade"] : undefined;
@@ -70731,7 +71150,8 @@ async function hoodLaunch(ctx, key, args) {
     quote,
     wallet: safeText(wallet.address),
     operationId: first.operationId,
-    landedLegs: run2.landed
+    landedLegs: run2.landed,
+    ...args.used
   });
 }
 function hoodLaterLegsGas(count, buys) {
@@ -72096,10 +72516,10 @@ async function perpsOrders(args, ctx) {
     if (ctx.json)
       return printTradingResult(ctx, result);
     const out = ctx.deps.stdout;
-    const open4 = result.open ?? [];
-    out.write(`Open on Hyperliquid (${open4.length}):
+    const open5 = result.open ?? [];
+    out.write(`Open on Hyperliquid (${open5.length}):
 `);
-    for (const o of open4) {
+    for (const o of open5) {
       out.write(`  ${safeText(o.coin)} ${o.side === "B" ? "buy" : "sell"} ${safeText(o.sz)} at ${safeText(o.limitPx)}${o.reduceOnly ? " reduce-only" : ""}${o.isTrigger ? ` trigger ${safeText(o.triggerPx)}` : ""}, cloid ${safeText(o.cloid ?? "none")}
 `);
     }
@@ -73171,13 +73591,13 @@ function writeWalletEvents(ctx, books) {
 function writeAgents(ctx, agents, all) {
   if (!agents || agents.length === 0)
     return;
-  const open4 = (count2, unmarked) => `${count2}${unmarked > 0 ? ` (${unmarked} unpriced)` : ""}`;
+  const open5 = (count2, unmarked) => `${count2}${unmarked > 0 ? ` (${unmarked} unpriced)` : ""}`;
   const rows = agents.map((a) => [
     a.keyPrefix === null ? "Manual (web app)" : a.label && a.label !== a.keyPrefix ? `${a.label} (${a.keyPrefix})` : a.keyPrefix,
     formatUsd(a.realizedNetUsd),
     formatUsd(a.unrealizedUsd),
     formatUsd(totalOf(a)),
-    open4(a.openPositions, a.unmarked),
+    open5(a.openPositions, a.unmarked),
     String(a.closedRounds)
   ]);
   rows.push([
@@ -73185,7 +73605,7 @@ function writeAgents(ctx, agents, all) {
     formatUsd(all.realizedNetUsd),
     formatUsd(all.unrealizedUsd),
     formatUsd(totalOf(all)),
-    open4(all.openPositions, all.unmarked),
+    open5(all.openPositions, all.unmarked),
     all.closedRounds !== undefined ? String(all.closedRounds) : "-"
   ]);
   ctx.deps.stdout.write(`
@@ -84159,6 +84579,7 @@ var COMMANDS = {
   swap: { bare: swap, subcommands: { status: swapStatus } },
   transfer: { bare: transfer },
   launch: { bare: launch },
+  image: { subcommands: { upload: imageUpload } },
   pnl: { bare: pnl },
   portfolio: { bare: portfolio },
   fees: { bare: feesList, subcommands: { claim: feesClaim } },
@@ -84578,7 +84999,7 @@ async function buildRealDeps() {
     platformKey: platformKey(process.platform, process.arch),
     platform: process.platform,
     arch: process.arch,
-    realpath: (path) => realpath(path),
+    realpath: (path) => realpath2(path),
     spawnHelper: realSpawnHelper,
     releasePolicy: RELEASE_POLICY,
     writeBytes: async (path, bytes) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@candledottv/cli",
-  "version": "0.11.23",
+  "version": "0.11.25",
   "description": "The Candle CLI: authorize a device from your browser, then manage API keys, wallets, and setup health from the terminal",
   "type": "module",
   "bin": {