@candledottv/cli 0.11.25 → 0.11.27

package/README.md

@@ -135,7 +135,7 @@ emergency procedure, rebinding, trusted wallets and API key access levels are al
 | `candle profile rename <old> <new>` | Renames a profile. |
 | `candle profile remove <name> --yes` | Deletes a profile and its stored credentials. |
 | `candle profile set <name> --rpc-url <url>\|--clear-rpc-url` | Sets or clears this profile's Solana RPC, used when `--rpc-url` and `CANDLE_SOLANA_RPC_URL` are not given. Only its host is ever shown. |
-| `candle mcp [--tools <a,b,c>] [--read-only] [--print-config]` | Runs the Candle MCP server (built into this binary) with this CLI's stored API key and API URL in its environment, so an MCP client config is just `{"mcpServers": {"candle": {"command": "/Users/you/.local/bin/candle", "args": ["mcp"]}}}` -- the absolute path, because GUI hosts launch servers with the app's environment and never see your PATH. Run `--print-config` to print that block filled in for this install. `--read-only` starts it with no key and only the six keyless read tools; `--tools` pins an explicit allowlist. The server is bundled into the binary, so the host needs nothing else installed. With `CANDLE_IMAGE_DIR` set to an absolute directory path in its environment, the two launch tools accept `imagePath` for an image file inside that directory; the upload is public and permanent, on a dry run too. |
+| `candle mcp [--tools <a,b,c>] [--read-only] [--print-config]` | Runs the Candle MCP server (built into this binary) with this CLI's stored API key and API URL in its environment, so an MCP client config is just `{"mcpServers": {"candle": {"command": "/Users/you/.local/bin/candle", "args": ["mcp"]}}}` -- the absolute path, because GUI hosts launch servers with the app's environment and never see your PATH. Run `--print-config` to print that block filled in for this install. `--read-only` starts it with no key and only the seven keyless read tools; `--tools` pins an explicit allowlist. The server is bundled into the binary, so the host needs nothing else installed. With `CANDLE_IMAGE_DIR` set to an absolute directory path in its environment, the two launch tools accept `imagePath` for an image file inside that directory; the upload is public and permanent, on a dry run too. |
 | `candle doctor` | Runs a full health check (runtime, backend, credentials, API reachability, credential validity, wallet delegation, the install method, the account's plan and its trade fee, and whether the `candle-fido2` security key helper is beside the binary) as a PASS/FAIL/SKIP table meant for pasting into a bug report. Exits nonzero on any FAIL. |
 | `candle verify <file> --bundle <path> [--identity <uri>] [--issuer <url>]` | Verifies a release asset's Sigstore bundle against the trusted root compiled into this binary. No network, no credentials, and nothing else installed: the bundle carries the certificate and the transparency-log entry. `--identity` defaults to the release identity for the version in a `latest.json` sitting beside the bundle; `--issuer` defaults to GitHub Actions'. Prints `verified: <identity>` and exits 0, or the reason on stderr and exits 1. |
 | `candle update [--check] [--to <tag>]` | Replaces this binary, and the `candle-fido2` helper beside it, with the latest signed release. Nothing is renamed until both downloads pass; the binary is renamed over the running binary only after its SHA-256 matches both SHA256SUMS and `latest.json` AND its Sigstore bundle verifies in process against that exact version's release workflow. `--check` reports what is available and installs nothing; `--to <tag>` pins a release (an older one installs, with a warning). A Homebrew or npm install is left alone, with the command that owns it printed instead. |
@@ -207,6 +207,11 @@ guarantee is unconfirmed: a wallet stop whose remote enforcement is still pendin
 enabled without verified signing authority, or a sweep that left a residual). Treat `3` as not
 done: follow the printed next step, usually re-running the same command.
 
+A swap or token trade also exits `3` when it may be on chain: the server answered
+`stage: "unconfirmed"` (sent, outcome not seen) or, for a token trade, `stage: "executed"` (the
+trade landed and a later step failed). The envelope's `details` keep `stage` and `signature`.
+Never retry under a new id; read `candle swap status <id>` first.
+
 The value is complete when the process exits, whatever stdout is connected to: a file, a pipe
 into `jq`, a subprocess, or an MCP host. The CLI exits only after stdout has drained, and a
 reader that closes the pipe early (`| head`) ends the output without an error.
@@ -405,8 +410,7 @@ Use the profile holding the TEE wallet's bound API key and the machine that hold
 relay authorization key. `--wallet` accepts its id, address or unique label. These commands
 never open or locally sign with a vault or TEE private key. Candle builds the transaction,
 and Privy signs it through Candle's relay. The server's scopes, raw/USD caps and atomic
-budget reservation apply to the human and the agent alike. Wide routes require the server's
-`TEE_WIDE_ROUTES_ENABLED=1`; it remains off by default.
+budget reservation apply to the human and the agent alike.
 
 ```sh
 candle swap SOL USDC --amount 0.1 --wallet trading --client-trade-id lunch-1
@@ -506,3 +510,20 @@ capped: a partial net must not be quoted as a lifetime figure. On upstream, wall
 malformed-data failure the section is `{ read: false, reason }`, without amounts; spot PnL still
 answers. An empty successful read is `{ read: true, ... }` with zero amounts. `--json` preserves
 the section and its coverage fields. Agent boards are outside this slice.
+
+
+## CNDL staking
+
+Solana staking is available through the agent rail while the deployment enables it (off by
+default). There is no instant unstake. Read the pool wait and wallet eligibility notes first:
+pending withdrawal CNDL counts toward nothing for Pro; outside the primary wallet sCNDL earns
+Solana rewards but no Hood rewards, and Pro follows the served tier mode.
+
+Commands: `candle stake`, `candle stake add <amount>`, `candle stake remove <amount>`,
+`candle stake finish [<withdrawal>]`, `candle stake claim <rewardId>` or `candle stake claim --all`.
+Use `--wallet main` (default for builds) or a TEE wallet with a local relay signer,
+`--client-stake-id <id>` for replay-safe retries, `--yes` to approve the displayed wallet/costs,
+and `--json` for the result. Add/remove amounts are decimal CNDL/sCNDL respectively. Writes
+MOVE REAL FUNDS. A rerun posts the saved signed TEE transaction to submit again without
+re-signing; the server reads the chain first, so it lands once. The signed transaction is kept
+in the CLI operations directory for that retry. An embedded rerun replays the saved build.