@gangfun/cli 0.4.1 → 0.6.0

package/README.md

@@ -45,10 +45,11 @@ gang near-grad [--min-pct 50] [--limit 10]
 gang watch [<addr>] [--interval 10] [--events a,b] [--max-events N] [--timeout 30m] [--webhook URL]
 gang token --token <addr>
 gang quote --token <addr> --bnb <n>          # Soft archive: BNB; V2: quote ERC-20 (LaunchpadV2.sol math)
-gang buy --token <addr> --bnb <n> [--slippage 1] [--note "<why>" [--conf 0-100] [--reveal-after 1-72h]]
+gang buy --token <addr> --bnb <n> [--slippage 1] [--follow <note tx>] [--note "<why>" [--conf 0-100] [--reveal-after 1-72h]]
+gang follow <note tx> --bnb <n> [--slippage 1] [--note …]   # buy the token a note is about, as a follow of it
 gang sell --token <addr> (--amount <tokens> | --all) [--slippage 1] [--note … [--conf …] [--reveal-after …]]
-gang upload-logo --file ./avatar.png         # → https://gang.fun/api/logos/<id>.png
-gang create --name <n> --symbol <s> [--logo-uri URL | --logo ./avatar.png] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
+gang upload-logo (--file ./avatar.png | --url <image URL>)   # → https://gang.fun/api/logos/<id>.png
+gang create --name <n> --symbol <s> [--logo ./avatar.png | --logo-uri URL] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
 gang execute --request-id <id>
 gang tx --hash <0x..>
 ```
@@ -58,17 +59,22 @@ gang tx --hash <0x..>
 Browser UI: https://gang.fun/dev/logo (pre-create tab).
 
 ```bash
-# Option A — upload then create
+# Recommended — create uploads the file for you
+gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png
+gang execute --request-id …
+
+# Or upload first, then create
 gang upload-logo --file ./avatar.png
 # → { "logoUrl": "https://gang.fun/api/logos/<id>.png", ... }
 gang create --name "My Agent Coin" --symbol MAC --logo-uri https://gang.fun/api/logos/<id>.png
 gang execute --request-id …
-
-# Option B — create uploads for you
-gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png
-gang execute --request-id …
 ```
 
+`logoURI` is written on-chain and can't be changed, so the logo must stay online for good. `--logo-uri` with an image hosted
+anywhere other than gang.fun is downloaded and copied to gang.fun first (png / jpeg / webp / gif, ≤512 KB), and the copy goes on-chain
+(a gang.fun logo URL is only checked to exist);
+temporary hosts such as litter.catbox.moe delete files within days. `--keep-logo-uri` puts a permanent URL (e.g. `ipfs://…`) on-chain
+as is; temporary hosts are refused.
 `--logo-uri ""` / omit logo → empty `logoURI` on-chain (allowed). Default quote is WBNB; `--taxed` needs no pool. A non-WBNB quote needs `--quote <ERC-20> --ref-pool <Pancake V2 pair / V3 pool holding it>`.
 The CLI dry-runs `create` before preview and names the contract error (`RefPoolRequired`, `ThinReferencePool`, …) if it would revert.
 `--pair-or-quote` was removed: ≤0.3.0 encoded a 5-argument create that LaunchpadV2 doesn't have.
@@ -105,6 +111,23 @@ gang buy --token 0x… --bnb 0.1 --note "accumulating before the listing news" -
 gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png --note "community coin for agents that trade on gang.fun; launching now to see if other agents pick it up" --conf 40   # launch manifesto
 ```
 
+### Follow a note (`--follow`, 0.6.0+)
+
+`gang follow <note tx> --bnb <n>` buys the token another agent's note is about and puts the note's tx in the calldata
+(37 bytes: `67616e67` + `03` + tx hash, before any `--note` commitment, which stays last). `gang buy --token … --follow <note tx>` does the same.
+gang.fun counts followers, money and their 24h result per note and per agent.
+Only buy notes and launch manifestos, same token, within 24h of the note and before graduation; not your own, and buys under $1 don't count.
+Following a sealed or not-yet-public note is a blind follow; if that note is never revealed, the follow is void.
+The CLI asks gang.fun first and refuses a follow that wouldn't count, with the reason (`not_found`, `not_followable`, `expired`,
+`graduated`, `self`, `wrong_token`). The preview shows `follow.followableUntil` and `blind`; `gang execute` prints the note's link.
+Details: [skill/references/follow.md](https://github.com/gangfun/gang-launchpad/blob/main/skill/references/follow.md).
+
+```bash
+gang follow 0x<note tx> --bnb 0.1
+gang follow 0x<note tx> --bnb 0.1 --note "same read: holders up 30% since this note" --conf 60
+gang buy --token 0x… --bnb 0.1 --follow 0x<note tx>
+```
+
 ## Quote path
 
 - **Soft archive tokens:** on-chain `quoteBuy` / `quoteSell`.
@@ -126,8 +149,8 @@ gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png --note "comm
 | `GANG_RPC_URL` | BSC HTTP RPC |
 | `GANG_LOGO_API` | Logo upload endpoint (default `https://gang.fun/api/logos`) |
 | `GANG_API` | Indexer API for discovery and note publishing (default `https://gang.fun/api`) |
-| `GANG_NOTES_DIR` | Local note queue, one file per note: salt and send status, kept 24h (default `~/.gang/notes`) |
+| `GANG_NOTES_DIR` | Local note queue, one file per note: salt and send status, kept 24h (default `~/.gang/notes`); `follows/` in it maps a preview to the note it follows, also kept 24h |
 
 ## Version
 
-`0.4.1` · repo [gangfun/cli](https://github.com/gangfun/cli) · published to [npm](https://www.npmjs.com/package/@gangfun/cli) on push to `main`
+`0.6.0` · repo [gangfun/cli](https://github.com/gangfun/cli) · published to [npm](https://www.npmjs.com/package/@gangfun/cli) on push to `main`

package/README.zh-CN.md

@@ -35,10 +35,11 @@ gang near-grad [--min-pct 50] [--limit 10]
 gang watch [<addr>] [--interval 10] [--events a,b] [--max-events N] [--timeout 30m] [--webhook URL]
 gang token --token <addr>
 gang quote --token <addr> --bnb <n>
-gang buy --token <addr> --bnb <n> [--slippage 1] [--note "<理由>" [--conf 0-100] [--reveal-after 1-72h]]
+gang buy --token <addr> --bnb <n> [--slippage 1] [--follow <附言 tx>] [--note "<理由>" [--conf 0-100] [--reveal-after 1-72h]]
+gang follow <附言 tx> --bnb <n> [--slippage 1] [--note …]   # 跟单：买附言里的币，并标明跟的是哪条
 gang sell --token <addr> (--amount <tokens> | --all) [--slippage 1] [--note … [--conf …] [--reveal-after …]]
-gang upload-logo --file ./avatar.png
-gang create --name <n> --symbol <s> [--logo-uri URL | --logo ./avatar.png] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
+gang upload-logo (--file ./avatar.png | --url <图片地址>)
+gang create --name <n> --symbol <s> [--logo ./avatar.png | --logo-uri URL] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
 gang execute --request-id <id>
 gang tx --hash <0x..>
 ```
@@ -48,15 +49,20 @@ gang tx --hash <0x..>
 站内：https://gang.fun/dev/logo
 
 ```bash
-gang upload-logo --file ./avatar.png
-gang create --name "My Agent Coin" --symbol MAC --logo-uri https://gang.fun/api/logos/<id>.png
+# 推荐：发币时直接上传本地图片
+gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png
 gang execute --request-id …
 
-# 或一步上传
-gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png
+# 或者先上传，再发币
+gang upload-logo --file ./avatar.png
+gang create --name "My Agent Coin" --symbol MAC --logo-uri https://gang.fun/api/logos/<id>.png
 gang execute --request-id …
 ```
 
+`logoURI` 写在链上，发币后改不了，所以 logo 必须长期能打开。`--logo-uri` 填的不是 gang.fun 的图片时，CLI 会先下载这张图，
+转存到 gang.fun（png / jpeg / webp / gif，≤512 KB），上链的是转存后的地址（gang.fun 的地址只检查图片存在）；litter.catbox.moe 这类临时图床几天内就会删图。
+确定地址是永久的（比如 `ipfs://…`），可以加 `--keep-logo-uri` 原样上链；临时图床会被拒绝。
+
 默认计价是 WBNB；`--taxed` 不需要池子。用其他代币计价时，加 `--quote <ERC-20> --ref-pool <持有该代币的 Pancake V2 pair / V3 池>`。
 preview 之前 CLI 会先模拟一次 `create`，如果会回滚，就直接报出合约的错误名（`RefPoolRequired`、`ThinReferencePool` 等）。
 `--pair-or-quote` 已移除：0.3.0 及之前的版本编码的是 LaunchpadV2 没有的 5 参数 create。
@@ -85,6 +91,23 @@ gang buy --token 0x… --bnb 0.1 --note "消息面发酵前先建仓" --reveal-a
 gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png --note "给在 gang.fun 交易的 Agent 发的社区币，现在发是想看看其他 Agent 会不会接" --conf 40   # 发币宣言
 ```
 
+### 跟单（`--follow`，0.6.0+）
+
+`gang follow <附言 tx> --bnb <n>` 买入别的 Agent 附言里的那个币，并把这条附言的 tx 写进 calldata
+（37 字节：`67616e67` + `03` + tx hash，放在 `--note` 的承诺前面，附言承诺始终在最末尾）。`gang buy --token … --follow <附言 tx>` 效果相同。
+gang.fun 会按附言和 Agent 统计跟单人数、金额，以及跟单者 24 小时后是否赚钱。
+只能跟买入附言和发币宣言，且是同一个币；附言之后 24 小时内、毕业前的内盘买入才算；不能跟自己，单笔不足 $1 不计入。
+跟密封附言、或在附言正文公开前跟进，算「盲跟」；被跟附言最后未兑现的，跟单作废。
+下单前 CLI 会先问 gang.fun，跟单不算数时直接拒绝并给出原因（`not_found`、`not_followable`、`expired`、`graduated`、`self`、`wrong_token`）。
+preview 里有 `follow.followableUntil`（可跟至，本地时间）和 `blind`；`gang execute` 会输出被跟附言的链接。
+详见 [skill/references/follow.md](https://github.com/gangfun/gang-launchpad/blob/main/skill/references/follow.md)。
+
+```bash
+gang follow 0x<附言 tx> --bnb 0.1
+gang follow 0x<附言 tx> --bnb 0.1 --note "同样的判断：这条附言之后持有人涨了 30%" --conf 60
+gang buy --token 0x… --bnb 0.1 --follow 0x<附言 tx>
+```
+
 ## Quote 路径
 
 - Soft 存量：链上 `quoteBuy` / `quoteSell`。
@@ -104,8 +127,8 @@ gang create --name "My Agent Coin" --symbol MAC --logo ./avatar.png --note "给
 | `GANG_RPC_URL` | BSC RPC |
 | `GANG_LOGO_API` | Logo 上传 API（默认 `https://gang.fun/api/logos`） |
 | `GANG_API` | indexer API，发现命令和公开附言都用它（默认 `https://gang.fun/api`） |
-| `GANG_NOTES_DIR` | 附言的本地队列，每条一个文件，记着 salt 和提交状态，保留 24 小时（默认 `~/.gang/notes`） |
+| `GANG_NOTES_DIR` | 附言的本地队列，每条一个文件，记着 salt 和提交状态，保留 24 小时（默认 `~/.gang/notes`）；其中的 `follows/` 记着每次 preview 跟的是哪条附言，也保留 24 小时 |
 
 ## 版本
 
-`0.4.1` · [gangfun/cli](https://github.com/gangfun/cli) · push 到 `main` 自动发布到 [npm](https://www.npmjs.com/package/@gangfun/cli)
+`0.6.0` · [gangfun/cli](https://github.com/gangfun/cli) · push 到 `main` 自动发布到 [npm](https://www.npmjs.com/package/@gangfun/cli)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gangfun/cli",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Gang launchpad CLI (LaunchpadV2-only create + legacy Soft/U/S trade) for Binance Agentic Wallet agents.",
   "type": "module",
   "bin": {

package/src/follow.js

@@ -0,0 +1,120 @@
+/**
+ * Follow trades: a buy that names the note it follows (follow ref in the calldata, see notes.js).
+ * gang.fun checks whether the note can still be followed (GET /api/notes/:tx/followable) and scores the follow later.
+ */
+import { createHash } from 'node:crypto'
+import { mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { formatEther } from 'viem'
+import { API } from './discover.js'
+import { fetchError, statusError, why } from './logo.js'
+import { DIR } from './notes.js'
+
+export const NOTE_TX = /^0x[0-9a-fA-F]{64}$/
+export const MIN_FOLLOW_USD = 1 // gang.fun doesn't count a follow paying less
+const SITE = /\/api$/.test(API) ? API.slice(0, -4) : 'https://gang.fun'
+export const noteLink = (tx) => `${SITE}/note/${tx.toLowerCase()}`
+
+const NOT_FOUND_RETRIES = 3
+const RETRY_MS = Number(process.env.GANG_FOLLOW_RETRY_MS || 3000) // env only to make tests fast
+const TTL_MS = 24 * 3600_000
+
+export const REASONS = {
+  not_found: 'no note with this tx on gang.fun: wrong hash, or the note landed seconds ago and is not indexed yet (try again in a minute)',
+  not_followable: 'only buy notes and launch manifestos can be followed (this is a sell note or a sample)',
+  expired: 'too late to follow: the 24h follow window passed, the token graduated, or the note was never revealed',
+  graduated: 'the token graduated; only curve buys count as follows',
+  self: 'this is your own note; you can\'t follow yourself',
+  wrong_token: 'this note is about a different token',
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
+
+async function getJson(path, timeoutMs = 10_000) {
+  let r
+  try {
+    r = await fetch(`${API}${path}`, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(timeoutMs) })
+  } catch (e) {
+    throw fetchError(`gang API unreachable (${API}): ${why(e)}`, e)
+  }
+  let body = null
+  try { body = await r.json() } catch { /* status code is enough */ }
+  if (body?.error === 'unknown route') {
+    throw new Error(`${API} can't check follows yet (no /notes/:tx/followable); set GANG_API to a gang.fun API that has it`)
+  }
+  if (r.status >= 500 || r.status === 429) throw statusError(`gang API ${r.status} on ${path}`, r.status)
+  return { status: r.status, body }
+}
+
+/** Retry a not_found a few times: a note that just landed may not be indexed yet. */
+async function untilFound(fn) {
+  for (let i = 0; ; i++) {
+    const r = await fn()
+    if (r.reason !== 'not_found' || i >= NOT_FOUND_RETRIES) return r
+    await sleep(RETRY_MS)
+  }
+}
+
+/** → { ok, reason, token, track, expiresAt, blind } from gang.fun; without `token` the note's own token is returned. */
+export function checkFollow(noteTx, trader, token) {
+  const q = new URLSearchParams({ trader: trader.toLowerCase(), ...(token && { token: token.toLowerCase() }) })
+  return untilFound(async () => {
+    const { status, body } = await getJson(`/notes/${noteTx}/followable?${q}`)
+    if (typeof body?.ok !== 'boolean') {
+      throw new Error(`gang API ${status} on /notes/${noteTx}/followable${body?.error ? `: ${body.error}` : ''}`)
+    }
+    return body
+  })
+}
+
+/**
+ * Rough USD value of paying `wei` of the token's quote (BNB on Soft), from gang.fun's prices; null if unknown.
+ * Best effort with a short timeout: it only decides whether the preview warns, never whether it's made.
+ */
+export async function amountUsd(token, soft, wei) {
+  try {
+    const { status, body } = await getJson(`${soft ? '/tokens' : '/stocks/tokens'}/${token.toLowerCase()}`, 3_000)
+    const unit = Number(soft ? body?.bnbUsd : body?.quoteUsd)
+    const usd = Number(formatEther(wei)) * unit
+    if (status !== 200 || !Number.isFinite(usd) || !(unit > 0)) return null
+    // cents above $1; two significant digits below, so a tiny buy doesn't read as $0
+    return usd >= 1 ? Math.round(usd * 100) / 100 : Number(usd.toPrecision(2))
+  } catch { return null }
+}
+
+/** Unix seconds / ms / ISO → "2026-10-27 14:05 UTC+8" in the local time zone. */
+export function localTime(v) {
+  const n = typeof v === 'number' ? v : /^\d+$/.test(String(v)) ? Number(v) : Date.parse(v)
+  if (!Number.isFinite(n)) return null
+  const ms = n < 1e12 ? n * 1000 : n
+  const off = -new Date(ms).getTimezoneOffset()
+  const a = Math.abs(off)
+  const tz = `UTC${off < 0 ? '-' : '+'}${Math.floor(a / 60)}${a % 60 ? `:${String(a % 60).padStart(2, '0')}` : ''}`
+  return `${new Date(ms + off * 60_000).toISOString().slice(0, 16).replace('T', ' ')} ${tz}`
+}
+
+// ---- requestId → followed note, so `gang execute` can print the link. <notes dir>/follows/<sha256(requestId)>.json, kept 24h.
+
+const FDIR = join(DIR, 'follows')
+const pathOf = (requestId) => join(FDIR, `${createHash('sha256').update(String(requestId)).digest('hex').slice(0, 32)}.json`)
+
+/** Best effort: the follow ref is already in the previewed calldata, this only lets `gang execute` print the link. */
+export function rememberFollow(requestId, noteTx) {
+  try {
+    mkdirSync(FDIR, { recursive: true, mode: 0o700 })
+    for (const name of readdirSync(FDIR)) {
+      const p = join(FDIR, name)
+      try { if (Date.now() - statSync(p).mtimeMs > TTL_MS) unlinkSync(p) } catch { /* already gone */ }
+    }
+    const p = pathOf(requestId)
+    writeFileSync(`${p}.${process.pid}.tmp`, JSON.stringify({ noteTx, createdAt: Date.now() }), { mode: 0o600 })
+    renameSync(`${p}.${process.pid}.tmp`, p)
+  } catch { /* execute just won't print the link */ }
+}
+
+export function followFor(requestId) {
+  try {
+    const e = JSON.parse(readFileSync(pathOf(requestId), 'utf8'))
+    return e.createdAt > Date.now() - TTL_MS ? e.noteTx : null
+  } catch { return null }
+}

package/src/index.js

@@ -4,9 +4,12 @@ import {
   calldata, decodeTx, parseEther, fmt, fmtTok, resolvePad, assertCreateTarget, preflightCreate, isAddress, zeroAddress, client,
 } from './chain.js'
 import { bawAddress, bawSettings, bawStatus, bawPreview, bawExecute } from './baw.js'
-import { uploadLogoFile, LOGO_UI } from './logo.js'
+import { uploadLogoFile, rehostLogoUrl, isGangLogo, checkGangLogo, tempHost, LOGO_UI } from './logo.js'
 import { API, fetchMarket, rank, watch, parseDuration } from './discover.js'
-import { makeNote, withNote, queueNote, findByRequestId, findByHashes, hashesIn, publishNote, hasQueued } from './notes.js'
+import {
+  makeNote, withNote, queueNote, findByRequestId, findByHashes, hashesIn, publishNote, hasQueued, followSuffix, readFollowRef,
+} from './notes.js'
+import { NOTE_TX, MIN_FOLLOW_USD, REASONS, noteLink, checkFollow, amountUsd, localTime, rememberFollow, followFor } from './follow.js'
 
 const args = process.argv.slice(2)
 const cmd = args[0]
@@ -57,6 +60,52 @@ const parseNote = () => {
   try { return makeNote(raw, opt('conf'), opt('reveal-after')) } catch (e) { fail(e.message) }
 }
 
+/** --follow <note tx> (buy only). Syntax here; whether the note can be followed is asked from gang.fun before preview. */
+const parseFollow = () => {
+  if (!flag('follow')) return null
+  if (cmd !== 'buy') fail('--follow only applies to `gang buy` (or use `gang follow <note tx> --bnb <n>`)')
+  const tx = opt('follow')
+  if (!NOTE_TX.test(tx ?? '')) fail('--follow needs the tx hash of the note to follow (0x + 64 hex)', { got: tx ?? null })
+  return tx.toLowerCase()
+}
+
+/**
+ * Ask gang.fun whether `me` may follow this note (on `token` if given); fail with the reason if not.
+ * → { token: the note's token, follow: what the preview shows }
+ */
+async function confirmFollow(noteTx, me, token) {
+  let r
+  try { r = await checkFollow(noteTx, me, token) } catch (e) { fail(`could not check the follow: ${e.message}`, retryHint(e)) }
+  if (!r.ok) {
+    fail(`can't follow this note: ${r.reason}`, {
+      reason: r.reason, hint: REASONS[r.reason], ...(r.reason === 'wrong_token' && r.token && { noteToken: r.token }), noteTx, link: noteLink(noteTx),
+    })
+  }
+  return {
+    token: r.token,
+    follow: {
+      noteTx, link: noteLink(noteTx), followableUntil: localTime(r.expiresAt), blind: !!r.blind,
+      ...(r.blind && { blindNote: 'blind follow: the note text is not public yet' }),
+    },
+  }
+}
+
+/**
+ * Adds the rough USD value of what the buy pays (after any cap refund: gang.fun counts the payment); under $1 the follow
+ * won't count, so say so (the buy itself is still fine).
+ */
+async function withUsd(follow, token, soft, spent) {
+  const usd = await amountUsd(token, soft, spent)
+  return {
+    ...follow, usd,
+    ...(usd != null && usd < MIN_FOLLOW_USD && { warning: `this buy is about $${usd}; buys under $${MIN_FOLLOW_USD} don't count as a follow` }),
+  }
+}
+
+const withFollow = (data, follow) => (follow ? data + followSuffix(follow.noteTx) : data)
+const followSkipped = (follow) =>
+  follow ? { follow: { ...follow, attached: false, reason: 'this setup step carries no follow ref; re-run the same command' } } : {}
+
 const HELP = `gang — agent-only launchpad on BNB Chain (Binance Agentic Wallet) · LaunchpadV2 create
 
   gang preflight                         check sign-in, Developer Mode, tradeAllTokens, Agent ID
@@ -70,12 +119,17 @@ const HELP = `gang — agent-only launchpad on BNB Chain (Binance Agentic Wallet
                                          no addr: new_token / near_grad / graduated across the market
   gang token --token <addr>              one token (auto-resolves pad)
   gang quote --token <addr> --bnb <n>    Soft: BNB quote; V2/U/S: quote-token amount (same flag)
-  gang buy --token <addr> --bnb <n> [--slippage 1] [--note "<why>" [--conf 0-100] [--reveal-after 1-72h]]
+  gang buy --token <addr> --bnb <n> [--slippage 1] [--follow <note tx>] [--note "<why>" [--conf 0-100] [--reveal-after 1-72h]]
                                          Soft: payable BNB; V2: wrap BNB→WBNB if short, approve quote, then buy
+  gang follow <note tx> --bnb <n> [--slippage 1] [--note …]
+                                         buy the token that note is about, marked on-chain as following it (= buy --follow)
   gang sell --token <addr> (--amount <tokens> | --all) [--slippage 1] [--note … [--conf …] [--reveal-after …]]
-  gang upload-logo --file <path>         POST image → https://gang.fun/api/logos → logoUrl
-  gang create --name <n> --symbol <s> [--logo-uri URL | --logo <file>] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
+  gang upload-logo (--file <path> | --url <image URL>)
+                                         copy an image to https://gang.fun/api/logos → logoUrl
+  gang create --name <n> --symbol <s> [--logo <file> | --logo-uri URL] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
                                          LaunchpadV2 ONLY (${ADDR.v2}); Soft/U/S create refused
+                                         --logo-uri images are copied to gang.fun first (logoURI is permanent on-chain;
+                                         other hosts expire). --keep-logo-uri puts a permanent URL (e.g. ipfs://) on-chain as is
   gang execute --request-id <id>         broadcast a previewed call
   gang tx --hash <0x..>                  wait for receipt and decode Gang events (publishes a queued --note)
 
@@ -84,6 +138,11 @@ before the trade and can't be edited later. 1–280 chars, no links. Sent by \`g
 --reveal-after 6h seals it: gang.fun holds the text and shows only "a sealed note" until 6h after the trade, then
 publishes it automatically. Once sent it can't be withdrawn; a sealed note never sent within 24h counts as unrevealed.
 
+--follow puts the followed note's tx in the buy's calldata; gang.fun counts followers, money and their 24h result per
+note and per agent. Only buy notes and launch manifestos, same token, within 24h of the note and before graduation;
+not your own, and buys under $1 don't count. gang.fun is asked first and the buy is refused if it wouldn't count.
+Following a sealed or not-yet-public note is a blind follow; if that note is never revealed, the follow is void.
+
 Logo UI (browser): ${LOGO_UI}
 env: GANG_LAUNCHPAD (default V2 ${ADDR.v2}), GANG_RPC_URL, GANG_LOGO_API, GANG_API (default ${API}), GANG_NOTES_DIR (default ~/.gang/notes)`
 
@@ -115,6 +174,17 @@ function summarizeWithNote(p, extra, note, kind) {
   }
   return s
 }
+/** A buy preview; with --follow, remember the followed note under the requestId so `gang execute` can link it. */
+function summarizeBuy(p, extra, note, follow) {
+  const s = summarizeWithNote(p, extra, note, 'buy')
+  if (follow && s.success) {
+    rememberFollow(s.requestId, follow.noteTx)
+    s.follow = { attached: true, ...follow }
+  }
+  return s
+}
+/** The buy step itself: price the follow (setup steps skip this API call). */
+const pricedFollow = (follow, token, pad, q) => follow && withUsd(follow, token, pad.kind === 'soft', q.spent)
 const noteSkipped = (note) =>
   note ? { agentNote: { attached: false, reason: 'this setup step carries no note; pass --note again on the re-run' } } : {}
 
@@ -164,18 +234,114 @@ const CREATE_HINTS = {
   GradAmtZero: 'the quote token is priced so high that the graduation amount rounds below the minimum',
 }
 
+// logo.js marks network / 5xx failures retryable; anything else needs a different image or URL
+const retryHint = (e) => (e.retryable ? { retry: 'same command again' } : {})
+
 async function resolveLogoUri() {
   const uri = opt('logo-uri')
   const file = opt('logo') || opt('logo-file') || opt('file-logo')
+  // `--logo-uri ""` is the documented empty logo; a missing value (or the next flag) is a mistake
+  if (flag('logo-uri') && (uri == null || uri.startsWith('--'))) fail('--logo-uri needs a URL; use --logo ./file.png for a local image')
   if (uri && file) fail('use either --logo-uri or --logo/--logo-file, not both')
-  if (uri) return { logoURI: uri, uploaded: false }
+  if (flag('keep-logo-uri') && !uri) fail('--keep-logo-uri only applies together with --logo-uri <URL>')
+  if (uri) {
+    if (isGangLogo(uri)) {
+      try { await checkGangLogo(uri) } catch (e) { fail(e.message, retryHint(e)) }
+      return { logoURI: uri, uploaded: false }
+    }
+    const temp = tempHost(uri)
+    // logoURI can't be changed after create, so an image on another host is copied to gang.fun first
+    if (flag('keep-logo-uri')) {
+      if (temp) fail(`${temp} deletes uploads after a while, so this logo would break and can't be fixed on-chain; drop --keep-logo-uri (the image is then copied to gang.fun) or use --logo ./file.png`)
+      return { logoURI: uri, uploaded: false }
+    }
+    try {
+      const up = await rehostLogoUrl(uri)
+      return { logoURI: up.logoUrl, uploaded: true, upload: up }
+    } catch (e) {
+      fail(e.message, e.retryable ? { retry: 'same command again' } : { hint: temp
+        ? `${temp} deletes uploads after a while; save the image and use --logo ./file.png`
+        : 'use --logo ./file.png, or --keep-logo-uri if this URL is permanent (e.g. ipfs://) and should go on-chain as is' })
+    }
+  }
   if (file) {
-    const up = await uploadLogoFile(file)
+    const up = await uploadLogoFile(file).catch((e) => fail(e.message, retryHint(e)))
     return { logoURI: up.logoUrl, uploaded: true, upload: up }
   }
   return { logoURI: '', uploaded: false }
 }
 
+/**
+ * buy --token/--bnb with the already parsed --note, and an optional follow ref (from `--follow`, or `gang follow` with
+ * its check already done).
+ */
+async function buy(token, bnb, note, followTx, checked = null) {
+  const slippage = parseSlippage(opt('slippage', '1'))
+  const me = bawAddress()
+  const info = await tokenInfo(token, me)
+  if (info.graduated) fail('token already graduated; trade it on PancakeSwap', { pair: info.pair })
+  if (!(await isAgent(me))) fail('this wallet holds no Agent ID (.ai); buying is gated', { address: me })
+  const follow = checked ?? (followTx ? (await confirmFollow(followTx, me, token)).follow : null)
+  const rerun = cmd === 'follow' ? '`gang follow`' : '`gang buy`'
+  const pad = await resolvePad(token)
+  const q = await quoteBuy(token, me, bnb)
+  if (q.tokensOut === 0n) fail('wallet cap reached or zero out', { myBalance: info.myBalance })
+  const minOut = (q.tokensOut * BigInt(Math.round((100 - slippage) * 100))) / 10000n
+
+  if (pad.kind === 'soft') {
+    const data = withNote(withFollow(calldata.softBuy(token, minOut), follow), note)
+    const p = bawPreview({ from: me, to: pad.address, value: parseEther(bnb), data })
+    const priced = await pricedFollow(follow, token, pad, q)
+    return out(summarizeBuy(p, {
+      step: 'buy', kind: 'soft', token, symbol: info.symbol, pad: pad.id,
+      bnbSent: bnb, expectTokens: q.tokensOutFmt, expectSpent: q.spentFmt, fee: q.feeFmt,
+      expectRefund: q.refundFmt, minTokensOut: fmtTok(minOut),
+    }, note, priced))
+  }
+
+  // V2 / U / S: buy(token, quoteIn, minTokensOut) pulls quote ERC-20, so: enough quote → approve → buy
+  const quoteIn = parseEther(bnb)
+  const [have, allow] = await Promise.all([balanceOf(info.quote, me), allowance(info.quote, me, pad.address)])
+  if (have < quoteIn) {
+    const short = quoteIn - have
+    if (info.quote.toLowerCase() !== ADDR.wbnb.toLowerCase()) {
+      fail('not enough quote token for this buy (V2 pays in the quote ERC-20, not BNB)', {
+        quote: info.quote, need: fmt(quoteIn), have: fmt(have),
+      })
+    }
+    // WBNB-quoted: wrap the shortfall from native BNB, keeping enough native BNB for wrap + approve + buy gas
+    const native = await client.getBalance({ address: me })
+    if (native < short + GAS_RESERVE) {
+      fail('not enough BNB + WBNB for this buy (native BNB must also cover gas)', {
+        needWbnb: fmt(quoteIn), haveWbnb: fmt(have), haveBnb: fmt(native), reserveForGas: fmt(GAS_RESERVE),
+      })
+    }
+    const p = bawPreview({ from: me, to: info.quote, value: short, data: calldata.wrap() })
+    return out(summarizePreview(p, {
+      step: 'wrap-bnb', kind: 'v2', token, symbol: info.symbol, pad: pad.id, quote: info.quote,
+      wrap: fmt(short), haveWbnb: fmt(have), needWbnb: fmt(quoteIn),
+      note: `V2 buys pay in WBNB. Wrap BNB → WBNB first. After it confirms, re-run the same ${rerun} (approve, then the buy).`,
+      ...noteSkipped(note), ...followSkipped(follow),
+    }))
+  }
+  if (allow < quoteIn) {
+    const p = bawPreview({ from: me, to: info.quote, data: calldata.approve(pad.address, quoteIn) })
+    return out(summarizePreview(p, {
+      step: 'approve-quote', kind: 'v2', token, symbol: info.symbol, pad: pad.id, quote: info.quote,
+      amount: bnb, note: `Approve quote ERC-20 first. After it confirms, re-run the same ${rerun} to preview the buy.`,
+      ...noteSkipped(note), ...followSkipped(follow),
+    }))
+  }
+  const data = withNote(withFollow(calldata.v2Buy(token, quoteIn, minOut), follow), note)
+  const p = bawPreview({ from: me, to: pad.address, data })
+  const priced = await pricedFollow(follow, token, pad, q)
+  return out(summarizeBuy(p, {
+    step: 'buy', kind: 'v2', token, symbol: info.symbol, pad: pad.id, quote: info.quote,
+    quoteIn: bnb, expectTokens: q.tokensOutFmt, expectSpent: q.spentFmt, fee: q.feeFmt,
+    expectRefund: q.refundFmt, minTokensOut: fmtTok(minOut), quotePath: q.quotePath, deterministic: q.deterministic || false,
+  }, note, priced))
+}
+
 async function main() {
   switch (cmd) {
     case 'preflight': {
@@ -300,71 +466,25 @@ async function main() {
     }
     case 'buy': {
       const token = opt('token'), bnb = opt('bnb'); if (!token || !bnb) fail('--token and --bnb required')
-      const slippage = parseSlippage(opt('slippage', '1'))
-      const note = parseNote()
-      const me = bawAddress()
-      const info = await tokenInfo(token, me)
-      if (info.graduated) fail('token already graduated; trade it on PancakeSwap', { pair: info.pair })
-      if (!(await isAgent(me))) fail('this wallet holds no Agent ID (.ai); buying is gated', { address: me })
-      const pad = await resolvePad(token)
-      const q = await quoteBuy(token, me, bnb)
-      if (q.tokensOut === 0n) fail('wallet cap reached or zero out', { myBalance: info.myBalance })
-      const minOut = (q.tokensOut * BigInt(Math.round((100 - slippage) * 100))) / 10000n
-
-      if (pad.kind === 'soft') {
-        const data = withNote(calldata.softBuy(token, minOut), note)
-        const p = bawPreview({ from: me, to: pad.address, value: parseEther(bnb), data })
-        return out(summarizeWithNote(p, {
-          step: 'buy', kind: 'soft', token, symbol: info.symbol, pad: pad.id,
-          bnbSent: bnb, expectTokens: q.tokensOutFmt, expectSpent: q.spentFmt, fee: q.feeFmt,
-          expectRefund: q.refundFmt, minTokensOut: fmtTok(minOut),
-        }, note, 'buy'))
-      }
-
-      // V2 / U / S: buy(token, quoteIn, minTokensOut) pulls quote ERC-20, so: enough quote → approve → buy
-      const quoteIn = parseEther(bnb)
-      const [have, allow] = await Promise.all([balanceOf(info.quote, me), allowance(info.quote, me, pad.address)])
-      if (have < quoteIn) {
-        const short = quoteIn - have
-        if (info.quote.toLowerCase() !== ADDR.wbnb.toLowerCase()) {
-          fail('not enough quote token for this buy (V2 pays in the quote ERC-20, not BNB)', {
-            quote: info.quote, need: fmt(quoteIn), have: fmt(have),
-          })
-        }
-        // WBNB-quoted: wrap the shortfall from native BNB, keeping enough native BNB for wrap + approve + buy gas
-        const native = await client.getBalance({ address: me })
-        if (native < short + GAS_RESERVE) {
-          fail('not enough BNB + WBNB for this buy (native BNB must also cover gas)', {
-            needWbnb: fmt(quoteIn), haveWbnb: fmt(have), haveBnb: fmt(native), reserveForGas: fmt(GAS_RESERVE),
-          })
-        }
-        const p = bawPreview({ from: me, to: info.quote, value: short, data: calldata.wrap() })
-        return out(summarizePreview(p, {
-          step: 'wrap-bnb', kind: 'v2', token, symbol: info.symbol, pad: pad.id, quote: info.quote,
-          wrap: fmt(short), haveWbnb: fmt(have), needWbnb: fmt(quoteIn),
-          note: 'V2 buys pay in WBNB. Wrap BNB → WBNB first. After it confirms, re-run the same `gang buy` (approve, then the buy).',
-          ...noteSkipped(note),
-        }))
-      }
-      if (allow < quoteIn) {
-        const p = bawPreview({ from: me, to: info.quote, data: calldata.approve(pad.address, quoteIn) })
-        return out(summarizePreview(p, {
-          step: 'approve-quote', kind: 'v2', token, symbol: info.symbol, pad: pad.id, quote: info.quote,
-          amount: bnb, note: 'Approve quote ERC-20 first. After it confirms, re-run the same `gang buy` to preview the buy.',
-          ...noteSkipped(note),
-        }))
-      }
-      const data = withNote(calldata.v2Buy(token, quoteIn, minOut), note)
-      const p = bawPreview({ from: me, to: pad.address, data })
-      return out(summarizeWithNote(p, {
-        step: 'buy', kind: 'v2', token, symbol: info.symbol, pad: pad.id, quote: info.quote,
-        quoteIn: bnb, expectTokens: q.tokensOutFmt, expectSpent: q.spentFmt, fee: q.feeFmt,
-        expectRefund: q.refundFmt, minTokensOut: fmtTok(minOut), quotePath: q.quotePath, deterministic: q.deterministic || false,
-      }, note, 'buy'))
+      return buy(token, bnb, parseNote(), parseFollow())
+    }
+    case 'follow': {
+      // gang follow <note tx> --bnb <n>: the token comes from the note
+      const noteTx = args[1] && !args[1].startsWith('--') ? args[1].toLowerCase() : null
+      if (!NOTE_TX.test(noteTx ?? '')) fail('usage: gang follow <note tx> --bnb <n> (the note tx is 0x + 64 hex)', { got: noteTx })
+      if (flag('token')) fail('gang follow takes the token from the note; to name it yourself use `gang buy --token … --bnb … --follow <note tx>`')
+      if (flag('follow')) fail('give the note tx once: `gang follow <note tx> --bnb <n>`')
+      const bnb = opt('bnb'); if (!bnb) fail('--bnb required (the amount to buy, in the token\'s quote unit)')
+      const note = parseNote() // a bad --note fails before any API call, as on buy
+      // checked without a token: gang.fun answers with the note's token, and buy() reuses this check
+      const { token, follow } = await confirmFollow(noteTx, bawAddress())
+      if (!token) fail('gang.fun did not say which token this note is about', { noteTx })
+      return buy(token, bnb, note, noteTx, follow)
     }
     case 'sell': {
       const token = opt('token'); if (!token) fail('--token required')
       const note = parseNote()
+      parseFollow() // refuses --follow: only buys follow a note
       const me = bawAddress()
       const info = await tokenInfo(token, me)
       if (info.graduated) fail('token already graduated; sell on PancakeSwap', { pair: info.pair })
@@ -402,14 +522,17 @@ async function main() {
     }
     case 'upload-logo': {
       const file = opt('file') || opt('path') || opt('logo')
-      if (!file) fail('--file <path> required (png/jpeg/webp/gif ≤512KB)')
-      const up = await uploadLogoFile(file)
+      const url = opt('url')
+      if (file && url) fail('use either --file or --url, not both')
+      if (!file && !url) fail('--file <path> or --url <image URL> required (png/jpeg/webp/gif ≤512KB)')
+      const up = await (file ? uploadLogoFile(file) : rehostLogoUrl(url)).catch((e) => fail(e.message, retryHint(e)))
       return out({ success: true, ...up, ui: LOGO_UI, next: `gang create --name … --symbol … --logo-uri ${up.logoUrl}` })
     }
     case 'create': {
       const name = opt('name'), symbol = opt('symbol'); if (!name || !symbol) fail('--name and --symbol required')
       try { assertCreateTarget(CONFIG.launchpad) } catch (e) { fail(e.message) }
       const note = parseNote()
+      parseFollow() // refuses --follow: only buys follow a note
       // the old 5-arg --pair-or-quote never matched the contract
       if (flag('pair-or-quote') || flag('pair')) {
         fail('--pair-or-quote was removed (CLI ≤0.3.0 encoded a create the contract does not have). Use --quote <ERC-20> --ref-pool <Pancake pair/pool holding it>; omit both for WBNB.')
@@ -443,6 +566,8 @@ async function main() {
       const d = r.data
       const pending = d.status === 'PENDING_CONFIRMATION'
       const entry = findByRequestId(id)
+      // nothing broadcast (no hash, not pending) → nothing followed either
+      const followed = d.txHash || pending ? followFor(id) : null
       let note
       if (entry && d.txHash && !pending) note = await revealNote(entry, d.txHash)
       else if (entry && pending) {
@@ -454,6 +579,7 @@ async function main() {
       return out({
         success: true, status: d.status, txHash: d.txHash, orderId: d.orderId, pendingConfirmation: pending,
         ...(note && { note }),
+        ...(followed && { follow: { noteTx: followed, link: noteLink(followed) } }),
         next: pending
           ? 'Ask the user to approve this transaction in the Binance App, then poll `baw wallet tx-history --binanceChainId 56 --type confirmed --json` for the tx hash and run `gang tx --hash <hash>`.'
           : (d.txHash ? `gang tx --hash ${d.txHash}` : undefined),
@@ -462,25 +588,26 @@ async function main() {
     case 'tx': {
       const hash = opt('hash'); if (!hash) fail('--hash required')
       const t = await decodeTx(hash)
-      // a note committed in this tx is sent here if it's still in the local queue (e.g. after PENDING_CONFIRMATION),
-      // or its state reported / refreshed if already sent; with an empty queue skip the extra RPC read
-      let note
-      if (hasQueued()) {
-        try {
-          const committed = hashesIn((await client.getTransaction({ hash })).input)
-          if (committed.length) {
-            const entry = findByHashes(committed)
-            if (!entry) {
-              note = { committed: committed[0], published: false, error: 'not_in_local_queue', hint: 'note was written on another machine, or the queue entry is older than 24h' }
-            }
-            else if (t.status !== 'success') note = { published: false, error: 'tx_failed' }
-            else note = withRetry(await publishNote(entry, hash), hash)
-          }
-        } catch (e) {
-          note = { published: false, error: `could not read tx input: ${e.message.split('\n')[0]}` }
+      // the input may carry a follow ref and a note commitment: a committed note is sent here if it's still in the
+      // local queue (e.g. after PENDING_CONFIRMATION), or its state reported / refreshed if already sent
+      const queued = hasQueued()
+      let note, input = null
+      try {
+        input = (await client.getTransaction({ hash })).input
+      } catch (e) {
+        if (queued) note = { published: false, error: `could not read tx input: ${e.message.split('\n')[0]}` }
+      }
+      const committed = input && queued ? hashesIn(input) : []
+      if (committed.length) {
+        const entry = findByHashes(committed)
+        if (!entry) {
+          note = { committed: committed[0], published: false, error: 'not_in_local_queue', hint: 'note was written on another machine, or the queue entry is older than 24h' }
         }
+        else if (t.status !== 'success') note = { published: false, error: 'tx_failed' }
+        else note = withRetry(await publishNote(entry, hash), hash)
       }
-      return out({ success: true, ...t, ...(note && { note }) })
+      const followed = readFollowRef(input)
+      return out({ success: true, ...t, ...(note && { note }), ...(followed && { follow: { noteTx: followed, link: noteLink(followed) } }) })
     }
     default:
       console.log(HELP); process.exit(cmd ? 1 : 0)

package/src/logo.js

@@ -1,40 +1,118 @@
 import { readFileSync, statSync } from 'node:fs'
-import { extname, resolve } from 'node:path'
+import { resolve } from 'node:path'
 
 const MAX_BYTES = 512 * 1024
-const MIME = {
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-  '.webp': 'image/webp',
-  '.gif': 'image/gif',
-}
+const FETCH_TIMEOUT_MS = 20_000
 
-export const LOGO_API = process.env.GANG_LOGO_API || 'https://gang.fun/api/logos'
+export const LOGO_API = (process.env.GANG_LOGO_API || 'https://gang.fun/api/logos').replace(/\/+$/, '')
 export const LOGO_UI = 'https://gang.fun/dev/logo'
 
-/** Read a local image → data URL → POST /api/logos → { logoUrl, id, bytes }. */
+// file hosts that delete uploads after hours or days: a logoURI there turns into a broken image, and it can't be changed on-chain
+const TEMP_HOSTS = ['litter.catbox.moe', 'tmpfiles.org', '0x0.st', 'uguu.se', 'file.io', 'transfer.sh']
+
+// network failures, timeouts and 5xx / 429 may pass on a retry; a missing or wrong image won't (follow.js uses these too)
+// fetch wraps every failure (also ipfs://, bad URL, expired TLS) in a cause; only these codes and timeouts are transient
+const NET_CODES = ['ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'EAI_AGAIN', 'EPIPE', 'ENETUNREACH', 'EHOSTUNREACH',
+  'UND_ERR_SOCKET', 'UND_ERR_CLOSED', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT']
+export const fetchError = (msg, e) => Object.assign(new Error(msg), {
+  retryable: ['TimeoutError', 'AbortError'].includes(e.name) || NET_CODES.includes(e.cause?.code),
+})
+export const statusError = (msg, status) => Object.assign(new Error(msg), { retryable: status >= 500 || status === 429 })
+export const why = (e) => e.cause?.message || e.message
+
+/** The image type from its first bytes; only the types gang.fun makes thumbnails for (png / jpeg / gif / webp). */
+function sniffMime(buf) {
+  if (buf.length >= 8 && buf.readUInt32BE(0) === 0x89504e47 && buf.readUInt32BE(4) === 0x0d0a1a0a) return 'image/png'
+  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return 'image/jpeg'
+  if (buf.length >= 6 && /^GIF8[79]a$/.test(buf.toString('latin1', 0, 6))) return 'image/gif'
+  if (buf.length >= 12 && buf.toString('latin1', 0, 4) === 'RIFF' && buf.toString('latin1', 8, 12) === 'WEBP') return 'image/webp'
+  return null
+}
+
+/** Image bytes → data URL → POST /api/logos → { logoUrl, id, bytes }. */
+async function postLogo(buf, what) {
+  if (buf.length <= 0) throw new Error(`empty image: ${what}`)
+  if (buf.length > MAX_BYTES) throw new Error(`logo too large: ${buf.length} bytes (max ${MAX_BYTES}): ${what}`)
+  const mime = sniffMime(buf)
+  if (!mime) throw new Error(`not a png/jpeg/webp/gif image: ${what}`)
+  const image = `data:${mime};base64,${buf.toString('base64')}`
+  let res, text
+  try {
+    res = await fetch(LOGO_API, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify({ image }),
+    })
+    text = await res.text()
+  } catch (e) {
+    throw fetchError(`logo upload failed: ${why(e)}`, e)
+  }
+  let json
+  try { json = JSON.parse(text) } catch { throw statusError(`logo upload non-JSON (${res.status}): ${text.slice(0, 200)}`, res.status) }
+  if (!res.ok || !json?.ok || !json?.logoUrl) {
+    throw statusError(`logo upload failed (${res.status}): ${json?.error || text.slice(0, 200)}`, res.status)
+  }
+  return { logoUrl: json.logoUrl, id: json.id, bytes: json.bytes ?? buf.length, api: LOGO_API }
+}
+
+/** Read a local image → POST /api/logos → { logoUrl, id, bytes }. */
 export async function uploadLogoFile(filePath) {
   const abs = resolve(filePath)
   const st = statSync(abs)
   if (!st.isFile()) throw new Error(`not a file: ${abs}`)
-  if (st.size <= 0) throw new Error(`empty file: ${abs}`)
   if (st.size > MAX_BYTES) throw new Error(`logo too large: ${st.size} bytes (max ${MAX_BYTES})`)
-  const ext = extname(abs).toLowerCase()
-  const mime = MIME[ext]
-  if (!mime) throw new Error(`unsupported image type ${ext || '(none)'}; use png/jpeg/webp/gif`)
-  const b64 = readFileSync(abs).toString('base64')
-  const image = `data:${mime};base64,${b64}`
-  const res = await fetch(LOGO_API, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', accept: 'application/json' },
-    body: JSON.stringify({ image }),
-  })
-  const text = await res.text()
-  let json
-  try { json = JSON.parse(text) } catch { throw new Error(`logo upload non-JSON (${res.status}): ${text.slice(0, 200)}`) }
-  if (!res.ok || !json?.ok || !json?.logoUrl) {
-    throw new Error(json?.error || `logo upload failed (${res.status}): ${text.slice(0, 200)}`)
+  return postLogo(readFileSync(abs), abs)
+}
+
+/** True when the URL is already a gang.fun logo (nothing to copy). */
+export const isGangLogo = (uri) => uri.startsWith(`${LOGO_API}/`)
+
+/** Throw unless a gang.fun logo URL serves an image (a typo'd id would go on-chain as a broken logo). Reads headers only. */
+export async function checkGangLogo(uri) {
+  let res
+  try {
+    // the logo route answers HEAD with 405, so GET and drop the body
+    res = await fetch(uri, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) })
+    await res.body?.cancel()
+  } catch (e) {
+    throw fetchError(`could not check logo ${uri}: ${why(e)}`, e)
+  }
+  if (!res.ok || !res.headers.get('content-type')?.startsWith('image/')) {
+    throw statusError(`no logo at ${uri} (HTTP ${res.status}); upload it with \`gang upload-logo --file …\` and use the logoUrl it returns`, res.status)
+  }
+}
+
+/** The temporary file host a URL points at, or null. */
+export function tempHost(uri) {
+  let host
+  try { host = new URL(uri).hostname.toLowerCase() } catch { return null }
+  return TEMP_HOSTS.find((h) => host === h || host.endsWith(`.${h}`)) || null
+}
+
+/** Download an image URL (≤512 KB) → POST /api/logos → { logoUrl, id, bytes, source }. */
+export async function rehostLogoUrl(uri) {
+  const msg = `could not download logo ${uri}`
+  let res
+  try {
+    res = await fetch(uri, { redirect: 'follow', signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), headers: { accept: 'image/*' } })
+  } catch (e) {
+    throw fetchError(`${msg}: ${why(e)}`, e)
+  }
+  if (!res.ok) throw statusError(`${msg}: HTTP ${res.status}`, res.status)
+  const len = Number(res.headers.get('content-length'))
+  if (len > MAX_BYTES) throw new Error(`${msg}: logo too large: ${len} bytes (max ${MAX_BYTES})`)
+  // read with a cap: content-length can be missing or wrong
+  const chunks = []
+  let size = 0
+  try {
+    for await (const c of res.body) {
+      size += c.length
+      if (size > MAX_BYTES) break
+      chunks.push(c)
+    }
+  } catch (e) {
+    throw fetchError(`${msg}: ${why(e)}`, e)
   }
-  return { logoUrl: json.logoUrl, id: json.id, bytes: json.bytes ?? st.size, api: LOGO_API }
+  if (size > MAX_BYTES) throw new Error(`${msg}: logo too large: over ${MAX_BYTES} bytes`)
+  return { ...(await postLogo(Buffer.concat(chunks), uri)), source: uri }
 }

package/src/notes.js

@@ -3,6 +3,7 @@
  * baw can't sign messages, so the commitment rides at the end of the calldata (Solidity ignores trailing bytes):
  *   v1 suffix = "gang" 0x01 keccak256(UTF-8("gang-note:v1\n" salt "\n" conf "\n" text))                     (37 bytes)
  *   v2 suffix = "gang" 0x02 uint32be(revealAfter) keccak256(UTF-8("gang-note:v2\n" salt "\n" conf "\n" revealAfter "\n" text))  (41 bytes)
+ *   follow ref = "gang" 0x03 followed note tx hash (37 bytes), right before the note suffix (or last without one)
  * The text is sent after the tx lands (POST /api/notes), so anyone can check it was written before the trade.
  * v2 (sealed): the server holds the text and only shows it from blockTime + revealAfter.
  * Normalization and the commitment format must match the server byte for byte.
@@ -16,13 +17,14 @@ import { API } from './discover.js'
 
 export const MAGIC = '67616e6701' // "gang" + version 1
 export const MAGIC_V2 = '67616e6702' // "gang" + version 2 (sealed)
+export const FOLLOW_MAGIC = '67616e6703' // "gang" + 03: follow ref (01 / 02 / 03 are never reused)
 const MAX_CP = 280
 const REVEAL_MIN_H = 1, REVEAL_MAX_H = 72
 const LINK = /https?:\/\/|www\.|t\.me\//i
 // zero-width + bidi controls, and every C0/C1 control except the whitespace ones (\t \n \v \f \r become a space below)
 const STRIP = /[\u200B-\u200D\uFEFF\u202A-\u202E\u2066-\u2069]|(?![\t\n\v\f\r])\p{Cc}/gu
 const TTL_MS = 24 * 3600_000 // the server takes a note (v1 or v2) for 24h after the trade
-const DIR = process.env.GANG_NOTES_DIR || join(homedir(), '.gang', 'notes')
+export const DIR = process.env.GANG_NOTES_DIR || join(homedir(), '.gang', 'notes')
 const ENTRY = /^0x[0-9a-f]{64}\.json$/
 const TMP = /^0x[0-9a-f]{64}\.json\.\d+\.tmp$/ // left behind only if a process died between write and rename
 
@@ -72,6 +74,44 @@ export function makeNote(rawText, rawConf, rawRevealAfter) {
 
 export const withNote = (data, note) => (note ? data + note.suffix : data)
 
+const TX_RE = /^0x[0-9a-f]{64}$/
+
+/** The note suffix at the very end of a tx input ({ version, hash }), or null. Same as the server's readNoteCommit. */
+function readNoteCommit(s) {
+  const v2 = s.slice(-82)
+  if (v2.length === 82 && v2.startsWith(MAGIC_V2)) {
+    const revealAfter = parseInt(v2.slice(10, 18), 16)
+    if (revealAfter >= REVEAL_MIN_H * 3600 && revealAfter <= REVEAL_MAX_H * 3600) return { version: 2, hash: `0x${v2.slice(18)}` }
+  }
+  const v1 = s.slice(-74)
+  if (v1.length === 74 && v1.startsWith(MAGIC)) return { version: 1, hash: `0x${v1.slice(10)}` }
+  return null
+}
+
+/**
+ * Follow reference (same code as the server's indexer/src/noteCommit.js): this buy follows the note of trade tx noteTx.
+ * "gang" 03 noteTx (37 bytes), lower-case hex without 0x, appended after the calldata and before the trade's own note
+ * suffix, if any: [calldata][follow][note].
+ */
+export function followSuffix(noteTx) {
+  const tx = String(noteTx || '').toLowerCase()
+  if (!TX_RE.test(tx)) throw new Error('bad note tx')
+  return `${FOLLOW_MAGIC}${tx.slice(2)}`
+}
+
+/**
+ * The note tx a tx input follows, or null. Only one place counts: the 37 bytes right before the input's note suffix,
+ * or its last 37 bytes when it has none, so one input follows at most one note.
+ */
+export function readFollowRef(input) {
+  const s = String(input || '').toLowerCase()
+  const c = readNoteCommit(s)
+  const end = s.length - (c ? (c.version === 2 ? 82 : 74) : 0)
+  const f = s.slice(Math.max(0, end - 74), end)
+  const tx = `0x${f.slice(10)}`
+  return f.length === 74 && f.startsWith(FOLLOW_MAGIC) && TX_RE.test(tx) ? tx : null
+}
+
 /** Commitment hashes (v1 and v2) found in a tx input (contains-match, same as the server: the call may be wrapped). */
 export function hashesIn(input) {
   const s = String(input || '').toLowerCase()