shinjuku-shield 0.3.91 → 0.3.93

package/README.md

@@ -6,13 +6,13 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.91. The npm packages `shinjuku-shield` and
+This is version 0.3.93. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files; `shinjuku` is the short command.
 
 ## Set up
 
 ```sh
-npx -y --no-audit --no-fund shinjuku-shield@0.3.91 setup
+npx -y --no-audit --no-fund shinjuku-shield@0.3.93 setup
 ```
 
 Setup makes the wallet on this machine, a private passphrase file, and the
@@ -24,7 +24,7 @@ server to that host's config.
 ## The `shinjuku` command
 
 ```sh
-npm install -g shinjuku@0.3.91
+npm install -g shinjuku@0.3.93
 shinjuku help
 ```
 
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.91 mcp
+claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.93 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.91", "mcp"] } } }
+{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.93", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "1d7842469a3a56390eae2b339649cb42551a19ef63c2f9b1d5716f875ce11b52",
-  "bytes": 12694423,
-  "sourceCommit": "49f574ac0d496bfe5fda2fff09ed900810a54eed",
+  "sha256": "6048ca6123de12e425ab2f3575fa69838eb1ea93dbff3d2facab612e0004bf8a",
+  "bytes": 12704961,
+  "sourceCommit": "714b20d52346099009acced7d327566f239e8b7d",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1297,5 +1297,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-24T01:44:56.272Z"
+  "publishedAt": "2026-10-24T03:23:12.626Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shield",
-  "version": "0.3.91",
+  "version": "0.3.93",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "1d784246",
-  "shinjukuSha256": "1d7842469a3a56390eae2b339649cb42551a19ef63c2f9b1d5716f875ce11b52",
+  "shinjukuRelease": "6048ca61",
+  "shinjukuSha256": "6048ca6123de12e425ab2f3575fa69838eb1ea93dbff3d2facab612e0004bf8a",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -47225,7 +47225,7 @@ async function rpcFetch(input, init) {
     rpcNotBefore.set(post.key, Math.max(rpcNotBefore.get(post.key) ?? 0, Date.now() + retryAfterMs(response)));
   }
 }
-function reexec(args, mode, plainProxy) {
+function proxiedChild(args, mode, plainProxy, stdio) {
   const proxy = withRunTag(mode, plainProxy);
   const env = {
     ...process.env,
@@ -47237,8 +47237,11 @@ function reexec(args, mode, plainProxy) {
   delete env[QUIET_RUN_MARK];
   const quiet = quietRun(args);
   if (quiet) env[QUIET_RUN_MARK] = quiet;
+  return spawn(process.execPath, [...proxiedExecArgv(process.execArgv), process.argv[1], ...args], { env, stdio });
+}
+function reexec(args, mode, plainProxy) {
   return new Promise((resolvePromise) => {
-    const child = spawn(process.execPath, [...proxiedExecArgv(process.execArgv), process.argv[1], ...args], { env, stdio: "inherit" });
+    const child = proxiedChild(args, mode, plainProxy, "inherit");
     const ignore = () => {
     };
     const forward = () => child.kill("SIGTERM");
@@ -47314,7 +47317,12 @@ async function proxyEntry(argv2, run5, { err = (text3) => process.stderr.write(t
   }
   return reexec(options.args, options.mode, options.proxy);
 }
-var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TUNNEL_LINE, TOR_INSTALL, OS_NAMES, osKey, torNotRunningMessage, NOTICE, QUIET_RUN_MARK, QUIET_NOTICE, QUIET_TERMINAL_COMMANDS, INFER_SUBCOMMANDS, quietRun, TOR_TROUBLE_LINE, TOR_WAIT_PLAIN, TOR_TROUBLE_PLAIN, TOR_TROUBLE_SAID, quietTorErr, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop, PROXY_WARNING_FLAG, proxiedExecArgv, proxiedNodeOptions, TOR_FROM_CONFIG_ENV, TOR_FROM_CONFIG_HINT;
+function torChild(argv2, stdio) {
+  const options = proxyOptions(argv2);
+  if (!options.mode) throw new ProxyUsageError("torChild needs --tor or --proxy");
+  return proxiedChild(options.args, options.mode, options.proxy, stdio);
+}
+var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TOR_EXPERT_BUNDLE_SHA256, TUNNEL_LINE, TOR_INSTALL, torStart, OS_NAMES, osKey, torNotRunningMessage, NOTICE, QUIET_RUN_MARK, QUIET_NOTICE, QUIET_TERMINAL_COMMANDS, INFER_SUBCOMMANDS, quietRun, TOR_TROUBLE_LINE, TOR_WAIT_PLAIN, TOR_TROUBLE_PLAIN, TOR_TROUBLE_SAID, quietTorErr, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop, PROXY_WARNING_FLAG, proxiedExecArgv, proxiedNodeOptions, TOR_FROM_CONFIG_ENV, TOR_FROM_CONFIG_HINT;
 var init_proxy = __esm({
   "wallet/src/net/proxy.mjs"() {
     "use strict";
@@ -47361,12 +47369,14 @@ var init_proxy = __esm({
     };
     isOnionHost = (host) => /\.onion$/i.test(String(host ?? "").replace(/\.+$/, ""));
     TOR_EXPERT_BUNDLE = "15.0.25";
+    TOR_EXPERT_BUNDLE_SHA256 = "c1988c701de2f24f7d098d1d6d7f507b58f27740d097f29c246e0524d639b252";
     TUNNEL_LINE = "HTTPTunnelPort 127.0.0.1:9080 IsolateDestAddr";
     TOR_INSTALL = Object.freeze({
-      windows: `iwr https://archive.torproject.org/tor-package-archive/torbrowser/${TOR_EXPERT_BUNDLE}/tor-expert-bundle-windows-x86_64-${TOR_EXPERT_BUNDLE}.tar.gz -OutFile $env:TEMP\\tor.tar.gz; mkdir -Force $env:LOCALAPPDATA\\tor | Out-Null; tar -xzf $env:TEMP\\tor.tar.gz -C $env:LOCALAPPDATA\\tor; & $env:LOCALAPPDATA\\tor\\tor\\tor.exe --HTTPTunnelPort '127.0.0.1:9080 IsolateDestAddr' --SocksPort 0`,
+      windows: `iwr https://archive.torproject.org/tor-package-archive/torbrowser/${TOR_EXPERT_BUNDLE}/tor-expert-bundle-windows-x86_64-${TOR_EXPERT_BUNDLE}.tar.gz -OutFile $env:TEMP\\tor.tar.gz; if ((Get-FileHash $env:TEMP\\tor.tar.gz -Algorithm SHA256).Hash -ne '${TOR_EXPERT_BUNDLE_SHA256}') { Remove-Item $env:TEMP\\tor.tar.gz; throw 'The Tor download does not match its pinned sha256, so it was deleted and not run' }; mkdir -Force $env:LOCALAPPDATA\\tor | Out-Null; & $env:SystemRoot\\System32\\tar.exe -xzf $env:TEMP\\tor.tar.gz -C $env:LOCALAPPDATA\\tor; & $env:LOCALAPPDATA\\tor\\tor\\tor.exe --HTTPTunnelPort '127.0.0.1:9080 IsolateDestAddr' --SocksPort 0`,
       macos: `brew install tor && echo '${TUNNEL_LINE}' >> "$(brew --prefix)/etc/tor/torrc" && brew services restart tor`,
       linux: `sudo apt install -y tor && echo '${TUNNEL_LINE}' | sudo tee -a /etc/tor/torrc && sudo systemctl restart tor`
     });
+    torStart = (platform = process.platform) => platform === "win32" ? { where: "PowerShell (keep its window open while the wallet runs)", command: TOR_INSTALL.windows } : platform === "darwin" ? { where: "Terminal", command: TOR_INSTALL.macos } : { where: "a terminal", command: TOR_INSTALL.linux };
     OS_NAMES = { windows: "Windows (PowerShell; keep its window open while the wallet runs)", macos: "macOS (Homebrew)", linux: "Linux (Debian or Ubuntu)" };
     osKey = (platform) => platform === "win32" ? "windows" : platform === "darwin" ? "macos" : "linux";
     torNotRunningMessage = (address5, platform = process.platform) => `tor_not_running: Tor is not running on this machine (nothing answers at ${address5}), so nothing was sent. ${torInstallText(platform)}`;
@@ -67280,6 +67290,9 @@ var init_errorCodes = __esm({
       "mcp_setup_switch_failed",
       "mcp_tor_unavailable",
       "setup_tor_unavailable",
+      // The wallet server behind Tor that the setup server starts after a Tor setup (stdioServer.mjs startTorRelay).
+      "setup_tor_wallet_ended",
+      "setup_tor_wallet_slow",
       "wallet_not_set_up",
       "shinjuku_setup",
       "wallet_status",
@@ -109970,7 +109983,7 @@ function refusalSay(a, tool, again, npmVersion) {
   }
   if (code2 === "mcp_balance_unknown") return "Nothing was moved yet: the wallet is still reading its private balance. Try again in a minute.";
   if (code2 === "mcp_payment_still_open") return "Not paid: a payment for this request is still open. Ask with its request_id for the result.";
-  if (code2 === "mcp_setup_restart_needed") return "The wallet is set up, but this app must restart to use it. Restart this app, then try again.";
+  if (code2 === "mcp_setup_restart_needed") return "The wallet is set up, but it must reconnect once. Follow the steps below, then try again. Nothing was paid.";
   if (code2 === "mcp_restart_needed") return "Nothing was paid. Restart this app, then try again.";
   if (/accounts_split/.test(code2) || /accounts_split/.test(detail)) {
     return `Nothing was ${tool === "wallet_unshield" ? "sent" : "paid"}. The wallet is getting your balance ready to send; try again in about 1 minute, then once more 2 minutes later.`;
@@ -110063,10 +110076,13 @@ function refusalSay(a, tool, again, npmVersion) {
     return str(a.ownAddressCommand) && words(own) <= SAY_MAX_WORDS ? own : head;
   }
   if (code2 === "mcp_unshield_declined") return "Not sent. The send was not confirmed.";
-  if (code2 === "mcp_setup_declined" && unshown) {
-    return `Not set up. This app cannot show the setup question. Run ${oneTimeCommandLine("setup", npmVersion)} in a terminal, then restart this app.`;
+  if (code2 === "mcp_setup_declined" && unshown || code2 === "mcp_setup_needs_terminal") {
+    return `Not set up. This app cannot show the setup question. Run ${oneTimeCommandLine("setup", npmVersion)} in a terminal, then reconnect the wallet.`;
   }
   if (code2 === "mcp_setup_declined") return "Not set up. The setup was not confirmed; nothing was created.";
+  if (code2 === "tor_not_running" && tool === "shinjuku_setup") return "Not set up: Tor is not running on this computer. Start it with the command below and ask again, or set up without Tor.";
+  if (code2 === "wallet_not_set_up" && tool === "x402_discover") return "Not searched yet. Set up the wallet first: setup asks one question, whether to use Tor, which hides your IP address.";
+  if (code2 === "wallet_not_set_up") return "The wallet is not set up yet, so nothing was paid. Ask to set up the wallet first.";
   if (code2 === "mcp_tool_disabled") return "Nothing was paid or moved. This tool is off; only your owner can turn it on when starting the wallet.";
   if (code2 === "mcp_unshield_to_invalid") {
     return "Not sent. That address has no USDC account yet. Ask for a Solana address that already holds USDC, like a Phantom address.";
@@ -127172,7 +127188,7 @@ ${canonical5}`;
     } catch {
       onion = false;
     }
-    return { network: mode === "tor" ? { mode: "tor", detail: `every request of this wallet goes through Tor (checked at start)${onion ? "; the facilitator is reached over its onion service, so no Tor exit sees those requests" : ""}` } : mode === "proxy" ? { mode: "proxy", detail: "every request of this wallet goes through the proxy in its launch line (--proxy); it is not checked as Tor" } : { mode: "direct", detail: "no Tor: the facilitator, the RPC provider and each seller see this computer's IP address; start the MCP with --tor (or run setup --prefer-tor) to hide it" } };
+    return { network: mode === "tor" ? { mode: "tor", detail: `every request of this wallet goes through Tor (checked at start)${onion ? "; the facilitator is reached over its onion service, so no Tor exit sees those requests" : ""}` } : mode === "proxy" ? { mode: "proxy", detail: "every request of this wallet goes through the proxy in its launch line (--proxy); it is not checked as Tor" } : { mode: "direct", detail: `no Tor: the facilitator, the RPC provider and each seller see this computer's IP address. To hide it, the user runs ${terminalCommand("setup --yes --prefer-tor")} once in a terminal (it records Tor and checks the wallet's files again; nothing else changes), then restarts this app` } };
   }
   function sayFirst(fields, tool, autoId) {
     let say6 = sayFor(fields, { tool, npmVersion });
@@ -127591,7 +127607,7 @@ ${canonical5}`;
   const balance = {
     name: "wallet_balance",
     title: "Balance",
-    description: `Use this when the user asks "what is my balance" or "how much USDC do I have": it answers ONE balance (balanceAtomic, what x402_pay can spend) and the public (unshielded) USDC. Pays nothing and signs nothing. When the user asks to see the wallet ("show my wallet"), print \`card\` as it is: at most 8 lines with the private balance, the public USDC, Tor on or off, the last 3 payments (time UTC, seller host, USDC), and example requests. balanceParts (only above 1): a send of all of it first gets the balance ready to send (next says the minutes; never say parts or join to the user). balanceAtomic is one number; breakdown names its parts (breakdown.shieldedAtomic is what wallet_unshield can send; privateSendPendingAtomic is the part of a running private send (wallet_unshield with parts or max_delay_minutes) not sent yet, already taken off shieldedAtomic; refundsInFlightAtomic is a Shinjuku refund on its way back; setAsideAtomic (only when not 0) is value an older version of this wallet set aside to pay sellers; during a pool move, pools lists each pool's part and movingAtomic is value on its way from the old pool to the new one; the move field shows the move, poolSwitches each switch). UNSHIELDED (unshieldedAtomic) is the plain public USDC on the wallet's own Solana key (ownAddress), the USDC wallet_shield makes private; unshieldedSolLamports is that key's SOL, information only: wallet_shield needs none (the facilitator's relayer pays every fee and rent). When the local balance is stale (a new deposit, a received payment), it reads the chain by itself first; when that takes longer than about 20 s it answers the last balance with refreshing: true and finishes in the background (call wallet_balance again in 30 s). A balance with refreshing: true and refreshReason is exact (payment_settling: a payment settles and the number counts it; account_join: the wallet gets its own balance ready to send and the number counts all of it; pool_move: value from the old pool arrives and the number counts it; refund_check: a refund counted from an old read, which the wallet checks now (never tell the user it is still on its way); first_check: a new wallet's first history check, the number is its own landed deposits). status reading (balanceAtomic null): the first balance read of a wallet that may hold money is not done; call wallet_balance again in 30 s. If the public read fails, unshieldedAtomic is null with unshieldedReason; the rest still answers. ownKeyTokens (only when there are any): the other tokens on ownAddress (not its USDC), each { mint, amountAtomic, decimals, amount }, at most 10 (ownKeyTokensMore counts the rest); a token is its mint, never a name or symbol; wallet_transfer_token with that mint as token_mint sells one and sends the USDC privately. earlierDeposits (only when there are any): USDC found at a one-time deposit address of an earlier pool, each with a notice line to tell the user; the wallet moves it into the current pool by itself. addFunds (only when there are any): each wallet_add_funds address still open, with its state and the USDC known to wait there (heldAtomic; null with heldNote when the address was not checked yet). startsAtNextRequest true (old name): its deposit is not sent yet; once the wallet has seen USDC there, it sends it by itself in about startsInMinutes + 1 minutes, in every host, with no ask. landingAtomic (only when not 0): USDC you added whose deposit landed on chain and that balanceAtomic does not count yet; this call finishes it and waits about 20 s for it, past that it is being counted: call wallet_balance again as next says (at once in the same turn when this call waited its 20 s, else in 30 s). session shows the spending limits (null or "none": no limit), what is left, where the limits come from, and how to change them (session.summary, only when a limit is set; with none, say nothing about limits, and never tell the user the session counters (sessionSpentAtomic, sessionMovedAtomic): they are limit bookkeeping and may count earlier conversations). verbose: true adds \`internal\` (accounts, notes, and other engineering numbers); the default answer leaves them out. To add money, use wallet_add_funds. Amounts are atomic units (USDC: 1000000 = 1 USDC); say and usdc give them in USDC.`,
+    description: `Use this when the user asks "what is my balance" or "how much USDC do I have": it answers ONE balance (balanceAtomic, what x402_pay can spend) and the public (unshielded) USDC. Pays nothing and signs nothing. When the user asks to see the wallet ("show my wallet"), print \`card\` as it is (at most 8 lines: balances, Tor, the last 3 payments, example requests). balanceParts (only above 1): a send of all of it first gets the balance ready to send (next says the minutes; never say parts or join to the user). balanceAtomic is one number; breakdown names its parts (breakdown.shieldedAtomic is what wallet_unshield can send; privateSendPendingAtomic is the part of a running private send (wallet_unshield with parts or max_delay_minutes) not sent yet, already taken off shieldedAtomic; refundsInFlightAtomic is a Shinjuku refund on its way back; setAsideAtomic (only when not 0) is value an older version of this wallet set aside to pay sellers; during a pool move, pools lists each pool's part and movingAtomic is value on its way from the old pool to the new one; the move field shows the move, poolSwitches each switch). UNSHIELDED (unshieldedAtomic) is the plain public USDC on the wallet's own Solana key (ownAddress), the USDC wallet_shield makes private; unshieldedSolLamports is that key's SOL, information only: wallet_shield needs none (the facilitator's relayer pays every fee and rent). When the local balance is stale (a new deposit, a received payment), it reads the chain by itself first; when that takes longer than about 20 s it answers the last balance with refreshing: true and finishes in the background (call wallet_balance again in 30 s). A balance with refreshing: true and refreshReason is exact (payment_settling: a payment settles and the number counts it; account_join: the wallet gets its own balance ready to send and the number counts all of it; pool_move: value from the old pool arrives and the number counts it; refund_check: a refund counted from an old read, which the wallet checks now (never tell the user it is still on its way); first_check: a new wallet's first history check, the number is its own landed deposits). status reading (balanceAtomic null): the first balance read of a wallet that may hold money is not done; call wallet_balance again in 30 s. If the public read fails, unshieldedAtomic is null with unshieldedReason; the rest still answers. ownKeyTokens (only when there are any): the other tokens on ownAddress (not its USDC), each { mint, amountAtomic, decimals, amount }, at most 10 (ownKeyTokensMore counts the rest); a token is its mint, never a name or symbol; wallet_transfer_token with that mint as token_mint sells one and sends the USDC privately. earlierDeposits (only when there are any): USDC found at a one-time deposit address of an earlier pool, each with a notice line to tell the user; the wallet moves it into the current pool by itself. addFunds (only when there are any): each wallet_add_funds address still open, with its state and the USDC known to wait there (heldAtomic; null with heldNote when the address was not checked yet). startsAtNextRequest true (old name): its deposit is not sent yet; once the wallet has seen USDC there, it sends it by itself in about startsInMinutes + 1 minutes, in every host, with no ask. landingAtomic (only when not 0): USDC you added whose deposit landed on chain and that balanceAtomic does not count yet; this call finishes it and waits about 20 s for it, past that it is being counted: call wallet_balance again as next says (at once in the same turn when this call waited its 20 s, else in 30 s). session: the spending limits (null or "none": no limit), what is left, and how to change them (session.summary, only when a limit is set). With no limit set, say nothing about limits or the session counters (limit bookkeeping; they may count earlier conversations). To add money, use wallet_add_funds. Amounts are atomic units (USDC: 1000000 = 1 USDC); say and usdc give them in USDC.`,
     inputSchema: { type: "object", properties: {
       verbose: { type: "boolean", description: "Optional. true adds `internal`: the engineering numbers (funded accounts, notes, payments without waiting, a 0 set-aside value). Default false." }
     }, additionalProperties: false },
@@ -129812,7 +129828,7 @@ ${canonical5}`;
       decimals = Number(session.openStore().state.decimals);
     } catch {
     }
-    const amount = formatAtomic(BigInt(job.amountAtomic), decimals);
+    const amount = usdcText2(job.amountAtomic, decimals);
     const askedAt = Date.now();
     try {
       const how = isSplitSend(job) ? job.parts === 1 ? ` after a random wait of up to ${job.maxDelayMinutes} min` : ` as ${job.parts} separate exits of unequal size, each after a random wait of up to ${job.maxDelayMinutes} min` : "";
@@ -130105,13 +130121,13 @@ ${canonical5}`;
         }
         if (checkInput) {
           try {
-            await recipientCheck(checkInput);
+            await withTimeout(recipientCheck(checkInput), RECIPIENT_CHECK_TIMEOUT_MS);
           } catch (error) {
             if (errorCode2(error, "") === "mcp_unshield_to_invalid") {
               log(`MCP_UNSHIELD_TO_REFUSED requestId=${request.requestId}`);
               return refuse12("mcp_unshield_to_invalid", /has no USDC token account/.test(String(error?.message)) ? UNSHIELD_TO_NO_USDC_DETAIL : String(error.message).replace(/^mcp_unshield_to_invalid:\s*/, ""), UNSHIELD_TO_INVALID_NEXT, { requestId: request.requestId, to: request.to });
             }
-            log(`MCP_UNSHIELD_TO_CHECK_SKIPPED requestId=${request.requestId} ${errorCode2(error, "unknown")}`);
+            log(`MCP_UNSHIELD_TO_CHECK_SKIPPED requestId=${request.requestId} ${error?.timedOut === true ? "timeout" : errorCode2(error, "unknown")}`);
           }
         }
       }
@@ -131189,7 +131205,7 @@ ${canonical5}`;
   const unshield = {
     name: "wallet_unshield",
     title: "Send USDC privately from the shielded balance",
-    description: `Use this when the user says "send 2 USDC to <address>" or "withdraw to my wallet" (leave \`to\` out for the owner's own wallet when one is set): it sends amount (USDC, like "2"; or amount_atomic) from the SHIELDED balance as plain USDC to \`to\`, a public Solana address (the USDC goes to its USDC token account). BEFORE you call it to send all of the balance when wallet_balance showed balanceParts above 1, write to the user that it takes about joinMinutes minutes (the wallet first gets the balance ready to send; never say parts or join to the user; some apps show nothing until this call ends). Privately: the chain shows the pool paying the address, not which wallet paid. The wallet's own key (ownAddress in wallet_balance) is this wallet's public address: it holds the public USDC, wallet_shield deposits from it, and wallet_transfer_token sells from it. So it is refused as \`to\`: an exit there would show on chain that the private balance belongs to this wallet. This holds whether or not that key ever deposited: wallet_add_funds deposits come from one-time addresses, not from this key, so never tell the user the deposits came from it. The facilitator pays every network fee; no SOL is needed. The owner's --unshield-to addresses send at once. Any other address is sent only after the user confirms it in the MCP client (a confirmation dialog); a client that cannot ask is refused (mcp_unshield_to_not_allowed) and a decline sends nothing (mcp_unshield_declined). \`to\` must already hold USDC (have a USDC token account): an address without one is refused before any dialog (mcp_unshield_to_invalid). It takes minutes (one wait of up to 5 minutes is normal): the call answers within about 20 s with stage (confirming, queued, refreshing, self-pay = preparing, exit = sending, done; joining = the wallet first gets the balance ready to send, then sends; the answer says how many more asks and when (joinAsks, joinMinutes), ok: true); call wallet_unshield again with the SAME request_id, amount, and to for the status (each call answers within about 20 s, at once when the send ends; a confirmation dialog the user answers may take longer). When the balance is in several parts, the FIRST call answers at once with stage joining and joinTellFirst: true; write its say to the user, then call again with the same request_id at once. One exception: for a single send (no parts, no delay) whose balance is in several parts, when this MCP app sends a progress token with the call, that next call joins the parts and then sends, taking up to ${JOIN_CALL_MAX_MS / 6e4} minutes, with a progress line every ${JOIN_STEP_MS / 1e3} s ("getting your balance ready to send (about M min)"; some apps show none of them, so the time is said before the call, as above). Without a progress token it answers within about 20 s with stage joining and when to ask again. The same request_id never sends twice, also after a restart. request_id is optional: without it the answer names the id it made, and the same call again within 10 minutes after it ends reads that same send. When it lands, the wallet writes an encrypted backup (backupPath). x402_pay calls wait while it runs. An optional owner cap (--max-unshield) may bound each call and what this wallet sends in any 24 hours, from every MCP process (mcp_unshield_cap_exceeded: tell the owner). Other refusals: mcp_argument_invalid, mcp_request_id_reused, mcp_unshield_to_invalid, wallet_locked, mcp_tool_disabled, mcp_unshield_failed, and the unshield's own p03_* codes. PRIVATE SEND (optional): when the user says "send it in parts", "spread it out", or "do not send it all at once", pass parts (2-8) WITH max_delay_minutes (1-60; parts with no wait are refused: they would leave together): the amount is split into parts exits of unequal size (each at least 0.01 USDC), each sent after a random wait of up to max_delay_minutes (part 1 too), so the chain shows no single exit of this amount at this time. max_delay_minutes alone delays one exit. ` + SEND_RUNS_ON + ` Late parts never go together. While parts are unsent, x402_pay may spend only the rest of the balance. The plan is saved in the wallet before part 1, so the same request_id (with the same parts and max_delay_minutes) continues after a restart and never sends a part twice; the answer's privateSend lists each part (state, amount, when it may go, transactions), sentAtomic, and remainingAtomic. The user confirms the whole send once. Both left out: one exit, as before. Each part is a full unshield, so it takes as long as one, and the facilitator pays the network fee of each. Privacy limit: every part goes to the SAME \`to\`, so anyone who adds up that address's incoming transfers sees the total; the parts hide the time and the single amount of the exit, not the sum the address received. wallet_cancel with the same request_id stops the parts not sent yet (their value stays in the shielded balance); while a part is being sent, that call waits for the part to finish, up to about ${CALL_BUDGET_MS / 1e3} s.`,
+    description: `Use this when the user says "send 2 USDC to <address>" or "withdraw to my wallet" (leave \`to\` out for the owner's own wallet when one is set): it sends amount (USDC, like "2"; or amount_atomic) from the SHIELDED balance as plain USDC to \`to\`, a public Solana address (the USDC goes to its USDC token account). BEFORE you call it to send all of the balance when wallet_balance showed balanceParts above 1, write to the user that it takes about joinMinutes minutes (the wallet first gets the balance ready to send; never say parts or join to the user; some apps show nothing until this call ends). Privately: the chain shows the pool paying the address, not which wallet paid. The wallet's own key (ownAddress in wallet_balance) is this wallet's public address: it holds the public USDC, wallet_shield deposits from it, and wallet_transfer_token sells from it. So it is refused as \`to\`: an exit there would show on chain that the private balance belongs to this wallet. This holds whether or not that key ever deposited: wallet_add_funds deposits come from one-time addresses, not from this key, so never tell the user the deposits came from it. The facilitator pays every network fee; no SOL is needed. The owner's --unshield-to addresses send at once. Any other address is sent only after the user confirms it in the MCP client (a confirmation dialog); a client that cannot ask is refused (mcp_unshield_to_not_allowed) and a decline sends nothing (mcp_unshield_declined). \`to\` must already hold USDC (have a USDC token account): an address without one is refused before any dialog (mcp_unshield_to_invalid). It takes minutes (one wait of up to 5 minutes is normal): the call answers within about 20 s with stage (confirming, queued, refreshing, self-pay = preparing, exit = sending, done; joining = the wallet first gets the balance ready to send, then sends; the answer says how many more asks and when (joinAsks, joinMinutes), ok: true); call wallet_unshield again with the SAME request_id, amount, and to for the status (each call answers within about 20 s, at once when the send ends; a confirmation dialog the user answers may take longer). When the balance is in several parts, the FIRST call answers at once with stage joining and joinTellFirst: true; write its say to the user, then call again with the same request_id at once. One exception: for a single send (no parts, no delay) whose balance is in several parts, when this MCP app sends a progress token with the call, that next call joins the parts and then sends, taking up to ${JOIN_CALL_MAX_MS / 6e4} minutes, with a progress line every ${JOIN_STEP_MS / 1e3} s ("getting your balance ready to send (about M min)"; some apps show none of them, so the time is said before the call, as above). Without a progress token it answers within about 20 s with stage joining and when to ask again. The same request_id never sends twice, also after a restart. request_id is optional: without it the answer names the id it made, and the same call again within 10 minutes after it ends reads that same send. When it lands, the wallet writes an encrypted backup (backupPath). x402_pay calls wait while it runs. An optional owner cap (--max-unshield) may bound each call and what this wallet sends in any 24 hours, from every MCP process (mcp_unshield_cap_exceeded: tell the owner). Other refusals: mcp_argument_invalid, mcp_request_id_reused, mcp_unshield_to_invalid, wallet_locked, mcp_tool_disabled, mcp_unshield_failed, and the unshield's own p03_* codes. PRIVATE SEND (optional): when the user says "send it in parts", "spread it out", or "do not send it all at once", pass parts (2-8) WITH max_delay_minutes (1-60); the parts argument says how it works, and its privacy limit, which you tell the user.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -131197,7 +131213,7 @@ ${canonical5}`;
         amount_atomic: { type: "string", pattern: "^[1-9][0-9]*$", description: "USDC to send, in atomic units (1000000 = 1 USDC)." },
         to: { type: "string", description: "The receiving Solana address (base58), exactly as the user gave it. Leave it out to send to the owner's own wallet when the owner set exactly one (wallet_balance session.unshield.to); with none or several set, pass it." },
         request_id: { type: "string", pattern: "^[A-Za-z0-9._:-]{1,128}$", description: "Optional. Your stable name for this send, like send-1; pass it again to read the status." },
-        parts: { type: "integer", minimum: 1, maximum: 8, description: "Optional, default 1: send the amount as this many separate exits of unequal size (a private send). Each part carries at least 10000 atomic (0.01 USDC). Above 1 it needs max_delay_minutes 1-60." },
+        parts: { type: "integer", minimum: 1, maximum: 8, description: "Optional, default 1: send the amount as this many separate exits of unequal size (a private send). Each part carries at least 10000 atomic (0.01 USDC). Above 1 it needs max_delay_minutes 1-60 (parts with no wait are refused: they would leave together). Each part is sent after a random wait of up to max_delay_minutes (part 1 too), so the chain shows no single exit of this amount at this time; max_delay_minutes alone delays one exit. " + SEND_RUNS_ON + ` Late parts never go together. While parts are unsent, x402_pay may spend only the rest of the balance. The plan is saved in the wallet before part 1, so the same request_id (with the same parts and max_delay_minutes) continues after a restart and never sends a part twice; the answer's privateSend lists each part (state, amount, when it may go, transactions), sentAtomic, and remainingAtomic. The user confirms the whole send once. Each part is a full unshield, so it takes as long as one, and the facilitator pays the network fee of each. Privacy limit (tell the user): every part goes to the SAME \`to\`, so anyone who adds up that address's incoming transfers sees the total; the parts hide the time and the single amount of the exit, not the sum the address received. wallet_cancel with the same request_id stops the parts not sent yet (their value stays in the shielded balance); while a part is being sent, that call waits for the part to finish, up to about ${CALL_BUDGET_MS / 1e3} s.` },
         max_delay_minutes: { type: "integer", minimum: 0, maximum: 60, description: "Optional, default 0: each part, part 1 included, is sent after a random wait of up to this many minutes (a private send)." }
       },
       additionalProperties: false
@@ -132164,7 +132180,7 @@ ${canonical5}`;
   async function confirmTransfer(request, quote, decimals) {
     const usdcOut = usdcText2(BigInt(quote.outAtomic));
     const usdcMin = usdcText2(BigInt(quote.minOutAtomic));
-    const amount = formatAtomic(BigInt(request.amountAtomic), decimals);
+    const amount = usdcText2(request.amountAtomic, decimals);
     const message = `Sell ${amount} of token ${request.tokenMint} for about ${usdcOut} USDC (at least ${usdcMin}; price impact ${(Number(quote.priceImpactPct) * 100).toFixed(2)} %), shield it, and send it to ${request.to} as ${request.parts} parts, each after a random wait of up to ${request.maxDelayMinutes} min? The address receives USDC, not the token.`;
     const askedAt = Date.now();
     try {
@@ -132573,9 +132589,9 @@ ${canonical5}`;
   const moreTokens = (maxTokens) => Math.max(1024, 2 * maxTokens);
   const torRefusal = () => refuse12(
     "inference_tor_required",
-    "inference sends the prompt to the AI provider and the company that runs the model, so this wallet sends it only from a --tor or --proxy run, where they see the proxy's exit and not this machine's IP. This MCP server was started without --tor or --proxy; nothing was sent or paid",
-    // The exact npm version when this wallet knows it (npmVersion: stdioServer.mjs walletVersion().npm; the owner's pin, 2026-10-23).
-    `Tell the user to add --tor to this MCP server's launch line in the host (for example \`npx -y --no-audit --no-fund ${npxPackageWord(npmVersion)} mcp --tor\`, with Tor's HTTPTunnelPort 127.0.0.1:9080 on), or --proxy http://host:port for an HTTP proxy they trust, then restart the server and call inference_chat again`
+    "inference sends the prompt to the AI provider and the company that runs the model, so this wallet sends it only over Tor (or a proxy the user trusts), where they see the exit and not this machine's IP. This wallet runs without Tor; nothing was sent or paid",
+    // docs/mcp/TOR.md: no flag name, port number or torrc in an agent-app answer outside the one command (here the setup line).
+    `Tell the user: private AI runs only over Tor, and this wallet runs without Tor. To turn Tor on, the user runs ${terminalCommand("setup --yes --prefer-tor")} once in a terminal (it records Tor and checks the wallet's files again; nothing else changes), then reconnects the wallet (${RESTART_STEPS}), and asks again`
   );
   const inferenceModels = {
     name: "inference_models",
@@ -133460,6 +133476,17 @@ function createSetupTools({
         recoveryFile ? { recoveryFile } : void 0
       );
     }
+    if (job.state === "no_tor") {
+      const torBrowser = job.torBrowser === true;
+      job = void 0;
+      const start = torStart();
+      return refuse12(
+        "tor_not_running",
+        `the user chose Tor in the setup question, and Tor is not running on this computer (nothing answers at the wallet's local Tor connection${torBrowser ? "; Tor Browser is open, but it does not give the kind of connection the wallet needs" : ""}); nothing was created or paid`,
+        `Tell the user: ${torBrowser ? "Tor Browser is open, but the wallet needs its own Tor connection. Run the command below." : "Tor hides your IP address, and it is not running on this computer."} Show torStartCommand in one code block, to copy into ${start.where}: this command downloads Tor and starts it for the wallet (more about Tor: https://www.torproject.org). If you can run commands here, offer to run it for the user. Then the user asks again to set up the wallet: it then sets up over Tor and always runs over Tor. Or, to set up without Tor, the user asks again and unticks "${SETUP_TOR_TITLE}" in the question`,
+        { torStartCommand: start.command }
+      );
+    }
     if (job.state === "declined") {
       const unshown = job.unshown === true;
       job = void 0;
@@ -133487,19 +133514,11 @@ function createSetupTools({
       wallet: summary.wallet.status,
       ...summary.wallet.recoveryFile ? { recoveryFile: summary.wallet.recoveryFile, solanaFeePayer: summary.wallet.solanaFeePayer } : {}
     });
-    if (job.state === "restart" && privateInference && job.failure.error === "setup_tor_needs_restart") {
-      return json3({
-        ...doneFacts(job.summary),
-        privateInference: true,
-        restartNeeded: true,
-        next: `The wallet is ready.${recoveryNext(job.summary)}${PRIVATE_INFERENCE_NEXT}`
-      });
-    }
     if (job.state === "restart") {
       return refuse12(
         "mcp_setup_restart_needed",
         `the wallet is set up, but this MCP server could not start the wallet tools in place (reason: ${job.failure.detail}); nothing was paid or moved`,
-        "Tell the user to restart this MCP server in the host (or restart the host app); the wallet tools start then",
+        `Tell the user: ${RESTART_STEPS}; the wallet tools start then`,
         { stage: "done" }
       );
     }
@@ -133507,15 +133526,16 @@ function createSetupTools({
       const summary = job.summary;
       return json3({
         ...doneFacts(summary),
+        ...summary.tor === true ? { tor: true } : {},
         ...privateInference ? { privateInference: true } : {},
-        next: `The wallet tools are live in this server: call wallet_balance.${recoveryNext(summary)} To add funds, call wallet_shield after the user sends USDC to solanaFeePayer (no SOL needed), or call wallet_add_funds: it gives a one-time address for any amount from 0.01 USDC. After the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes.` + (privateInference ? " Private inference is on: after funding, call inference_chat (with no prompt it lists the models and prices); if this server was started with --no-tor, restart it without --no-tor so it runs behind Tor (inference_chat refuses until then)." : "")
+        next: `The wallet tools are live in this server: call wallet_balance.${recoveryNext(summary)}` + (summary.tor === true ? " Setup ran over Tor, and the wallet runs over Tor: the servers it talks to do not see this computer's IP address." : "") + (summary.wallet.solanaFeePayer ? " To add funds, call wallet_shield after the user sends USDC to solanaFeePayer (no SOL needed), or call" : " To add funds, call") + " wallet_add_funds: it gives a one-time address for any amount from 0.01 USDC. After the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes." + (privateInference ? " Private inference is on: after funding, call inference_chat (with no prompt it lists the models and prices); if this server was started with --no-tor, restart it without --no-tor so it runs behind Tor (inference_chat refuses until then)." : "")
       });
     }
     return json3({ ok: true, stage: job.stage, ...job.progress ? { progress: job.progress } : {}, next: SETUP_POLL_NEXT });
   }
   async function confirm2(plan) {
     const limit = (atomic4) => String(atomic4) === NO_LIMIT_ATOMIC2 ? "no limit" : `${usdc9(atomic4)} USDC`;
-    const message = `Create a Shinjuku Shield wallet on this machine (spending limits: ${limit(plan.maxPaymentAtomic)} per payment, ${limit(plan.maxSessionAtomic)} in any 24 hours)? The keys and a random passphrase stay in private files on this machine. Optional: tick "Use private inference for your AI now". ${PRIVATE_INFERENCE_WHY} It records Tor for this server (Tor must run with HTTPTunnelPort 127.0.0.1:9080).`;
+    const message = `Create a Shinjuku Shield wallet on this machine (spending limits: ${limit(plan.maxPaymentAtomic)} per payment, ${limit(plan.maxSessionAtomic)} in any 24 hours)? The keys and a random passphrase stay in private files on this machine.`;
     const askedAt = Date.now();
     try {
       const answer = await client.elicit({
@@ -133524,15 +133544,17 @@ function createSetupTools({
           type: "object",
           properties: {
             confirm: { type: "boolean", title: "Create the wallet", description: message, default: true },
-            privateInference: { type: "boolean", title: "Use private inference for your AI now", description: PRIVATE_INFERENCE_WHY, default: false }
+            tor: { type: "boolean", title: SETUP_TOR_TITLE, description: `${SETUP_TOR_WHY} Setup downloads the wallet's files over Tor too.`, default: true },
+            privateInference: { type: "boolean", title: "Use private inference for your AI now", description: `${PRIVATE_INFERENCE_WHY} It needs Tor, so it turns Tor on.`, default: false }
           },
           required: ["confirm"]
         }
       }, elicitTimeoutMs);
       const ok = answer?.action === "accept" && answer?.content?.confirm !== false;
-      return { ok, privateInference: answer?.content?.privateInference === true, unshown: !ok && elicitUnshown(askedAt, answer) };
+      const privateInference = answer?.content?.privateInference === true;
+      return { ok, privateInference, tor: answer?.content?.tor !== false || privateInference, unshown: !ok && elicitUnshown(askedAt, answer) };
     } catch (error) {
-      return { ok: false, privateInference: false, unshown: error?.timedOut !== true && elicitUnshown(askedAt) };
+      return { ok: false, privateInference: false, tor: false, unshown: error?.timedOut !== true && elicitUnshown(askedAt) };
     }
   }
   async function begin() {
@@ -133555,10 +133577,16 @@ function createSetupTools({
         log(`MCP_SETUP_DECLINED${answer.unshown ? " unshown=true" : ""}`);
         return;
       }
+      if (answer.tor && !inTorRun() && await localTorProof(TOR_HTTP_TUNNEL) === "refused") {
+        job.torBrowser = await localTorProof(TOR_BROWSER_PORT) !== "refused";
+        job.state = "no_tor";
+        log(`MCP_SETUP_NO_TOR${job.torBrowser ? " tor-browser=open" : ""}`);
+        return;
+      }
       job.state = "running";
       job.stage = "starting";
       job.privateInference = answer.privateInference;
-      log("MCP_SETUP_STARTED");
+      log(`MCP_SETUP_STARTED tor=${answer.tor}`);
       try {
         job.summary = await setup.run((stage, progress3) => {
           if (stage === "wallet-created" && progress3?.recoveryFile) {
@@ -133567,7 +133595,7 @@ function createSetupTools({
           }
           job.stage = stage;
           job.progress = progress3;
-        }, { privateInference: answer.privateInference });
+        }, { privateInference: answer.privateInference, tor: answer.tor });
       } catch (error) {
         job.failure = failure2(error, "mcp_setup_failed");
         job.state = "failed";
@@ -133593,7 +133621,7 @@ function createSetupTools({
   const setupTool = {
     name: "shinjuku_setup",
     title: "Set up the Shinjuku Shield wallet",
-    description: "The wallet is not set up on this machine yet. Call this when the user wants to pay an x402 URL, check a balance, or shield USDC. It asks the user to confirm in this client (with the spending caps), then creates a self-custody wallet on this machine (keys and a random passphrase in private local files; no tool takes or returns them), downloads and checks the proof tools (about 191 MB, minutes), and switches this server to the wallet tools. Takes no arguments. Call it again with no arguments as `next` says for the stage (confirming, platform, release, passphrase, wallet, proof-tools, config, done). A decline creates nothing (mcp_setup_declined). A client that cannot confirm is refused (mcp_setup_needs_terminal) with the terminal command; a client that declines at once without showing the dialog gets mcp_setup_declined with the same terminal command.",
+    description: "The wallet is not set up on this machine yet. Call this when the user wants to pay an x402 URL, check a balance, or shield USDC. It asks the user to confirm in this client (with the spending caps), then creates a self-custody wallet on this machine (keys and a random passphrase in private local files; no tool takes or returns them), downloads and checks the proof tools (about 191 MB, minutes), and switches this server to the wallet tools. Takes no arguments. Call it again with no arguments as `next` says for the stage (confirming, tor, platform, release, passphrase, wallet, proof-tools, config, done). A decline creates nothing (mcp_setup_declined). A client that cannot confirm is refused (mcp_setup_needs_terminal) with the terminal command; a client that declines at once without showing the dialog gets mcp_setup_declined with the same terminal command.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     run: () => begin()
@@ -133628,11 +133656,11 @@ function createSetupTools({
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     // Hidden after setup are hidden here too (callable by name, not listed).
     ...MCP_HIDDEN_TOOL_NAMES.includes(name) ? { hidden: true } : {},
-    // After setup, a switch that could not happen in place (Tor, or the wallet did not open) keeps every money tool refused.
+    // After setup, a switch that could not happen (the wallet did not open, or its server behind Tor did not start) keeps every money tool refused.
     run: async () => job?.state === "restart" ? refuse12(
       "mcp_setup_restart_needed",
       `the wallet is set up, but this MCP server could not start the wallet tools in place (reason: ${job.failure.detail}); nothing was paid or moved`,
-      "Tell the user to restart this MCP server in the host (or restart the host app); the wallet tools start then",
+      `Tell the user: ${RESTART_STEPS}; the wallet tools start then`,
       { stage: "done" }
     ) : refuse12(
       "wallet_not_set_up",
@@ -133646,9 +133674,32 @@ function createSetupTools({
     description: "The wallet is set up and its tools are live. Answers the setup summary; it never creates a second wallet.",
     run: async () => job ? status() : json3({ ok: true, stage: "done", walletReady: true, next: "call wallet_balance" })
   };
-  return { tools: [setupTool, statusTool, ...MCP_TOOL_NAMES.map((name) => name === "x402_discover" ? discoverTool(discoverCacheDir) : notSetUp(name))], doneTool };
+  const discoverNow = inTorRun();
+  const discoverAfterSetup = () => {
+    const tool = notSetUp("x402_discover");
+    return {
+      ...tool,
+      description: "Finds x402 sellers after setup. Before setup it sends nothing: setup first asks the user whether to use Tor, which hides this computer's IP address from the servers that list sellers. Call shinjuku_setup first.",
+      run: async (args) => job?.state === "restart" ? tool.run(args) : refuse12(
+        "wallet_not_set_up",
+        "x402_discover asks Shinjuku and other servers for their seller lists, and they would see this computer's IP address before the user chose whether to use Tor; nothing was sent",
+        "Tell the user: set up the wallet first; setup asks one question, whether to use Tor (it hides your IP address). Then call shinjuku_setup; after setup, call x402_discover again",
+        ...job ? [{ stage: job.stage }] : []
+      )
+    };
+  };
+  const sayOnRefusal = (tool) => ({ ...tool, run: async (args, ctx) => {
+    const output2 = await tool.run(args, ctx);
+    const text3 = typeof output2?.text === "string" ? output2.text : output2?.content?.[0]?.text;
+    return typeof text3 === "string" && /^\s*\{\s*"ok"\s*:\s*false\b/.test(text3) ? addSay(output2, tool.name, { npmVersion }) : output2;
+  } });
+  const discover = discoverNow ? withSay(discoverTool(discoverCacheDir), { npmVersion }) : sayOnRefusal(discoverAfterSetup());
+  return {
+    tools: [sayOnRefusal(setupTool), statusTool, ...MCP_TOOL_NAMES.map((name) => name !== "x402_discover" ? sayOnRefusal(notSetUp(name)) : discover)],
+    doneTool: sayOnRefusal(doneTool)
+  };
 }
-var import_web3133, shownCaps, RELEASE_RETRY_MS, STAGE_WORDS, stageWords, INTERNAL_BALANCE_DETAIL, shownBreakdown, sessionLeftShown, TOKEN_UNIT_TOOLS, RESOURCE_PAYMENT_WAL_PREFIX2, POOL_LAYOUT_CODE, POOL_LAYOUT_UPDATE, USEPOD_VIA_INFERENCE_CHAT, SEND_RUNS_ON, DEPOSIT_RUNS_ON, CLI_FUNDS_PLAN_PREFIX, CLI_FUNDS_SCHEMA, SELF_PAY_ORIGIN3, REQUEST_ID4, POSITIVE_ATOMIC6, PRIVATE_HOST3, FORBIDDEN_HEADERS3, MAX_BODY_BYTES2, PREVIEW_TIMEOUT_MS, PREVIEW_SELLER_READ_MS, CALL_BUDGET_MS, budgetLeft, MONEY_FIRST_ANSWER_MS, BALANCE_AFTER_LANDING_MS, JOIN_CALL_MAX_MS, JOIN_NUDGE_QUIET_MS, JOIN_STEP_MS, sleep2, PROGRESS_EVERY_MS2, READ_BUDGET_MS, UNPAID_TOR_TRY_MS, UNPAID_CLEAR_MS, READ_BUDGET_TOOLS, FLOAT_BUSY_CODES, RETRY_MARGIN_MS, ASK_PAY_CODES, runningNpmVersion, terminalCommand, capPlaceWords, capRaiseText, cheaperSellerText, limitNext, SAFE_TEXT, MCP_TOOL_ALIASES, POOL_SWITCH_WHY, POOL_SWITCH_NEXT, SWITCH_STATES, quietSwitch, switchKey, ATOMIC_TEXT, FLOAT_ID, ANSWERED_EXIT_RETRY_MS, ANSWERED_EXIT_UNCONFIRMED_MS, ANSWERED_EXIT_RETRY_WINDOW_MS, ANSWERED_EXIT_CLOSED, switchAmount, switchEta, switchRows, OWNER_CAP_CODES, JOIN_END_MCP, JOIN_END_TERMINAL_LIBRARY, JOIN_RETRY_BACKOFF_MS, WALLET_CAP_FIX, MCP_CAP_FIX, capFix, ownerOnlyNext, mcpNext, CONFIDENTIAL_RETIRED, json3, answerResult, discoverTool, refuse12, publicOffer, FLOAT_PAID_CODES, FLOAT_PRIVATE_LEG, floatStillSettling, MONEY_ID2, toRecordId, linkKindOf, moneyId, REFUSED_CODES, refusedCodeOf, PLAIN_REASONS, plainReason, KEPT_SEND_TRIES, shownId, isSplitSend, sendPartId, PROMISED_NEXT, PUBLIC_READ_TIMEOUT_MS, withTimeout, ownKey, readFailure, OWN_KEY_TOKENS_MAX, OWN_TOKENS_GRACE_MS, tokenAmountText, elsewhereId, AGENT_ID_SCHEMA, agentIdName, minutesText2, ageWords2, DEPOSIT_SENT_STATES, depositLanded, usdcText2, walkWalletHistory, REFRESH_LEASE_WALK_MS, HOME_MARKS_SETTLED_MS2, AUTO_BACKUPS_KEPT, AUTO_BACKUP_NAME, AUTO_BACKUP_VERIFIED, FRONTED_SETTLE_MARGIN_SLOTS, BALANCE_REFRESH_WAIT_MS, BALANCE_REFRESH_GRACE_MS, BALANCE_REFRESH_LONG_MS, INBOUND_REFRESH_AGE_MS, CAP_BALANCE_WAIT_MS, CAP_BALANCE_RETRY_MS, REFRESH_RETRY_MS, FINALITY_POLL_MS, FINALITY_WAIT_MS, FINALITY_REFRESH_LIMIT_MS, POOL_WATCH_MS, POOL_WATCH_POLL_MS, EARLY_BALANCE_DELAY_MS, FINALITY_SETTLE_WINDOW_SLOTS, PUBLIC_READ_ANSWER_MS, SWITCH_WAIT_MS, UNSHIELD_TO_NO_USDC_DETAIL, UNSHIELD_TO_INVALID_NEXT, INFERENCE_MIN_MAX_TOKENS, ELICIT_TIMEOUT_MS, ELICIT_UNSHOWN_MS, elicitUnshown, POLL_SECONDS3, TRANSFER_CHANGE_READ_MS, TEMP_CLEAN_DELAY_MS, KEPT_ON_DISK, MAX_SHIELDED_BALANCE_ATOMIC, receiveGenerator, MCP_TOOL_NAMES, MCP_HIDDEN_TOOL_NAMES, setupTerminalNext, SETUP_POLL_NEXT, PRIVATE_INFERENCE_WHY, PRIVATE_INFERENCE_NEXT;
+var import_web3133, shownCaps, RELEASE_RETRY_MS, STAGE_WORDS, stageWords, INTERNAL_BALANCE_DETAIL, shownBreakdown, sessionLeftShown, TOKEN_UNIT_TOOLS, RESOURCE_PAYMENT_WAL_PREFIX2, POOL_LAYOUT_CODE, POOL_LAYOUT_UPDATE, USEPOD_VIA_INFERENCE_CHAT, SEND_RUNS_ON, DEPOSIT_RUNS_ON, CLI_FUNDS_PLAN_PREFIX, CLI_FUNDS_SCHEMA, SELF_PAY_ORIGIN3, REQUEST_ID4, POSITIVE_ATOMIC6, PRIVATE_HOST3, FORBIDDEN_HEADERS3, MAX_BODY_BYTES2, PREVIEW_TIMEOUT_MS, PREVIEW_SELLER_READ_MS, CALL_BUDGET_MS, budgetLeft, MONEY_FIRST_ANSWER_MS, BALANCE_AFTER_LANDING_MS, JOIN_CALL_MAX_MS, JOIN_NUDGE_QUIET_MS, JOIN_STEP_MS, sleep2, PROGRESS_EVERY_MS2, READ_BUDGET_MS, UNPAID_TOR_TRY_MS, UNPAID_CLEAR_MS, READ_BUDGET_TOOLS, FLOAT_BUSY_CODES, RETRY_MARGIN_MS, ASK_PAY_CODES, runningNpmVersion, terminalCommand, capPlaceWords, capRaiseText, cheaperSellerText, limitNext, SAFE_TEXT, MCP_TOOL_ALIASES, POOL_SWITCH_WHY, POOL_SWITCH_NEXT, SWITCH_STATES, quietSwitch, switchKey, ATOMIC_TEXT, FLOAT_ID, ANSWERED_EXIT_RETRY_MS, ANSWERED_EXIT_UNCONFIRMED_MS, ANSWERED_EXIT_RETRY_WINDOW_MS, ANSWERED_EXIT_CLOSED, switchAmount, switchEta, switchRows, OWNER_CAP_CODES, JOIN_END_MCP, JOIN_END_TERMINAL_LIBRARY, JOIN_RETRY_BACKOFF_MS, WALLET_CAP_FIX, MCP_CAP_FIX, capFix, ownerOnlyNext, mcpNext, CONFIDENTIAL_RETIRED, json3, answerResult, discoverTool, refuse12, publicOffer, FLOAT_PAID_CODES, FLOAT_PRIVATE_LEG, floatStillSettling, MONEY_ID2, toRecordId, linkKindOf, moneyId, REFUSED_CODES, refusedCodeOf, PLAIN_REASONS, plainReason, KEPT_SEND_TRIES, shownId, isSplitSend, sendPartId, PROMISED_NEXT, PUBLIC_READ_TIMEOUT_MS, RECIPIENT_CHECK_TIMEOUT_MS, withTimeout, ownKey, readFailure, OWN_KEY_TOKENS_MAX, OWN_TOKENS_GRACE_MS, tokenAmountText, elsewhereId, AGENT_ID_SCHEMA, agentIdName, minutesText2, ageWords2, DEPOSIT_SENT_STATES, depositLanded, usdcText2, walkWalletHistory, REFRESH_LEASE_WALK_MS, HOME_MARKS_SETTLED_MS2, AUTO_BACKUPS_KEPT, AUTO_BACKUP_NAME, AUTO_BACKUP_VERIFIED, FRONTED_SETTLE_MARGIN_SLOTS, BALANCE_REFRESH_WAIT_MS, BALANCE_REFRESH_GRACE_MS, BALANCE_REFRESH_LONG_MS, INBOUND_REFRESH_AGE_MS, CAP_BALANCE_WAIT_MS, CAP_BALANCE_RETRY_MS, REFRESH_RETRY_MS, FINALITY_POLL_MS, FINALITY_WAIT_MS, FINALITY_REFRESH_LIMIT_MS, POOL_WATCH_MS, POOL_WATCH_POLL_MS, EARLY_BALANCE_DELAY_MS, FINALITY_SETTLE_WINDOW_SLOTS, PUBLIC_READ_ANSWER_MS, SWITCH_WAIT_MS, UNSHIELD_TO_NO_USDC_DETAIL, UNSHIELD_TO_INVALID_NEXT, INFERENCE_MIN_MAX_TOKENS, ELICIT_TIMEOUT_MS, ELICIT_UNSHOWN_MS, elicitUnshown, POLL_SECONDS3, TRANSFER_CHANGE_READ_MS, TEMP_CLEAN_DELAY_MS, KEPT_ON_DISK, MAX_SHIELDED_BALANCE_ATOMIC, receiveGenerator, MCP_TOOL_NAMES, MCP_HIDDEN_TOOL_NAMES, setupTerminalNext, SETUP_POLL_NEXT, PRIVATE_INFERENCE_WHY, RESTART_STEPS, TOR_BROWSER_PORT, SETUP_TOR_TITLE, SETUP_TOR_WHY;
 var init_tools = __esm({
   "wallet/src/mcp/tools.mjs"() {
     "use strict";
@@ -133976,6 +134027,7 @@ var init_tools = __esm({
     sendPartId = (requestId) => (index) => `mp${index}-${toRecordId(requestId)}`;
     PROMISED_NEXT = "Nothing was sent. Part of the shielded balance is promised to the unsent parts of a private send. Wait until that send is done (wallet_unshield with its request_id shows its parts), or stop its unsent parts with wallet_cancel and its request_id, then call wallet_unshield again with the same arguments; or send at most freeAtomic now with a NEW request_id";
     PUBLIC_READ_TIMEOUT_MS = 3e4;
+    RECIPIENT_CHECK_TIMEOUT_MS = 8e3;
     withTimeout = (promise, ms) => Promise.race([
       promise,
       new Promise((_, reject) => {
@@ -134080,10 +134132,13 @@ var init_tools = __esm({
       "inference_models",
       "wallet_receive_shielded"
     ]);
-    setupTerminalNext = () => `Tell the user to run \`${terminalCommand("setup")}\` in a terminal on this machine, then restart this MCP server in the host`;
+    setupTerminalNext = () => `Tell the user to run \`${terminalCommand("setup")}\` in a terminal on this machine, then reconnect the wallet (${RESTART_STEPS})`;
     SETUP_POLL_NEXT = `call shinjuku_setup again in ${POLL_SECONDS3} s for the status (it never creates a second wallet)`;
     PRIVATE_INFERENCE_WHY = "Your agent then buys AI answers from an AI provider, paid from your private balance over Tor; the AI provider and the company that runs the model see the prompt, not who paid.";
-    PRIVATE_INFERENCE_NEXT = " Private inference is on: config.json records Tor, so restart this MCP server in the host now; it then runs behind Tor (Tor must run with HTTPTunnelPort 127.0.0.1:9080), and until then every wallet tool and inference_chat stay refused. After the restart: fund the wallet with wallet_add_funds (it gives a one-time address; after the user sends USDC there from any wallet, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes), then call inference_chat (with no prompt it lists the models; a short qwen3-8-flash answer costs about 0.001 USDC, 0.011 USDC when the AI provider offers only its standard payment). For another agent app, call inference_server: it starts the local AI address and gives its base_url and api key.";
+    RESTART_STEPS = "In Claude Code: type /mcp, pick shinjuku-shielded, and choose Reconnect. In Claude Desktop: quit it and open it again. In another app: restart it";
+    TOR_BROWSER_PORT = "http://127.0.0.1:9150";
+    SETUP_TOR_TITLE = "Use Tor?";
+    SETUP_TOR_WHY = "It hides your IP address from the payment service and sellers.";
   }
 });
 
@@ -134202,7 +134257,7 @@ function createMcpDispatcher({ tools, instructions: instructions2 = INSTRUCTIONS
   };
 }
 function serveStdio({ input, output: output2, dispatch, log = () => {
-}, client }) {
+}, client, forward = () => false }) {
   const inFlight = /* @__PURE__ */ new Set();
   const write = (message) => {
     if (message === void 0) return;
@@ -134248,6 +134303,7 @@ function serveStdio({ input, output: output2, dispatch, log = () => {
       write(parseError);
       return;
     }
+    if (forward(text3, message)) return;
     if (takeResponse(message)) return;
     const task = (async () => {
       if (Array.isArray(message)) {
@@ -135099,6 +135155,70 @@ function startProofToolsRefresh({
     clearTimeout(retry);
   };
 }
+function startTorRelay({ spawn: spawn10, initParams, output: output2, log, rewrite = (line) => line, readyMs = TOR_RELAY_READY_MS }) {
+  const child = spawn10();
+  let ready = false;
+  let settle;
+  const answered2 = new Promise((resolvePromise, rejectPromise) => {
+    settle = { resolve: resolvePromise, reject: rejectPromise };
+  });
+  const exited = new Promise((resolvePromise) => {
+    child.on("error", (error) => {
+      log(`MCP_TOR_RELAY_SPAWN_FAILED ${error?.code ?? error?.name ?? "Error"}`);
+      resolvePromise(1);
+    });
+    child.on("exit", (code2, signal) => resolvePromise(code2 ?? (signal ? 1 : 0)));
+  });
+  exited.then((code2) => {
+    if (!ready) settle.reject(new Error(`setup_tor_wallet_ended: the wallet server behind Tor ended (exit code ${code2}) before it answered; its own lines are in this server's log`));
+  });
+  const timer = setTimeout(() => settle.reject(new Error(`setup_tor_wallet_slow: the wallet server behind Tor gave no answer in ${readyMs / 1e3} s`)), readyMs);
+  timer.unref?.();
+  let buffer = "";
+  child.stdout.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    buffer += chunk;
+    let newline;
+    while ((newline = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, newline);
+      buffer = buffer.slice(newline + 1);
+      if (!line.trim()) continue;
+      if (!ready) {
+        let message;
+        try {
+          message = JSON.parse(line);
+        } catch {
+          message = void 0;
+        }
+        if (message?.id === RELAY_INIT_ID) {
+          ready = true;
+          clearTimeout(timer);
+          settle.resolve();
+          continue;
+        }
+      }
+      output2.write(`${rewrite(line)}
+`);
+    }
+  });
+  child.stdin.on("error", () => {
+  });
+  const write = (line) => {
+    if (child.stdin.writable) child.stdin.write(`${line}
+`);
+  };
+  write(JSON.stringify({
+    jsonrpc: "2.0",
+    id: RELAY_INIT_ID,
+    method: "initialize",
+    params: initParams ?? { protocolVersion: SUPPORTED_PROTOCOL_VERSIONS[0], capabilities: {}, clientInfo: { name: "shinjuku-setup-relay", version: "1" } }
+  }));
+  write(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }));
+  return answered2.then(() => ({ write, end: () => child.stdin.end(), exited }), (error) => {
+    child.kill("SIGTERM");
+    throw error;
+  });
+}
 async function runSetupModeServer({
   setupTools,
   startNormal,
@@ -135106,13 +135226,13 @@ async function runSetupModeServer({
   output: output2 = process.stdout,
   errorOutput = process.stderr,
   updateCheck,
-  discoverCacheDir,
   launchNotice
 }) {
   const log = (line) => errorOutput.write(`${line}
 `);
   const client = createClientBridge();
-  const notice = startUpdateNotice({ log, ...updateCheck !== void 0 ? { check: updateCheck } : {} });
+  const startNotice = (facilitator) => startUpdateNotice({ facilitator, log, ...updateCheck !== void 0 ? { check: updateCheck } : {} });
+  let notice = startUpdateNotice({ log, check: false });
   const saved = { log: console.log, info: console.info, debug: console.debug };
   const toStderr = (...parts) => console.error(...parts);
   console.log = toStderr;
@@ -135122,11 +135242,48 @@ async function runSetupModeServer({
   let doneTool;
   let current;
   let ended;
+  let initParams;
+  let relay;
+  let relayStopped;
+  const relayEnded = new Promise((resolvePromise) => {
+    relayStopped = resolvePromise;
+  });
+  const listIds = /* @__PURE__ */ new Set();
+  const withDoneTool = (line) => {
+    if (!doneTool || !listIds.size) return line;
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return line;
+    }
+    if (!listIds.delete(message?.id) || !Array.isArray(message?.result?.tools)) return line;
+    const listed = {
+      name: doneTool.name,
+      title: doneTool.title,
+      description: doneTool.description,
+      inputSchema: doneTool.inputSchema,
+      annotations: { title: doneTool.title, ...doneTool.annotations }
+    };
+    return JSON.stringify({ ...message, result: { ...message.result, tools: [...message.result.tools.filter((tool) => tool?.name !== doneTool.name), listed] } });
+  };
   const stopKeepWarm = startOnionKeepWarm();
   const activate = async () => {
-    if (wallet) return;
+    if (wallet || relay) return;
     const options = await startNormal();
+    if (options.relay) {
+      relay = await startTorRelay({ spawn: options.relay, initParams, output: output2, log, rewrite: withDoneTool });
+      relay.exited.then((code2) => {
+        log(`MCP_TOR_RELAY_ENDED code=${code2}`);
+        relayStopped();
+      });
+      current = createMcpDispatcher({ tools: doneTool ? [doneTool] : [], instructions: INSTRUCTIONS, log, client, listChanged: true });
+      log("MCP_SETUP_SWITCHED to the wallet server behind Tor");
+      client.notify?.("notifications/tools/list_changed");
+      return;
+    }
     wallet = await openWalletServer({ ...options, client, log });
+    notice = startNotice(options.memoServiceUrl);
     current = createMcpDispatcher({
       tools: withLaunchNotice(notice.wrapTools([...wallet.tools, ...doneTool ? [doneTool] : []], UPDATE_NOTICE_TOOLS), launchNotice),
       instructions: withLaunchLine(notice.instructions(INSTRUCTIONS), launchNotice),
@@ -135140,8 +135297,6 @@ async function runSetupModeServer({
   };
   try {
     const setup = setupTools({ client, log, activate });
-    if (discoverCacheDir) loadX402Listings({ cacheDir: discoverCacheDir }).catch(() => {
-    });
     doneTool = setup.doneTool;
     if (launchNotice) log(`MCP_LAUNCH_OLD_FORM ${launchNotice}`);
     current = createMcpDispatcher({
@@ -135153,15 +135308,30 @@ async function runSetupModeServer({
       listChanged: true
     });
     log("MCP_READY setup-mode: the wallet is not set up; tools: shinjuku_setup, wallet_status");
-    await serveStdio({ input, output: output2, dispatch: (entry) => current(entry), log, client });
+    const forward = (text3, message) => {
+      if (!relay) return false;
+      if (message?.method === "tools/call" && message.params?.name === "shinjuku_setup") return false;
+      if (message?.method === "tools/list" && validId(message.id)) listIds.add(message.id);
+      relay.write(text3);
+      return true;
+    };
+    const served = serveStdio({ input, output: output2, log, client, forward, dispatch: (entry) => {
+      if (entry?.method === "initialize") initParams = entry.params;
+      return current(entry);
+    } });
+    await Promise.race([served, relayEnded]);
   } finally {
     stopKeepWarm();
+    if (relay) {
+      relay.end();
+      await relay.exited;
+    }
     ended = wallet ? await closeWithin(wallet.close(), { moving: wallet.moving, movingWork: wallet.movingWork, historyBusy: closeHistoryBusy(wallet), log }) : true;
     Object.assign(console, saved);
   }
   return { closed: ended };
 }
-var import_web3134, SUPPORTED_PROTOCOL_VERSIONS, MAX_LINE_BYTES, POSITIVE_ATOMIC7, INSTRUCTIONS, MCP_LOG_LEVELS, POOL_SWITCH_LOG_LEVEL, validId, BUNDLED_SOURCE_DIR, SHA256_HEX, UPDATE_NOTICE_TOOLS, UPDATE_NOTICE_MAX_TEXT, NPM_VERSION2, GIT_COMMIT, ownWalletVersion, mcpServerVersion, UPDATE_NOTICE_TEXT, updateNoticeLine, LAUNCH_NOTICE_TOOLS, withLaunchLine, capRequired, setupInvalid, TOOL_ROOTS_WAIT_MS, ROOTS_FREE_TOOLS, MCP_CLOSE_BOUND_MS, MCP_CLOSE_HISTORY_BOUND_MS, MCP_CLOSE_UNREADABLE_BOUND_MS, MCP_CLOSE_POLL_MS, closeHistoryBusy, SETUP_INSTRUCTIONS;
+var import_web3134, SUPPORTED_PROTOCOL_VERSIONS, MAX_LINE_BYTES, POSITIVE_ATOMIC7, INSTRUCTIONS, MCP_LOG_LEVELS, POOL_SWITCH_LOG_LEVEL, validId, BUNDLED_SOURCE_DIR, SHA256_HEX, UPDATE_NOTICE_TOOLS, UPDATE_NOTICE_MAX_TEXT, NPM_VERSION2, GIT_COMMIT, ownWalletVersion, mcpServerVersion, UPDATE_NOTICE_TEXT, updateNoticeLine, LAUNCH_NOTICE_TOOLS, withLaunchLine, capRequired, setupInvalid, TOOL_ROOTS_WAIT_MS, ROOTS_FREE_TOOLS, MCP_CLOSE_BOUND_MS, MCP_CLOSE_HISTORY_BOUND_MS, MCP_CLOSE_UNREADABLE_BOUND_MS, MCP_CLOSE_POLL_MS, closeHistoryBusy, SETUP_INSTRUCTIONS, TOR_RELAY_READY_MS, RELAY_INIT_ID;
 var init_stdioServer = __esm({
   "wallet/src/mcp/stdioServer.mjs"() {
     "use strict";
@@ -135192,7 +135362,7 @@ var init_stdioServer = __esm({
     SUPPORTED_PROTOCOL_VERSIONS = Object.freeze(["2025-06-18", "2025-03-26", "2024-11-05"]);
     MAX_LINE_BYTES = 4 * 1024 * 1024;
     POSITIVE_ATOMIC7 = /^[1-9][0-9]{0,30}$/;
-    INSTRUCTIONS = `A self-custody Shinjuku Shield wallet on this machine; the keys and the passphrase stay in this process and no tool takes or returns them. Every tool answer starts with say: one plain sentence to tell the user; the other fields hold the exact numbers. Map the user's plain request to one tool: "what is my balance" -> wallet_balance; "add money" / "deposit" / "fund the wallet" / "move USDC in from Phantom, an exchange, or another wallet" -> wallet_add_funds (it answers a one-time Solana address; the user sends USDC to it from any wallet or exchange, and the money becomes private a few minutes after it arrives, at the next wallet call: no other step after the send); "shield the USDC on this wallet's own address" -> wallet_shield (only for public USDC already on that address, wallet_balance unshielded; to add money, use wallet_add_funds); "stop" / "cancel" -> wallet_cancel with the request_id of what to stop; "pay this URL" -> x402_pay (call it directly, no preview is needed: it checks the price against any limit the owner set when it pays and pays nothing above it); "what does this URL cost" -> x402_preview (only when the user asks for the price; it pays nothing); "find a paid API for X" -> x402_discover (the wallet starts downloading the public listings when it starts and keeps a copy for 10 minutes; a search with no fresh copy waits for the download: a few seconds on a fast link, up to a few minutes on a slow link or over Tor; your search words never leave this machine), then x402_pay on the url it found; "send 2 USDC to <address>" -> wallet_unshield. wallet_balance answers ONE balance (balanceAtomic; balance is the same amount in USDC); breakdown names its parts. x402_pay pays any x402 seller from that one balance: a seller that cannot take a private payment directly (Coinbase CDP, PayAI, ...) is paid through Shinjuku (the wallet pays Shinjuku privately, the seller's price plus a small fee, and Shinjuku pays the seller); x402_pay's answer shows priceAtomic, feeAtomic, and amountAtomic (the total), and max_payment (USDC text, like "0.05") or max_payment_atomic, when you pass one, must cover the total. If such a seller does not take the payment, the refund comes back to the balance by itself within about 7 minutes; nothing more to do. Tool arguments and fields ending in Atomic are atomic units (USDC: 1000000 = 1 USDC); tell the user amounts in USDC. The wallet does the upkeep by itself: it reads the chain when the local balance is stale and writes an encrypted backup after money moves; the user never runs a CLI command for this. wallet_shield, wallet_add_funds, and wallet_unshield can run for minutes in the background: call again with the SAME request_id (each answer shows it as requestId) as its next says; the same request_id never moves money twice. Pass your own request_id to x402_pay: a retry after a timeout with that same request_id never pays twice. wallet_unshield never sends to the wallet's own deposit address (that would link the send to the user's deposits); a send to an address the owner did not approve ahead asks the user to confirm it in this client first. When the owner set limits, x402_pay never pays more than the limit for one payment or, in any 24 hours, the limit for this wallet (all MCP processes together); with no limit set, the balance is the only bound. Never claim a payment happened unless the answer has a transaction. On an error code that ends in _retry_same_request, call x402_pay again with the SAME request_id: it never pays twice. Privacy: the chain does not show which wallet paid, but this MCP host and its model provider see every URL, body, price, and paid answer the agent handles. Pool switches: when a tool answer has a poolSwitch field with tellUser true, tell the user each poolSwitch.items[].message where tellUser is true, in plain words, once. The wallet moves the balance by itself; the user never needs to act. During a switch the balance stays one number (balanceAtomic). wallet_balance shows the details.`;
+    INSTRUCTIONS = `A self-custody Shinjuku Shield wallet on this machine; the keys and the passphrase stay in this process and no tool takes or returns them. Every tool answer starts with say: one plain sentence to tell the user; the other fields hold the exact numbers. Map the user's plain request to one tool: "what is my balance" -> wallet_balance; "add money" / "deposit" / "fund the wallet" / "move USDC in from Phantom, an exchange, or another wallet" -> wallet_add_funds (it answers a one-time address; the money becomes private a few minutes after it arrives, at the next wallet call); "shield the USDC on this wallet's own address" -> wallet_shield (only public USDC already there); "stop" / "cancel" -> wallet_cancel with the request_id of what to stop; "pay this URL" -> x402_pay (call it directly, no preview is needed); "what does this URL cost" -> x402_preview (only when the user asks for the price); "find a paid API for X" -> x402_discover, then x402_pay on the url it found; "send 2 USDC to <address>" -> wallet_unshield. wallet_balance answers ONE balance (balanceAtomic), and x402_pay pays any x402 seller from it (through Shinjuku for a seller that cannot take a private payment: max_payment must cover the total amountAtomic, fee included; a refund comes back by itself within about 7 minutes). Fields ending in Atomic are atomic units (USDC: 1000000 = 1 USDC); tell the user amounts in USDC. The wallet does its upkeep by itself (chain reads, encrypted backups); the user never runs a CLI command for it. wallet_shield, wallet_add_funds, and wallet_unshield can run for minutes: call again with the SAME request_id as next says. Pass your own request_id to x402_pay: the same request_id never pays or moves money twice (on a code that ends in _retry_same_request, call again with it). wallet_unshield never sends to the wallet's own deposit address; a send to an address the owner did not approve ahead asks the user to confirm it in this client first. When the owner set limits, x402_pay never pays above them (one payment, and any 24 hours for this wallet across all MCP processes); with none, the balance is the only bound. Never claim a payment happened unless the answer has a transaction. Privacy: the chain does not show which wallet paid, but this MCP host and its model provider see every URL, body, price, and paid answer the agent handles. When an item of an answer's poolSwitch.items[] has tellUser true, tell the user its message once, in plain words; the wallet moves the balance by itself.`;
     MCP_LOG_LEVELS = Object.freeze(["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"]);
     POOL_SWITCH_LOG_LEVEL = "info";
     validId = (id) => id === null || typeof id === "string" || typeof id === "number" && Number.isFinite(id);
@@ -135220,7 +135390,9 @@ var init_stdioServer = __esm({
     MCP_CLOSE_UNREADABLE_BOUND_MS = 6e4;
     MCP_CLOSE_POLL_MS = 500;
     closeHistoryBusy = (server) => () => compactHistoryReadsRunning() > 0 || memoReadsAheadRunning() > 0 || server.refreshOpen?.() === true;
-    SETUP_INSTRUCTIONS = `A self-custody Shinjuku Shield wallet server that is NOT SET UP on this machine yet. Every money tool answers wallet_not_set_up. When the user wants to pay, check a balance, or shield USDC, call shinjuku_setup: it asks the user to confirm in this client, then creates the wallet on this machine (the keys and a random passphrase stay in local files; no tool takes or returns them) and downloads and checks the proof tools. It takes minutes: call shinjuku_setup again as its answer's next says. When it answers stage done, the wallet tools are live in this same server (tools/list changes). ${INSTRUCTIONS}`;
+    SETUP_INSTRUCTIONS = `This Shinjuku Shield wallet server is NOT SET UP on this machine yet: every money tool answers wallet_not_set_up. When the user wants to pay, check a balance, or add money, call shinjuku_setup: it asks the user to confirm in this client, creates the wallet here, and downloads the proof tools (minutes: call it again as its next says). At stage done the wallet tools are live in this same server. After setup: ${INSTRUCTIONS}`;
+    TOR_RELAY_READY_MS = 18e4;
+    RELAY_INIT_ID = "shinjuku-wallet-relay-initialize";
   }
 });
 
@@ -135595,7 +135767,7 @@ async function serveTorMissingMcp({ message, recheck = async () => false, input
       ready = false;
     }
     const body = ready ? {
-      say: `Tor runs on this machine now, but this wallet started before it did. ${RESTART}.`,
+      say: "Tor runs now. Reconnect the wallet once (the steps are below), then ask again. Nothing was paid.",
       ok: false,
       error: "mcp_restart_needed",
       next: `Tell the user: ${RESTART}. Nothing was paid.`
@@ -135634,7 +135806,7 @@ var init_torMissingMcp = __esm({
     "use strict";
     init_stdioServer();
     init_tools();
-    RESTART = "Restart this MCP server in your app (or restart the app), then ask again";
+    RESTART = `Reconnect the wallet once (${RESTART_STEPS}), then ask again`;
   }
 });
 
@@ -159643,7 +159815,8 @@ var PublicFundsFailure = class extends Error {
 };
 var failure = (code2, text3) => new PublicFundsFailure(`p03_funds_${code2}: ${text3}`);
 var iso2 = (ms) => new Date(ms).toISOString();
-var usdc5 = (atomic4, decimals = 6) => formatAtomic(BigInt(atomic4), decimals);
+var plainUsdc = (text3) => text3.includes(".") ? text3.replace(/0+$/, "").replace(/\.$/, "") : text3;
+var usdc5 = (atomic4, decimals = 6) => plainUsdc(formatAtomic(BigInt(atomic4), decimals));
 var usdcFlag = usdcFlagText;
 var planName = (fundsId) => `${FUNDS_PLAN_PREFIX2}${fundsId}`;
 var lockPath = (walletFile) => `${walletFile}.add-funds.lock`;
@@ -159862,7 +160035,7 @@ function fundsView(store, plan, { now = Date.now(), running } = {}) {
 function fundsSummary(view2) {
   const privacy = `. Privacy: ${view2.privacy}`;
   const status = view2.status.endsWith(privacy) ? view2.status.slice(0, -privacy.length) : view2.status;
-  const total = view2.balance?.total ? ` (your balance now: ${view2.balance.total} USDC)` : "";
+  const total = view2.balance?.total ? ` (your balance now: ${plainUsdc(String(view2.balance.total))} USDC)` : "";
   return [
     view2.ready ? `add-funds ${view2.fundsId} is ready: ${view2.amount} was added to your shielded balance${total}.` : `add-funds ${view2.fundsId} is not ready yet: ${status}.`,
     `Next: ${view2.next}.`
@@ -159894,6 +160067,7 @@ function fundsStatusSummary(view2) {
 }
 var HELD = /^(shinjuku(?:-wallet)?\b.*\bfailed: |shinjuku(?:-wallet)?\b.*: waiting for funds, nothing failed \(|hint: |Help: |next: |Examples?:|Every flag: |  shinjuku(?:-wallet)? )/;
 var STEP_TOR_LINE = /^(?:tor|proxy): /;
+var DENOMINATION_WARNING = /^warning: no pool denomination is configured\b/;
 async function runStep(ctx, argv2) {
   if (ctx.signal.aborted) return { exit: 1, held: [], codes: [], details: {}, aborted: true };
   const file = join37(ctx.tempDir, `step-${randomBytes28(8).toString("hex")}.json`);
@@ -159919,7 +160093,7 @@ async function runStep(ctx, argv2) {
 `);
       return;
     }
-    if (ctx.quiet && isProgressLine(text3)) return;
+    if (ctx.quiet && (isProgressLine(text3) || DENOMINATION_WARNING.test(text3))) return;
     if (!text3.trim() || ctx.shown.has(text3)) return;
     ctx.shown.add(text3);
     ctx.io.err(`  ${text3}
@@ -161958,6 +162132,7 @@ async function runInferStop(values, deps) {
 var CHAT_RAW_ARGS = /* @__PURE__ */ Symbol("chat raw args");
 var WALLET_FROM_SETUP = /* @__PURE__ */ Symbol("wallet from setup");
 var RAN_BEHIND_TOR = /* @__PURE__ */ Symbol("ran behind tor");
+var SETUP_RERUN = /* @__PURE__ */ Symbol("setup rerun");
 var INFER_CAP_FLAGS = Object.freeze(["--max-payment", "--max-session"]);
 var RanBehindTorFailed = class extends Error {
   constructor(code2) {
@@ -162216,15 +162391,7 @@ function withProofToolsRefresh(options, fromConfig) {
 var inProxiedRun = (env) => childRunProxy(env).args.length > 0;
 var terminalQuiet = (values, deps) => deps.stdoutIsTTY?.() === true && !values.has("--json") && !values.has("--verbose");
 var TOR_RUN_STARTED_ENV2 = "SHINJUKU_WALLET_TOR_RUN_STARTED_FILE";
-var TOR_DOWN_DETAIL = "Your private connection (Tor) is not running, so no payment was made. Start Tor, then restart this MCP server in your agent host and try again.";
-var recordedTunnelHost = (configPath2) => {
-  try {
-    const tunnel = readSetupConfig(dirname33(configPath2))?.torTunnel;
-    return tunnel ? new URL(tunnel).host : "127.0.0.1:9080";
-  } catch {
-    return "127.0.0.1:9080";
-  }
-};
+var TOR_DOWN_DETAIL = "The wallet runs only over Tor, and Tor is not running on this computer (after the computer restarts, Tor must be started again), so nothing was paid or sent.";
 var recordedTunnelUrl = (configPath2) => {
   try {
     return readSetupConfig(dirname33(configPath2))?.torTunnel ?? TOR_HTTP_TUNNEL;
@@ -162232,11 +162399,18 @@ var recordedTunnelUrl = (configPath2) => {
     return TOR_HTTP_TUNNEL;
   }
 };
-var torDownNext = (configPath2) => `Tell the user: start Tor (its torrc needs HTTPTunnelPort ${recordedTunnelHost(configPath2)}), then restart this MCP server in the agent host (or restart the host app); the wallet tools start behind Tor then. Setup recorded Tor in ${configPath2}; a setup rerun keeps it. Nothing falls back to a direct connection. If Tor is not installed: ${torInstallText()}`;
+var torDownNext = (configPath2) => `Tell the user why: Tor is not running, and the wallet never falls back to a direct connection. Show torStartCommand in one code block, to copy into ${torStart().where}: this command downloads Tor and starts it for the wallet. If you can run commands here, offer to run it for the user. When Tor runs: ${RESTART}. (Setup recorded Tor in ${configPath2}.)`;
 async function runMcpTorDown({ exitCode, configPath: configPath2, input = process.stdin, output: output2 = process.stdout, errorOutput = process.stderr }) {
   const log = (line) => errorOutput.write(`${line}
 `);
-  const unavailable = JSON.stringify({ ok: false, error: "mcp_tor_unavailable", detail: TOR_DOWN_DETAIL, next: torDownNext(configPath2) }, null, 2);
+  const unavailable = JSON.stringify({
+    say: "Not paid: the wallet runs only over Tor, and Tor is not running on this computer. Start it with the command below.",
+    ok: false,
+    error: "mcp_tor_unavailable",
+    detail: TOR_DOWN_DETAIL,
+    next: torDownNext(configPath2),
+    torStartCommand: torStart().command
+  }, null, 2);
   const tunnel = recordedTunnelUrl(configPath2);
   const answer = async () => {
     let ready = false;
@@ -162246,7 +162420,7 @@ async function runMcpTorDown({ exitCode, configPath: configPath2, input = proces
       ready = false;
     }
     const restart = ready ? {
-      say: `Tor runs on this machine now, but this wallet started before it did. ${RESTART}.`,
+      say: "Tor runs now. Reconnect the wallet once (the steps are below), then ask again. Nothing was paid.",
       ok: false,
       error: "mcp_restart_needed",
       next: `Tell the user: ${RESTART}. Nothing was paid.`
@@ -162378,11 +162552,12 @@ async function runMcpFirstRun(values, deps) {
         discoverCacheDir: join40(home, "discover-cache"),
         npmVersion: deps.walletVersion().npm
       }),
-      discoverCacheDir: join40(home, "discover-cache"),
       startNormal: async () => {
         const after = mcpValuesAfterSetup(values, home, deps);
-        if (after.values.get(MCP_FROM_CONFIG).config.tor === true && !after.values.has("--no-tor") && !inProxiedRun(deps.env)) {
-          throw new Error("setup_tor_needs_restart: config.json asks for Tor, and this MCP server started without Tor, so it does not switch to the wallet tools in place; every money tool stays refused. Restart this MCP server in the host: it then starts behind Tor (Tor must run with HTTPTunnelPort 127.0.0.1:9080)");
+        const config = after.values.get(MCP_FROM_CONFIG).config;
+        if (config.tor === true && !after.values.has("--no-tor") && !inProxiedRun(deps.env)) {
+          const args = ["--tor", "mcp", ...after.values.get(MCP_RAW_ARGS), ...config.torTunnel ? ["--proxy", config.torTunnel] : []];
+          return { relay: () => deps.torChild(args, ["pipe", "pipe", "inherit"]) };
         }
         const options = withProofToolsRefresh(mcpServerOptions(after.values, after.deps), after.values.get(MCP_FROM_CONFIG));
         warm = options.proofToolsPath ? deps.startKeepWarm(options, deps.env) : void 0;
@@ -162410,14 +162585,45 @@ function mcpSetupAdapter(values, home, deps) {
     },
     missing: () => missingPieces(home, readSetupConfig(home)),
     // privateInference: the human ticked "Use private inference for your AI now" (a yes, as setup --private-inference);
-    // no tick keeps what config.json records.
-    run: async (onStage, { privateInference } = {}) => runSetupRecorded(
-      { ...setupOptionsOf(values, home), onStage },
-      setupDeps,
-      inferenceRecordOf(readSetupConfig(home), privateInference === true ? true : void 0)
-    )
+    // no tick keeps what config.json records. tor: the answer to "Use Tor?" (private inference turns it on). A server
+    // already behind Tor (or an old caller with no answer) sets up in place.
+    run: async (onStage, { privateInference, tor } = {}) => {
+      if (tor === true && !inProxiedRun(deps.env)) return mcpSetupBehindTor(values, home, deps, { privateInference: privateInference === true, onStage });
+      return runSetupRecorded(
+        { ...setupOptionsOf(values, home), ...typeof tor === "boolean" ? { tor } : {}, onStage },
+        setupDeps,
+        inferenceRecordOf(readSetupConfig(home), privateInference === true ? true : void 0)
+      );
+    }
   };
 }
+async function mcpSetupBehindTor(values, home, deps, { privateInference, onStage }) {
+  const caps = new Map(Object.entries(setupOptionsOf(values, home)).filter(([key]) => key !== "home").map(([key, value]) => [`--${key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`, value]));
+  onStage("tor", "setup runs over Tor: it makes the wallet and downloads its files (about 191 MB) over Tor, which takes a few minutes");
+  const child = deps.torChild(
+    ["--tor", "setup", "--yes", "--prefer-tor", ...privateInference ? ["--private-inference"] : [], ...setupArgvOf(caps)],
+    ["ignore", 2, 2]
+  );
+  const code2 = await new Promise((resolvePromise) => {
+    child.on("error", () => resolvePromise(1));
+    child.on("exit", (exitCode, signal) => resolvePromise(exitCode ?? (signal ? 1 : 0)));
+  });
+  const config = code2 === 0 ? setupConfigOf(home) : void 0;
+  if (!config) {
+    const made = setupConfigOf(home)?.recoveryFile;
+    if (made && existsSync(made)) onStage("wallet-created", { recoveryFile: made });
+    throw new Error(`setup_tor_unavailable: setup ran behind Tor, and that run ended with exit code ${code2} (its lines are in this server's log); nothing was paid. It continues where it stopped when it runs again`);
+  }
+  onStage("tor", "the wallet is made; its server starts over Tor now (the first Tor connection can take a minute)");
+  const recoveryFile = config.recoveryFile && existsSync(config.recoveryFile) ? config.recoveryFile : void 0;
+  return Object.freeze({
+    pool: config.pool,
+    caps: config.caps,
+    tor: true,
+    wallet: { status: recoveryFile ? "created" : "existing", ...recoveryFile ? { recoveryFile } : {} },
+    ...privateInference ? { privateInference: true } : {}
+  });
+}
 function inferenceRecordOf(old, answer) {
   const recorded = typeof old?.inference?.enabled === "boolean" ? old.inference.enabled : void 0;
   if (answer === true) return true;
@@ -162714,13 +162920,14 @@ async function runSetupCommand(values, deps) {
   let ownAddress = values.get("--own-address");
   const old = setupConfigOf(home);
   const behindTor = (wanted) => wanted && !values.has("--no-tor") && !inProxiedRun(deps.env);
+  const missing = missingPieces(home, old);
+  if (old && !missing.length) values.set(SETUP_RERUN, "settings");
   if (!interactive && behindTor(values.has("--prefer-tor") || values.has("--private-inference") || old?.tor === true)) {
     await setupBehindTor(setupArgvOf(values), deps);
     if (ownAddress) io.out(`${recordOwnAddress(home, ownAddress, deps).join("\n")}
 `);
     return void 0;
   }
-  const missing = missingPieces(home, old);
   const npmVersion = deps.walletVersion().npm;
   const introduced = values.has("--yes") && inProxiedRun(deps.env);
   const asksOwnFirst = interactive && Boolean(old) && terminal && !ownAddress;
@@ -162742,7 +162949,7 @@ async function runSetupCommand(values, deps) {
     ...values.has("--max-shield") ? { maxShield: values.get("--max-shield") } : {},
     ...values.has("--max-unshield") ? { maxUnshield: values.get("--max-unshield") } : {},
     ...values.has("--prefer-tor") || torRunRecords ? { tor: true } : {},
-    // This --tor run's own local tunnel when it is not 127.0.0.1:9080 (setup --tor --proxy http://127.0.0.1:9150): mcp uses it.
+    // This --tor run's own local tunnel when it is not 127.0.0.1:9080 (another local Tor HTTPTunnelPort, for example a second tor process: setup --tor --proxy http://127.0.0.1:9180): mcp uses it.
     ...torRunRecords && childRunProxy(deps.env).args[1] === "--proxy" ? { torTunnel: childRunProxy(deps.env).args[2] } : {},
     ...values.has("--passphrase-file") ? { passphraseFile: values.get("--passphrase-file") } : {},
     ...values.has("--facilitator") ? { facilitator: values.get("--facilitator") } : {},
@@ -162775,6 +162982,7 @@ async function runSetupCommand(values, deps) {
       if (/^setup_own_address_[a-z_]+: /.test(String(error?.message))) throw new PublicFailure(error.message);
       throw error;
     }
+    values.set(SETUP_RERUN, "own-address");
     io.out([
       `Saved: ${ownAddress} is your own address now, so your agent sends money back to you there without asking each time (no restart of your agent app needed).`,
       ...saved.dropped.length ? [`config.json keeps ${MAX_OWN_ADDRESSES} own addresses: the oldest (${saved.dropped.join(", ")}) now ask before each send.`] : [],
@@ -162856,25 +163064,33 @@ Copy it to two offline places now; it is the only way to restore this wallet.
   lines.push("");
   io.out(`${lines.join("\n")}
 `);
+  const rerun = values.get(SETUP_RERUN) === "settings";
   const targets = values.get("--add-to") ?? [];
   if (targets.length) addToHosts(targets, home, deps, { force: values.has("--force"), npmVersion });
-  io.out(`${targets.length ? "Or add it by hand" : "Add it to your agent host"}:
+  if (rerun && !targets.length) {
+    io.out("Your agent app keeps its MCP entry: restart this wallet's MCP server there (or restart the app) so it reads these settings. To add the wallet to another agent app, run setup again with --add-to claude-code, claude-desktop, or cursor.\n");
+  } else {
+    io.out(`${targets.length ? "Or add it by hand" : "Add it to your agent host"}:
 ${hostConfigText({ home, env: deps.env, platform: deps.platform ?? process.platform, npmVersion })}
 `);
-  io.out(`
+    io.out(`
 ${terminalUseLines(npmVersion).join("\n")}
 `);
+  }
   const config = setupConfigOf(home);
+  const inferenceNow = summary.privateInference === true && (!rerun || old?.inference?.enabled !== true);
   let apiKey;
-  if (summary.privateInference === true && config?.pool) {
+  if (inferenceNow && config?.pool) {
     try {
       apiKey = localAiServerApiKey(home, { walletPath: homeWalletPath(home, config.pool) });
     } catch {
       apiKey = void 0;
     }
   }
-  io.out(`
-${summary.privateInference === true ? privateInferencePath(config, { apiKey }).text : fundingStepText(config?.tor === true)}`);
+  if (inferenceNow) io.out(`
+${privateInferencePath(config, { apiKey }).text}`);
+  else if (!rerun) io.out(`
+${fundingStepText(config?.tor === true)}`);
   if (interactive) await offerFundNow(deps, { tor: config?.tor === true });
 }
 function validateAddFunds(values) {
@@ -163735,8 +163951,9 @@ var COMMANDS = [
       "A command that takes --pool (balance, recover, deposit, add-funds, and others) takes it, and the passphrase of this home's wallet, from config.json when you leave them out: shinjuku balance needs no flags. A pocket command (pocket list, scan, reshield, release, fill) takes this home's --wallet and passphrase file the same way, and --program, --proof-tools, --facilitator when it needs them. A flag or SHIELDED_WALLET_PASSPHRASE still wins; init and restore never use config.json, and move reads it itself."
     ],
     next: `start it from your agent host with npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
-    // After a run: the same line as the host config setup printed (this npm version, when the wallet knows it).
-    nextAfterRun: (values, deps) => `start it from your agent host with npx -y --no-audit --no-fund ${npxPackageWord(deps.walletVersion().npm)} mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
+    // After a run: the same line as the host config setup printed (this npm version, when the wallet knows it). A rerun
+    // of a complete setup (SETUP_RERUN): the agent app already has the entry.
+    nextAfterRun: (values, deps) => values.get(SETUP_RERUN) === "settings" ? `restart this wallet's MCP server in your agent app (or restart the app) so it reads these settings, then ask your agent "what is my balance"` : values.get(SETUP_RERUN) === "own-address" ? "ask your agent to send money to your own address: it sends without asking you each time" : `start it from your agent host with npx -y --no-audit --no-fund ${npxPackageWord(deps.walletVersion().npm)} mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
     run: (args, values, deps, io) => deps.setupMain(values, { ...deps, io })
   },
   {
@@ -166247,6 +166464,8 @@ function defaultDependencies() {
         else process.env[TOR_RUN_STARTED_ENV2] = before;
       }
     },
+    /** One command line as a child behind Tor with the given stdio (the MCP setup server's Tor setup and Tor wallet server). */
+    torChild: (argv2, stdio) => torChild(argv2, stdio),
     // No command calls these (the v0b and laneb families are retired, RETIRED_FAMILIES). They stay only because
     // wallet/scripts/bundle.mjs still requires the V0b zk-sdk WASM in the bundle; drop both together.
     v0bMain: async (...args) => (await Promise.resolve().then(() => (init_cli4(), cli_exports))).v0bMain(...args),