shinjuku-shield 0.3.92 → 0.3.93

package/README.md

@@ -6,13 +6,13 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.92. The npm packages `shinjuku-shield` and
+This is version 0.3.93. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files; `shinjuku` is the short command.
 
 ## Set up
 
 ```sh
-npx -y --no-audit --no-fund shinjuku-shield@0.3.92 setup
+npx -y --no-audit --no-fund shinjuku-shield@0.3.93 setup
 ```
 
 Setup makes the wallet on this machine, a private passphrase file, and the
@@ -24,7 +24,7 @@ server to that host's config.
 ## The `shinjuku` command
 
 ```sh
-npm install -g shinjuku@0.3.92
+npm install -g shinjuku@0.3.93
 shinjuku help
 ```
 
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.92 mcp
+claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.93 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.92", "mcp"] } } }
+{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.93", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "afa037c8868c722838c0642335b1767af4bcc0040878ae441e83cb94dd9aeea2",
-  "bytes": 12692822,
-  "sourceCommit": "3b6e926704a348088fa33d114ed7913e2d610033",
+  "sha256": "6048ca6123de12e425ab2f3575fa69838eb1ea93dbff3d2facab612e0004bf8a",
+  "bytes": 12704961,
+  "sourceCommit": "714b20d52346099009acced7d327566f239e8b7d",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1297,5 +1297,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-24T02:20:31.413Z"
+  "publishedAt": "2026-10-24T03:23:12.626Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shield",
-  "version": "0.3.92",
+  "version": "0.3.93",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "afa037c8",
-  "shinjukuSha256": "afa037c8868c722838c0642335b1767af4bcc0040878ae441e83cb94dd9aeea2",
+  "shinjukuRelease": "6048ca61",
+  "shinjukuSha256": "6048ca6123de12e425ab2f3575fa69838eb1ea93dbff3d2facab612e0004bf8a",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -47225,7 +47225,7 @@ async function rpcFetch(input, init) {
     rpcNotBefore.set(post.key, Math.max(rpcNotBefore.get(post.key) ?? 0, Date.now() + retryAfterMs(response)));
   }
 }
-function reexec(args, mode, plainProxy) {
+function proxiedChild(args, mode, plainProxy, stdio) {
   const proxy = withRunTag(mode, plainProxy);
   const env = {
     ...process.env,
@@ -47237,8 +47237,11 @@ function reexec(args, mode, plainProxy) {
   delete env[QUIET_RUN_MARK];
   const quiet = quietRun(args);
   if (quiet) env[QUIET_RUN_MARK] = quiet;
+  return spawn(process.execPath, [...proxiedExecArgv(process.execArgv), process.argv[1], ...args], { env, stdio });
+}
+function reexec(args, mode, plainProxy) {
   return new Promise((resolvePromise) => {
-    const child = spawn(process.execPath, [...proxiedExecArgv(process.execArgv), process.argv[1], ...args], { env, stdio: "inherit" });
+    const child = proxiedChild(args, mode, plainProxy, "inherit");
     const ignore = () => {
     };
     const forward = () => child.kill("SIGTERM");
@@ -47314,7 +47317,12 @@ async function proxyEntry(argv2, run5, { err = (text3) => process.stderr.write(t
   }
   return reexec(options.args, options.mode, options.proxy);
 }
-var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TUNNEL_LINE, TOR_INSTALL, OS_NAMES, osKey, torNotRunningMessage, NOTICE, QUIET_RUN_MARK, QUIET_NOTICE, QUIET_TERMINAL_COMMANDS, INFER_SUBCOMMANDS, quietRun, TOR_TROUBLE_LINE, TOR_WAIT_PLAIN, TOR_TROUBLE_PLAIN, TOR_TROUBLE_SAID, quietTorErr, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop, PROXY_WARNING_FLAG, proxiedExecArgv, proxiedNodeOptions, TOR_FROM_CONFIG_ENV, TOR_FROM_CONFIG_HINT;
+function torChild(argv2, stdio) {
+  const options = proxyOptions(argv2);
+  if (!options.mode) throw new ProxyUsageError("torChild needs --tor or --proxy");
+  return proxiedChild(options.args, options.mode, options.proxy, stdio);
+}
+var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TOR_EXPERT_BUNDLE_SHA256, TUNNEL_LINE, TOR_INSTALL, torStart, OS_NAMES, osKey, torNotRunningMessage, NOTICE, QUIET_RUN_MARK, QUIET_NOTICE, QUIET_TERMINAL_COMMANDS, INFER_SUBCOMMANDS, quietRun, TOR_TROUBLE_LINE, TOR_WAIT_PLAIN, TOR_TROUBLE_PLAIN, TOR_TROUBLE_SAID, quietTorErr, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop, PROXY_WARNING_FLAG, proxiedExecArgv, proxiedNodeOptions, TOR_FROM_CONFIG_ENV, TOR_FROM_CONFIG_HINT;
 var init_proxy = __esm({
   "wallet/src/net/proxy.mjs"() {
     "use strict";
@@ -47361,12 +47369,14 @@ var init_proxy = __esm({
     };
     isOnionHost = (host) => /\.onion$/i.test(String(host ?? "").replace(/\.+$/, ""));
     TOR_EXPERT_BUNDLE = "15.0.25";
+    TOR_EXPERT_BUNDLE_SHA256 = "c1988c701de2f24f7d098d1d6d7f507b58f27740d097f29c246e0524d639b252";
     TUNNEL_LINE = "HTTPTunnelPort 127.0.0.1:9080 IsolateDestAddr";
     TOR_INSTALL = Object.freeze({
-      windows: `iwr https://archive.torproject.org/tor-package-archive/torbrowser/${TOR_EXPERT_BUNDLE}/tor-expert-bundle-windows-x86_64-${TOR_EXPERT_BUNDLE}.tar.gz -OutFile $env:TEMP\\tor.tar.gz; mkdir -Force $env:LOCALAPPDATA\\tor | Out-Null; tar -xzf $env:TEMP\\tor.tar.gz -C $env:LOCALAPPDATA\\tor; & $env:LOCALAPPDATA\\tor\\tor\\tor.exe --HTTPTunnelPort '127.0.0.1:9080 IsolateDestAddr' --SocksPort 0`,
+      windows: `iwr https://archive.torproject.org/tor-package-archive/torbrowser/${TOR_EXPERT_BUNDLE}/tor-expert-bundle-windows-x86_64-${TOR_EXPERT_BUNDLE}.tar.gz -OutFile $env:TEMP\\tor.tar.gz; if ((Get-FileHash $env:TEMP\\tor.tar.gz -Algorithm SHA256).Hash -ne '${TOR_EXPERT_BUNDLE_SHA256}') { Remove-Item $env:TEMP\\tor.tar.gz; throw 'The Tor download does not match its pinned sha256, so it was deleted and not run' }; mkdir -Force $env:LOCALAPPDATA\\tor | Out-Null; & $env:SystemRoot\\System32\\tar.exe -xzf $env:TEMP\\tor.tar.gz -C $env:LOCALAPPDATA\\tor; & $env:LOCALAPPDATA\\tor\\tor\\tor.exe --HTTPTunnelPort '127.0.0.1:9080 IsolateDestAddr' --SocksPort 0`,
       macos: `brew install tor && echo '${TUNNEL_LINE}' >> "$(brew --prefix)/etc/tor/torrc" && brew services restart tor`,
       linux: `sudo apt install -y tor && echo '${TUNNEL_LINE}' | sudo tee -a /etc/tor/torrc && sudo systemctl restart tor`
     });
+    torStart = (platform = process.platform) => platform === "win32" ? { where: "PowerShell (keep its window open while the wallet runs)", command: TOR_INSTALL.windows } : platform === "darwin" ? { where: "Terminal", command: TOR_INSTALL.macos } : { where: "a terminal", command: TOR_INSTALL.linux };
     OS_NAMES = { windows: "Windows (PowerShell; keep its window open while the wallet runs)", macos: "macOS (Homebrew)", linux: "Linux (Debian or Ubuntu)" };
     osKey = (platform) => platform === "win32" ? "windows" : platform === "darwin" ? "macos" : "linux";
     torNotRunningMessage = (address5, platform = process.platform) => `tor_not_running: Tor is not running on this machine (nothing answers at ${address5}), so nothing was sent. ${torInstallText(platform)}`;
@@ -67280,6 +67290,9 @@ var init_errorCodes = __esm({
       "mcp_setup_switch_failed",
       "mcp_tor_unavailable",
       "setup_tor_unavailable",
+      // The wallet server behind Tor that the setup server starts after a Tor setup (stdioServer.mjs startTorRelay).
+      "setup_tor_wallet_ended",
+      "setup_tor_wallet_slow",
       "wallet_not_set_up",
       "shinjuku_setup",
       "wallet_status",
@@ -109970,7 +109983,7 @@ function refusalSay(a, tool, again, npmVersion) {
   }
   if (code2 === "mcp_balance_unknown") return "Nothing was moved yet: the wallet is still reading its private balance. Try again in a minute.";
   if (code2 === "mcp_payment_still_open") return "Not paid: a payment for this request is still open. Ask with its request_id for the result.";
-  if (code2 === "mcp_setup_restart_needed") return "The wallet is set up, but this app must restart to use it. Restart this app, then try again.";
+  if (code2 === "mcp_setup_restart_needed") return "The wallet is set up, but it must reconnect once. Follow the steps below, then try again. Nothing was paid.";
   if (code2 === "mcp_restart_needed") return "Nothing was paid. Restart this app, then try again.";
   if (/accounts_split/.test(code2) || /accounts_split/.test(detail)) {
     return `Nothing was ${tool === "wallet_unshield" ? "sent" : "paid"}. The wallet is getting your balance ready to send; try again in about 1 minute, then once more 2 minutes later.`;
@@ -110063,10 +110076,13 @@ function refusalSay(a, tool, again, npmVersion) {
     return str(a.ownAddressCommand) && words(own) <= SAY_MAX_WORDS ? own : head;
   }
   if (code2 === "mcp_unshield_declined") return "Not sent. The send was not confirmed.";
-  if (code2 === "mcp_setup_declined" && unshown) {
-    return `Not set up. This app cannot show the setup question. Run ${oneTimeCommandLine("setup", npmVersion)} in a terminal, then restart this app.`;
+  if (code2 === "mcp_setup_declined" && unshown || code2 === "mcp_setup_needs_terminal") {
+    return `Not set up. This app cannot show the setup question. Run ${oneTimeCommandLine("setup", npmVersion)} in a terminal, then reconnect the wallet.`;
   }
   if (code2 === "mcp_setup_declined") return "Not set up. The setup was not confirmed; nothing was created.";
+  if (code2 === "tor_not_running" && tool === "shinjuku_setup") return "Not set up: Tor is not running on this computer. Start it with the command below and ask again, or set up without Tor.";
+  if (code2 === "wallet_not_set_up" && tool === "x402_discover") return "Not searched yet. Set up the wallet first: setup asks one question, whether to use Tor, which hides your IP address.";
+  if (code2 === "wallet_not_set_up") return "The wallet is not set up yet, so nothing was paid. Ask to set up the wallet first.";
   if (code2 === "mcp_tool_disabled") return "Nothing was paid or moved. This tool is off; only your owner can turn it on when starting the wallet.";
   if (code2 === "mcp_unshield_to_invalid") {
     return "Not sent. That address has no USDC account yet. Ask for a Solana address that already holds USDC, like a Phantom address.";
@@ -127172,7 +127188,7 @@ ${canonical5}`;
     } catch {
       onion = false;
     }
-    return { network: mode === "tor" ? { mode: "tor", detail: `every request of this wallet goes through Tor (checked at start)${onion ? "; the facilitator is reached over its onion service, so no Tor exit sees those requests" : ""}` } : mode === "proxy" ? { mode: "proxy", detail: "every request of this wallet goes through the proxy in its launch line (--proxy); it is not checked as Tor" } : { mode: "direct", detail: "no Tor: the facilitator, the RPC provider and each seller see this computer's IP address; start the MCP with --tor (or run setup --prefer-tor) to hide it" } };
+    return { network: mode === "tor" ? { mode: "tor", detail: `every request of this wallet goes through Tor (checked at start)${onion ? "; the facilitator is reached over its onion service, so no Tor exit sees those requests" : ""}` } : mode === "proxy" ? { mode: "proxy", detail: "every request of this wallet goes through the proxy in its launch line (--proxy); it is not checked as Tor" } : { mode: "direct", detail: `no Tor: the facilitator, the RPC provider and each seller see this computer's IP address. To hide it, the user runs ${terminalCommand("setup --yes --prefer-tor")} once in a terminal (it records Tor and checks the wallet's files again; nothing else changes), then restarts this app` } };
   }
   function sayFirst(fields, tool, autoId) {
     let say6 = sayFor(fields, { tool, npmVersion });
@@ -132573,9 +132589,9 @@ ${canonical5}`;
   const moreTokens = (maxTokens) => Math.max(1024, 2 * maxTokens);
   const torRefusal = () => refuse12(
     "inference_tor_required",
-    "inference sends the prompt to the AI provider and the company that runs the model, so this wallet sends it only from a --tor or --proxy run, where they see the proxy's exit and not this machine's IP. This MCP server was started without --tor or --proxy; nothing was sent or paid",
-    // The exact npm version when this wallet knows it (npmVersion: stdioServer.mjs walletVersion().npm; the owner's pin, 2026-10-23).
-    `Tell the user to add --tor to this MCP server's launch line in the host (for example \`npx -y --no-audit --no-fund ${npxPackageWord(npmVersion)} mcp --tor\`, with Tor's HTTPTunnelPort 127.0.0.1:9080 on), or --proxy http://host:port for an HTTP proxy they trust, then restart the server and call inference_chat again`
+    "inference sends the prompt to the AI provider and the company that runs the model, so this wallet sends it only over Tor (or a proxy the user trusts), where they see the exit and not this machine's IP. This wallet runs without Tor; nothing was sent or paid",
+    // docs/mcp/TOR.md: no flag name, port number or torrc in an agent-app answer outside the one command (here the setup line).
+    `Tell the user: private AI runs only over Tor, and this wallet runs without Tor. To turn Tor on, the user runs ${terminalCommand("setup --yes --prefer-tor")} once in a terminal (it records Tor and checks the wallet's files again; nothing else changes), then reconnects the wallet (${RESTART_STEPS}), and asks again`
   );
   const inferenceModels = {
     name: "inference_models",
@@ -133460,6 +133476,17 @@ function createSetupTools({
         recoveryFile ? { recoveryFile } : void 0
       );
     }
+    if (job.state === "no_tor") {
+      const torBrowser = job.torBrowser === true;
+      job = void 0;
+      const start = torStart();
+      return refuse12(
+        "tor_not_running",
+        `the user chose Tor in the setup question, and Tor is not running on this computer (nothing answers at the wallet's local Tor connection${torBrowser ? "; Tor Browser is open, but it does not give the kind of connection the wallet needs" : ""}); nothing was created or paid`,
+        `Tell the user: ${torBrowser ? "Tor Browser is open, but the wallet needs its own Tor connection. Run the command below." : "Tor hides your IP address, and it is not running on this computer."} Show torStartCommand in one code block, to copy into ${start.where}: this command downloads Tor and starts it for the wallet (more about Tor: https://www.torproject.org). If you can run commands here, offer to run it for the user. Then the user asks again to set up the wallet: it then sets up over Tor and always runs over Tor. Or, to set up without Tor, the user asks again and unticks "${SETUP_TOR_TITLE}" in the question`,
+        { torStartCommand: start.command }
+      );
+    }
     if (job.state === "declined") {
       const unshown = job.unshown === true;
       job = void 0;
@@ -133487,19 +133514,11 @@ function createSetupTools({
       wallet: summary.wallet.status,
       ...summary.wallet.recoveryFile ? { recoveryFile: summary.wallet.recoveryFile, solanaFeePayer: summary.wallet.solanaFeePayer } : {}
     });
-    if (job.state === "restart" && privateInference && job.failure.error === "setup_tor_needs_restart") {
-      return json3({
-        ...doneFacts(job.summary),
-        privateInference: true,
-        restartNeeded: true,
-        next: `The wallet is ready.${recoveryNext(job.summary)}${PRIVATE_INFERENCE_NEXT}`
-      });
-    }
     if (job.state === "restart") {
       return refuse12(
         "mcp_setup_restart_needed",
         `the wallet is set up, but this MCP server could not start the wallet tools in place (reason: ${job.failure.detail}); nothing was paid or moved`,
-        "Tell the user to restart this MCP server in the host (or restart the host app); the wallet tools start then",
+        `Tell the user: ${RESTART_STEPS}; the wallet tools start then`,
         { stage: "done" }
       );
     }
@@ -133507,15 +133526,16 @@ function createSetupTools({
       const summary = job.summary;
       return json3({
         ...doneFacts(summary),
+        ...summary.tor === true ? { tor: true } : {},
         ...privateInference ? { privateInference: true } : {},
-        next: `The wallet tools are live in this server: call wallet_balance.${recoveryNext(summary)} To add funds, call wallet_shield after the user sends USDC to solanaFeePayer (no SOL needed), or call wallet_add_funds: it gives a one-time address for any amount from 0.01 USDC. After the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes.` + (privateInference ? " Private inference is on: after funding, call inference_chat (with no prompt it lists the models and prices); if this server was started with --no-tor, restart it without --no-tor so it runs behind Tor (inference_chat refuses until then)." : "")
+        next: `The wallet tools are live in this server: call wallet_balance.${recoveryNext(summary)}` + (summary.tor === true ? " Setup ran over Tor, and the wallet runs over Tor: the servers it talks to do not see this computer's IP address." : "") + (summary.wallet.solanaFeePayer ? " To add funds, call wallet_shield after the user sends USDC to solanaFeePayer (no SOL needed), or call" : " To add funds, call") + " wallet_add_funds: it gives a one-time address for any amount from 0.01 USDC. After the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes." + (privateInference ? " Private inference is on: after funding, call inference_chat (with no prompt it lists the models and prices); if this server was started with --no-tor, restart it without --no-tor so it runs behind Tor (inference_chat refuses until then)." : "")
       });
     }
     return json3({ ok: true, stage: job.stage, ...job.progress ? { progress: job.progress } : {}, next: SETUP_POLL_NEXT });
   }
   async function confirm2(plan) {
     const limit = (atomic4) => String(atomic4) === NO_LIMIT_ATOMIC2 ? "no limit" : `${usdc9(atomic4)} USDC`;
-    const message = `Create a Shinjuku Shield wallet on this machine (spending limits: ${limit(plan.maxPaymentAtomic)} per payment, ${limit(plan.maxSessionAtomic)} in any 24 hours)? The keys and a random passphrase stay in private files on this machine. Optional: tick "Use private inference for your AI now". ${PRIVATE_INFERENCE_WHY} It records Tor for this server (Tor must run with HTTPTunnelPort 127.0.0.1:9080).`;
+    const message = `Create a Shinjuku Shield wallet on this machine (spending limits: ${limit(plan.maxPaymentAtomic)} per payment, ${limit(plan.maxSessionAtomic)} in any 24 hours)? The keys and a random passphrase stay in private files on this machine.`;
     const askedAt = Date.now();
     try {
       const answer = await client.elicit({
@@ -133524,15 +133544,17 @@ function createSetupTools({
           type: "object",
           properties: {
             confirm: { type: "boolean", title: "Create the wallet", description: message, default: true },
-            privateInference: { type: "boolean", title: "Use private inference for your AI now", description: PRIVATE_INFERENCE_WHY, default: false }
+            tor: { type: "boolean", title: SETUP_TOR_TITLE, description: `${SETUP_TOR_WHY} Setup downloads the wallet's files over Tor too.`, default: true },
+            privateInference: { type: "boolean", title: "Use private inference for your AI now", description: `${PRIVATE_INFERENCE_WHY} It needs Tor, so it turns Tor on.`, default: false }
           },
           required: ["confirm"]
         }
       }, elicitTimeoutMs);
       const ok = answer?.action === "accept" && answer?.content?.confirm !== false;
-      return { ok, privateInference: answer?.content?.privateInference === true, unshown: !ok && elicitUnshown(askedAt, answer) };
+      const privateInference = answer?.content?.privateInference === true;
+      return { ok, privateInference, tor: answer?.content?.tor !== false || privateInference, unshown: !ok && elicitUnshown(askedAt, answer) };
     } catch (error) {
-      return { ok: false, privateInference: false, unshown: error?.timedOut !== true && elicitUnshown(askedAt) };
+      return { ok: false, privateInference: false, tor: false, unshown: error?.timedOut !== true && elicitUnshown(askedAt) };
     }
   }
   async function begin() {
@@ -133555,10 +133577,16 @@ function createSetupTools({
         log(`MCP_SETUP_DECLINED${answer.unshown ? " unshown=true" : ""}`);
         return;
       }
+      if (answer.tor && !inTorRun() && await localTorProof(TOR_HTTP_TUNNEL) === "refused") {
+        job.torBrowser = await localTorProof(TOR_BROWSER_PORT) !== "refused";
+        job.state = "no_tor";
+        log(`MCP_SETUP_NO_TOR${job.torBrowser ? " tor-browser=open" : ""}`);
+        return;
+      }
       job.state = "running";
       job.stage = "starting";
       job.privateInference = answer.privateInference;
-      log("MCP_SETUP_STARTED");
+      log(`MCP_SETUP_STARTED tor=${answer.tor}`);
       try {
         job.summary = await setup.run((stage, progress3) => {
           if (stage === "wallet-created" && progress3?.recoveryFile) {
@@ -133567,7 +133595,7 @@ function createSetupTools({
           }
           job.stage = stage;
           job.progress = progress3;
-        }, { privateInference: answer.privateInference });
+        }, { privateInference: answer.privateInference, tor: answer.tor });
       } catch (error) {
         job.failure = failure2(error, "mcp_setup_failed");
         job.state = "failed";
@@ -133593,7 +133621,7 @@ function createSetupTools({
   const setupTool = {
     name: "shinjuku_setup",
     title: "Set up the Shinjuku Shield wallet",
-    description: "The wallet is not set up on this machine yet. Call this when the user wants to pay an x402 URL, check a balance, or shield USDC. It asks the user to confirm in this client (with the spending caps), then creates a self-custody wallet on this machine (keys and a random passphrase in private local files; no tool takes or returns them), downloads and checks the proof tools (about 191 MB, minutes), and switches this server to the wallet tools. Takes no arguments. Call it again with no arguments as `next` says for the stage (confirming, platform, release, passphrase, wallet, proof-tools, config, done). A decline creates nothing (mcp_setup_declined). A client that cannot confirm is refused (mcp_setup_needs_terminal) with the terminal command; a client that declines at once without showing the dialog gets mcp_setup_declined with the same terminal command.",
+    description: "The wallet is not set up on this machine yet. Call this when the user wants to pay an x402 URL, check a balance, or shield USDC. It asks the user to confirm in this client (with the spending caps), then creates a self-custody wallet on this machine (keys and a random passphrase in private local files; no tool takes or returns them), downloads and checks the proof tools (about 191 MB, minutes), and switches this server to the wallet tools. Takes no arguments. Call it again with no arguments as `next` says for the stage (confirming, tor, platform, release, passphrase, wallet, proof-tools, config, done). A decline creates nothing (mcp_setup_declined). A client that cannot confirm is refused (mcp_setup_needs_terminal) with the terminal command; a client that declines at once without showing the dialog gets mcp_setup_declined with the same terminal command.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     run: () => begin()
@@ -133628,11 +133656,11 @@ function createSetupTools({
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     // Hidden after setup are hidden here too (callable by name, not listed).
     ...MCP_HIDDEN_TOOL_NAMES.includes(name) ? { hidden: true } : {},
-    // After setup, a switch that could not happen in place (Tor, or the wallet did not open) keeps every money tool refused.
+    // After setup, a switch that could not happen (the wallet did not open, or its server behind Tor did not start) keeps every money tool refused.
     run: async () => job?.state === "restart" ? refuse12(
       "mcp_setup_restart_needed",
       `the wallet is set up, but this MCP server could not start the wallet tools in place (reason: ${job.failure.detail}); nothing was paid or moved`,
-      "Tell the user to restart this MCP server in the host (or restart the host app); the wallet tools start then",
+      `Tell the user: ${RESTART_STEPS}; the wallet tools start then`,
       { stage: "done" }
     ) : refuse12(
       "wallet_not_set_up",
@@ -133646,9 +133674,32 @@ function createSetupTools({
     description: "The wallet is set up and its tools are live. Answers the setup summary; it never creates a second wallet.",
     run: async () => job ? status() : json3({ ok: true, stage: "done", walletReady: true, next: "call wallet_balance" })
   };
-  return { tools: [setupTool, statusTool, ...MCP_TOOL_NAMES.map((name) => name === "x402_discover" ? discoverTool(discoverCacheDir) : notSetUp(name))], doneTool };
+  const discoverNow = inTorRun();
+  const discoverAfterSetup = () => {
+    const tool = notSetUp("x402_discover");
+    return {
+      ...tool,
+      description: "Finds x402 sellers after setup. Before setup it sends nothing: setup first asks the user whether to use Tor, which hides this computer's IP address from the servers that list sellers. Call shinjuku_setup first.",
+      run: async (args) => job?.state === "restart" ? tool.run(args) : refuse12(
+        "wallet_not_set_up",
+        "x402_discover asks Shinjuku and other servers for their seller lists, and they would see this computer's IP address before the user chose whether to use Tor; nothing was sent",
+        "Tell the user: set up the wallet first; setup asks one question, whether to use Tor (it hides your IP address). Then call shinjuku_setup; after setup, call x402_discover again",
+        ...job ? [{ stage: job.stage }] : []
+      )
+    };
+  };
+  const sayOnRefusal = (tool) => ({ ...tool, run: async (args, ctx) => {
+    const output2 = await tool.run(args, ctx);
+    const text3 = typeof output2?.text === "string" ? output2.text : output2?.content?.[0]?.text;
+    return typeof text3 === "string" && /^\s*\{\s*"ok"\s*:\s*false\b/.test(text3) ? addSay(output2, tool.name, { npmVersion }) : output2;
+  } });
+  const discover = discoverNow ? withSay(discoverTool(discoverCacheDir), { npmVersion }) : sayOnRefusal(discoverAfterSetup());
+  return {
+    tools: [sayOnRefusal(setupTool), statusTool, ...MCP_TOOL_NAMES.map((name) => name !== "x402_discover" ? sayOnRefusal(notSetUp(name)) : discover)],
+    doneTool: sayOnRefusal(doneTool)
+  };
 }
-var import_web3133, shownCaps, RELEASE_RETRY_MS, STAGE_WORDS, stageWords, INTERNAL_BALANCE_DETAIL, shownBreakdown, sessionLeftShown, TOKEN_UNIT_TOOLS, RESOURCE_PAYMENT_WAL_PREFIX2, POOL_LAYOUT_CODE, POOL_LAYOUT_UPDATE, USEPOD_VIA_INFERENCE_CHAT, SEND_RUNS_ON, DEPOSIT_RUNS_ON, CLI_FUNDS_PLAN_PREFIX, CLI_FUNDS_SCHEMA, SELF_PAY_ORIGIN3, REQUEST_ID4, POSITIVE_ATOMIC6, PRIVATE_HOST3, FORBIDDEN_HEADERS3, MAX_BODY_BYTES2, PREVIEW_TIMEOUT_MS, PREVIEW_SELLER_READ_MS, CALL_BUDGET_MS, budgetLeft, MONEY_FIRST_ANSWER_MS, BALANCE_AFTER_LANDING_MS, JOIN_CALL_MAX_MS, JOIN_NUDGE_QUIET_MS, JOIN_STEP_MS, sleep2, PROGRESS_EVERY_MS2, READ_BUDGET_MS, UNPAID_TOR_TRY_MS, UNPAID_CLEAR_MS, READ_BUDGET_TOOLS, FLOAT_BUSY_CODES, RETRY_MARGIN_MS, ASK_PAY_CODES, runningNpmVersion, terminalCommand, capPlaceWords, capRaiseText, cheaperSellerText, limitNext, SAFE_TEXT, MCP_TOOL_ALIASES, POOL_SWITCH_WHY, POOL_SWITCH_NEXT, SWITCH_STATES, quietSwitch, switchKey, ATOMIC_TEXT, FLOAT_ID, ANSWERED_EXIT_RETRY_MS, ANSWERED_EXIT_UNCONFIRMED_MS, ANSWERED_EXIT_RETRY_WINDOW_MS, ANSWERED_EXIT_CLOSED, switchAmount, switchEta, switchRows, OWNER_CAP_CODES, JOIN_END_MCP, JOIN_END_TERMINAL_LIBRARY, JOIN_RETRY_BACKOFF_MS, WALLET_CAP_FIX, MCP_CAP_FIX, capFix, ownerOnlyNext, mcpNext, CONFIDENTIAL_RETIRED, json3, answerResult, discoverTool, refuse12, publicOffer, FLOAT_PAID_CODES, FLOAT_PRIVATE_LEG, floatStillSettling, MONEY_ID2, toRecordId, linkKindOf, moneyId, REFUSED_CODES, refusedCodeOf, PLAIN_REASONS, plainReason, KEPT_SEND_TRIES, shownId, isSplitSend, sendPartId, PROMISED_NEXT, PUBLIC_READ_TIMEOUT_MS, RECIPIENT_CHECK_TIMEOUT_MS, withTimeout, ownKey, readFailure, OWN_KEY_TOKENS_MAX, OWN_TOKENS_GRACE_MS, tokenAmountText, elsewhereId, AGENT_ID_SCHEMA, agentIdName, minutesText2, ageWords2, DEPOSIT_SENT_STATES, depositLanded, usdcText2, walkWalletHistory, REFRESH_LEASE_WALK_MS, HOME_MARKS_SETTLED_MS2, AUTO_BACKUPS_KEPT, AUTO_BACKUP_NAME, AUTO_BACKUP_VERIFIED, FRONTED_SETTLE_MARGIN_SLOTS, BALANCE_REFRESH_WAIT_MS, BALANCE_REFRESH_GRACE_MS, BALANCE_REFRESH_LONG_MS, INBOUND_REFRESH_AGE_MS, CAP_BALANCE_WAIT_MS, CAP_BALANCE_RETRY_MS, REFRESH_RETRY_MS, FINALITY_POLL_MS, FINALITY_WAIT_MS, FINALITY_REFRESH_LIMIT_MS, POOL_WATCH_MS, POOL_WATCH_POLL_MS, EARLY_BALANCE_DELAY_MS, FINALITY_SETTLE_WINDOW_SLOTS, PUBLIC_READ_ANSWER_MS, SWITCH_WAIT_MS, UNSHIELD_TO_NO_USDC_DETAIL, UNSHIELD_TO_INVALID_NEXT, INFERENCE_MIN_MAX_TOKENS, ELICIT_TIMEOUT_MS, ELICIT_UNSHOWN_MS, elicitUnshown, POLL_SECONDS3, TRANSFER_CHANGE_READ_MS, TEMP_CLEAN_DELAY_MS, KEPT_ON_DISK, MAX_SHIELDED_BALANCE_ATOMIC, receiveGenerator, MCP_TOOL_NAMES, MCP_HIDDEN_TOOL_NAMES, setupTerminalNext, SETUP_POLL_NEXT, PRIVATE_INFERENCE_WHY, PRIVATE_INFERENCE_NEXT;
+var import_web3133, shownCaps, RELEASE_RETRY_MS, STAGE_WORDS, stageWords, INTERNAL_BALANCE_DETAIL, shownBreakdown, sessionLeftShown, TOKEN_UNIT_TOOLS, RESOURCE_PAYMENT_WAL_PREFIX2, POOL_LAYOUT_CODE, POOL_LAYOUT_UPDATE, USEPOD_VIA_INFERENCE_CHAT, SEND_RUNS_ON, DEPOSIT_RUNS_ON, CLI_FUNDS_PLAN_PREFIX, CLI_FUNDS_SCHEMA, SELF_PAY_ORIGIN3, REQUEST_ID4, POSITIVE_ATOMIC6, PRIVATE_HOST3, FORBIDDEN_HEADERS3, MAX_BODY_BYTES2, PREVIEW_TIMEOUT_MS, PREVIEW_SELLER_READ_MS, CALL_BUDGET_MS, budgetLeft, MONEY_FIRST_ANSWER_MS, BALANCE_AFTER_LANDING_MS, JOIN_CALL_MAX_MS, JOIN_NUDGE_QUIET_MS, JOIN_STEP_MS, sleep2, PROGRESS_EVERY_MS2, READ_BUDGET_MS, UNPAID_TOR_TRY_MS, UNPAID_CLEAR_MS, READ_BUDGET_TOOLS, FLOAT_BUSY_CODES, RETRY_MARGIN_MS, ASK_PAY_CODES, runningNpmVersion, terminalCommand, capPlaceWords, capRaiseText, cheaperSellerText, limitNext, SAFE_TEXT, MCP_TOOL_ALIASES, POOL_SWITCH_WHY, POOL_SWITCH_NEXT, SWITCH_STATES, quietSwitch, switchKey, ATOMIC_TEXT, FLOAT_ID, ANSWERED_EXIT_RETRY_MS, ANSWERED_EXIT_UNCONFIRMED_MS, ANSWERED_EXIT_RETRY_WINDOW_MS, ANSWERED_EXIT_CLOSED, switchAmount, switchEta, switchRows, OWNER_CAP_CODES, JOIN_END_MCP, JOIN_END_TERMINAL_LIBRARY, JOIN_RETRY_BACKOFF_MS, WALLET_CAP_FIX, MCP_CAP_FIX, capFix, ownerOnlyNext, mcpNext, CONFIDENTIAL_RETIRED, json3, answerResult, discoverTool, refuse12, publicOffer, FLOAT_PAID_CODES, FLOAT_PRIVATE_LEG, floatStillSettling, MONEY_ID2, toRecordId, linkKindOf, moneyId, REFUSED_CODES, refusedCodeOf, PLAIN_REASONS, plainReason, KEPT_SEND_TRIES, shownId, isSplitSend, sendPartId, PROMISED_NEXT, PUBLIC_READ_TIMEOUT_MS, RECIPIENT_CHECK_TIMEOUT_MS, withTimeout, ownKey, readFailure, OWN_KEY_TOKENS_MAX, OWN_TOKENS_GRACE_MS, tokenAmountText, elsewhereId, AGENT_ID_SCHEMA, agentIdName, minutesText2, ageWords2, DEPOSIT_SENT_STATES, depositLanded, usdcText2, walkWalletHistory, REFRESH_LEASE_WALK_MS, HOME_MARKS_SETTLED_MS2, AUTO_BACKUPS_KEPT, AUTO_BACKUP_NAME, AUTO_BACKUP_VERIFIED, FRONTED_SETTLE_MARGIN_SLOTS, BALANCE_REFRESH_WAIT_MS, BALANCE_REFRESH_GRACE_MS, BALANCE_REFRESH_LONG_MS, INBOUND_REFRESH_AGE_MS, CAP_BALANCE_WAIT_MS, CAP_BALANCE_RETRY_MS, REFRESH_RETRY_MS, FINALITY_POLL_MS, FINALITY_WAIT_MS, FINALITY_REFRESH_LIMIT_MS, POOL_WATCH_MS, POOL_WATCH_POLL_MS, EARLY_BALANCE_DELAY_MS, FINALITY_SETTLE_WINDOW_SLOTS, PUBLIC_READ_ANSWER_MS, SWITCH_WAIT_MS, UNSHIELD_TO_NO_USDC_DETAIL, UNSHIELD_TO_INVALID_NEXT, INFERENCE_MIN_MAX_TOKENS, ELICIT_TIMEOUT_MS, ELICIT_UNSHOWN_MS, elicitUnshown, POLL_SECONDS3, TRANSFER_CHANGE_READ_MS, TEMP_CLEAN_DELAY_MS, KEPT_ON_DISK, MAX_SHIELDED_BALANCE_ATOMIC, receiveGenerator, MCP_TOOL_NAMES, MCP_HIDDEN_TOOL_NAMES, setupTerminalNext, SETUP_POLL_NEXT, PRIVATE_INFERENCE_WHY, RESTART_STEPS, TOR_BROWSER_PORT, SETUP_TOR_TITLE, SETUP_TOR_WHY;
 var init_tools = __esm({
   "wallet/src/mcp/tools.mjs"() {
     "use strict";
@@ -134081,10 +134132,13 @@ var init_tools = __esm({
       "inference_models",
       "wallet_receive_shielded"
     ]);
-    setupTerminalNext = () => `Tell the user to run \`${terminalCommand("setup")}\` in a terminal on this machine, then restart this MCP server in the host`;
+    setupTerminalNext = () => `Tell the user to run \`${terminalCommand("setup")}\` in a terminal on this machine, then reconnect the wallet (${RESTART_STEPS})`;
     SETUP_POLL_NEXT = `call shinjuku_setup again in ${POLL_SECONDS3} s for the status (it never creates a second wallet)`;
     PRIVATE_INFERENCE_WHY = "Your agent then buys AI answers from an AI provider, paid from your private balance over Tor; the AI provider and the company that runs the model see the prompt, not who paid.";
-    PRIVATE_INFERENCE_NEXT = " Private inference is on: config.json records Tor, so restart this MCP server in the host now; it then runs behind Tor (Tor must run with HTTPTunnelPort 127.0.0.1:9080), and until then every wallet tool and inference_chat stay refused. After the restart: fund the wallet with wallet_add_funds (it gives a one-time address; after the user sends USDC there from any wallet, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes), then call inference_chat (with no prompt it lists the models; a short qwen3-8-flash answer costs about 0.001 USDC, 0.011 USDC when the AI provider offers only its standard payment). For another agent app, call inference_server: it starts the local AI address and gives its base_url and api key.";
+    RESTART_STEPS = "In Claude Code: type /mcp, pick shinjuku-shielded, and choose Reconnect. In Claude Desktop: quit it and open it again. In another app: restart it";
+    TOR_BROWSER_PORT = "http://127.0.0.1:9150";
+    SETUP_TOR_TITLE = "Use Tor?";
+    SETUP_TOR_WHY = "It hides your IP address from the payment service and sellers.";
   }
 });
 
@@ -134203,7 +134257,7 @@ function createMcpDispatcher({ tools, instructions: instructions2 = INSTRUCTIONS
   };
 }
 function serveStdio({ input, output: output2, dispatch, log = () => {
-}, client }) {
+}, client, forward = () => false }) {
   const inFlight = /* @__PURE__ */ new Set();
   const write = (message) => {
     if (message === void 0) return;
@@ -134249,6 +134303,7 @@ function serveStdio({ input, output: output2, dispatch, log = () => {
       write(parseError);
       return;
     }
+    if (forward(text3, message)) return;
     if (takeResponse(message)) return;
     const task = (async () => {
       if (Array.isArray(message)) {
@@ -135100,6 +135155,70 @@ function startProofToolsRefresh({
     clearTimeout(retry);
   };
 }
+function startTorRelay({ spawn: spawn10, initParams, output: output2, log, rewrite = (line) => line, readyMs = TOR_RELAY_READY_MS }) {
+  const child = spawn10();
+  let ready = false;
+  let settle;
+  const answered2 = new Promise((resolvePromise, rejectPromise) => {
+    settle = { resolve: resolvePromise, reject: rejectPromise };
+  });
+  const exited = new Promise((resolvePromise) => {
+    child.on("error", (error) => {
+      log(`MCP_TOR_RELAY_SPAWN_FAILED ${error?.code ?? error?.name ?? "Error"}`);
+      resolvePromise(1);
+    });
+    child.on("exit", (code2, signal) => resolvePromise(code2 ?? (signal ? 1 : 0)));
+  });
+  exited.then((code2) => {
+    if (!ready) settle.reject(new Error(`setup_tor_wallet_ended: the wallet server behind Tor ended (exit code ${code2}) before it answered; its own lines are in this server's log`));
+  });
+  const timer = setTimeout(() => settle.reject(new Error(`setup_tor_wallet_slow: the wallet server behind Tor gave no answer in ${readyMs / 1e3} s`)), readyMs);
+  timer.unref?.();
+  let buffer = "";
+  child.stdout.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    buffer += chunk;
+    let newline;
+    while ((newline = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, newline);
+      buffer = buffer.slice(newline + 1);
+      if (!line.trim()) continue;
+      if (!ready) {
+        let message;
+        try {
+          message = JSON.parse(line);
+        } catch {
+          message = void 0;
+        }
+        if (message?.id === RELAY_INIT_ID) {
+          ready = true;
+          clearTimeout(timer);
+          settle.resolve();
+          continue;
+        }
+      }
+      output2.write(`${rewrite(line)}
+`);
+    }
+  });
+  child.stdin.on("error", () => {
+  });
+  const write = (line) => {
+    if (child.stdin.writable) child.stdin.write(`${line}
+`);
+  };
+  write(JSON.stringify({
+    jsonrpc: "2.0",
+    id: RELAY_INIT_ID,
+    method: "initialize",
+    params: initParams ?? { protocolVersion: SUPPORTED_PROTOCOL_VERSIONS[0], capabilities: {}, clientInfo: { name: "shinjuku-setup-relay", version: "1" } }
+  }));
+  write(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }));
+  return answered2.then(() => ({ write, end: () => child.stdin.end(), exited }), (error) => {
+    child.kill("SIGTERM");
+    throw error;
+  });
+}
 async function runSetupModeServer({
   setupTools,
   startNormal,
@@ -135107,13 +135226,13 @@ async function runSetupModeServer({
   output: output2 = process.stdout,
   errorOutput = process.stderr,
   updateCheck,
-  discoverCacheDir,
   launchNotice
 }) {
   const log = (line) => errorOutput.write(`${line}
 `);
   const client = createClientBridge();
-  const notice = startUpdateNotice({ log, ...updateCheck !== void 0 ? { check: updateCheck } : {} });
+  const startNotice = (facilitator) => startUpdateNotice({ facilitator, log, ...updateCheck !== void 0 ? { check: updateCheck } : {} });
+  let notice = startUpdateNotice({ log, check: false });
   const saved = { log: console.log, info: console.info, debug: console.debug };
   const toStderr = (...parts) => console.error(...parts);
   console.log = toStderr;
@@ -135123,11 +135242,48 @@ async function runSetupModeServer({
   let doneTool;
   let current;
   let ended;
+  let initParams;
+  let relay;
+  let relayStopped;
+  const relayEnded = new Promise((resolvePromise) => {
+    relayStopped = resolvePromise;
+  });
+  const listIds = /* @__PURE__ */ new Set();
+  const withDoneTool = (line) => {
+    if (!doneTool || !listIds.size) return line;
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return line;
+    }
+    if (!listIds.delete(message?.id) || !Array.isArray(message?.result?.tools)) return line;
+    const listed = {
+      name: doneTool.name,
+      title: doneTool.title,
+      description: doneTool.description,
+      inputSchema: doneTool.inputSchema,
+      annotations: { title: doneTool.title, ...doneTool.annotations }
+    };
+    return JSON.stringify({ ...message, result: { ...message.result, tools: [...message.result.tools.filter((tool) => tool?.name !== doneTool.name), listed] } });
+  };
   const stopKeepWarm = startOnionKeepWarm();
   const activate = async () => {
-    if (wallet) return;
+    if (wallet || relay) return;
     const options = await startNormal();
+    if (options.relay) {
+      relay = await startTorRelay({ spawn: options.relay, initParams, output: output2, log, rewrite: withDoneTool });
+      relay.exited.then((code2) => {
+        log(`MCP_TOR_RELAY_ENDED code=${code2}`);
+        relayStopped();
+      });
+      current = createMcpDispatcher({ tools: doneTool ? [doneTool] : [], instructions: INSTRUCTIONS, log, client, listChanged: true });
+      log("MCP_SETUP_SWITCHED to the wallet server behind Tor");
+      client.notify?.("notifications/tools/list_changed");
+      return;
+    }
     wallet = await openWalletServer({ ...options, client, log });
+    notice = startNotice(options.memoServiceUrl);
     current = createMcpDispatcher({
       tools: withLaunchNotice(notice.wrapTools([...wallet.tools, ...doneTool ? [doneTool] : []], UPDATE_NOTICE_TOOLS), launchNotice),
       instructions: withLaunchLine(notice.instructions(INSTRUCTIONS), launchNotice),
@@ -135141,8 +135297,6 @@ async function runSetupModeServer({
   };
   try {
     const setup = setupTools({ client, log, activate });
-    if (discoverCacheDir) loadX402Listings({ cacheDir: discoverCacheDir }).catch(() => {
-    });
     doneTool = setup.doneTool;
     if (launchNotice) log(`MCP_LAUNCH_OLD_FORM ${launchNotice}`);
     current = createMcpDispatcher({
@@ -135154,15 +135308,30 @@ async function runSetupModeServer({
       listChanged: true
     });
     log("MCP_READY setup-mode: the wallet is not set up; tools: shinjuku_setup, wallet_status");
-    await serveStdio({ input, output: output2, dispatch: (entry) => current(entry), log, client });
+    const forward = (text3, message) => {
+      if (!relay) return false;
+      if (message?.method === "tools/call" && message.params?.name === "shinjuku_setup") return false;
+      if (message?.method === "tools/list" && validId(message.id)) listIds.add(message.id);
+      relay.write(text3);
+      return true;
+    };
+    const served = serveStdio({ input, output: output2, log, client, forward, dispatch: (entry) => {
+      if (entry?.method === "initialize") initParams = entry.params;
+      return current(entry);
+    } });
+    await Promise.race([served, relayEnded]);
   } finally {
     stopKeepWarm();
+    if (relay) {
+      relay.end();
+      await relay.exited;
+    }
     ended = wallet ? await closeWithin(wallet.close(), { moving: wallet.moving, movingWork: wallet.movingWork, historyBusy: closeHistoryBusy(wallet), log }) : true;
     Object.assign(console, saved);
   }
   return { closed: ended };
 }
-var import_web3134, SUPPORTED_PROTOCOL_VERSIONS, MAX_LINE_BYTES, POSITIVE_ATOMIC7, INSTRUCTIONS, MCP_LOG_LEVELS, POOL_SWITCH_LOG_LEVEL, validId, BUNDLED_SOURCE_DIR, SHA256_HEX, UPDATE_NOTICE_TOOLS, UPDATE_NOTICE_MAX_TEXT, NPM_VERSION2, GIT_COMMIT, ownWalletVersion, mcpServerVersion, UPDATE_NOTICE_TEXT, updateNoticeLine, LAUNCH_NOTICE_TOOLS, withLaunchLine, capRequired, setupInvalid, TOOL_ROOTS_WAIT_MS, ROOTS_FREE_TOOLS, MCP_CLOSE_BOUND_MS, MCP_CLOSE_HISTORY_BOUND_MS, MCP_CLOSE_UNREADABLE_BOUND_MS, MCP_CLOSE_POLL_MS, closeHistoryBusy, SETUP_INSTRUCTIONS;
+var import_web3134, SUPPORTED_PROTOCOL_VERSIONS, MAX_LINE_BYTES, POSITIVE_ATOMIC7, INSTRUCTIONS, MCP_LOG_LEVELS, POOL_SWITCH_LOG_LEVEL, validId, BUNDLED_SOURCE_DIR, SHA256_HEX, UPDATE_NOTICE_TOOLS, UPDATE_NOTICE_MAX_TEXT, NPM_VERSION2, GIT_COMMIT, ownWalletVersion, mcpServerVersion, UPDATE_NOTICE_TEXT, updateNoticeLine, LAUNCH_NOTICE_TOOLS, withLaunchLine, capRequired, setupInvalid, TOOL_ROOTS_WAIT_MS, ROOTS_FREE_TOOLS, MCP_CLOSE_BOUND_MS, MCP_CLOSE_HISTORY_BOUND_MS, MCP_CLOSE_UNREADABLE_BOUND_MS, MCP_CLOSE_POLL_MS, closeHistoryBusy, SETUP_INSTRUCTIONS, TOR_RELAY_READY_MS, RELAY_INIT_ID;
 var init_stdioServer = __esm({
   "wallet/src/mcp/stdioServer.mjs"() {
     "use strict";
@@ -135222,6 +135391,8 @@ var init_stdioServer = __esm({
     MCP_CLOSE_POLL_MS = 500;
     closeHistoryBusy = (server) => () => compactHistoryReadsRunning() > 0 || memoReadsAheadRunning() > 0 || server.refreshOpen?.() === true;
     SETUP_INSTRUCTIONS = `This Shinjuku Shield wallet server is NOT SET UP on this machine yet: every money tool answers wallet_not_set_up. When the user wants to pay, check a balance, or add money, call shinjuku_setup: it asks the user to confirm in this client, creates the wallet here, and downloads the proof tools (minutes: call it again as its next says). At stage done the wallet tools are live in this same server. After setup: ${INSTRUCTIONS}`;
+    TOR_RELAY_READY_MS = 18e4;
+    RELAY_INIT_ID = "shinjuku-wallet-relay-initialize";
   }
 });
 
@@ -135596,7 +135767,7 @@ async function serveTorMissingMcp({ message, recheck = async () => false, input
       ready = false;
     }
     const body = ready ? {
-      say: `Tor runs on this machine now, but this wallet started before it did. ${RESTART}.`,
+      say: "Tor runs now. Reconnect the wallet once (the steps are below), then ask again. Nothing was paid.",
       ok: false,
       error: "mcp_restart_needed",
       next: `Tell the user: ${RESTART}. Nothing was paid.`
@@ -135635,7 +135806,7 @@ var init_torMissingMcp = __esm({
     "use strict";
     init_stdioServer();
     init_tools();
-    RESTART = "Restart this MCP server in your app (or restart the app), then ask again";
+    RESTART = `Reconnect the wallet once (${RESTART_STEPS}), then ask again`;
   }
 });
 
@@ -161961,6 +162132,7 @@ async function runInferStop(values, deps) {
 var CHAT_RAW_ARGS = /* @__PURE__ */ Symbol("chat raw args");
 var WALLET_FROM_SETUP = /* @__PURE__ */ Symbol("wallet from setup");
 var RAN_BEHIND_TOR = /* @__PURE__ */ Symbol("ran behind tor");
+var SETUP_RERUN = /* @__PURE__ */ Symbol("setup rerun");
 var INFER_CAP_FLAGS = Object.freeze(["--max-payment", "--max-session"]);
 var RanBehindTorFailed = class extends Error {
   constructor(code2) {
@@ -162219,15 +162391,7 @@ function withProofToolsRefresh(options, fromConfig) {
 var inProxiedRun = (env) => childRunProxy(env).args.length > 0;
 var terminalQuiet = (values, deps) => deps.stdoutIsTTY?.() === true && !values.has("--json") && !values.has("--verbose");
 var TOR_RUN_STARTED_ENV2 = "SHINJUKU_WALLET_TOR_RUN_STARTED_FILE";
-var TOR_DOWN_DETAIL = "Your private connection (Tor) is not running, so no payment was made. Start Tor, then restart this MCP server in your agent host and try again.";
-var recordedTunnelHost = (configPath2) => {
-  try {
-    const tunnel = readSetupConfig(dirname33(configPath2))?.torTunnel;
-    return tunnel ? new URL(tunnel).host : "127.0.0.1:9080";
-  } catch {
-    return "127.0.0.1:9080";
-  }
-};
+var TOR_DOWN_DETAIL = "The wallet runs only over Tor, and Tor is not running on this computer (after the computer restarts, Tor must be started again), so nothing was paid or sent.";
 var recordedTunnelUrl = (configPath2) => {
   try {
     return readSetupConfig(dirname33(configPath2))?.torTunnel ?? TOR_HTTP_TUNNEL;
@@ -162235,11 +162399,18 @@ var recordedTunnelUrl = (configPath2) => {
     return TOR_HTTP_TUNNEL;
   }
 };
-var torDownNext = (configPath2) => `Tell the user: start Tor (its torrc needs HTTPTunnelPort ${recordedTunnelHost(configPath2)}), then restart this MCP server in the agent host (or restart the host app); the wallet tools start behind Tor then. Setup recorded Tor in ${configPath2}; a setup rerun keeps it. Nothing falls back to a direct connection. If Tor is not installed: ${torInstallText()}`;
+var torDownNext = (configPath2) => `Tell the user why: Tor is not running, and the wallet never falls back to a direct connection. Show torStartCommand in one code block, to copy into ${torStart().where}: this command downloads Tor and starts it for the wallet. If you can run commands here, offer to run it for the user. When Tor runs: ${RESTART}. (Setup recorded Tor in ${configPath2}.)`;
 async function runMcpTorDown({ exitCode, configPath: configPath2, input = process.stdin, output: output2 = process.stdout, errorOutput = process.stderr }) {
   const log = (line) => errorOutput.write(`${line}
 `);
-  const unavailable = JSON.stringify({ ok: false, error: "mcp_tor_unavailable", detail: TOR_DOWN_DETAIL, next: torDownNext(configPath2) }, null, 2);
+  const unavailable = JSON.stringify({
+    say: "Not paid: the wallet runs only over Tor, and Tor is not running on this computer. Start it with the command below.",
+    ok: false,
+    error: "mcp_tor_unavailable",
+    detail: TOR_DOWN_DETAIL,
+    next: torDownNext(configPath2),
+    torStartCommand: torStart().command
+  }, null, 2);
   const tunnel = recordedTunnelUrl(configPath2);
   const answer = async () => {
     let ready = false;
@@ -162249,7 +162420,7 @@ async function runMcpTorDown({ exitCode, configPath: configPath2, input = proces
       ready = false;
     }
     const restart = ready ? {
-      say: `Tor runs on this machine now, but this wallet started before it did. ${RESTART}.`,
+      say: "Tor runs now. Reconnect the wallet once (the steps are below), then ask again. Nothing was paid.",
       ok: false,
       error: "mcp_restart_needed",
       next: `Tell the user: ${RESTART}. Nothing was paid.`
@@ -162381,11 +162552,12 @@ async function runMcpFirstRun(values, deps) {
         discoverCacheDir: join40(home, "discover-cache"),
         npmVersion: deps.walletVersion().npm
       }),
-      discoverCacheDir: join40(home, "discover-cache"),
       startNormal: async () => {
         const after = mcpValuesAfterSetup(values, home, deps);
-        if (after.values.get(MCP_FROM_CONFIG).config.tor === true && !after.values.has("--no-tor") && !inProxiedRun(deps.env)) {
-          throw new Error("setup_tor_needs_restart: config.json asks for Tor, and this MCP server started without Tor, so it does not switch to the wallet tools in place; every money tool stays refused. Restart this MCP server in the host: it then starts behind Tor (Tor must run with HTTPTunnelPort 127.0.0.1:9080)");
+        const config = after.values.get(MCP_FROM_CONFIG).config;
+        if (config.tor === true && !after.values.has("--no-tor") && !inProxiedRun(deps.env)) {
+          const args = ["--tor", "mcp", ...after.values.get(MCP_RAW_ARGS), ...config.torTunnel ? ["--proxy", config.torTunnel] : []];
+          return { relay: () => deps.torChild(args, ["pipe", "pipe", "inherit"]) };
         }
         const options = withProofToolsRefresh(mcpServerOptions(after.values, after.deps), after.values.get(MCP_FROM_CONFIG));
         warm = options.proofToolsPath ? deps.startKeepWarm(options, deps.env) : void 0;
@@ -162413,14 +162585,45 @@ function mcpSetupAdapter(values, home, deps) {
     },
     missing: () => missingPieces(home, readSetupConfig(home)),
     // privateInference: the human ticked "Use private inference for your AI now" (a yes, as setup --private-inference);
-    // no tick keeps what config.json records.
-    run: async (onStage, { privateInference } = {}) => runSetupRecorded(
-      { ...setupOptionsOf(values, home), onStage },
-      setupDeps,
-      inferenceRecordOf(readSetupConfig(home), privateInference === true ? true : void 0)
-    )
+    // no tick keeps what config.json records. tor: the answer to "Use Tor?" (private inference turns it on). A server
+    // already behind Tor (or an old caller with no answer) sets up in place.
+    run: async (onStage, { privateInference, tor } = {}) => {
+      if (tor === true && !inProxiedRun(deps.env)) return mcpSetupBehindTor(values, home, deps, { privateInference: privateInference === true, onStage });
+      return runSetupRecorded(
+        { ...setupOptionsOf(values, home), ...typeof tor === "boolean" ? { tor } : {}, onStage },
+        setupDeps,
+        inferenceRecordOf(readSetupConfig(home), privateInference === true ? true : void 0)
+      );
+    }
   };
 }
+async function mcpSetupBehindTor(values, home, deps, { privateInference, onStage }) {
+  const caps = new Map(Object.entries(setupOptionsOf(values, home)).filter(([key]) => key !== "home").map(([key, value]) => [`--${key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`, value]));
+  onStage("tor", "setup runs over Tor: it makes the wallet and downloads its files (about 191 MB) over Tor, which takes a few minutes");
+  const child = deps.torChild(
+    ["--tor", "setup", "--yes", "--prefer-tor", ...privateInference ? ["--private-inference"] : [], ...setupArgvOf(caps)],
+    ["ignore", 2, 2]
+  );
+  const code2 = await new Promise((resolvePromise) => {
+    child.on("error", () => resolvePromise(1));
+    child.on("exit", (exitCode, signal) => resolvePromise(exitCode ?? (signal ? 1 : 0)));
+  });
+  const config = code2 === 0 ? setupConfigOf(home) : void 0;
+  if (!config) {
+    const made = setupConfigOf(home)?.recoveryFile;
+    if (made && existsSync(made)) onStage("wallet-created", { recoveryFile: made });
+    throw new Error(`setup_tor_unavailable: setup ran behind Tor, and that run ended with exit code ${code2} (its lines are in this server's log); nothing was paid. It continues where it stopped when it runs again`);
+  }
+  onStage("tor", "the wallet is made; its server starts over Tor now (the first Tor connection can take a minute)");
+  const recoveryFile = config.recoveryFile && existsSync(config.recoveryFile) ? config.recoveryFile : void 0;
+  return Object.freeze({
+    pool: config.pool,
+    caps: config.caps,
+    tor: true,
+    wallet: { status: recoveryFile ? "created" : "existing", ...recoveryFile ? { recoveryFile } : {} },
+    ...privateInference ? { privateInference: true } : {}
+  });
+}
 function inferenceRecordOf(old, answer) {
   const recorded = typeof old?.inference?.enabled === "boolean" ? old.inference.enabled : void 0;
   if (answer === true) return true;
@@ -162717,13 +162920,14 @@ async function runSetupCommand(values, deps) {
   let ownAddress = values.get("--own-address");
   const old = setupConfigOf(home);
   const behindTor = (wanted) => wanted && !values.has("--no-tor") && !inProxiedRun(deps.env);
+  const missing = missingPieces(home, old);
+  if (old && !missing.length) values.set(SETUP_RERUN, "settings");
   if (!interactive && behindTor(values.has("--prefer-tor") || values.has("--private-inference") || old?.tor === true)) {
     await setupBehindTor(setupArgvOf(values), deps);
     if (ownAddress) io.out(`${recordOwnAddress(home, ownAddress, deps).join("\n")}
 `);
     return void 0;
   }
-  const missing = missingPieces(home, old);
   const npmVersion = deps.walletVersion().npm;
   const introduced = values.has("--yes") && inProxiedRun(deps.env);
   const asksOwnFirst = interactive && Boolean(old) && terminal && !ownAddress;
@@ -162745,7 +162949,7 @@ async function runSetupCommand(values, deps) {
     ...values.has("--max-shield") ? { maxShield: values.get("--max-shield") } : {},
     ...values.has("--max-unshield") ? { maxUnshield: values.get("--max-unshield") } : {},
     ...values.has("--prefer-tor") || torRunRecords ? { tor: true } : {},
-    // This --tor run's own local tunnel when it is not 127.0.0.1:9080 (setup --tor --proxy http://127.0.0.1:9150): mcp uses it.
+    // This --tor run's own local tunnel when it is not 127.0.0.1:9080 (another local Tor HTTPTunnelPort, for example a second tor process: setup --tor --proxy http://127.0.0.1:9180): mcp uses it.
     ...torRunRecords && childRunProxy(deps.env).args[1] === "--proxy" ? { torTunnel: childRunProxy(deps.env).args[2] } : {},
     ...values.has("--passphrase-file") ? { passphraseFile: values.get("--passphrase-file") } : {},
     ...values.has("--facilitator") ? { facilitator: values.get("--facilitator") } : {},
@@ -162778,6 +162982,7 @@ async function runSetupCommand(values, deps) {
       if (/^setup_own_address_[a-z_]+: /.test(String(error?.message))) throw new PublicFailure(error.message);
       throw error;
     }
+    values.set(SETUP_RERUN, "own-address");
     io.out([
       `Saved: ${ownAddress} is your own address now, so your agent sends money back to you there without asking each time (no restart of your agent app needed).`,
       ...saved.dropped.length ? [`config.json keeps ${MAX_OWN_ADDRESSES} own addresses: the oldest (${saved.dropped.join(", ")}) now ask before each send.`] : [],
@@ -162859,25 +163064,33 @@ Copy it to two offline places now; it is the only way to restore this wallet.
   lines.push("");
   io.out(`${lines.join("\n")}
 `);
+  const rerun = values.get(SETUP_RERUN) === "settings";
   const targets = values.get("--add-to") ?? [];
   if (targets.length) addToHosts(targets, home, deps, { force: values.has("--force"), npmVersion });
-  io.out(`${targets.length ? "Or add it by hand" : "Add it to your agent host"}:
+  if (rerun && !targets.length) {
+    io.out("Your agent app keeps its MCP entry: restart this wallet's MCP server there (or restart the app) so it reads these settings. To add the wallet to another agent app, run setup again with --add-to claude-code, claude-desktop, or cursor.\n");
+  } else {
+    io.out(`${targets.length ? "Or add it by hand" : "Add it to your agent host"}:
 ${hostConfigText({ home, env: deps.env, platform: deps.platform ?? process.platform, npmVersion })}
 `);
-  io.out(`
+    io.out(`
 ${terminalUseLines(npmVersion).join("\n")}
 `);
+  }
   const config = setupConfigOf(home);
+  const inferenceNow = summary.privateInference === true && (!rerun || old?.inference?.enabled !== true);
   let apiKey;
-  if (summary.privateInference === true && config?.pool) {
+  if (inferenceNow && config?.pool) {
     try {
       apiKey = localAiServerApiKey(home, { walletPath: homeWalletPath(home, config.pool) });
     } catch {
       apiKey = void 0;
     }
   }
-  io.out(`
-${summary.privateInference === true ? privateInferencePath(config, { apiKey }).text : fundingStepText(config?.tor === true)}`);
+  if (inferenceNow) io.out(`
+${privateInferencePath(config, { apiKey }).text}`);
+  else if (!rerun) io.out(`
+${fundingStepText(config?.tor === true)}`);
   if (interactive) await offerFundNow(deps, { tor: config?.tor === true });
 }
 function validateAddFunds(values) {
@@ -163738,8 +163951,9 @@ var COMMANDS = [
       "A command that takes --pool (balance, recover, deposit, add-funds, and others) takes it, and the passphrase of this home's wallet, from config.json when you leave them out: shinjuku balance needs no flags. A pocket command (pocket list, scan, reshield, release, fill) takes this home's --wallet and passphrase file the same way, and --program, --proof-tools, --facilitator when it needs them. A flag or SHIELDED_WALLET_PASSPHRASE still wins; init and restore never use config.json, and move reads it itself."
     ],
     next: `start it from your agent host with npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
-    // After a run: the same line as the host config setup printed (this npm version, when the wallet knows it).
-    nextAfterRun: (values, deps) => `start it from your agent host with npx -y --no-audit --no-fund ${npxPackageWord(deps.walletVersion().npm)} mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
+    // After a run: the same line as the host config setup printed (this npm version, when the wallet knows it). A rerun
+    // of a complete setup (SETUP_RERUN): the agent app already has the entry.
+    nextAfterRun: (values, deps) => values.get(SETUP_RERUN) === "settings" ? `restart this wallet's MCP server in your agent app (or restart the app) so it reads these settings, then ask your agent "what is my balance"` : values.get(SETUP_RERUN) === "own-address" ? "ask your agent to send money to your own address: it sends without asking you each time" : `start it from your agent host with npx -y --no-audit --no-fund ${npxPackageWord(deps.walletVersion().npm)} mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
     run: (args, values, deps, io) => deps.setupMain(values, { ...deps, io })
   },
   {
@@ -166250,6 +166464,8 @@ function defaultDependencies() {
         else process.env[TOR_RUN_STARTED_ENV2] = before;
       }
     },
+    /** One command line as a child behind Tor with the given stdio (the MCP setup server's Tor setup and Tor wallet server). */
+    torChild: (argv2, stdio) => torChild(argv2, stdio),
     // No command calls these (the v0b and laneb families are retired, RETIRED_FAMILIES). They stay only because
     // wallet/scripts/bundle.mjs still requires the V0b zk-sdk WASM in the bundle; drop both together.
     v0bMain: async (...args) => (await Promise.resolve().then(() => (init_cli4(), cli_exports))).v0bMain(...args),