shinjuku-shield 0.3.95 → 0.3.96

package/README.md

@@ -6,13 +6,13 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.95. The npm packages `shinjuku-shield` and
+This is version 0.3.96. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files; `shinjuku` is the short command.
 
 ## Set up
 
 ```sh
-npx -y --no-audit --no-fund shinjuku-shield@0.3.95 setup
+npx -y --no-audit --no-fund shinjuku-shield@0.3.96 setup
 ```
 
 Setup makes the wallet on this machine, a private passphrase file, and the
@@ -24,7 +24,7 @@ server to that host's config.
 ## The `shinjuku` command
 
 ```sh
-npm install -g shinjuku@0.3.95
+npm install -g shinjuku@0.3.96
 shinjuku help
 ```
 
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.95 mcp
+claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.96 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.95", "mcp"] } } }
+{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.96", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "6304f68098886ee10121039f4fb06e7b07fc812b608c5595292ffeaad1ff2ea9",
-  "bytes": 12720423,
-  "sourceCommit": "96c50ad9474c58624219002d5da194e3982f28f5",
+  "sha256": "4a3321b081e721e8815c614b5e68bb8bf31405cda64ff0b1b9f3b98e62958bab",
+  "bytes": 12723643,
+  "sourceCommit": "7a18460800537e3397d851bac7c0dc44b64333d8",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1297,5 +1297,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-24T05:34:58.862Z"
+  "publishedAt": "2026-10-24T06:44:24.102Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shield",
-  "version": "0.3.95",
+  "version": "0.3.96",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "6304f680",
-  "shinjukuSha256": "6304f68098886ee10121039f4fb06e7b07fc812b608c5595292ffeaad1ff2ea9",
+  "shinjukuRelease": "4a3321b0",
+  "shinjukuSha256": "4a3321b081e721e8815c614b5e68bb8bf31405cda64ff0b1b9f3b98e62958bab",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -104889,7 +104889,7 @@ function isOlderSetupEntry(existing, entry) {
   if (!isPlainObject3(existing) || !Array.isArray(existing.args) || entry.command !== "npx" || !Array.isArray(entry.args)) return false;
   const pinned = (args) => args.some((arg) => PINNED_PACKAGE.test(arg));
   if (pinned(existing.args) && !pinned(entry.args)) return false;
-  const plain = (args) => args.map((arg) => PINNED_PACKAGE.test(arg) || NPM_PACKAGE_NAMES.includes(arg) ? NPX_PACKAGE : arg);
+  const plain = (args) => args.map((arg) => PINNED_PACKAGE.test(arg) || NPM_PACKAGE_NAMES.includes(arg) || arg === COMMAND_PACKAGE ? NPX_PACKAGE : arg);
   const was = { ...existing, args: plain(existing.args) };
   const now = { ...entry, args: plain(entry.args) };
   return sameJson2(was, now) || sameJson2(was, { ...now, args: now.args.filter((arg) => !NPX_INSTALL_FLAGS.includes(arg)) });
@@ -104973,7 +104973,7 @@ function addToJsonHost(file, entry, { now = /* @__PURE__ */ new Date(), force =
   }
   return { file, changed: true, ...backup ? { backup } : {} };
 }
-var import_web3118, CONFIG_SCHEMA, CONFIG_FILE, NPM_PACKAGE_NAMES, NPX_PACKAGE, COMMAND_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, P03_BINDING2, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC2, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC2, configPath, homeWalletPath, invalid3, isPubkey, MAX_OWN_ADDRESSES, isOwnAddressText, HOST_TARGETS, PINNED_PACKAGE, NPM_VERSION, knownNpmVersion, WINDOWS_SHELL_CODE, isPlainObject3, sameJson2;
+var import_web3118, CONFIG_SCHEMA, CONFIG_FILE, NPM_PACKAGE_NAMES, COMMAND_PACKAGE, NPX_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, P03_BINDING2, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC2, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC2, configPath, homeWalletPath, invalid3, isPubkey, MAX_OWN_ADDRESSES, isOwnAddressText, HOST_TARGETS, PINNED_PACKAGE, NPM_VERSION, knownNpmVersion, WINDOWS_SHELL_CODE, isPlainObject3, sameJson2;
 var init_config2 = __esm({
   "wallet/src/setup/config.mjs"() {
     "use strict";
@@ -104983,8 +104983,8 @@ var init_config2 = __esm({
     CONFIG_SCHEMA = "shinjuku-shielded/config/v1";
     CONFIG_FILE = "config.json";
     NPM_PACKAGE_NAMES = Object.freeze(["shinjuku-shield", "shinjuku-shielded"]);
-    NPX_PACKAGE = NPM_PACKAGE_NAMES[0];
     COMMAND_PACKAGE = "shinjuku";
+    NPX_PACKAGE = COMMAND_PACKAGE;
     NPX_INSTALL_FLAGS = Object.freeze(["--no-audit", "--no-fund"]);
     MCP_SERVER_NAME = "shinjuku-shielded";
     P03_BINDING2 = "carbon-shielded-exact/svm-v3";
@@ -105026,7 +105026,7 @@ var init_config2 = __esm({
     MAX_OWN_ADDRESSES = 8;
     isOwnAddressText = (value) => isPubkey(value);
     HOST_TARGETS = Object.freeze(["claude-code", "claude-desktop", "cursor"]);
-    PINNED_PACKAGE = /^shinjuku-shield(?:ed)?@(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+    PINNED_PACKAGE = /^shinjuku(?:-shield(?:ed)?)?@(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
     NPM_VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
     knownNpmVersion = (npmVersion) => typeof npmVersion === "string" && npmVersion !== "0.0.0" && NPM_VERSION.test(npmVersion) ? npmVersion : void 0;
     WINDOWS_SHELL_CODE = /[%$`"\r\n]/;
@@ -105344,7 +105344,7 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
       const awaiting = pendingDeposits.find((entry) => entry.state === "awaiting_funds");
       if (records.every(planOnly)) {
         Object.assign(detail, { unspentAtomic: "0", reservedAtomic: "0", balanceSource: "new_wallet_nothing_received" });
-        return report("empty", 0n, "no deposit yet: deposit one of two ways (shinjuku help deposit). 1) The more private path, shinjuku deposit --relay: no SOL is needed; its first run prints a one-time address to fund with USDC from an exchange withdrawal or an outside privacy pool. 2) Send USDC and about 0.01 SOL to your solanaFeePayer address (printed by init), then run shinjuku deposit without --relay; that deposit edge is public. If this wallet only holds restored keys or receives payments, run balance --refresh");
+        return report("empty", 0n, "no deposit yet: run shinjuku add-funds --route exchange --amount 1 (change 1 to the USDC you want): it gives a one-time address and its QR code to send USDC to from any wallet or exchange (no SOL needed). If this wallet only holds restored keys or receives payments, run balance --refresh");
       }
       reasons.push("this wallet has a deposit, add-funds or payment record but no balance walk yet: its balance is not known until the first read");
       return report("unknown", null, proved ? `deposit ${proved.depositId} is proved but not sent: back up (shinjuku help backup-export), then rerun the same deposit command with --submit --service <facilitator URL>` : awaiting ? `deposit ${awaiting.depositId} waits for USDC at its one-time address: fund it, then rerun the same deposit --relay command (it prints the address)` : refreshCommand(state));
@@ -110135,8 +110135,8 @@ function linkSay(a) {
       const max = usdcText(a.roundMaxAtomic);
       const what = hint ? `${hint} USDC` : max ? `up to ${max} USDC` : "USDC";
       const send3 = `Send ${what} on Solana to ${address5}.`;
-      const full = `${send3} After it arrives, ask for your balance once; it becomes private by itself a few minutes later.`;
-      return words(full) <= SAY_MAX_WORDS ? full : `${send3} After it arrives, ask for your balance once; it becomes private a few minutes later.`;
+      const full = `${send3} After it arrives, ask for your balance once; it becomes private by itself within a few minutes.`;
+      return words(full) <= SAY_MAX_WORDS ? full : `${send3} After it arrives, ask for your balance once; it becomes private within a few minutes.`;
     }
     case "shielding":
     case "partly_shielded": {
@@ -110342,6 +110342,8 @@ function balanceLine(a, room = SAY_MAX_WORDS) {
   if (moving) return have(`. ${MOVE_LINE}`);
   const held = heldByPaymentSay(a.detail);
   if (balance === "0" && held) return held;
+  const waitsAt = Array.isArray(a.addFunds) && a.addFunds.some((row) => row && row.state === "open" && row.landed !== true && (row.heldAtomic === null || row.heldAtomic === "0"));
+  if (balance === "0" && !pubPart && waitsAt) return "Your private balance is 0. The wallet watches your add-funds address and shows the USDC here after it arrives.";
   if (balance === "0" && !pubPart) return "Your private balance is empty. Use wallet_add_funds to get an address to send USDC to.";
   const parts = Number.isSafeInteger(a.balanceParts) && a.balanceParts > 1 && !a.sendWaiting ? a.balanceParts : 0;
   if (parts) {
@@ -119781,7 +119783,7 @@ function createAddFundsTool({
   return {
     name: "wallet_add_funds",
     title: "Add money: a one-time address to send USDC to",
-    description: 'Use this to add money to the wallet. Answers a NEW one-time Solana address of this wallet (with a solana: pay link and one line to paste). Send USDC to it from any wallet or exchange; after it arrives, ask for the balance once (wallet_balance): the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes (no other step). Up to 5 USDC (or the shield limit set at start) goes in at a time; more waits safely at the address and goes in a little at a time. amount (USDC text, like "0.37") is optional: a hint shown in the link. Without request_id each call gives a new address (at most 5 unused ones; then the newest unused one again). With a request_id: the first call makes its address, a later call answers that address and its state. Use each address for ONE payer: a second payer on the same address is linked to the first on chain. Moves no money by itself. Refusals: mcp_argument_invalid, payme_amount_invalid, payme_note_invalid, mcp_request_id_reused, mcp_request_id_reserved, payme_key_probe_exhausted, mcp_tool_disabled, wallet_locked, mcp_add_funds_failed.',
+    description: 'Use this to add money to the wallet. Answers a NEW one-time Solana address of this wallet (with a solana: pay link and one line to paste). Send USDC to it from any wallet or exchange; after it arrives, ask for the balance once (wallet_balance): the wallet then sees the USDC and makes it private by itself after a random privacy wait of up to 5 minutes (no other step). Up to 5 USDC (or the shield limit set at start) goes in at a time; more waits safely at the address and goes in a little at a time. amount (USDC text, like "0.37") is optional: a hint shown in the link. Without request_id each call gives a new address (at most 5 unused ones; then the newest unused one again). With a request_id: the first call makes its address, a later call answers that address and its state. Use each address for ONE payer: a second payer on the same address is linked to the first on chain. Moves no money by itself. Refusals: mcp_argument_invalid, payme_amount_invalid, payme_note_invalid, mcp_request_id_reused, mcp_request_id_reserved, payme_key_probe_exhausted, mcp_tool_disabled, wallet_locked, mcp_add_funds_failed.',
     inputSchema: {
       type: "object",
       properties: {
@@ -127407,7 +127409,7 @@ ${canonical5}`;
       return refuse12(
         code2,
         `the shielded balance is less than this payment needs (price + fee); nothing was paid.${facts}`,
-        `Nothing was paid. Tell the user the balance is too low for this price: wallet_balance shows breakdown.shieldedAtomic (a refund still on its way shows as refundsInFlightAtomic and becomes spendable when it arrives). To pay, add USDC with wallet_add_funds (it gives an address; after the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes), wait until wallet_balance counts it, then call ${tool} again with request_id "${requestId}" and ${same2} (it never pays twice)`,
+        `Nothing was paid. Tell the user the balance is too low for this price: wallet_balance shows breakdown.shieldedAtomic (a refund still on its way shows as refundsInFlightAtomic and becomes spendable when it arrives). To pay, add USDC with wallet_add_funds (it gives an address; after the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of up to 5 minutes), wait until wallet_balance counts it, then call ${tool} again with request_id "${requestId}" and ${same2} (it never pays twice)`,
         {
           requestId,
           paid: false,
@@ -127469,7 +127471,7 @@ ${canonical5}`;
       if (reads.size >= LINK_HELD_READS_MAX) break;
       if (record.state !== "open" || typeof record.tokenAccount !== "string" || ATOMIC_TEXT.test(String(record.leftAtAddressAtomic ?? ""))) continue;
       const seen = linkHeldSeen.get(record.id);
-      if (seen && Date.now() - seen.atMs < LINK_HELD_FRESH_MS) {
+      if (seen && seen.held !== "0" && Date.now() - seen.atMs < LINK_HELD_FRESH_MS) {
         reads.set(record.id, Promise.resolve(seen.held));
         continue;
       }
@@ -127899,7 +127901,7 @@ ${canonical5}`;
       else if (one.breakdown?.movingAtomic && one.breakdown.movingAtomic !== "0") next = "some of your balance moves to the facilitator's new pool now (movingAtomic): it counts in balanceAtomic and is spendable in a few minutes; the move field shows the move";
       else if (unshielded.unshieldedAtomic && unshielded.unshieldedAtomic !== "0" && shieldEnabled) next = 'to make the public USDC private, call wallet_shield with amount (like "0.37")';
       else if (one.balanceAtomic === "0" && shieldEnabled) {
-        next = elsewhereEnabled ? `the shielded balance is 0, so x402_pay cannot pay yet. To add funds, call wallet_add_funds: it gives a one-time address; up to ${usdcText2(payMeRoundMax())} USDC sent there on Solana becomes private a few minutes after it arrives while this MCP server runs (or call wallet_add_funds with its request_id to finish it at once)` : `the shielded balance is 0, so x402_pay cannot pay yet. To add funds: send USDC on Solana to ownAddress (this wallet's own key), then call wallet_shield with amount (any amount from ${usdcText2(10000n)} to ${usdcText2(MAX_SHIELDED_BALANCE_ATOMIC)} USDC)`;
+        next = elsewhereEnabled ? `the shielded balance is 0, so x402_pay cannot pay yet. To add funds, call wallet_add_funds: it gives a one-time address; up to ${usdcText2(payMeRoundMax())} USDC sent there on Solana becomes private within a few minutes after it arrives while this MCP server runs (or call wallet_add_funds with its request_id to finish it at once)` : `the shielded balance is 0, so x402_pay cannot pay yet. This server has no private deposit address, so the only way in is a deposit from this wallet's public address (ownAddress): the chain then shows that this wallet's public address added that amount; later payments stay private. Tell the user this BEFORE they send. To add funds that way: send USDC on Solana to ownAddress, then call wallet_shield with amount (any amount from ${usdcText2(10000n)} to ${usdcText2(MAX_SHIELDED_BALANCE_ATOMIC)} USDC)`;
       } else next = "nothing to do; x402_pay pays from balanceAtomic, wallet_unshield sends from breakdown.shieldedAtomic";
       const lastRead = one.balanceAtomic === null && refresh.refreshing === true && !firstRead && ATOMIC_TEXT.test(String(report.detail?.unspentAtomic ?? "")) && Number.isFinite(report.detail?.lastRefresh?.ageSeconds) ? { privateAtomic: String(report.detail.unspentAtomic), ageMinutes: Math.max(1, Math.round(report.detail.lastRefresh.ageSeconds / 60)) } : void 0;
       if (lastRead) {
@@ -127988,6 +127990,7 @@ ${canonical5}`;
         sendWaiting = void 0;
       }
       const arrivingAll = addFundsOpen.filter((link2) => link2.landed !== true && (link2.state === "shielding" || /^[1-9][0-9]*$/.test(String(link2.heldAtomic ?? ""))));
+      const addFundsWaiting = addFundsOpen.filter((link2) => link2.state === "open" && link2.landed !== true && (link2.heldAtomic === null || link2.heldAtomic === "0"));
       const arrivingLine = (arriving) => {
         const amount = /^[1-9][0-9]*$/.test(String(arriving.shieldingAtomic ?? "")) ? `${usdcText2(arriving.shieldingAtomic)} USDC` : /^[1-9][0-9]*$/.test(String(arriving.heldAtomic ?? "")) ? `${usdcText2(arriving.heldAtomic)} USDC` : "USDC (an amount still being read)";
         const when = arriving.state === "shielding" && !arriving.startsAtNextRequest ? "is becoming private now (its deposit transaction was sent; about 1 minute)" : arriving.startsInMinutes > 0 ? `waits about ${minutesText2(arriving.startsInMinutes)} (a random wait hides the link to the deposit), then becomes private by itself in about 1 minute more` : "becomes private by itself: its deposit starts now and takes about 1 minute";
@@ -127999,6 +128002,9 @@ ${canonical5}`;
         next = `${landedNext ? `${landedNext}. ` : ""}${arrivingLine(arrivingAll[0])}. ${inWait(arrivingAll[0]) ? "Tell the user it becomes private by itself at that time; they can ask about the balance after that to see it" : "Tell the user it becomes private by itself in about 1 minute; they can ask about the balance after that to see it"}; do not hurry it.${runsOn} If balanceAtomic does not show it 10 minutes after that, call wallet_add_funds with request_id "${arrivingAll[0].requestId}": it finishes it now. Do not ask for a new address`;
       } else if (arrivingAll.length > 1) {
         next = `${landedNext ? `${landedNext}. ` : ""}${arrivingAll.map(arrivingLine).join("; ")}. ${arrivingAll.some(inWait) ? "Tell the user the total; each becomes private by itself at the time named, and they can ask about the balance after that to see it" : "Tell the user the total; it becomes private by itself in about 1 minute, and they can ask about the balance after that to see it"}; do not hurry it.${runsOn} If balanceAtomic does not show one 10 minutes after its time, call wallet_add_funds with its request_id: it finishes it now. Do not ask for a new address`;
+      } else if (one.balanceAtomic === "0" && addFundsWaiting.length) {
+        const ids = addFundsWaiting.map((link2) => `"${link2.requestId}"`).join(", ");
+        next = `${landedNext ? `${landedNext}. ` : ""}the shielded balance is 0, and the wallet waits for USDC at the add-funds address${addFundsWaiting.length > 1 ? "es" : ""} it gave (request_id ${ids}); ${addFundsWaiting.some((link2) => link2.heldAtomic === null) ? "its chain read is not done yet" : "the chain shows no USDC there yet"}. Tell the user: after they send USDC there, the wallet sees it and makes it private by itself after a random privacy wait of up to 5 minutes; if they sent it already, it can take a minute to show: call wallet_balance again in a minute. Do not ask for a new address`;
       }
       const earlierDeposits = (ops.oneTimeAdopt === false ? [] : adopter.outcomes()).map((outcome) => ({
         pool: outcome.pool,
@@ -131671,7 +131677,7 @@ ${canonical5}`;
       }
     }
   };
-  const RECEIVE_ONLY_NOTICE = "This wallet has nothing it can pay with yet (no shield in its saved balance or its local records). A payment to receiveShielded arrives in the shielded balance as a received payment. wallet_unshield sends a received payment out without a shield: one unshield sends one received payment, up to its amount. To pay with it (x402_pay), this wallet must first shield any amount once, or unshield some of a received payment once (the rest stays in the shielded balance and can pay then). To shield, use wallet_shield (even 0.01 USDC sent to ownAddress first; the facilitator pays its fee), before or after the payment arrives";
+  const RECEIVE_ONLY_NOTICE = "This wallet has nothing it can pay with yet (no shield in its saved balance or its local records). A payment to receiveShielded arrives in the shielded balance as a received payment. wallet_unshield sends a received payment out without a shield: one unshield sends one received payment, up to its amount. To pay with it (x402_pay), this wallet must first shield any amount once, or unshield some of a received payment once (the rest stays in the shielded balance and can pay then). " + (elsewhereEnabled ? "To shield, use wallet_add_funds (even 0.01 USDC sent to its one-time address; the facilitator pays its fee), before or after the payment arrives" : "This server has no private deposit address: to shield, use wallet_shield (even 0.01 USDC sent to ownAddress first; the facilitator pays its fee), before or after the payment arrives. The chain then shows that this wallet's public address added that amount (later payments stay private): tell the user this before the deposit");
   const RECEIVE_SHIELDED_NEXT = "Give receiveShielded to the payer: an OTC seller pastes it as receiveShielded, an OTC buyer as refundTo. Use a new one for each payment. A payment to it shows in wallet_balance after the wallet's next chain read: one runs when this server starts, after each payment, shield, or unshield of this wallet, and when wallet_balance is called more than a minute after the last read (that call answers refreshing: true; call wallet_balance again in about 30 s)";
   const RECEIVE_SHIELDED_PRIVACY = "Only a Shinjuku Shield payer in the same pool can pay it, with a private pool payment. The chain shows no address of yours. Each call gives a new recipient: give each payer its own";
   const receiveShielded = {
@@ -133603,7 +133609,9 @@ function createSetupTools({
       pool: summary.pool,
       caps: shownCaps({ maxPaymentAtomic: summary.caps.maxPayment, maxSessionAtomic: summary.caps.maxSession }),
       wallet: summary.wallet.status,
-      ...summary.wallet.recoveryFile ? { recoveryFile: summary.wallet.recoveryFile, solanaFeePayer: summary.wallet.solanaFeePayer } : {}
+      // F2 (0.3.95 live run p95n, 06:19 UTC 2026-10-24): the agent offered the user "the public address above" (this field)
+      // beside wallet_add_funds. The wallet's own address is not shown here; wallet_balance names it (ownAddress) for its public USDC.
+      ...summary.wallet.recoveryFile ? { recoveryFile: summary.wallet.recoveryFile } : {}
     });
     if (current.state === "restart") return restartAnswer(current);
     if (current.state === "done") {
@@ -133620,7 +133628,7 @@ function createSetupTools({
         ...acceptedFacts(),
         ...summary.tor === true ? { tor: true } : {},
         ...privateInference ? { privateInference: true } : {},
-        next: `${ACCEPTED_NEXT}The wallet tools are live in this server: the tool list changed (the setup tools are gone, wallet_status included; wallet_balance answers it). This is not a disconnect: do not tell the user to restart or reconnect. Call wallet_balance.${recoveryNext(summary)}` + (summary.tor === true ? " Setup ran over Tor, and the wallet runs over Tor: the servers it talks to do not see this computer's IP address." : "") + (summary.wallet.solanaFeePayer ? " To add funds, call wallet_shield after the user sends USDC to solanaFeePayer (no SOL needed), or call" : " To add funds, call") + " wallet_add_funds: it gives a one-time address for any amount from 0.01 USDC. After the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of a few minutes." + (privateInference ? " Private inference is on: after funding, call inference_chat (with no prompt it lists the models and prices); if this app's wallet entry turns Tor off, inference_chat refuses until the owner removes that setting there and reconnects the wallet, so it runs behind Tor." : "")
+        next: `${ACCEPTED_NEXT}The wallet tools are live in this server: the tool list changed (the setup tools are gone, wallet_status included; wallet_balance answers it). This is not a disconnect: do not tell the user to restart or reconnect. Call wallet_balance.${recoveryNext(summary)}` + (summary.tor === true ? " Setup ran over Tor, and the wallet runs over Tor: the servers it talks to do not see this computer's IP address." : "") + " To add funds, call wallet_add_funds: it gives a one-time address for any amount from 0.01 USDC. After the user sends USDC there, ask for the balance once: the wallet then sees the USDC and makes it private by itself after a random privacy wait of up to 5 minutes." + (privateInference ? " Private inference is on: after funding, call inference_chat (with no prompt it lists the models and prices); if this app's wallet entry turns Tor off, inference_chat refuses until the owner removes that setting there and reconnects the wallet, so it runs behind Tor." : "")
       });
     }
     if (current.state === "confirming") return json3({ say: SETUP_CONFIRMING_SAY, ok: true, stage: "confirming", next: SETUP_CONFIRMING_NEXT });
@@ -133797,10 +133805,24 @@ function createSetupTools({
       });
     }
   };
+  const SETUP_MODE_PURPOSE = {
+    wallet_balance: "Shows the private USDC balance and any USDC on its way in.",
+    wallet_add_funds: "Gives a one-time address to add USDC to the private balance from any wallet or exchange.",
+    x402_pay: "Pays an x402 URL (a paid web API or file) privately from the private balance and returns what it answers.",
+    x402_preview: "Shows what an x402 URL costs before a payment; it pays nothing.",
+    wallet_unshield: "Sends USDC from the private balance to a Solana address, privately.",
+    wallet_cancel: "Stops an unfinished payment, send or add-funds request.",
+    wallet_receipts: "Lists the recent payments and sends with their receipts.",
+    wallet_shield: "Makes public USDC on this wallet's own address private.",
+    wallet_transfer_token: "Sells a Solana token this wallet holds for USDC and sends that USDC privately to an address.",
+    wallet_transfer_token_status: "Shows how a token sale and send goes, and can stop it.",
+    inference_server: "Starts a private AI address on this computer for another AI app (an OpenAI-compatible base URL and key): each AI answer is paid privately from the private balance.",
+    inference_chat: "Asks an AI model and pays for its answer privately from the private balance; with no prompt it lists the models and their prices."
+  };
   const notSetUp = (name) => ({
     name,
     title: `${name} (wallet not set up)`,
-    description: `The wallet is not set up on this machine, so ${name} answers wallet_not_set_up and does nothing. Call shinjuku_setup first.`,
+    description: `${SETUP_MODE_PURPOSE[name] ? `${SETUP_MODE_PURPOSE[name]} ` : ""}The wallet is not set up on this machine yet, so ${name} answers wallet_not_set_up and does nothing now. Call shinjuku_setup first.`,
     inputSchema: { type: "object" },
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     // Hidden after setup are hidden here too (callable by name, not listed).
@@ -133941,7 +133963,7 @@ var init_tools = __esm({
     TOKEN_UNIT_TOOLS = /* @__PURE__ */ new Set(["wallet_transfer_token", "wallet_transfer_token_status"]);
     RESOURCE_PAYMENT_WAL_PREFIX2 = "resource-payment-";
     POOL_LAYOUT_CODE = /pool_state_length_or_magic_invalid|pool_layout_table_invalid|pool_state_anchor_layout_invalid/;
-    POOL_LAYOUT_UPDATE = `This wallet release cannot read the pool's on-chain record: the pool program most likely changed its layout in an upgrade. A new wallet version is ready. If the app's MCP config names a fixed version (for example shinjuku-shielded@0.3.80), change it to ${NPX_PACKAGE}@latest (or to the newest version in the Releases table at https://github.com/ShinjukuStaition/shinjuku-shielded#releases). Then restart this MCP server in your app (or restart the app): a start with no fixed version, or with @latest, loads the latest version. Nothing was downloaded or changed yet`;
+    POOL_LAYOUT_UPDATE = "This wallet release cannot read the pool's on-chain record: the pool program most likely changed its layout in an upgrade. A new wallet version is ready. If the app's MCP config names a fixed version (for example shinjuku-shield@0.3.86), change the version after the @ to latest (shinjuku-shield@latest), or to the newest version in the Releases table at https://github.com/ShinjukuStaition/shinjuku-shielded#releases. Then restart this MCP server in your app (or restart the app): a start with no fixed version, or with @latest, loads the latest version. Nothing was downloaded or changed yet";
     USEPOD_VIA_INFERENCE_CHAT = "use inference_chat for AI answers: it sends the prompt only through Tor or the wallet's own proxy";
     SEND_RUNS_ON = "The smaller payments go by themselves: when the agent host ends this MCP server, the wallet's send runner (a background wallet process) sends each one at its planned time and then ends. If the computer is off or asleep at the time of one, that payment waits a new random time after the next wallet start.";
     DEPOSIT_RUNS_ON = "The deposit goes on by itself: when the agent host ends this MCP server, the wallet's send runner (a background wallet process) runs it at its time and then ends. If the computer is off or asleep then, or the background wallet process could not start, the next wallet process runs it.";
@@ -135520,7 +135542,7 @@ var init_stdioServer = __esm({
     SUPPORTED_PROTOCOL_VERSIONS = Object.freeze(["2025-06-18", "2025-03-26", "2024-11-05"]);
     MAX_LINE_BYTES = 4 * 1024 * 1024;
     POSITIVE_ATOMIC7 = /^[1-9][0-9]{0,30}$/;
-    INSTRUCTIONS = `A self-custody Shinjuku Shield wallet on this machine; the keys and the passphrase stay in this process and no tool takes or returns them. Every tool answer starts with say: one plain sentence to tell the user; the other fields hold the exact numbers. Map the user's plain request to one tool: "what is my balance" -> wallet_balance; "add money" / "deposit" / "fund the wallet" / "move USDC in from Phantom, an exchange, or another wallet" -> wallet_add_funds (it answers a one-time address; the money becomes private a few minutes after it arrives, at the next wallet call); "shield the USDC on this wallet's own address" -> wallet_shield (only public USDC already there); "stop" / "cancel" -> wallet_cancel with the request_id of what to stop; "pay this URL" -> x402_pay (call it directly, no preview is needed); "what does this URL cost" -> x402_preview (only when the user asks for the price); "find a paid API for X" -> x402_discover, then x402_pay on the url it found; "send 2 USDC to <address>" -> wallet_unshield. wallet_balance answers ONE balance (balanceAtomic), and x402_pay pays any x402 seller from it (through Shinjuku for a seller that cannot take a private payment: max_payment must cover the total amountAtomic, fee included; a refund comes back by itself within about 7 minutes). Fields ending in Atomic are atomic units (USDC: 1000000 = 1 USDC); tell the user amounts in USDC. The wallet does its upkeep by itself (chain reads, encrypted backups); the user never runs a CLI command for it. wallet_shield, wallet_add_funds, and wallet_unshield can run for minutes: call again with the SAME request_id as next says. Pass your own request_id to x402_pay: the same request_id never pays or moves money twice (on a code that ends in _retry_same_request, call again with it). wallet_unshield never sends to the wallet's own deposit address; a send to an address the owner did not approve ahead asks the user to confirm it in this client first. When the owner set limits, x402_pay never pays above them (one payment, and any 24 hours for this wallet across all MCP processes); with none, the balance is the only bound. Never claim a payment happened unless the answer has a transaction. Privacy: the chain does not show which wallet paid, but this MCP host and its model provider see every URL, body, price, and paid answer the agent handles. When an item of an answer's poolSwitch.items[] has tellUser true, tell the user its message once, in plain words; the wallet moves the balance by itself.`;
+    INSTRUCTIONS = `A self-custody Shinjuku Shield wallet on this machine; the keys and the passphrase stay in this process and no tool takes or returns them. Every tool answer starts with say: one plain sentence to tell the user; the other fields hold the exact numbers. Map the user's plain request to one tool: "what is my balance" -> wallet_balance; "add money" / "deposit" / "fund the wallet" / "move USDC in from Phantom, an exchange, or another wallet" -> wallet_add_funds (it answers a one-time address; the money becomes private within a few minutes after it arrives, at the next wallet call); "shield the USDC on this wallet's own address" -> wallet_shield (only public USDC already there); "stop" / "cancel" -> wallet_cancel with the request_id of what to stop; "pay this URL" -> x402_pay (call it directly, no preview is needed); "what does this URL cost" -> x402_preview (only when the user asks for the price); "find a paid API for X" -> x402_discover, then x402_pay on the url it found; "send 2 USDC to <address>" -> wallet_unshield. wallet_balance answers ONE balance (balanceAtomic), and x402_pay pays any x402 seller from it (through Shinjuku for a seller that cannot take a private payment: max_payment must cover the total amountAtomic, fee included; a refund comes back by itself within about 7 minutes). Fields ending in Atomic are atomic units (USDC: 1000000 = 1 USDC); tell the user amounts in USDC. The wallet does its upkeep by itself (chain reads, encrypted backups); the user never runs a CLI command for it. wallet_shield, wallet_add_funds, and wallet_unshield can run for minutes: call again with the SAME request_id as next says. Pass your own request_id to x402_pay: the same request_id never pays or moves money twice (on a code that ends in _retry_same_request, call again with it). wallet_unshield never sends to the wallet's own deposit address; a send to an address the owner did not approve ahead asks the user to confirm it in this client first. When the owner set limits, x402_pay never pays above them (one payment, and any 24 hours for this wallet across all MCP processes); with none, the balance is the only bound. Never claim a payment happened unless the answer has a transaction. Privacy: the chain does not show which wallet paid, but this MCP host and its model provider see every URL, body, price, and paid answer the agent handles. When an item of an answer's poolSwitch.items[] has tellUser true, tell the user its message once, in plain words; the wallet moves the balance by itself.`;
     MCP_LOG_LEVELS = Object.freeze(["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"]);
     POOL_SWITCH_LOG_LEVEL = "info";
     validId = (id) => id === null || typeof id === "string" || typeof id === "number" && Number.isFinite(id);
@@ -135531,7 +135553,7 @@ var init_stdioServer = __esm({
     NPM_VERSION2 = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
     GIT_COMMIT = /^[0-9a-f]{40}$/;
     mcpServerVersion = (version3 = walletVersion()) => version3.npm ?? (version3.release ? `release-${version3.release}` : "source");
-    UPDATE_NOTICE_TEXT = `A new wallet version is ready. If your app's config names a fixed version (for example shinjuku-shielded@0.3.80), change it to ${NPX_PACKAGE}@latest, then restart this MCP server in your app (or restart the app). If the config names no version, just restart this MCP server in your app (or restart the app). Nothing was downloaded or changed yet, and this version keeps working until then.`;
+    UPDATE_NOTICE_TEXT = "A new wallet version is ready. If your app's config names a fixed version (for example shinjuku-shield@0.3.86), change the version after the @ to latest (shinjuku-shield@latest), then restart this MCP server in your app (or restart the app). If the config names no version, just restart this MCP server in your app (or restart the app). Nothing was downloaded or changed yet, and this version keeps working until then.";
     updateNoticeLine = (update3) => `Tell the user: ${UPDATE_NOTICE_TEXT} (release ${update3.current}; this wallet runs ${update3.running}.)`;
     LAUNCH_NOTICE_TOOLS = Object.freeze(["wallet_balance", "wallet_status"]);
     withLaunchLine = (instructions2, line) => !line ? instructions2 : () => `${typeof instructions2 === "function" ? instructions2() : instructions2} Tell the user: ${line}`;
@@ -162822,7 +162844,7 @@ function fundingStepText(tor) {
     "Add money: the wallet starts empty. Two private ways, each for any amount from 0.01 USDC:",
     `  In this terminal: ${fundCommandText(tor)}`,
     "     It prints a one-time address and its QR code: send exactly that amount of USDC (Solana SPL) to it from an exchange or a phone wallet, and it makes the USDC private by itself (our relayer pays every fee). --amount is in USDC (2 = 2 USDC, 0.05 = 5 cents): change it to the amount you want.",
-    '  Or ask your agent: add the server to your agent host (above), then ask "Add 0.50 USDC to my private balance". It calls wallet_add_funds and gives a one-time address: send that USDC on Solana from any wallet or exchange, and it becomes private a few minutes after it arrives, at the next wallet call (no SOL needed; our relayer pays every fee).',
+    '  Or ask your agent: add the server to your agent host (above), then ask "Add 0.50 USDC to my private balance". It calls wallet_add_funds and gives a one-time address: send that USDC on Solana from any wallet or exchange, and it becomes private within a few minutes after it arrives, at the next wallet call (no SOL needed; our relayer pays every fee).',
     ""
   ].join("\n");
 }
@@ -163211,7 +163233,7 @@ Copy it to two offline places now; it is the only way to restore this wallet.
   ];
   if (summary.wallet.status === "created") {
     lines.push(
-      `  wallet       created; your public address (solanaFeePayer): ${summary.wallet.solanaFeePayer ?? "see balance"}`,
+      "  wallet       created",
       `  recovery     ${summary.wallet.recoveryFile}`,
       "",
       "BACK UP NOW: copy the recovery file to two offline places (it holds the seed and the key), then delete it from this machine.",
@@ -164092,7 +164114,7 @@ var COMMANDS = [
       flag2("--own-address", "<address>", `optional, in your own terminal only (the same as the answer to setup's address question): your own wallet address (Phantom, Solflare, an exchange's deposit address), for sending money back to yourself: the MCP sends to it without asking each time (as mcp --unshield-to), also in an agent app that cannot show a question. Not this wallet's own address. Refused in a script, a pipe, or an agent's tool (no terminal), also with --yes: an agent must never approve an address. A rerun adds it to the ones config.json records (at most ${MAX_OWN_ADDRESSES})`),
       flag2("--passphrase-file", "<file>", "your own passphrase file (8 or more characters); default: setup writes a new random passphrase to <home>/passphrase.txt, readable by you alone. Needed for a wallet that exists already"),
       flag2("--facilitator", "<https origin>", `the facilitator whose release, pool, and proof tools setup uses; default ${GUIDE.facilitator}`, { check: "origin" }),
-      flag2("--add-to", "<claude-code|claude-desktop|cursor>", `also add the server (npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp: the host starts this npm version; a wallet not installed from npm writes shinjuku-shield without a version) to this agent host's config; repeat it for more. Without it, setup prints the configs`, { repeat: true }),
+      flag2("--add-to", "<claude-code|claude-desktop|cursor>", `also add the server (npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp: the host starts this npm version; a wallet not installed from npm writes shinjuku without a version) to this agent host's config; repeat it for more. Without it, setup prints the configs`, { repeat: true }),
       bool2("--force", "with --add-to: replace a different shinjuku-shielded entry already in a JSON host config (the old file is backed up first, mode 0600), or in Claude Code (claude mcp remove of that one server, then add)"),
       flag2("--trust-proof-tools", "<sha256>", `ADVANCED: install the proof-tool set whose SHA256SUMS has this SHA-256 instead of the set this wallet build pins (needed for a facilitator the build does not pin). Check the set out of band first; the normal fix for a new set is npx -y --no-audit --no-fund ${NPX_PACKAGE}@latest setup`)
     ],
@@ -164109,7 +164131,7 @@ var COMMANDS = [
       "The passphrase is never printed and no MCP tool takes or returns it. The recovery file holds the seed and the key: copy it to two offline places, then delete it from this machine.",
       `The proof tools are the set this wallet build PINS (its SHA256SUMS hash is in the wallet; --trust-proof-tools replaces it). A facilitator whose /api/wallet/release names another set is refused (setup_proof_tools_pin_mismatch: update the wallet, npx -y --no-audit --no-fund ${NPX_PACKAGE}@latest setup). SHA256SUMS must have the pinned SHA-256, and every file must have the SHA-256 its line names, as /skill.md section 7b; bin/ and house/bin/ get the execute bit. A file that does not match is not kept. Each download has a hard size limit.`,
       "Your own --passphrase-file must be private: on Linux and macOS setup refuses a file that group or other may read or write, or that another user owns (setup_passphrase_file_insecure: chmod 600 <file>). On Windows setup cannot read the access list; it accepts the file with a warning.",
-      "--add-to for Claude Desktop or Cursor: a host config whose mcpServers is not a JSON object, or that has a different shinjuku-shielded entry (without --force), is left alone. Otherwise the old file is copied to <file>.bak-<time> (mode 0600 on Linux and macOS; on Windows the folder's access list) and the new file replaces it in one rename. An entry an older setup wrote (no version, another version, or the old package name shinjuku-shielded; the same home) is replaced without --force. For Claude Code, a shinjuku-shielded server already there needs --force.",
+      "--add-to for Claude Desktop or Cursor: a host config whose mcpServers is not a JSON object, or that has a different shinjuku-shielded entry (without --force), is left alone. Otherwise the old file is copied to <file>.bak-<time> (mode 0600 on Linux and macOS; on Windows the folder's access list) and the new file replaces it in one rename. An entry an older setup wrote (no version, another version, or an old package name, shinjuku-shield or shinjuku-shielded; the same home) is replaced without --force. For Claude Code, a shinjuku-shielded server already there needs --force.",
       "The provers are Linux programs. Linux: ready. Windows: the wallet runs them through WSL; setup checks that wsl.exe runs (wsl --install -d Ubuntu otherwise). macOS: not supported; setup says so and creates nothing.",
       "Run it again at any time: it never changes an existing wallet, keeps the recorded caps unless you pass new ones, checks every proof-tool file again, downloads what is missing or newer, and rewrites config.json.",
       `Then mcp needs no flags: npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp reads config.json (a flag on the command line still wins). Before setup, mcp in a terminal offers to run setup; started by an agent host, it serves shinjuku_setup, which runs this same setup after you confirm in the host.`,