shinjuku-shielded 0.3.155 → 0.3.157

package/README.md

@@ -6,19 +6,19 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.155. The npm packages `shinjuku-shield` and
+This is version 0.3.157. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files. The command is `shinjuku`.
 
 ## Set up
 
 ```sh
-npm install -g shinjuku@0.3.155
+npm install -g shinjuku@0.3.157
 shinjuku setup
 ```
 
 Type the two lines as they are. `npx install shinjuku` does not work: npx
 reads `install` as the name of another npm package. To set up without
-installing, type `npx shinjuku@0.3.155 setup`.
+installing, type `npx shinjuku@0.3.157 setup`.
 
 Setup makes the wallet on this machine, a private passphrase file, and the
 checked proof tools (about 191 MB), and writes `config.json`. It also writes
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.155 mcp
+claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.157 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.155", "mcp"] } } }
+{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.157", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and
@@ -55,7 +55,7 @@ Codex (the Codex app and Codex CLI read the same file, `~/.codex/config.toml`):
 ```toml
 [mcp_servers.shinjuku]
 command = "npx"
-args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.155", "mcp"]
+args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.157", "mcp"]
 startup_timeout_sec = 120
 tool_timeout_sec = 300
 ```

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "65d2837cf983622ed22a9d2bfb488a3a6ff0f276cb0d561b1be6074415daab0f",
-  "bytes": 9055610,
-  "sourceCommit": "5645304267acd2efd47b75cf75ae25ffae3096c5",
+  "sha256": "46b6176b85190a52572566a760686111c9f01d07b8057e83a3ea1d76a20a3f5f",
+  "bytes": 9069628,
+  "sourceCommit": "4c41d8d68ac102c3b34f13def9057f631c923ce7",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1038,5 +1038,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-11-03T05:58:09.739Z"
+  "publishedAt": "2026-11-03T09:32:37.020Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.155",
+  "version": "0.3.157",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "65d2837c",
-  "shinjukuSha256": "65d2837cf983622ed22a9d2bfb488a3a6ff0f276cb0d561b1be6074415daab0f",
+  "shinjukuRelease": "46b6176b",
+  "shinjukuSha256": "46b6176b85190a52572566a760686111c9f01d07b8057e83a3ea1d76a20a3f5f",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-shield#readme",

package/shinjuku-wallet.mjs

@@ -42618,6 +42618,15 @@ function markPhase(phase, outcome) {
   } catch {
   }
 }
+function boundMarkPhase() {
+  const write = scope.getStore();
+  return (phase, outcome) => {
+    try {
+      write?.(phase, outcome);
+    } catch {
+    }
+  };
+}
 function poolReadOutcome(slot3, moved) {
   let text3;
   try {
@@ -42917,6 +42926,9 @@ function tunnelRefused(statusCode) {
 }
 function optimisticConnect(params, { proxyHost, proxyPort, closedInRow }) {
   const target = String(params.path);
+  const mark = boundMarkPhase();
+  const startedAt = Date.now();
+  let dials = 0;
   const head = `CONNECT ${target} HTTP/1.1\r
 ${Object.entries(params.headers ?? {}).filter(([name, value2]) => value2 !== void 0 && !/[\r\n]/.test(`${name}${value2}`)).map(([name, value2]) => `${name}: ${value2}\r
 `).join("")}\r
@@ -42969,6 +42981,7 @@ ${Object.entries(params.headers ?? {}).filter(([name, value2]) => value2 !== voi
     if (first) pendingReject = reject;
     reply = Buffer.alloc(0);
     ready = false;
+    dials += 1;
     socket = net.connect(proxyPort, proxyHost);
     socket.setNoDelay(true);
     let connected = false;
@@ -42977,6 +42990,7 @@ ${Object.entries(params.headers ?? {}).filter(([name, value2]) => value2 !== voi
       socket.write(head);
       for (const chunk of sent) socket.write(chunk);
       ready = true;
+      mark("tunnel-sent", `dial${dials}`);
       if (first) pendingReject = void 0;
       resolve39();
     });
@@ -42990,9 +43004,11 @@ ${Object.entries(params.headers ?? {}).filter(([name, value2]) => value2 !== voi
       if (end < 0) return;
       const status = Number(/^HTTP\/1\.[01] (\d{3})/.exec(reply.subarray(0, reply.indexOf("\r\n")).toString("latin1"))?.[1] ?? 0);
       if (status !== 200) {
+        mark("tunnel-refused", `http${status}`);
         stream.destroy(tunnelRefused(status));
         return;
       }
+      mark("tunnel-200", `ms${Date.now() - startedAt}_dial${dials}`);
       open4 = true;
       sent.length = 0;
       closedInRow.delete(target);
@@ -43019,6 +43035,7 @@ ${Object.entries(params.headers ?? {}).filter(([name, value2]) => value2 !== voi
         return;
       }
       const closed = (closedInRow.get(target) ?? 0) + 1;
+      mark("tunnel-closed", `n${closed}`);
       if (closed < TUNNEL_CLOSED_TRIES) {
         closedInRow.set(target, closed);
         dial(false).catch((error) => stream.destroy(error));
@@ -43042,6 +43059,7 @@ var init_tunnelGuard = __esm({
   "wallet/src/net/tunnelGuard.mjs"() {
     "use strict";
     init_keepAlive();
+    init_phaseTiming();
     RUN_MARK = "SHINJUKU_WALLET_PROXIED";
     TUNNEL_CLOSED_TRIES = 3;
   }
@@ -67009,6 +67027,7 @@ var init_errorCodes = __esm({
       "inference_no_provider",
       "inference_origin_refused",
       "inference_out_of_tokens",
+      "inference_empty_answer",
       // wallet_unshield of a balance in several accounts: the stage code while the automatic join runs (mcp/tools.mjs joiningStage).
       "unshield_joining_accounts",
       // unshield of a fixed amount in a terminal: its own join (joinForFixedSend, AB186) did not get the balance ready.
@@ -83564,15 +83583,19 @@ function memoryRequestMatches(record, { url, request, programId, anyProgram = fa
 function dropOldAnswers(now) {
   for (const [key, entry] of answers) if (now >= entry.atMs + MEMORY_ANSWER_KEEP_MS) answers.delete(key);
 }
-function keepMemoryAnswer(record, resultBase64, now = Date.now()) {
+function keepMemoryAnswer(record, resultBase64, now = Date.now(), sellerHeaders = []) {
   if (!isMemoryFingerprint(record?.fingerprint) || typeof resultBase64 !== "string") return;
   dropOldAnswers(now);
-  keepBounded(answers, record.fingerprint, { resultBase64, atMs: now });
+  keepBounded(answers, record.fingerprint, { resultBase64, atMs: now, sellerHeaders: Array.isArray(sellerHeaders) ? sellerHeaders : [] });
 }
 function memoryAnswer(record, now = Date.now()) {
   dropOldAnswers(now);
   return isMemoryFingerprint(record?.fingerprint) ? answers.get(record.fingerprint)?.resultBase64 : void 0;
 }
+function memoryAnswerHeaders(record, now = Date.now()) {
+  dropOldAnswers(now);
+  return (isMemoryFingerprint(record?.fingerprint) ? answers.get(record.fingerprint)?.sellerHeaders : void 0) ?? [];
+}
 function forgetMemoryOnly() {
   requests.clear();
   answers.clear();
@@ -102203,7 +102226,7 @@ function floatOutcomeWords(code2, error, t) {
     case "p03_float_answer_invalid_refund_pending": {
       const amount = amountText(error?.paidAtomic, "the amount paid");
       const fixable = floatSellerCanBeFixed(error);
-      const seller = fixable && typeof error?.sellerReason === "string" ? ` ${p.The} refused this request (HTTP ${error.httpStatus}) and said why: ${JSON.stringify(error.sellerReason)}.` : fixable ? ` ${p.The} refused this request (HTTP ${error.httpStatus}) and said why in its first answer; the wallet does not keep ${p.the}'s words.` : typeof error?.sellerReason === "string" ? ` ${p.The} answered HTTP ${error.httpStatus}: ${JSON.stringify(error.sellerReason)}.` : Number.isInteger(error?.httpStatus) ? ` ${p.The} answered HTTP ${error.httpStatus}.` : "";
+      const seller = fixable && error?.sellerReasonHidden === true ? ` ${p.The} refused this request (HTTP ${error.httpStatus}); its own words are not shown, because they can repeat your question.` : fixable && typeof error?.sellerReason === "string" ? ` ${p.The} refused this request (HTTP ${error.httpStatus}) and said why: ${JSON.stringify(error.sellerReason)}.` : fixable ? ` ${p.The} refused this request (HTTP ${error.httpStatus}) and said why in its first answer; the wallet does not keep ${p.the}'s words.` : typeof error?.sellerReason === "string" ? ` ${p.The} answered HTTP ${error.httpStatus}: ${JSON.stringify(error.sellerReason)}.` : Number.isInteger(error?.httpStatus) ? ` ${p.The} answered HTTP ${error.httpStatus}.` : "";
       const late2 = floatChargeTooLate(error) ? ` ${p.The} worked ${error.sellerAnswerSeconds} s before it tried to charge, and its answer says the charge failed. A Solana payment expires about 30 s after it is signed, so no wallet can pay ${p.a} that works this long before it charges.` : "";
       const tryAgain = fixable ? t.ai ? `${p.The} said what is wrong with the request. If ${stillWants(t)} an answer, change the question as it says, then ${t.rerun.toLowerCase()} with ${t.newId}` : `The seller said what is wrong with the request. If ${stillWants(t)} the data, fix the request as the seller says (for example add the query values, headers, or body fields it names), then ${t.rerun.toLowerCase()} with the fixed request and ${t.newId}` : late2 ? t.ai ? `${p.The} works too long before it charges. ${t.ai.other}` : "Do not pay this seller again: it works too long before it charges" : t.ai ? `If ${stillWants(t)} an answer, ${t.askNew}` : `If ${stillWants(t)} the data, try this seller again with ${t.newId}`;
       const why = floatRefundWhy(error, Boolean(t.ai));
@@ -102380,7 +102403,7 @@ function floatOutcomeWords(code2, error, t) {
       return void 0;
   }
 }
-var ATOMIC4, TRANSFER_DEAD_WORDS, payeeOf, floatSellerCanBeFixed, floatSeller4xx, answeredInstead, floatStillSettling, floatChargeTooLate, amountText, withTransaction, PAID_SELLER_FAILED_CODE, stillWants, AI_SERVER_WRONG, QUOTE_REFUSED_WHY;
+var ATOMIC4, TRANSFER_DEAD_WORDS, payeeOf, floatSellerCanBeFixed, withoutProviderText, floatSeller4xx, answeredInstead, floatStillSettling, floatChargeTooLate, amountText, withTransaction, PAID_SELLER_FAILED_CODE, stillWants, AI_SERVER_WRONG, QUOTE_REFUSED_WHY;
 var init_floatWords = __esm({
   "wallet/src/pay/floatWords.mjs"() {
     "use strict";
@@ -102393,6 +102416,11 @@ var init_floatWords = __esm({
     };
     payeeOf = (ai) => ai ? { the: "the AI provider", The: "The AI provider", this: "the AI provider", a: "an AI provider" } : { the: "the seller", The: "The seller", this: "this seller", a: "a seller" };
     floatSellerCanBeFixed = (error) => floatSeller4xx(error) && !floatChargeTooLate(error) && ![402, 408, 429].includes(error.httpStatus) && (typeof error?.sellerReason === "string" && error.sellerReason.trim() !== "" || error?.sellerFixable === true);
+    withoutProviderText = (facts) => {
+      const { sellerReason, ...rest } = facts ?? {};
+      if (typeof sellerReason !== "string" || !sellerReason.trim()) return rest;
+      return { ...rest, sellerReasonHidden: true, ...floatSellerCanBeFixed(facts) ? { sellerFixable: true } : {} };
+    };
     floatSeller4xx = (error) => Number.isInteger(error?.httpStatus) && error.httpStatus >= 400 && error.httpStatus < 500;
     answeredInstead = (p, status, data) => `${p.the} answered HTTP ${status}${status >= 500 ? " (an error on its side)" : ""} instead of ${data}`;
     floatStillSettling = (code2, error) => code2 === "p03_float_paid_finishing_retry_same_request" && error?.sellerCode === "payment_pending_retry_same_payment";
@@ -103664,10 +103692,10 @@ function markFloatRefundOutcomesShown(store, shown) {
   }
 }
 function toMemoryOnly(store, walName2, record) {
-  const { resultBase64, resultSha256: _hash, sellerReason: _reason, ...rest } = record;
+  const { resultBase64, resultSha256: _hash, sellerReason: _reason, sellerHeaders, ...rest } = record;
   const next = { ...rest, fingerprint: memoryOnlyFingerprint(), request: memoryOnlyRequest(record.request), memoryOnly: true };
   store.writeWal(walName2, next);
-  if (next.state === "receipt") keepMemoryAnswer(next, resultBase64);
+  if (next.state === "receipt") keepMemoryAnswer(next, resultBase64, void 0, sellerHeaders);
   return next;
 }
 function finishedAtMs(record) {
@@ -104428,7 +104456,7 @@ async function payViaFloat({
     if (record.state === "receipt" && record.memoryOnly === true) {
       const kept3 = memoryAnswer(record);
       if (kept3 === void 0) finished(record);
-      return paidResult({ ...record, resultBase64: kept3 }, true);
+      return paidResult({ ...record, resultBase64: kept3, sellerHeaders: memoryAnswerHeaders(record) }, true);
     }
     if (record.state === "receipt") return paidResult(record, true);
     if (record.state === "refund_pending") refundPendingAnswer(record);
@@ -104805,18 +104833,18 @@ async function payViaFloat({
         transaction: isSolanaSignature(settled?.transaction) ? settled.transaction : null,
         network: record.requirement.network
       };
+      const sellerHeaders = keptSellerHeaders(response.headers);
       record = {
         ...record,
         state: "receipt",
         status: response.status,
         receipt,
-        ...answerFields(record, resultBase64),
-        sellerHeaders: keptSellerHeaders(response.headers),
+        ...answerFields(record, resultBase64, sellerHeaders),
         answeredAtMs: Date.now()
       };
       store.writeWal(walName2, record);
       mark("float-receipt");
-      return answered(store, walName2, record, resultBase64);
+      return answered(store, walName2, record, resultBase64, sellerHeaders);
     }
     const sellerReason = await sellerAnswerText(response);
     if (wasKept) keptAgain(response.status, sellerReason);
@@ -105087,18 +105115,18 @@ async function selfBroadcastLeg({ store, walName: walName2, record, sendRequest,
         transaction: isSolanaSignature(settled?.transaction) ? settled.transaction : record.broadcastSignature,
         network: record.requirement.network
       };
+      const sellerHeaders = keptSellerHeaders(response.headers);
       record = {
         ...record,
         state: "receipt",
         status: response.status,
         receipt,
-        ...answerFields(record, resultBase64),
-        sellerHeaders: keptSellerHeaders(response.headers),
+        ...answerFields(record, resultBase64, sellerHeaders),
         answeredAtMs: Date.now()
       };
       store.writeWal(walName2, record);
       mark("float-receipt");
-      return answered(store, walName2, record, resultBase64);
+      return answered(store, walName2, record, resultBase64, sellerHeaders);
     }
     if (response.status >= 500 || response.status === 202) {
       const unansweredReason = await sellerRefusalText(response);
@@ -105170,13 +105198,13 @@ function keptSellerHeaders(headers) {
   }
   return kept3;
 }
-function answerFields(record, resultBase64) {
-  return record.memoryOnly === true ? {} : { resultBase64 };
+function answerFields(record, resultBase64, sellerHeaders) {
+  return record.memoryOnly === true ? {} : { resultBase64, sellerHeaders };
 }
-function answered(store, walName2, record, resultBase64) {
+function answered(store, walName2, record, resultBase64, sellerHeaders) {
   if (record.memoryOnly !== true) return paidResult(record, false);
-  keepMemoryAnswer(record, resultBase64);
-  return paidResult({ ...record, resultBase64 }, false);
+  keepMemoryAnswer(record, resultBase64, void 0, sellerHeaders);
+  return paidResult({ ...record, resultBase64, sellerHeaders }, false);
 }
 function paidResult(record, replayed) {
   return {
@@ -105270,7 +105298,7 @@ var init_floatPay = __esm({
     floatPaymentWalName = (requestKey) => `${FLOAT_PAYMENT_WAL_PREFIX2}${requestKey}`;
     floatRecordName = (requestId) => floatPaymentWalName(hash7(requestId));
     FLOAT_KEEP_BYTES_MS = 6e5;
-    memoryOnlyNeedsScrub = (record) => record?.memoryOnly === true && (record.resultSha256 !== void 0 || record.request?.bodySha256 !== void 0 || record.request?.headersSha256 !== void 0 || !/^memory-[0-9a-f]{64}$/.test(String(record.fingerprint ?? "")));
+    memoryOnlyNeedsScrub = (record) => record?.memoryOnly === true && (record.resultSha256 !== void 0 || Array.isArray(record.sellerHeaders) && record.sellerHeaders.length > 0 || record.request?.bodySha256 !== void 0 || record.request?.headersSha256 !== void 0 || !/^memory-[0-9a-f]{64}$/.test(String(record.fingerprint ?? "")));
     FLOAT_KEEP_OPEN_REQUEST_MS = 36e5;
     configCache = /* @__PURE__ */ new Map();
     configGeneration = 0;
@@ -109479,6 +109507,16 @@ function refusalSay(a, tool, again, npmVersion) {
     const head = `${paid ? `Paid ${paid} USDC${price2 && positive(fee) ? ` (${price2} price + ${fee} Shinjuku fee)` : ""}` : "Paid"}, but`;
     return firstFit(`${head} the model reached the answer's length limit before it answered.${more}`, `${head} the answer hit its length limit.${more}`);
   }
+  if (code2 === "inference_empty_answer") {
+    const again2 = " Ask again (it pays again) or pick another model.";
+    if (a.replayed === true && a.paid === false) return `Nothing was paid, and the stored answer is empty.${again2}`;
+    if (a.replayed === true) return `Already paid; the stored answer is empty and nothing new was paid.${again2}`;
+    const paid = usdcText2(a.paidAtomic);
+    const price2 = usdcText2(a.priceAtomic);
+    const fee = usdcText2(a.feeAtomic);
+    const head = `${paid ? `Paid ${paid} USDC${price2 && positive(fee) ? ` (${price2} price + ${fee} Shinjuku fee)` : ""}` : "Paid"}, but`;
+    return firstFit(`${head} the AI returned no answer, and no refund comes.${again2}`, `${head} the AI returned no answer.${again2}`);
+  }
   if (code2 === "inference_no_provider") {
     return "Nothing was paid: no AI provider can take this wallet's payment for this model right now. Ask for another model, or ask again later.";
   }
@@ -110935,8 +110973,8 @@ async function offeredPrice(paymentRequired, store, serviceUrl2, target, timing,
   }
   return { rail, amountAtomic: highest.toString(), priceAtomic: highest.toString() };
 }
-function ownRecord(store, requestId) {
-  const float = floatRecordOf(store, requestId);
+function ownRecord(store, requestId, { strict = false } = {}) {
+  const float = strict ? store.readWal(floatRecordName(requestId)) : floatRecordOf(store, requestId);
   if (float) return { kind: "float", record: float };
   const key = sha256Hex2(Buffer.from(requestId, "utf8"));
   const shielded = store.readWal(`resource-payment-${key}`);
@@ -111049,9 +111087,9 @@ async function payTurn({ session, target, method, headers, body, maxPrice, polic
   if (session.closed) fail26("fetch_session_closed", "this payer session is closed; open a new one");
   const paymentStartedAt = Date.now();
   const timing = typeof opts?.timing === "function" ? opts.timing : session.timing();
-  const mark = (phase) => {
+  const mark = (phase, outcome) => {
     try {
-      timing?.(phase);
+      timing?.(phase, outcome);
     } catch {
     }
   };
@@ -111069,12 +111107,12 @@ async function payTurn({ session, target, method, headers, body, maxPrice, polic
         warmFloatConfig({ origin: new URL(session.memoServiceUrl).origin, timing: mark });
         startRecoveredPaymentTools(lazyProofTools(session));
       }
-      const response = await unpaidRequest(target, () => keepAliveInit({
+      const response = await withPhaseScope(mark, "fetch", () => unpaidRequest(target, () => keepAliveInit({
         method,
         headers,
         ...body ? { body } : {},
         redirect: "manual"
-      }), { timeoutMs: Number.isSafeInteger(opts?.unpaidTimeoutMs) && opts.unpaidTimeoutMs > 0 ? opts.unpaidTimeoutMs : void 0, onCut: opts?.onUnpaidCut });
+      }), { timeoutMs: Number.isSafeInteger(opts?.unpaidTimeoutMs) && opts.unpaidTimeoutMs > 0 ? opts.unpaidTimeoutMs : void 0, onCut: opts?.onUnpaidCut }));
       if (response.status !== 402) return response;
       const encoded = response.headers.get("PAYMENT-REQUIRED");
       void drainBody(response);
@@ -111474,6 +111512,23 @@ async function paidCall({ session, target, method, headers, body, cap, maxPrice,
     }
     mark("fetch-ready");
     const fresh = challenge !== void 0 && Date.now() - challenge.atMs <= PREFETCH_MAX_AGE_MS;
+    const leftDecision = () => {
+      let left = true;
+      let unreadable = false;
+      let after;
+      try {
+        after = ownRecord(store, requestId, { strict: true });
+        left = after === void 0 ? own !== void 0 : committed(after, store) && !closedUnpaid(after, store) && !preparedOnly(after, store);
+      } catch {
+        after = void 0;
+        unreadable = true;
+      }
+      const atomic4 = left ? (after === void 0 ? void 0 : paidAmount(after) ?? price2?.amountAtomic) ?? String(cap) : void 0;
+      return Object.freeze({ left, atomic: atomic4, unreadable, before: leftBefore });
+    };
+    const recordLeft = (decision) => {
+      if (policy && decision.left) policy.record({ amountAtomic: earlierRun ? "0" : decision.atomic, url: target, requestId });
+    };
     const result = await payResource({
       store,
       connection: session.connection,
@@ -111517,19 +111572,54 @@ async function paidCall({ session, target, method, headers, body, cap, maxPrice,
           onCompactList: memoPrefetchOnList(session, store)
         })
       }
-    }).finally(markMade);
-    const amountAtomic = paidAmount(ownRecord(store, requestId)) ?? price2?.amountAtomic;
+    }).finally(markMade).catch((error) => {
+      const failure2 = error !== null && typeof error === "object" ? error : Object.assign(new Error(String(error)), { cause: error });
+      try {
+        const decision = leftDecision();
+        try {
+          failure2.paidLeft = decision;
+        } catch {
+        }
+        recordLeft(decision);
+      } catch {
+      }
+      throw failure2;
+    });
+    let ownAfter;
+    let afterUnreadable = false;
+    try {
+      ownAfter = ownRecord(store, requestId, { strict: true });
+    } catch {
+      ownAfter = void 0;
+      afterUnreadable = true;
+    }
+    const resultAtomic = POSITIVE_ATOMIC4.test(String(result.paidAtomic ?? "")) ? String(result.paidAtomic) : void 0;
+    const amountAtomic = paidAmount(ownAfter) ?? resultAtomic ?? price2?.amountAtomic ?? (result.replayed ? void 0 : String(cap));
     if (!result.replayed && policy && amountAtomic) policy.record({ amountAtomic: earlierRun ? "0" : amountAtomic, url: target, requestId });
-    const bytes2 = Buffer.from(result.resultBase64 ?? "", "base64");
-    const payment = {
-      transaction: result.receipt?.transaction,
-      scheme: result.scheme === "exact" ? "exact" : "shielded-exact",
-      amountAtomic: amountAtomic ?? null,
-      requestId,
-      replayed: result.replayed === true,
-      receiptFinality: result.receiptFinality ?? null
-    };
-    return new Response(bytes2, { status: 200, headers: paidResponseHeaders(result.sellerHeaders, sniffContentType(bytes2), payment) });
+    try {
+      const bytes2 = Buffer.from(result.resultBase64 ?? "", "base64");
+      const payment = {
+        transaction: result.receipt?.transaction,
+        scheme: result.scheme === "exact" ? "exact" : "shielded-exact",
+        amountAtomic: amountAtomic ?? null,
+        requestId,
+        replayed: result.replayed === true,
+        receiptFinality: result.receiptFinality ?? null
+      };
+      return new Response(bytes2, { status: 200, headers: paidResponseHeaders(result.sellerHeaders, sniffContentType(bytes2), payment) });
+    } catch (error) {
+      const failure2 = error !== null && typeof error === "object" ? error : Object.assign(new Error(String(error)), { cause: error });
+      try {
+        failure2.paidLeft = Object.freeze({
+          left: true,
+          atomic: amountAtomic ?? String(cap),
+          unreadable: afterUnreadable,
+          before: leftBefore || result.replayed === true
+        });
+      } catch {
+      }
+      throw failure2;
+    }
   } finally {
     await release();
   }
@@ -139030,6 +139120,21 @@ ${canonical5}`;
           "inference_chat"
         )), paidStore);
       }
+      if (typeof content === "string" && !content.trim()) {
+        const paidText = usdcText3(paidAtomic ?? "");
+        const reasonLogged = result.finishReason === void 0 || result.finishReason === null ? "none" : ["stop", "length", "content_filter", "tool_calls", "function_call"].includes(result.finishReason) ? result.finishReason : "other";
+        log(`MCP_INFERENCE_EMPTY requestId=${requestId} finishReason=${reasonLogged}`);
+        return withRefundNotices(json3(sayFirst(
+          {
+            ok: false,
+            error: "inference_empty_answer",
+            detail: `the AI provider returned an empty answer (finish reason ${JSON.stringify(result.finishReason ?? null)}); ` + (unpaid ? "nothing was paid: this request id's payment never landed (the pool's public history proves it)" : `this call was paid${paidText ? ` (${paidText} USDC)` : ""}${transaction ? ` in transaction ${transaction}` : ""} and no refund comes`),
+            ...paidFields,
+            next: unpaid ? "nothing was paid, and this request id's stored answer is empty. If the user still wants an answer, call inference_chat with a NEW request_id, or another model; it pays then" : receipt.replayed === true ? "this request id was already paid and its stored answer is empty; nothing new was paid. If the user still wants an answer, call inference_chat with a NEW request_id, or another model; it pays again" : `Tell the user: the AI returned no answer, and this call paid ${paidText ? `${paidText} USDC` : "(see paidAtomic)"}; no refund comes. If the user still wants an answer, call inference_chat again with a NEW request_id (reword the question, or pick another model); it pays again. The same request_id returns this same empty answer`
+          },
+          "inference_chat"
+        )), paidStore);
+      }
       return withRefundNotices(json3(sayFirst({
         ok: true,
         ...paidFields,
@@ -145139,7 +145244,8 @@ async function runChat({ io, values, deps = {} }) {
     empty: 0,
     pending: void 0,
     busy: false,
-    interrupts: 0
+    interrupts: 0,
+    epoch: 0
   };
   const servedNow = catalogNow;
   servedNow();
@@ -145514,8 +145620,15 @@ ${costLine2(picked.entry.id)}.` + (start ? "" : `
 The next question uses it${state.mode === "talk" ? ", with the conversation so far" : ""}.`);
   };
   let reader;
+  const warnPaidPending = (how) => {
+    if (!state.pending || !state.unsure.has(state.pending) || state.dropWarned === state.pending) return false;
+    state.dropWarned = state.pending;
+    say3(`An answer you may have paid for (${usdcWords(state.unsure.get(state.pending))}) is not finished. Type /retry to finish it: it never pays twice. Or ${how}.`);
+    return true;
+  };
   const onInterrupt = () => {
     if (!state.busy) {
+      if (warnPaidPending("press Ctrl+C again to end the chat and drop it")) return;
       reader?.close();
       return;
     }
@@ -145728,6 +145841,7 @@ When it says ready, type your message here.`);
         state.interrupts = 0;
       }
       state.pending = void 0;
+      const wasUnsure = state.unsure.get(turn);
       state.unsure.delete(turn);
       const replayed = result.receipt?.replayed === true;
       let unpaid = false;
@@ -145738,6 +145852,7 @@ When it says ready, type your message here.`);
       }
       const paid = unpaid ? 0n : typeof result.paidAtomic === "bigint" ? result.paidAtomic : void 0;
       if (paid !== void 0) state.spent += paid;
+      else if (wasUnsure !== void 0 && !unpaid) state.spent += wasUnsure;
       const content = typeof result.content === "string" ? result.content : "";
       const paidText = unpaid ? "nothing was paid: the earlier payment for this answer never went through" : paid === void 0 ? "paid (the amount was not reported)" : replayed ? `already paid ${usdcWords(paid)} earlier for this answer; nothing new was paid` : `paid ${usdcWords(paid)}`;
       const dayRoom2 = dayRoomSentence();
@@ -145749,7 +145864,7 @@ When it says ready, type your message here.`);
         return;
       }
       state.answers += 1;
-      if (state.mode === "talk") state.history = [...turn.messages, { role: "assistant", content }];
+      if (state.mode === "talk" && (turn.epoch ?? 0) === state.epoch) state.history = [...turn.messages, { role: "assistant", content }];
       io.out(`${fitColumns(
         content,
         process.stdout.isTTY ? process.stdout.columns : 0,
@@ -145770,28 +145885,45 @@ When it says ready, type your message here.`);
     const failed = async (error, turn) => {
       const code2 = errorCodeOf(error);
       const surelyNothing = nothingPaid(error);
+      const paidLeft = [error, error?.cause].map((one) => one?.paidLeft).find((one) => one && typeof one === "object" && typeof one.left === "boolean");
+      const leftAtomic = paidLeft?.left === true && /^[1-9][0-9]{0,30}$/.test(String(paidLeft.atomic ?? "")) ? BigInt(paidLeft.atomic) : void 0;
       const paidAtomic = error?.details?.receipt ? error.details.paidAtomic : void 0;
+      const wasUnsure = state.unsure.get(turn);
       state.pending = void 0;
       if (error?.details?.receipt) {
+        state.unsure.delete(turn);
         if (typeof paidAtomic === "bigint") state.spent += paidAtomic;
+        else if (wasUnsure !== void 0) state.spent += wasUnsure;
         state.empty += 1;
         say3(`This answer was paid${typeof paidAtomic === "bigint" ? ` (${usdcWords(paidAtomic)})` : ""}, but no usable answer came back from the AI provider. A new question pays again: ask again, or /model to try another model (${modelIds2}). This chat paid ${paidSoFar()} so far.`);
         return;
       }
       if (code2 === "p03_resource_payment_answer_not_kept") {
+        const earlier = error?.earlierPaymentAtomic ?? error?.cause?.earlierPaymentAtomic;
+        state.unsure.delete(turn);
+        if (/^[1-9][0-9]{0,30}$/.test(String(earlier ?? ""))) state.spent += BigInt(earlier);
+        else if (wasUnsure !== void 0) state.spent += wasUnsure;
         state.empty += 1;
         say3(`${answerNotKeptWords(error?.earlierPaymentAtomic ?? error?.cause?.earlierPaymentAtomic)} This chat paid ${paidSoFar()} so far.`);
         return;
       }
-      if (/another_request_unresolved$/.test(code2 ?? "") && (error?.memoryOnlyOpen ?? error?.cause?.memoryOnlyOpen) === true) {
+      if (paidLeft?.left !== true && /another_request_unresolved$/.test(code2 ?? "") && (error?.memoryOnlyOpen ?? error?.cause?.memoryOnlyOpen) === true) {
         say3(memoryOnlyOpenWords(error?.closesAtUnix ?? error?.cause?.closesAtUnix));
         return;
       }
       if (code2 === "fetch_proof_tools_unavailable") {
+        const earlier = error?.earlierPaymentAtomic ?? error?.cause?.earlierPaymentAtomic;
+        const heldAtomic = /^[1-9][0-9]{0,30}$/.test(String(earlier ?? "")) ? BigInt(earlier) : leftAtomic ?? wasUnsure;
+        if (heldAtomic !== void 0) {
+          state.unsure.set(turn, heldAtomic);
+          state.pending = turn;
+          say3(`This wallet is missing some setup files, so this try sent nothing and paid nothing new. The earlier payment for this answer (${usdcWords(heldAtomic)}) may be paid already: type /retry to try again (it never pays twice). If you end the chat to run ${commandLine("setup")}, the wallet closes that payment by itself: if it never reached the AI provider, the money comes back.`);
+          return;
+        }
         say3(`This wallet is missing some setup files, so nothing was paid. End the chat (/exit), run ${commandLine("setup")} to install them, then start the chat again: ${commandLine("chat")}`);
         return;
       }
-      if (localErrorCodes(error).includes(SPLIT_CODE)) {
+      if (paidLeft?.left !== true && localErrorCodes(error).includes(SPLIT_CODE)) {
         state.pending = turn;
         const why = joinOutcome === "stale" ? "the wallet could not read your balance again just now" : joinOutcome === "unfinished" ? "the wallet did not finish getting it ready in this turn" : joinOutcome === "files" ? void 0 : "part of it is not ready to spend yet (another payment of this wallet, or its change, is not final yet)";
         say3(why === void 0 ? `Your private balance covers this answer in total, but not yet in one payment. Nothing was paid. Get it ready in another terminal: ${commandLine("prepare")}, then type /retry: it asks the same question again.` : `Your private balance covers this answer in total, but ${why}. Nothing was paid. Type /retry in a minute: it gets the balance ready by itself when it needs to, and never pays twice.`);
@@ -145843,14 +145975,36 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
         say3(held2 !== void 0 && facts.preparedNotSent === true ? `Nothing was paid: a payment of ${usdcWords(held2)} is prepared for an earlier try of this question and not sent, and the wallet never pays twice for one question. This chat cannot send it. ${closeFirst}` : held2 !== void 0 ? `This question already has a payment of ${usdcWords(held2)} from an earlier try, made with other details, and the wallet never pays twice for one question; nothing more was paid. This chat cannot finish that payment, and the same question typed again is a new question that pays again.` : open4 ? `Nothing was paid: an earlier try of this question was made with other details and is not finished; nothing of it was sent, and it blocks every new question until it is closed. ${closeFirst}` : "Nothing was paid: an earlier try of this question was made with other details. If you still want an answer, type the question again: it goes out as a new question.");
         return;
       }
-      const float = typeof code2 === "string" && !CAP_CODES.test(code2) ? floatOutcomeWords(code2, facts, chatFloatTerms()) : void 0;
+      const float = typeof code2 === "string" && !CAP_CODES.test(code2) ? floatOutcomeWords(code2, withoutProviderText(facts), chatFloatTerms()) : void 0;
       if (float) {
-        const spent = floatSpent(code2, facts) && /^[1-9][0-9]{0,30}$/.test(String(facts.paidAtomic ?? ""));
-        if (spent) state.spent += BigInt(facts.paidAtomic);
-        if (["p03_float_seller_unanswered_retry_same_request", "p03_float_seller_refused_after_payment", "p03_float_outcome_not_certain"].includes(code2) && /^[1-9][0-9]{0,30}$/.test(String(facts.paidAtomic ?? ""))) {
-          state.unsure.set(turn, BigInt(facts.paidAtomic));
-        } else state.unsure.delete(turn);
-        if (floatSpent(code2, facts)) state.empty += 1;
+        const keptAmount = () => {
+          try {
+            const kept3 = keptPayment(session.openStore(), turn.requestId);
+            return kept3?.committed === true && kept3.cancelled !== true && /^[1-9][0-9]{0,30}$/.test(String(kept3.amountAtomic ?? "")) ? BigInt(kept3.amountAtomic) : void 0;
+          } catch {
+            return typeof turn.capAtomic === "bigint" && turn.capAtomic > 0n ? turn.capAtomic : void 0;
+          }
+        };
+        const amount = /^[1-9][0-9]{0,30}$/.test(String(facts.paidAtomic ?? "")) ? BigInt(facts.paidAtomic) : paidLeft ? leftAtomic : FLOAT_NOT_PAID.has(code2) ? void 0 : keptAmount();
+        const paidForSure = floatSpent(code2, facts) || code2 === PAID_SELLER_FAILED_CODE;
+        const spent = paidForSure && (amount !== void 0 || wasUnsure !== void 0);
+        if (paidLeft?.left === true && !paidForSure && (FLOAT_NOT_PAID.has(code2) || NOTHING_PAID.test(`${float[1]} ${float[2]}`))) {
+          const held3 = amount ?? leftAtomic ?? (typeof turn.capAtomic === "bigint" && turn.capAtomic > 0n ? turn.capAtomic : void 0);
+          if (held3 !== void 0) state.unsure.set(turn, held3);
+          state.pending = turn;
+          try {
+            (typeof session.timing === "function" ? session.timing() : void 0)?.("chat-answer-failed", code2);
+          } catch {
+          }
+          say3(`The answer did not come back, and the wallet cannot prove this payment${held3 !== void 0 ? ` (${usdcWords(held3)})` : ""} stayed unpaid: it may be paid already. Type /retry to finish it (it never pays twice). This chat counts it until it is certain.`);
+          return;
+        }
+        if (paidForSure) {
+          state.unsure.delete(turn);
+          if (spent) state.spent += amount ?? wasUnsure;
+        } else if (FLOAT_NOT_PAID.has(code2)) state.unsure.delete(turn);
+        else if (amount !== void 0) state.unsure.set(turn, amount);
+        if (paidForSure) state.empty += 1;
         if (floatRetry(code2, facts)) state.pending = turn;
         try {
           const mark = typeof session.timing === "function" ? session.timing() : void 0;
@@ -145863,17 +146017,33 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
       }
       let prepared;
       let neverLeft = false;
-      if (!surelyNothing) {
+      let keptAtomic;
+      if (paidLeft) {
+        if (paidLeft.left) keptAtomic = leftAtomic ?? (typeof turn.capAtomic === "bigint" && turn.capAtomic > 0n ? turn.capAtomic : void 0);
+        else {
+          let kept3;
+          try {
+            kept3 = keptPayment(session.openStore(), turn.requestId);
+          } catch {
+            kept3 = void 0;
+          }
+          if (kept3?.prepared === true) prepared = /^[1-9][0-9]{0,30}$/.test(String(kept3.amountAtomic ?? "")) ? ` of ${usdcWords(BigInt(kept3.amountAtomic))}` : "";
+          else neverLeft = true;
+        }
+      } else if (!surelyNothing) {
         try {
           const kept3 = keptPayment(session.openStore(), turn.requestId);
+          if (/^[1-9][0-9]{0,30}$/.test(String(kept3?.amountAtomic ?? ""))) keptAtomic = BigInt(kept3.amountAtomic);
           if (kept3 === void 0 || kept3.committed !== true || kept3.cancelled === true) neverLeft = true;
-          else if (kept3.prepared === true) prepared = /^[1-9][0-9]{0,30}$/.test(String(kept3.amountAtomic ?? "")) ? ` of ${usdcWords(BigInt(kept3.amountAtomic))}` : "";
+          else if (kept3.prepared === true) prepared = keptAtomic !== void 0 ? ` of ${usdcWords(keptAtomic)}` : "";
         } catch {
           prepared = void 0;
           neverLeft = false;
+          if (typeof turn.capAtomic === "bigint" && turn.capAtomic > 0n) keptAtomic = turn.capAtomic;
         }
       }
-      const nothing = surelyNothing || neverLeft;
+      const nothing = paidLeft ? neverLeft : surelyNothing || neverLeft;
+      if (!nothing && prepared === void 0 && keptAtomic !== void 0) state.unsure.set(turn, keptAtomic);
       const again = nothing ? "ask again" : prepared !== void 0 ? "type /retry (it sends that same payment, never a second one)" : "type /retry (it finishes the same payment and never pays twice)";
       if (!nothing) state.pending = turn;
       const paidWords = nothing ? "Nothing was paid." : prepared !== void 0 ? `Nothing was paid: a payment${prepared} is prepared for this question and not sent yet.` : "It may be paid already.";
@@ -145915,8 +146085,10 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
     const command = async (text3) => {
       const [name, ...rest] = text3.split(/\s+/);
       const arg = rest.join(" ").trim();
-      if (name === "/exit" || name === "/quit" || name === "/q") return true;
+      if (name === "/exit" || name === "/quit" || name === "/q") return !warnPaidPending(`${name} again ends the chat and drops it`);
       if (name === "/new") {
+        if (warnPaidPending("/new again starts a new conversation and drops it")) return false;
+        state.epoch += 1;
         state.history = [];
         state.pending = void 0;
         forgetMemoryOnly();
@@ -145930,10 +146102,10 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
         if (!next) say3("Type /mode 1 for one question at a time, or /mode 2 for a conversation.");
         else {
           state.mode = next;
+          state.epoch += 1;
           state.history = [];
-          state.pending = void 0;
-          forgetMemoryOnly();
-          say3(next === "each" ? "Mode now: one question at a time. Each question goes alone, and the chat names each payment." : "Mode now: a conversation. The AI remembers from your next question on, and the running total shows beside you.");
+          if (!state.pending) forgetMemoryOnly();
+          say3((next === "each" ? "Mode now: one question at a time. Each question goes alone, and the chat names each payment." : "Mode now: a conversation. The AI remembers from your next question on, and the running total shows beside you.") + (state.pending ? " Your unfinished answer is kept: /retry finishes it." : ""));
         }
       } else if (name === "/model" || name === "/provider") {
         const now = await servedNow();
@@ -146022,6 +146194,7 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
         if (text3.startsWith("/")) {
           if (await command(text3)) break;
         } else {
+          if (warnPaidPending("type your new question again to drop it and ask the new one")) continue;
           if (state.pending) say3("(The unfinished answer is dropped; this is a new question.)");
           state.pending = void 0;
           const now = await servedNow();
@@ -146033,12 +146206,16 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
             requestId: `chat-${randomBytes29(8).toString("hex")}`,
             model: state.model,
             liveEntry: liveOf(state.model),
+            epoch: state.epoch,
             messages: state.mode === "each" ? [{ role: "user", content: text3 }] : [...state.history, { role: "user", content: text3 }],
             capAtomic: void 0
           });
         }
       }
     }
+    if (state.pending && state.unsure.has(state.pending)) {
+      say3(`An answer you may have paid for (${usdcWords(state.unsure.get(state.pending))}) was not finished, and the chat keeps no copy of it. The wallet closes that payment by itself: if it never reached the AI provider, the money comes back to your private balance; if it did, your next private question tells you that it was paid.`);
+    }
     say3([
       `Chat ended. It paid ${paidSoFar()} for ${questionsWords()}. The conversation is gone from memory.`,
       ...chatEndLines({ color, columns: process.stderr.columns ?? 0 })
@@ -146051,7 +146228,7 @@ When it says ready, type /retry: it asks the same question again.` : receivedOnl
     await session.close();
   }
 }
-var SPLIT_CODE, DEFAULT_MODEL2, CHAT_DEFAULT_MODEL, CHAT_MAX_TOKENS, CHAT_SHORT_TOKENS, DEFAULT_ANSWER_CAP_ATOMIC, DEFAULT_CHAT_CAP_ATOMIC, CHEAPEST_MODEL, PICK_PAGE, PICK_MOST_BROWSED, PICK_MATCHES, PICK_COLUMNS, PICK_ID_COLUMNS, PICK_NAME_COLUMNS, STILL_WAITING_MS, higherCap, shortInChat, POSITIVE_ATOMIC9, SHORT_QUESTION, SHORT_QUESTION_TOKENS, PASTE_JOIN_MS, CAP_CODES, WAIT_CODES, NO_ANSWER_CODES, HISTORY_CODES, chatFloatTerms, floatRetry, floatSpent, asSentence, upFirst, lowFirst, NOTHING_PAID, CAP_FROM, PROGRESS_LINE, SHOWN_PROGRESS, isProgressLine, fail46, nothingPaid;
+var SPLIT_CODE, DEFAULT_MODEL2, CHAT_DEFAULT_MODEL, CHAT_MAX_TOKENS, CHAT_SHORT_TOKENS, DEFAULT_ANSWER_CAP_ATOMIC, DEFAULT_CHAT_CAP_ATOMIC, CHEAPEST_MODEL, PICK_PAGE, PICK_MOST_BROWSED, PICK_MATCHES, PICK_COLUMNS, PICK_ID_COLUMNS, PICK_NAME_COLUMNS, STILL_WAITING_MS, higherCap, shortInChat, POSITIVE_ATOMIC9, SHORT_QUESTION, SHORT_QUESTION_TOKENS, PASTE_JOIN_MS, CAP_CODES, WAIT_CODES, NO_ANSWER_CODES, HISTORY_CODES, chatFloatTerms, floatRetry, floatSpent, FLOAT_NOT_PAID, asSentence, upFirst, lowFirst, NOTHING_PAID, CAP_FROM, PROGRESS_LINE, SHOWN_PROGRESS, isProgressLine, fail46, nothingPaid;
 var init_chat = __esm({
   "wallet/src/inference/chat.mjs"() {
     "use strict";
@@ -146133,6 +146310,7 @@ var init_chat = __esm({
     });
     floatRetry = (code2, facts) => /_retry_same_request$|_retry_later$/.test(code2) || ["p03_float_already_paid", "p03_float_config_unreadable"].includes(code2) || code2 === "p03_float_request_refused" && facts.floatCode === "float_quote_in_progress" || code2 === "p03_float_seller_kept_payment" && facts.resent !== true && facts.pruned !== true && facts.httpStatus !== 402;
     floatSpent = (code2, facts) => code2 === "p03_float_receipt_pruned" || code2 === "p03_float_seller_kept_payment" && !floatRetry(code2, facts);
+    FLOAT_NOT_PAID = /* @__PURE__ */ new Set(["p03_float_request_expired_nothing_paid"]);
     asSentence = (text3) => `${text3.charAt(0).toUpperCase()}${text3.slice(1).replace(/[.;\s]+$/, "")}.`;
     upFirst = (text3) => `${text3.charAt(0).toUpperCase()}${text3.slice(1)}`;
     lowFirst = (text3) => `${text3.charAt(0).toLowerCase()}${text3.slice(1)}`;
@@ -153380,7 +153558,7 @@ var INFER_MODEL_IDS = ["claude-opus-5", "deepseek-v4-1-flash", "qwen3-8-flash"];
 var INFER_EXAMPLE_TAIL = `--max-tokens 512 --max-payment 0.02 --max-session 0.1 ${PAYER_SESSION_BASE} --tor`;
 var INFER_COST_LINE = "The AI provider charges its quoted cap for --max-tokens a request (often far below 0.01 USDC; 0.01 USDC on its standard offer, so --max-payment must cover that) and keeps what the answer does not use (no refund of the rest); the wallet pays the AI provider's price plus Shinjuku's fee (Shinjuku pays the AI provider for you), never more than --max-payment a request; the AI provider and the company that runs the model see your prompt and the answer. The chain shows one private payment, not who paid";
 var INFER_STDIN_MAX_BYTES = 1024 * 1024;
-var INFER_STDIN_EXAMPLE = `echo "Summarize x402 in one line" | ${CLI_WORD} infer - --model qwen3-8-flash`;
+var INFER_STDIN_EXAMPLE = `cat question.txt | ${CLI_WORD} infer -`;
 var CURL_USEPOD_NEXT = `use \`${CLI_WORD} infer\` for the AI provider: it sends the prompt only through --tor or --proxy`;
 function unshieldArgs(command, args) {
   if (args.includes("--amount")) return args;
@@ -153411,6 +153589,7 @@ function inferArgs(command, args) {
       index += 1;
     }
   }
+  if (!out.includes("--prompt") && !out.includes("--help") && !out.includes("-h") && process.stdin.isTTY) out.push("--prompt", "-");
   return out;
 }
 function inferTorGate(env) {
@@ -153430,7 +153609,7 @@ function validateInfer(values, env) {
   }
   if (values.has("--max-tokens") && Number(values.get("--max-tokens")) < 1) throw new UsageError("--max-tokens must be at least 1 (give 256 or more, 512 answers a short question: a reasoning model like qwen3-8-flash thinks first, and with fewer tokens it can stop before it answers, still paid): it sets the most the request can cost");
   if (!values.get("--prompt").trim()) {
-    throw new UsageError(`the prompt is empty: pipe it in and write - in its place (private: not in the process list or shell history), like ${INFER_STDIN_EXAMPLE}`);
+    throw new UsageError(`the prompt is empty: run ${CLI_WORD} infer alone in a terminal and type the question when it asks, or pipe it in from a file, like ${INFER_STDIN_EXAMPLE}`);
   }
   if (!values.has(WALLET_FROM_SETUP) && (values.has("--pool") || values.has("--wallet"))) inferTorGate(env);
 }
@@ -153466,6 +153645,22 @@ async function readStdinBytes({ maxBytes }) {
 async function inferPrompt(values, deps) {
   const given = values.get("--prompt");
   if (given !== "-") return given;
+  if (!deps.readStdin && process.stdin.isTTY) {
+    const asker = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
+    let line;
+    try {
+      line = await new Promise((resolveLine) => {
+        asker.once("close", () => resolveLine(null));
+        asker.question("Type your question, then press Enter: ", resolveLine);
+      });
+    } finally {
+      asker.close();
+    }
+    if (line === null || !String(line).trim()) {
+      throw new UsageError(`no question was typed, so nothing was sent or paid. Run ${cli4()} infer again and type your question, or use ${cli4()} chat`);
+    }
+    return String(line);
+  }
   const raw = await (deps.readStdin ?? readStdinBytes)({ maxBytes: INFER_STDIN_MAX_BYTES });
   const bytes2 = typeof raw === "string" ? Buffer.from(raw, "utf8") : Buffer.from(raw ?? []);
   if (bytes2.length > INFER_STDIN_MAX_BYTES) {
@@ -153625,10 +153820,13 @@ function inferOutput(result, { values, io, model: model2, quiet, requestId, held
 ` : `paid ${paidText}${quiet ? "" : ` request-id ${result.requestId ?? requestId}`}${stopped}
 `);
   }
+  const empty = !String(result.content ?? "").trim();
+  const emptyWords = result.finishReason === "length" ? `The model used all its tokens before its answer started, so no answer came back (${replayed || held ? "paid earlier" : `paid ${paidText}`}). Ask again with a higher --max-tokens, or use another model (${cli4()} infer models).` : `The model sent an empty answer (${replayed || held ? "paid earlier" : `paid ${paidText}`}). Ask again: that is a new question and pays again.`;
   if (values.has("--json")) {
     io.out(`${JSON.stringify(
       {
-        ok: true,
+        ok: !empty,
+        ...empty ? { error: "inference_empty_answer", message: emptyWords } : {},
         model: result.model ?? model2,
         content: result.content,
         finishReason: result.finishReason,
@@ -153643,10 +153841,16 @@ function inferOutput(result, { values, io, model: model2, quiet, requestId, held
       (key, value2) => typeof value2 === "bigint" ? value2.toString() : value2
     )}
 `);
+    if (empty) throw new PrintedFailure("inference_empty_answer");
     return;
   }
   for (const line of paidNotices) io.err(`${line}
 `);
+  if (empty) {
+    io.err(`${emptyWords}${quiet ? "" : ` request-id ${result.requestId ?? requestId}`}
+`);
+    throw new PrintedFailure("inference_empty_answer");
+  }
   io.out(`${result.content ?? ""}
 `);
   if (plainPaid) {
@@ -154225,6 +154429,13 @@ var RanBehindTorFailed = class extends Error {
     this.exitCode = code2;
   }
 };
+var PrintedFailure = class extends Error {
+  constructor(code2) {
+    super(code2);
+    this.code = code2;
+    this.exitCode = 1;
+  }
+};
 function chatBeforeValidate(values, deps, args) {
   values.set(CHAT_RAW_ARGS, args);
   if (values.has("--wallet") || values.has("--pool")) return void 0;
@@ -156392,7 +156603,7 @@ var COMMANDS = [
     summary: "Ask an AI model one question and pay for the answer from your private balance (Shielded Inference, through the AI provider's x402 route).",
     env: [],
     flags: [
-      flag2("--prompt", "<text>", `what to ask; write - to read it from stdin (the private form), or write it alone, in quotes (${CLI_WORD} infer "Summarize x402 in one line" ...)`, { required: true }),
+      flag2("--prompt", "<text>", `what to ask; with no question in a terminal, infer asks for it (the words stay out of your shell history); write - to read it from stdin (a file or a script), or write it alone, in quotes (${CLI_WORD} infer "Summarize x402 in one line" ...)`, { required: true }),
       flag2("--model", "<id>", `the model (default ${DEFAULT_MODEL2}): ${INFER_MODEL_IDS.join(", ")} (${CLI_WORD} infer models lists their prices)`),
       flag2("--max-tokens", "<n>", "the longest answer to pay for, in tokens; default 4096, 512 for claude-opus-5 (give 256 or more; 512 answers a short question: a reasoning model like qwen3-8-flash thinks first, and with fewer tokens it can stop before it answers, still paid); it sets the most this request can cost", { check: "count" }),
       flag2("--max-payment", "<usdc>", `the most this request may pay in all, in USDC (0.02 = 2 cents). It must be at least 0.011: the wallet never sets a call's ceiling below the AI provider's 0.01 USDC floor on its standard offer, and a call also pays Shinjuku's 0.001 USDC fee, so 0.02 covers it. What a call pays is the AI provider's quote for --max-tokens plus Shinjuku's fee: with ${DEFAULT_MODEL2} and the default ${DEFAULT_MAX_TOKENS} tokens, a short question costs about ${usdcOr(DEFAULT_ANSWER_PAID_ATOMIC)}, at most 0.011 USDC: 0.01 USDC plus the fee when the AI provider offers only its standard payment. A higher ceiling is refused before anything is paid. Default: from your limits (setup or limits sets them), else 0.05`, { check: "atomic", usdc: true }),
@@ -156405,12 +156616,12 @@ var COMMANDS = [
     ],
     examples: [
       `${CLI_WORD} infer "Say hello in three words"`,
-      `echo "Summarize x402 in one line" | ${CLI_WORD} infer -`,
-      `echo "Write a haiku about tunnels" | ${CLI_WORD} infer - --model claude-opus-5 --json ${INFER_EXAMPLE_TAIL}`
+      `${CLI_WORD} infer`,
+      `cat question.txt | ${CLI_WORD} infer - --model claude-opus-5 --json ${INFER_EXAMPLE_TAIL}`
     ],
     notes: [
       `After setup it needs no flags, as chat: config.json gives the wallet, the model is ${DEFAULT_MODEL2}, the caps are from your limits (setup or limits sets them; else 0.05 USDC a call and 1 USDC a run), and it runs behind Tor by itself (Tor must run, as setup recorded it). A flag you give still wins. With --pool or --wallet the command line is the whole config: then add --tor (or --proxy <url>).`,
-      `Private form (recommended): pipe the prompt in and write - in its place, so it is not in the process list or your shell history: ${INFER_STDIN_EXAMPLE}. stdin is read until it ends (UTF-8, at most 1 MiB); an empty one is refused before anything is paid.`,
+      `Private form (recommended): type ${CLI_WORD} infer alone in a terminal, and type the question when it asks: the words are not in the command line, the process list or your shell history. A question typed on the command line (in quotes) is saved in your shell history. For a file or a script, write - and pipe the question in: ${INFER_STDIN_EXAMPLE}; stdin is read until it ends (UTF-8, at most 1 MiB); an empty one is refused before anything is paid.`,
       "It runs only through Tor (or --proxy <url>), never a direct connection: the AI provider would see your IP address next to your prompt, so the command refuses before anything is sent.",
       `${INFER_COST_LINE}. stderr says this before the payment, with the most the request can cost.`,
       "stdout holds the answer; stderr says paid <amount> USDC request-id <id>. An answer cut short by --max-tokens says so. The wallet's own progress lines (Tor, the RPC relay, the pool history walk, the memo reads) show only with --verbose; warnings and failures always show.",
@@ -156435,7 +156646,7 @@ var COMMANDS = [
     flags: [bool2("--json", "print the list as one JSON line (prices in atomic USDC per 1M tokens)")],
     examples: [`${CLI_WORD} infer models`, `${CLI_WORD} infer models --json`],
     notes: [`${INFER_COST_LINE}.`],
-    next: `ask one: echo "Summarize x402 in one line" | ${CLI_WORD} infer - --model ${DEFAULT_MODEL2}`,
+    next: `ask one: ${CLI_WORD} infer (it asks for the question), or chat: ${CLI_WORD} chat`,
     run: (args, values, deps, io) => deps.inferModelsMain(values, { ...deps, io })
   },
   {
@@ -159815,7 +160026,7 @@ function failureHint(command, reason, deps, values, floatError) {
   }
   const floatCode = /\b(p03_float_[a-z_]+|wallet_quote_refused_[a-z0-9_]+|p03_resource_paid_seller_failed)\b/.exec(reason)?.[1];
   const facts = REQUEST_ID_TAKEN2.test(reason) ? { ...floatError, ...conflictRecordFacts(reason, values, deps) } : floatError;
-  const float = floatCode ? floatOutcomeWords(floatCode, facts, CLI_FLOAT_TERMS(values, deps, command)) : void 0;
+  const float = floatCode ? floatOutcomeWords(floatCode, command?.name === "infer" ? withoutProviderText(facts) : facts, CLI_FLOAT_TERMS(values, deps, command)) : void 0;
   if (float) return `${float[1].replace(/[.;\s]+$/, "")}. ${float[2]}`;
   const pocketHint = pocketFailureHint(reason, command);
   if (pocketHint) return pocketHint;
@@ -160643,12 +160854,14 @@ This copy: ${walletVersionLine(deps.walletVersion())}
     }
     if (isFamily(name)) {
       if (INTERNAL_FAMILIES.has(name) && args.length === 0) throw new UsageError("Unknown command.");
-      if (args.length === 0) {
+      const aloneInTerminal = args.length === 0 && COMMAND_BY_NAME.has(name) && process.stdin.isTTY === true;
+      if (args.length === 0 && !aloneInTerminal) {
         io.out(familyOverviewText(name));
         return 0;
       }
       const three = `${name} ${args[0]} ${args[1]}`;
-      if (COMMAND_BY_NAME.has(name) && !COMMAND_BY_NAME.has(`${name} ${args[0]}`) && !COMMAND_BY_NAME.has(three)) command = COMMAND_BY_NAME.get(name);
+      if (aloneInTerminal) command = COMMAND_BY_NAME.get(name);
+      else if (COMMAND_BY_NAME.has(name) && !COMMAND_BY_NAME.has(`${name} ${args[0]}`) && !COMMAND_BY_NAME.has(three)) command = COMMAND_BY_NAME.get(name);
       else command = COMMAND_BY_NAME.has(three) ? (args.splice(0, 2), COMMAND_BY_NAME.get(three)) : COMMAND_BY_NAME.get(`${name} ${args.shift()}`);
       if (!command && INTERNAL_FAMILIES.has(name)) throw new UsageError("Unknown command.");
       if (!command) {
@@ -160724,6 +160937,10 @@ This copy: ${walletVersionLine(deps.walletVersion())}
     if (endsProcess) showProgressAgain = () => {
     };
     if (error instanceof RanBehindTorFailed) return error.exitCode;
+    if (error instanceof PrintedFailure) {
+      writeRunResult(deps, command, error.exitCode, error);
+      return error.exitCode;
+    }
     if (error instanceof UsageError) {
       let setUp = false;
       try {
@@ -160843,7 +161060,7 @@ Next: fund that address, then rerun the same command; it continues where it stop
     const blockingLine = typeof blocking === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(blocking) ? `earlier payment: --request-id ${blocking}
 ` : "";
     const payee = command.name === "infer" ? "the AI provider" : "the seller";
-    const sellerSaid = error?.sellerReason ?? error?.cause?.sellerReason;
+    const sellerSaid = command.name === "infer" ? void 0 : error?.sellerReason ?? error?.cause?.sellerReason;
     const sellerLine = typeof sellerSaid === "string" && sellerSaid ? `${payee === "the seller" ? "seller" : payee} answered HTTP ${error?.httpStatus ?? error?.cause?.httpStatus}: ${JSON.stringify(sellerSaid)}
 ` : "";
     const landedTx = error?.transaction ?? error?.cause?.transaction;