shinjuku-shielded 0.3.159 → 0.3.161

package/README.md

@@ -6,19 +6,19 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.159. The npm packages `shinjuku-shield` and
+This is version 0.3.161. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files. The command is `shinjuku`.
 
 ## Set up
 
 ```sh
-npm install -g shinjuku@0.3.159
+npm install -g shinjuku@0.3.161
 shinjuku setup
 ```
 
 Type the two lines as they are. `npx install shinjuku` does not work: npx
 reads `install` as the name of another npm package. To set up without
-installing, type `npx shinjuku@0.3.159 setup`.
+installing, type `npx shinjuku@0.3.161 setup`.
 
 Setup makes the wallet on this machine, a private passphrase file, and the
 checked proof tools (about 191 MB), and writes `config.json`. It also writes
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.159 mcp
+claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.161 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.159", "mcp"] } } }
+{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.161", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and
@@ -55,7 +55,7 @@ Codex (the Codex app and Codex CLI read the same file, `~/.codex/config.toml`):
 ```toml
 [mcp_servers.shinjuku]
 command = "npx"
-args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.159", "mcp"]
+args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.161", "mcp"]
 startup_timeout_sec = 120
 tool_timeout_sec = 300
 ```

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "cefda627cdfe4d2186085a15dd230f822175f98c4f3a10c4b5f1e1327114d627",
-  "bytes": 9244374,
-  "sourceCommit": "3e2a43e33968834e73c6ca8d2a2e1ba669ce04b8",
+  "sha256": "9bbc535c39d7f3ca35992be853e343d8374075618e0130ef2ab4f526a300b091",
+  "bytes": 9260169,
+  "sourceCommit": "157e988ee5f4ca6c609f49b296feabd64217eba7",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1038,5 +1038,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-11-04T03:27:04.696Z"
+  "publishedAt": "2026-11-04T06:13:30.270Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.159",
+  "version": "0.3.161",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "cefda627",
-  "shinjukuSha256": "cefda627cdfe4d2186085a15dd230f822175f98c4f3a10c4b5f1e1327114d627",
+  "shinjukuRelease": "9bbc535c",
+  "shinjukuSha256": "9bbc535c39d7f3ca35992be853e343d8374075618e0130ef2ab4f526a300b091",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-shield#readme",

package/shinjuku-wallet.mjs

@@ -61,7 +61,7 @@ var __toCommonJS = (mod7) => __copyProps(__defProp({}, "__esModule", { value: tr
 import { readFileSync as realReadFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFile, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, statfsSync, truncateSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFile, readSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, statfsSync, truncateSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 function readFileSync(path, options) {
   const target = typeof path === "string" ? path : path instanceof URL ? fileURLToPath(path) : void 0;
   if (target !== void 0) {
@@ -48011,12 +48011,12 @@ var init_proxy = __esm({
     TOR_DEB_KEY = "https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc";
     TOR_DEB_KEYRING = "/usr/share/keyrings/deb.torproject.org-keyring.gpg";
     TOR_INSTALL = Object.freeze({
-      windows: `iwr ${TOR_EXPERT_BUNDLE_URL} -OutFile $env:TEMP\\tor.tar.gz; if ((Get-FileHash $env:TEMP\\tor.tar.gz -Algorithm SHA256).Hash -ne '${TOR_EXPERT_BUNDLE_SHA256}') { Remove-Item $env:TEMP\\tor.tar.gz; throw 'The Tor download does not match its pinned sha256, so it was deleted and not run' }; mkdir -Force $env:LOCALAPPDATA\\tor | Out-Null; & $env:SystemRoot\\System32\\tar.exe -xzf $env:TEMP\\tor.tar.gz -C $env:LOCALAPPDATA\\tor; & $env:LOCALAPPDATA\\tor\\tor\\tor.exe --HTTPTunnelPort '127.0.0.1:9080 IsolateDestAddr' --SocksPort 0`,
+      windows: `iwr ${TOR_EXPERT_BUNDLE_URL} -OutFile $env:TEMP\\tor.tar.gz; if ((Get-FileHash $env:TEMP\\tor.tar.gz -Algorithm SHA256).Hash -ne '${TOR_EXPERT_BUNDLE_SHA256}') { Remove-Item $env:TEMP\\tor.tar.gz; throw 'The Tor download does not match its pinned sha256, so it was deleted and not run' }; mkdir -Force $env:LOCALAPPDATA\\tor | Out-Null; & $env:SystemRoot\\System32\\tar.exe -xzf $env:TEMP\\tor.tar.gz -C $env:LOCALAPPDATA\\tor; Start-Process -WindowStyle Hidden -FilePath $env:LOCALAPPDATA\\tor\\tor\\tor.exe -ArgumentList '--HTTPTunnelPort "127.0.0.1:9080 IsolateDestAddr" --SocksPort 0'`,
       macos: `brew install tor && (grep -qxF '${TUNNEL_LINE}' "$(brew --prefix)/etc/tor/torrc" || echo '${TUNNEL_LINE}' >> "$(brew --prefix)/etc/tor/torrc") && brew services restart tor`,
       linux: `sudo apt install -y apt-transport-https gnupg wget && wget -qO- ${TOR_DEB_KEY} | gpg --dearmor | sudo tee ${TOR_DEB_KEYRING} >/dev/null && printf 'Types: deb\\nURIs: https://deb.torproject.org/torproject.org/\\nSuites: %s\\nComponents: main\\nSigned-By: ${TOR_DEB_KEYRING}\\n' "$(. /etc/os-release && echo "$VERSION_CODENAME")" | sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null && sudo apt update && sudo apt install -y tor deb.torproject.org-keyring && (grep -qxF '${TUNNEL_LINE}' /etc/tor/torrc || echo '${TUNNEL_LINE}' | sudo tee -a /etc/tor/torrc) && sudo service tor restart`
     });
     torStart = (platform = process.platform, tunnelHost) => {
-      const base = platform === "win32" ? { where: "PowerShell (keep its window open while the wallet runs)", command: TOR_INSTALL.windows } : platform === "darwin" ? { where: "Terminal", command: TOR_INSTALL.macos } : { where: "a terminal", command: TOR_INSTALL.linux };
+      const base = platform === "win32" ? { where: "PowerShell (Tor then runs in the background, so you can close that window)", command: TOR_INSTALL.windows } : platform === "darwin" ? { where: "Terminal", command: TOR_INSTALL.macos } : { where: "a terminal", command: TOR_INSTALL.linux };
       return LOCAL_TUNNEL.test(tunnelHost ?? "") ? { ...base, command: base.command.replaceAll("127.0.0.1:9080", tunnelHost) } : base;
     };
     LOCAL_TUNNEL = /^127\.0\.0\.1:\d{1,5}$/;
@@ -48036,12 +48036,12 @@ ${command}`;
     TOR_WINDOW = Object.freeze({ win32: "PowerShell", darwin: "Terminal" });
     torNotRunningMessage = (address4, platform = process.platform, { fromConfig = false } = {}) => {
       const { command } = torStart(platform);
-      const keep = platform === "win32" ? " and keep that window open" : "";
+      const keep = platform === "win32" ? " (Tor then runs in the background, so you can close that window)" : "";
       return `tor_not_running: Tor is not running on this machine, so nothing was sent.${fromConfig ? TOR_FROM_CONFIG_SENTENCE : ""} Tor hides your IP address. Start it with the command below in ${TOR_WINDOW[platform] ?? "a terminal"}${keep}:
   ${command}`;
     };
-    torUpdateHow = (platform = process.platform) => platform === "win32" ? `${TOR_STOP_OLD_WINDOWS} Then start a newer Tor with the command below in PowerShell and keep that window open` : `Install a newer Tor with the command below in ${TOR_WINDOW[platform] ?? "a terminal"}`;
-    TOR_STOP_OLD_WINDOWS = "Stop your old Tor first: close the window it runs in, or for a Tor in WSL run wsl -u root service tor stop .";
+    torUpdateHow = (platform = process.platform) => platform === "win32" ? `${TOR_STOP_OLD_WINDOWS} Then start a newer Tor with the command below in PowerShell (it runs in the background, so you can close that window)` : `Install a newer Tor with the command below in ${TOR_WINDOW[platform] ?? "a terminal"}`;
+    TOR_STOP_OLD_WINDOWS = "Stop your old Tor first: in PowerShell run Stop-Process -Name tor , or for a Tor in WSL run wsl -u root service tor stop .";
     torTooOldWhy = (version3) => `Your Tor program is too old (${version3}). It has a known fault that can link two of your payments, so the wallet sent nothing.`;
     torTooOldMessage = (version3, platform = process.platform, { fromConfig = false, tunnelHost } = {}) => {
       const { command } = torStart(platform, tunnelHost);
@@ -54272,8 +54272,22 @@ function hostShellWord(word, platform = process.platform) {
   return `"${word}"`;
 }
 function hostConfigFile(target, { platform = process.platform, env = process.env, home = homedir() } = {}) {
+  const set = (name) => typeof env[name] === "string" && env[name].trim() ? env[name].trim() : void 0;
   if (target === "cursor") return join8(home, ".cursor", "mcp.json");
   if (target === "codex") return join8(env.CODEX_HOME || join8(home, ".codex"), "config.toml");
+  if (target === "vscode") {
+    const appData = platform === "win32" ? env.APPDATA || join8(home, "AppData", "Roaming") : platform === "darwin" ? join8(home, "Library", "Application Support") : env.XDG_CONFIG_HOME || join8(home, ".config");
+    return join8(appData, "Code", "User", "mcp.json");
+  }
+  if (target === "devin") {
+    return join8(platform === "win32" ? join8(home, "AppData", "Roaming", "devin") : join8(env.XDG_CONFIG_HOME || join8(home, ".config"), "devin"), "mcp_config.json");
+  }
+  if (target === "cline") {
+    return set("CLINE_MCP_SETTINGS_PATH") ?? join8(set("CLINE_DATA_DIR") ?? join8(set("CLINE_DIR") ?? join8(home, ".cline"), "data"), "settings", "cline_mcp_settings.json");
+  }
+  if (target === "continue") return join8(set("CONTINUE_GLOBAL_DIR") ? resolve6(set("CONTINUE_GLOBAL_DIR")) : join8(home, ".continue"), "mcpServers", `${MCP_SERVER_NAME}.yaml`);
+  if (target === "gemini") return join8(set("GEMINI_CLI_HOME") ?? home, ".gemini", "settings.json");
+  if (target === "antigravity") return join8(home, ".gemini", "config", "mcp_config.json");
   if (target === "claude-desktop") {
     if (platform === "win32") return join8(env.APPDATA || join8(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     if (platform === "darwin") return join8(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
@@ -54281,8 +54295,17 @@ function hostConfigFile(target, { platform = process.platform, env = process.env
   }
   return void 0;
 }
-function hostConfigText({ home, env = process.env, platform = process.platform, npmVersion, skip = /* @__PURE__ */ new Set() } = {}) {
+function hostConfigText({ home, env = process.env, platform = process.platform, npmVersion, skip = /* @__PURE__ */ new Set(), userHome = homedir() } = {}) {
   const entry = mcpServerEntry({ home, platform, npmVersion });
+  const more = ["vscode", "devin", "cline", "continue", "gemini", "antigravity"].filter((target) => !skip.has(target)).flatMap((target) => {
+    const file = hostConfigFile(target, { platform, env, home: userHome });
+    if (target === "continue") return [`${HOST_NAMES[target]}: save these lines as ${file}:`, ...continueBlockText(hostEntry(target, entry)).trimEnd().split("\n").map((line) => `  ${line}`)];
+    const key = hostServersKey(target);
+    return [
+      `${HOST_NAMES[target]} (${file}): in that file, add these lines inside the { } after "${key}" (put a comma after the entry before them; a file with no "${key}" gets "${key}": { } first):`,
+      ...`${JSON.stringify(MCP_SERVER_NAME)}: ${JSON.stringify(hostEntry(target, entry), null, 2)}`.split("\n").map((line) => `  ${line}`)
+    ];
+  });
   const member = `${JSON.stringify(MCP_SERVER_NAME)}: ${JSON.stringify(entry, null, 2)}`;
   const files = [["claude-desktop", "Claude Desktop (claude_desktop_config.json)"], ["cursor", "Cursor (~/.cursor/mcp.json)"]].filter(([target]) => !skip.has(target)).map(([, label]) => label);
   return [
@@ -54294,9 +54317,48 @@ function hostConfigText({ home, env = process.env, platform = process.platform,
     ...skip.has("codex") ? [] : [
       "Codex (the Codex app and Codex CLI), at the end of ~/.codex/config.toml:",
       ...codexTomlBlock(entry).trimEnd().split("\n").map((line) => `  ${line}`)
-    ]
+    ],
+    ...more
+  ].join("\n");
+}
+function continueBlockText(entry) {
+  return [
+    "# The Shinjuku Shield wallet's server, written by its setup.",
+    ...CONTINUE_HEADER,
+    `  - ${JSON.stringify({ name: MCP_SERVER_NAME, ...entry })}`,
+    ""
   ].join("\n");
 }
+function continueServersIn(text3) {
+  const lines = text3.replace(/^/, "").split(/\r?\n/).filter((line) => line.trim() && !/^\s*#/.test(line));
+  const items = lines.filter((line) => /^\s*-\s/.test(line));
+  if (items.length !== 1 || !sameJson(lines.filter((line) => !/^\s*-\s/.test(line)).map((line) => line.trim()), CONTINUE_HEADER)) return void 0;
+  let value2;
+  try {
+    value2 = JSON.parse(items[0].replace(/^\s*-\s*/, ""));
+  } catch {
+    return void 0;
+  }
+  if (!isPlainObject(value2) || typeof value2.name !== "string") return void 0;
+  const { name, ...entry } = value2;
+  return { [name]: entry };
+}
+function addToContinueHost(file, entry, { now = /* @__PURE__ */ new Date(), force = false, platform = process.platform, restrict = restrictToOwnerWindows } = {}) {
+  const result = changeJsonFile(file, (text3) => {
+    if (!text3.trim()) return continueBlockText(entry);
+    const servers = continueServersIn(text3);
+    if (!servers) {
+      throw new Error("setup_host_config_unreadable: Continue's block file for the wallet was changed by hand, so setup left it alone; add the printed entry by hand");
+    }
+    const [[name, existing]] = Object.entries(servers);
+    if (name === MCP_SERVER_NAME && sameJson(existing, entry)) return void 0;
+    if (!force && !(name === MCP_SERVER_NAME && isOlderSetupEntry(existing, entry))) {
+      throw new Error(`setup_host_config_conflict: Continue's block file for the wallet holds a different server, so setup left it alone; rerun setup with --force to replace it (the old file is backed up first), or edit it by hand`);
+    }
+    return continueBlockText(entry);
+  }, { now, platform, restrict, codec: TEXT_CODEC });
+  return { file, ...result, replaced: [] };
+}
 function codexTomlBlock(entry) {
   const lines = [
     `[mcp_servers.${tomlKey(MCP_SERVER_NAME)}]`,
@@ -54581,31 +54643,32 @@ function restrictToOwnerWindows(file, { run: run2 = execFileSync2 } = {}) {
     throw new Error("setup_host_config_acl_failed: setup could not limit the file to only you on this computer (icacls), so it did not write it; add the printed entry by hand");
   }
 }
-function addToJsonHost(file, entry, { now = /* @__PURE__ */ new Date(), force = false, platform = process.platform, restrict = restrictToOwnerWindows } = {}) {
+function addToJsonHost(file, entry, { now = /* @__PURE__ */ new Date(), force = false, platform = process.platform, restrict = restrictToOwnerWindows, key = "mcpServers" } = {}) {
   try {
-    return addToStrictJsonHost(file, entry, { now, force, platform, restrict });
+    return addToStrictJsonHost(file, entry, { now, force, platform, restrict, key });
   } catch (error) {
     if (error?.jsonc !== true) throw error;
-    const result = changeJsonFile(file, (text3) => jsoncWithMember(text3, entry, { force }), { now, platform, restrict, codec: TEXT_CODEC });
+    const result = changeJsonFile(file, (text3) => jsoncWithMember(text3, entry, { force, key }), { now, platform, restrict, codec: TEXT_CODEC });
     return { file, ...result, replaced: [] };
   }
 }
-function addToStrictJsonHost(file, entry, { now, force, platform, restrict }) {
+function addToStrictJsonHost(file, entry, { now, force, platform, restrict, key }) {
   let replaced = [];
   const result = changeJsonFile(file, (current) => {
-    if (current.mcpServers !== void 0 && !isPlainObject(current.mcpServers)) {
-      throw new Error("setup_host_config_unreadable: the host's config file has an mcpServers that is not a JSON object, so setup left it alone; fix it or add the printed entry by hand");
+    const held = current[key];
+    if (held !== void 0 && !isPlainObject(held)) {
+      throw new Error(`setup_host_config_unreadable: the host's config file has a ${key} that is not a JSON object, so setup left it alone; fix it or add the printed entry by hand`);
     }
-    replaced = OLD_MCP_SERVER_NAMES.filter((name) => current.mcpServers !== void 0 && Object.hasOwn(current.mcpServers, name));
-    const existing = current.mcpServers !== void 0 && Object.hasOwn(current.mcpServers, MCP_SERVER_NAME) ? current.mcpServers[MCP_SERVER_NAME] : void 0;
+    replaced = OLD_MCP_SERVER_NAMES.filter((name) => held !== void 0 && Object.hasOwn(held, name));
+    const existing = held !== void 0 && Object.hasOwn(held, MCP_SERVER_NAME) ? held[MCP_SERVER_NAME] : void 0;
     if (existing !== void 0) {
       if (sameJson(existing, entry) && replaced.length === 0) return void 0;
       if (!force && !sameJson(existing, entry) && !isOlderSetupEntry(existing, entry)) {
         throw new Error(`setup_host_config_conflict: the host's config file already has a different "${MCP_SERVER_NAME}" server, so setup left it alone; rerun setup with --force to replace it (the old file is backed up first), or edit it by hand`);
       }
     }
-    const servers = Object.fromEntries(Object.entries(current.mcpServers ?? {}).filter(([name]) => !OLD_MCP_SERVER_NAMES.includes(name)));
-    return { ...current, mcpServers: { ...servers, [MCP_SERVER_NAME]: entry } };
+    const servers = Object.fromEntries(Object.entries(held ?? {}).filter(([name]) => !OLD_MCP_SERVER_NAMES.includes(name)));
+    return { ...current, [key]: { ...servers, [MCP_SERVER_NAME]: entry } };
   }, { now, platform, restrict });
   return { file, ...result, replaced };
 }
@@ -54725,13 +54788,13 @@ function memberSlot(src, object) {
   }
   return { at: close, comma: src[at] === "," ? void 0 : last.value.end };
 }
-function jsoncWithMember(text3, entry, { force }) {
+function jsoncWithMember(text3, entry, { force, key = "mcpServers" }) {
   const unreadable = () => {
     throw new Error("setup_host_config_unreadable: the host's config file has comments and names the wallet's server in a way setup does not change by itself, so setup left it alone; add the printed entry by hand");
   };
   const root = parseJsonc(text3);
   if (root.kind !== "object") unreadable();
-  const servers = root.members.filter((member) => member.key === "mcpServers");
+  const servers = root.members.filter((member) => member.key === key);
   if (servers.length > 1 || servers[0] && servers[0].value.kind !== "object") unreadable();
   const holder = servers[0]?.value;
   if (holder && holder.members.some((member) => OLD_MCP_SERVER_NAMES.includes(member.key))) unreadable();
@@ -54752,7 +54815,7 @@ ${indent}`) });
     const slot3 = memberSlot(text3, object);
     const indent = `${indentAt(text3, object.start)}  `;
     const member = holder ? `${JSON.stringify(MCP_SERVER_NAME)}: ${JSON.stringify(entry, null, 2).replace(/\n/g, `
-${indent}`)}` : `"mcpServers": ${JSON.stringify({ [MCP_SERVER_NAME]: entry }, null, 2).replace(/\n/g, `
+${indent}`)}` : `${JSON.stringify(key)}: ${JSON.stringify({ [MCP_SERVER_NAME]: entry }, null, 2).replace(/\n/g, `
 ${indent}`)}`;
     const lineStart = text3.lastIndexOf("\n", slot3.at - 1) + 1;
     edits.push(/^[ \t]*$/.test(text3.slice(lineStart, slot3.at)) ? { at: lineStart, end: lineStart, text: `${indent}${member}
@@ -54764,11 +54827,34 @@ ${indentAt(text3, slot3.at)}` });
   let next = text3;
   for (const edit of edits.sort((a, b) => b.at - a.at)) next = `${next.slice(0, edit.at)}${edit.text}${next.slice(edit.end)}`;
   const after = parseJsonc(next).value;
-  const want = { ...root.value, mcpServers: { ...root.value.mcpServers ?? {}, [MCP_SERVER_NAME]: entry } };
+  const want = { ...root.value, [key]: { ...root.value[key] ?? {}, [MCP_SERVER_NAME]: entry } };
   if (!sameJson(after, want)) unreadable();
   return next;
 }
-function changeJsonFile(file, change, { now, platform, restrict, codec = JSON_CODEC }) {
+function changeJsonFile(file, change, options) {
+  const target = realFileOf(file);
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const result = changeFileOnce(target, change, options, attempt);
+    if (result !== RACED) return result;
+  }
+  throw new Error("setup_host_config_changed: the app changed its settings file while setup wrote it, so setup left the file as the app wrote it; run setup again");
+}
+function realFileOf(file) {
+  let link2;
+  try {
+    link2 = lstatSync(file).isSymbolicLink();
+  } catch (error) {
+    if (error?.code === "ENOENT") return file;
+    throw error;
+  }
+  if (!link2) return file;
+  try {
+    return realpathSync(file);
+  } catch {
+    throw new Error("setup_host_config_link_broken: the host's config file is a link to a file that does not exist, so setup did not change it; fix the link or add the printed entry by hand");
+  }
+}
+function changeFileOnce(file, change, { now, platform, restrict, codec = JSON_CODEC }, attempt) {
   let current = codec.empty();
   let bytes2;
   if (existsSync(file)) {
@@ -54781,7 +54867,7 @@ function changeJsonFile(file, change, { now, platform, restrict, codec = JSON_CO
   let backup;
   if (bytes2 !== void 0) {
     mode = statSync(file).mode & 511;
-    backup = `${file}.bak-${now.toISOString().replace(/[:.]/g, "-")}`;
+    backup = `${file}.bak-${now.toISOString().replace(/[:.]/g, "-")}${attempt ? `-${attempt + 1}` : ""}`;
     const fd = openSync(backup, "wx", 384);
     let restrictFailed = false;
     try {
@@ -54813,6 +54899,11 @@ function changeJsonFile(file, change, { now, platform, restrict, codec = JSON_CO
       writeFileSync(temp, codec.write(next), { mode: mode ?? 384, flag: "wx" });
     }
     if (mode !== void 0 && platform !== "win32") chmodSync(temp, mode);
+    const nowBytes = existsSync(file) ? readFileSync(file) : void 0;
+    if (bytes2 === void 0 ? nowBytes !== void 0 : nowBytes === void 0 || !nowBytes.equals(bytes2)) {
+      rmSync(temp, { force: true });
+      return RACED;
+    }
     renameSync(temp, file);
   } catch (error) {
     rmSync(temp, { force: true });
@@ -54820,7 +54911,7 @@ function changeJsonFile(file, change, { now, platform, restrict, codec = JSON_CO
   }
   return { changed: true, ...backup ? { backup } : {} };
 }
-var import_web396, CONFIG_SCHEMA, CONFIG_FILE, NPM_PACKAGE_NAMES, COMMAND_PACKAGE, NPX_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, OLD_MCP_SERVER_NAMES, P03_BINDING, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC, HOME_FOLDER, OLDER_HOME_FOLDER, defaultHomeWords, configPath, homeWalletPath, invalid, isPubkey, MAX_OWN_ADDRESSES, isOwnAddressText, salvagePath, clearConfigSalvage, HOST_TARGETS, HOST_NAMES, CODEX_STARTUP_TIMEOUT_SEC, CODEX_TOOL_TIMEOUT_SEC, PINNED_PACKAGE, LAUNCHER_PACKAGE, NPM_VERSION, knownNpmVersion, RELEASES_URL, npmStartEnvironment, NPM_START_KEYS, defaultWalletHome, WINDOWS_SHELL_CODE, tomlString, tomlKey, codexEntryOf, isPlainObject, sameJson, claudeCodeEntry, READ_ONLY_TOOL_NAMES, claudeCodeAllowRules, claudeCodeSettingsFile, UNREADABLE_JSON, JSON_CODEC, indentAt, TEXT_CODEC;
+var import_web396, CONFIG_SCHEMA, CONFIG_FILE, NPM_PACKAGE_NAMES, COMMAND_PACKAGE, NPX_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, OLD_MCP_SERVER_NAMES, P03_BINDING, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC, HOME_FOLDER, OLDER_HOME_FOLDER, defaultHomeWords, configPath, homeWalletPath, invalid, isPubkey, MAX_OWN_ADDRESSES, isOwnAddressText, salvagePath, clearConfigSalvage, HOST_TARGETS, HOST_NAMES, hostServersKey, hostEntry, CODEX_STARTUP_TIMEOUT_SEC, CODEX_TOOL_TIMEOUT_SEC, PINNED_PACKAGE, LAUNCHER_PACKAGE, NPM_VERSION, knownNpmVersion, RELEASES_URL, npmStartEnvironment, NPM_START_KEYS, defaultWalletHome, WINDOWS_SHELL_CODE, CONTINUE_HEADER, tomlString, tomlKey, codexEntryOf, isPlainObject, sameJson, claudeCodeEntry, READ_ONLY_TOOL_NAMES, claudeCodeAllowRules, claudeCodeSettingsFile, UNREADABLE_JSON, JSON_CODEC, indentAt, TEXT_CODEC, RACED;
 var init_config = __esm({
   "wallet/src/setup/config.mjs"() {
     "use strict";
@@ -54880,8 +54971,21 @@ var init_config = __esm({
     isOwnAddressText = (value2) => isPubkey(value2);
     salvagePath = (home) => join8(home, "config.salvage.json");
     clearConfigSalvage = (home) => rmSync(salvagePath(home), { force: true });
-    HOST_TARGETS = Object.freeze(["claude-code", "claude-desktop", "cursor", "codex"]);
-    HOST_NAMES = Object.freeze({ "claude-code": "Claude Code", "claude-desktop": "Claude Desktop", cursor: "Cursor", codex: "Codex" });
+    HOST_TARGETS = Object.freeze(["claude-code", "claude-desktop", "cursor", "codex", "vscode", "devin", "cline", "continue", "gemini", "antigravity"]);
+    HOST_NAMES = Object.freeze({
+      "claude-code": "Claude Code",
+      "claude-desktop": "Claude Desktop",
+      cursor: "Cursor",
+      codex: "Codex",
+      vscode: "VS Code",
+      devin: "Devin Desktop",
+      cline: "Cline",
+      continue: "Continue",
+      gemini: "Gemini CLI",
+      antigravity: "Antigravity"
+    });
+    hostServersKey = (target) => target === "vscode" ? "servers" : "mcpServers";
+    hostEntry = (target, entry) => ["vscode", "cline", "continue"].includes(target) ? { type: "stdio", ...entry } : entry;
     CODEX_STARTUP_TIMEOUT_SEC = 120;
     CODEX_TOOL_TIMEOUT_SEC = 300;
     PINNED_PACKAGE = /^shinjuku(?:-shield(?:ed)?)?@(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
@@ -54893,6 +54997,7 @@ var init_config = __esm({
     NPM_START_KEYS = ["npm_config_offline", "npm_config_prefer_offline"];
     defaultWalletHome = (home = homedir()) => setupHome({}, home);
     WINDOWS_SHELL_CODE = /[%$`"\r\n]/;
+    CONTINUE_HEADER = Object.freeze(["name: Shinjuku Shield", "version: 0.0.1", "schema: v1", "mcpServers:"]);
     tomlString = (value2) => `"${String(value2).replace(/[\\"]/g, (c) => `\\${c}`).replace(/[\u0000-\u001f\u007f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`)}"`;
     tomlKey = (key) => /^[A-Za-z0-9_-]+$/.test(key) ? key : tomlString(key);
     codexEntryOf = (server) => ({
@@ -54947,6 +55052,7 @@ var init_config = __esm({
     });
     indentAt = (src, at) => /^[ \t]*/.exec(src.slice(src.lastIndexOf("\n", at - 1) + 1))[0];
     TEXT_CODEC = Object.freeze({ empty: () => "", read: (text3) => text3, write: (next) => next });
+    RACED = /* @__PURE__ */ Symbol("raced");
   }
 });
 
@@ -125660,6 +125766,8 @@ function clearBackupWithCode(home, code2) {
   return true;
 }
 function backupPlaces({ platform = process.platform, env = process.env } = {}) {
+  const roots = cloudRoots({ platform, env, home: homedir2() });
+  const notSynced = (list) => list.filter((place) => !cloudPlace(place.path, { platform, env, roots: () => roots }));
   const places = [];
   if (platform === "win32") {
     try {
@@ -125681,12 +125789,12 @@ function backupPlaces({ platform = process.platform, env = process.env } = {}) {
     } catch {
     }
     const profile = env.USERPROFILE ?? homedir2();
-    for (const [label, path] of [["Desktop", join29(profile, "Desktop")], ["Desktop", join29(profile, "OneDrive", "Desktop")], ["Documents", join29(profile, "Documents")]]) {
+    for (const [label, path] of [["Desktop", join29(profile, "Desktop")], ["Documents", join29(profile, "Documents")]]) {
       if (isFolder(path) && !places.some((place) => place.path.toLowerCase() === path.toLowerCase())) {
         places.push({ label: `${label} (${path}; on this computer: it does not help if this computer breaks)`, path, removable: false });
       }
     }
-    return places;
+    return notSynced(places);
   }
   let user = "";
   try {
@@ -125706,7 +125814,66 @@ function backupPlaces({ platform = process.platform, env = process.env } = {}) {
   for (const path of [join29(homedir2(), "Desktop"), homedir2()]) {
     if (isFolder(path)) places.push({ label: `${path} (on this computer: it does not help if this computer breaks)`, path, removable: false });
   }
-  return places;
+  return notSynced(places);
+}
+function cloudPlace(place, { platform = process.platform, env = process.env, home = homedir2(), roots } = {}) {
+  const text3 = String(place ?? "").trim();
+  if (!text3) return void 0;
+  const fold = platform === "win32" || platform === "darwin";
+  const sep5 = platform === "win32" ? "\\" : "/";
+  const norm = (path) => {
+    const full = (platform === "win32" ? resolve25(localForm(path, platform)) : posix.resolve(path)).replace(/[\\/]+$/, "");
+    return fold ? full.toLowerCase() : full;
+  };
+  const at = norm(text3);
+  for (const root of (roots ?? (() => cloudRoots({ platform, env, home })))()) {
+    const base = norm(root.path);
+    if (base && (at === base || at.startsWith(`${base}${sep5}`))) return root.service;
+  }
+  for (const part of text3.split(/[\\/]+/).map((name) => name.trim().toLowerCase())) {
+    if (part === "onedrive" || part.startsWith("onedrive - ") || part.startsWith("onedrive-")) return "OneDrive";
+    if (part === "dropbox" || part.startsWith("dropbox (") || part.startsWith("dropbox-")) return "Dropbox";
+    if (["my drive", "shared drives", "google drive"].includes(part) || part.startsWith("googledrive")) return "Google Drive";
+    if (["iclouddrive", "icloud drive", "icloud photos", "mobile documents"].includes(part)) return "iCloud";
+  }
+  return void 0;
+}
+function cloudRoots({ platform = process.platform, env = process.env, home = homedir2() } = {}) {
+  const roots = [];
+  const add2 = (path, service) => {
+    if (typeof path === "string" && path.trim()) roots.push({ path: path.trim(), service });
+  };
+  const dropbox = (file) => {
+    let info;
+    try {
+      info = JSON.parse(readFileSync(file, "utf8"));
+    } catch {
+      return;
+    }
+    for (const account of Object.values(info ?? {})) add2(account?.path, "Dropbox");
+  };
+  if (platform === "win32") {
+    for (const name of ["OneDrive", "OneDriveConsumer", "OneDriveCommercial"]) add2(env[name], "OneDrive");
+    add2(join29(env.USERPROFILE ?? home, "OneDrive"), "OneDrive");
+    try {
+      const result = spawnSync3(
+        "reg.exe",
+        ["query", "HKCU\\Software\\Microsoft\\OneDrive\\Accounts", "/s", "/v", "UserFolder"],
+        { windowsHide: true, encoding: "utf8", timeout: 1e4 }
+      );
+      for (const match of String(result.stdout ?? "").matchAll(/UserFolder\s+REG_\w+\s+(.+)/g)) add2(match[1], "OneDrive");
+    } catch {
+    }
+    if (env.APPDATA) dropbox(join29(env.APPDATA, "Dropbox", "info.json"));
+    if (env.LOCALAPPDATA) dropbox(join29(env.LOCALAPPDATA, "Dropbox", "info.json"));
+    return roots;
+  }
+  dropbox(posix.join(home, ".dropbox", "info.json"));
+  if (platform === "darwin") {
+    add2(posix.join(home, "Library", "Mobile Documents"), "iCloud");
+    add2(posix.join(home, "Library", "CloudStorage"), "a cloud service");
+  }
+  return roots;
 }
 async function saveBackup(home, folder, {
   removable,
@@ -125714,7 +125881,8 @@ async function saveBackup(home, folder, {
   platform = process.platform,
   restrict = restrictFolderToOwner,
   driveType = windowsDriveType,
-  mounts = posixMounts
+  mounts = posixMounts,
+  env = process.env
 } = {}) {
   const typed = String(folder ?? "").trim().replace(/^"(.*)"$/, "$1");
   const types = /* @__PURE__ */ new Map();
@@ -125726,85 +125894,173 @@ async function saveBackup(home, folder, {
   const noFolder = (at) => backupFailed(`there is no folder ${at}. Plug in the drive or type another folder`);
   const refuse13 = (found, at) => {
     if (found === "missing") throw noFolder(at);
+    if (found === "link") throw backupFailed(LINK_WORDS(at));
     if (found) throw backupFailed(found === "unknown" ? UNKNOWN_DRIVE_WORDS(at) : NETWORK_PLACE_WORDS(at));
   };
+  const roots = cloudRoots({ platform, env, home: homedir2() });
+  const refuseCloud = (at) => {
+    const service = cloudPlace(at, { platform, env, roots: () => roots });
+    if (service) throw backupFailed(CLOUD_WORDS(at, service));
+  };
   refuse13(networkPlace(typed, net4), typed);
   const place = localForm(resolve25(typed), platform);
   refuse13(networkPlace(place, net4), place);
-  refuse13(linkToNetwork(place, net4), place);
-  if (!isAbsolute7(place) || !isFolder(place)) throw noFolder(place);
-  const real = realLocal(place, net4, refuse13);
-  const files = backupFiles(home);
-  const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  let target = join29(real, `shinjuku-backup-${date}`);
-  for (let n = 2; existsSync(target); n += 1) target = join29(real, `shinjuku-backup-${date}-${n}`);
-  try {
-    mkdirSync(target, { mode: 448 });
+  refuseCloud(place);
+  const onWay = linkOnWay(place, platform);
+  const fullPath = isAbsolute7(typed) && (platform !== "win32" || /^(?:[\\/]{2}[?.][\\/])?[A-Za-z]:[\\/]/.test(typed));
+  if (onWay === "missing" && !fullPath) throw noFolder(place);
+  const trail = { files: [], dirs: [] };
+  let made;
+  try {
+    made = onWay === "missing" ? makeMissingFolder(place, net4, refuse13, noFolder, trail) : refuse13(onWay, place);
+    return await saveInFolder();
   } catch (error) {
-    throw backupFailed(`the wallet could not make a folder in ${place} (${error?.code === "EACCES" || error?.code === "EPERM" ? "no permission to write there" : error?.code === "ENOSPC" ? "the drive is full" : "it cannot write there"}). Pick another place`);
+    removeTrail(trail);
+    throw error;
   }
-  const stillHere = (path) => {
-    let now;
+  async function saveInFolder() {
+    if (!isAbsolute7(place) || !isFolder(place)) throw noFolder(place);
+    const real = realLocal(place, net4, refuse13);
+    refuseCloud(real);
+    if (made && !samePath(real, made.real, platform)) throw backupFailed(MOVED_WORDS(place));
+    const files = backupFiles(home);
+    const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    let target = join29(real, `shinjuku-backup-${date}`);
+    for (let n = 2; existsSync(target); n += 1) target = join29(real, `shinjuku-backup-${date}-${n}`);
+    try {
+      mkdirSync(target, { mode: 448 });
+      trail.dirs.push(identityOf(target));
+    } catch (error) {
+      throw backupFailed(`the wallet could not make a folder in ${place} (${error?.code === "EACCES" || error?.code === "EPERM" ? "no permission to write there" : error?.code === "ENOSPC" ? "the drive is full" : "it cannot write there"}). Pick another place`);
+    }
+    const stillHere = (path) => {
+      let now;
+      try {
+        now = localForm(realpathSync.native(path), platform);
+      } catch {
+        now = void 0;
+      }
+      if (!now || !samePath(now, path, platform)) throw backupFailed(MOVED_WORDS(place));
+      refuse13(networkPlace(now, net4), now);
+      refuseCloud(now);
+    };
+    stillHere(target);
+    let access;
     try {
-      now = localForm(realpathSync.native(path), platform);
+      access = restrict(target, platform);
     } catch {
-      now = void 0;
+      access = "open";
+    }
+    if (access === "foreign") {
+      throw backupFailed(`this folder can be opened by other accounts (${place}); pick another place`);
+    }
+    const ownerOnly = access === "owner";
+    const saved = [];
+    const names = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      let name = basename6(file);
+      for (let n = 2; names.has(name.toLowerCase()); n += 1) name = `${basename6(file, extname(file))}-${n}${extname(file)}`;
+      names.add(name.toLowerCase());
+      const copy = join29(target, name);
+      stillHere(target);
+      try {
+        copyFileSync(file, copy, constants.COPYFILE_EXCL);
+        trail.files.push(identityOf(copy));
+        if (platform !== "win32") chmodSync(copy, 384);
+      } catch (error) {
+        throw backupFailed(`the copy to ${target} failed (${error?.code === "ENOSPC" ? "the drive is full" : "the drive did not take the file"}). Pick another place`);
+      }
+      stillHere(copy);
+      saved.push({ name, source: file, sha256: sha256Of(file) });
     }
-    if (!now || !samePath(now, path, platform)) throw backupFailed(MOVED_WORDS(place));
-    refuse13(networkPlace(now, net4), now);
-  };
-  stillHere(target);
-  let access;
-  try {
-    access = restrict(target, platform);
-  } catch {
-    access = "open";
+    for (const entry of saved) {
+      if (sha256Of(join29(target, entry.name)) !== entry.sha256) throw backupFailed(`the copy in ${target} does not match the original. Pick another place`);
+    }
+    const code2 = cleared ? void 0 : backupCode();
+    writeRecord(home, { savedAt: (/* @__PURE__ */ new Date()).toISOString(), folder: target, cleared, ...code2 ? { codeSha256: code2.sha256 } : {} });
+    const warning = removable === true ? "Anyone who gets this USB stick can spend your money: keep it somewhere safe." : !ownerOnly ? "Other people who use this computer or drive may be able to open it: keep it somewhere only you can reach." : void 0;
+    return { folder: target, files: saved.map(({ name, sha256: sha25610 }) => ({ name, sha256: sha25610 })), ownerOnly, ...warning ? { warning } : {}, ...code2 ? { code: code2.code } : {} };
   }
-  if (access === "foreign") {
+}
+function localForm(place, platform) {
+  if (platform !== "win32") return place;
+  const local = /^[\\/]{2}[?.][\\/]([A-Za-z]:(?:[\\/].*)?)$/.exec(place)?.[1];
+  return local ? local.length === 2 ? `${local}\\` : local : place;
+}
+function makeMissingFolder(place, net4, refuse13, noFolder, trail) {
+  if (!isAbsolute7(place)) throw noFolder(place);
+  const names = [];
+  let parent = place;
+  while (!existsSync(parent)) {
+    const up = dirname28(parent);
+    if (up === parent) throw noFolder(place);
+    names.unshift(basename6(parent));
+    parent = up;
+  }
+  if (!names.length || !isFolder(parent)) throw noFolder(place);
+  if (net4.platform === "win32") {
+    const bad2 = names.find((name) => WINDOWS_RESERVED.test(name.replace(/[. ]+$/, "")) || /[<>:"|?*\u0000-\u001f]/.test(name) || /[. ]$/.test(name));
+    if (bad2) throw backupFailed(`"${bad2}" cannot be a folder name on Windows. Type another folder`);
+  }
+  refuse13(linkOnWay(parent, net4.platform), parent);
+  let at = realLocal(parent, net4, refuse13);
+  const realFolderAt = (path) => {
+    let stat2;
     try {
-      rmdirSync(target);
+      stat2 = lstatSync(path);
     } catch {
+      return false;
     }
-    throw backupFailed(`this folder can be opened by other accounts (${place}); pick another place`);
-  }
-  const ownerOnly = access === "owner";
-  const saved = [];
-  const names = /* @__PURE__ */ new Set();
-  for (const file of files) {
-    let name = basename6(file);
-    for (let n = 2; names.has(name.toLowerCase()); n += 1) name = `${basename6(file, extname(file))}-${n}${extname(file)}`;
-    names.add(name.toLowerCase());
-    const copy = join29(target, name);
-    stillHere(target);
+    if (stat2.isSymbolicLink() || !stat2.isDirectory()) return false;
+    let now;
     try {
-      copyFileSync(file, copy, constants.COPYFILE_EXCL);
-      if (platform !== "win32") chmodSync(copy, 384);
-    } catch (error) {
-      throw backupFailed(`the copy to ${target} failed (${error?.code === "ENOSPC" ? "the drive is full" : "the drive did not take the file"}). Pick another place`);
+      now = localForm(realpathSync.native(path), net4.platform);
+    } catch {
+      return false;
     }
+    return samePath(now, path, net4.platform);
+  };
+  for (const name of names) {
+    if (!realFolderAt(at)) throw backupFailed(MOVED_WORDS(place));
+    const next = join29(at, name);
     try {
-      stillHere(copy);
+      mkdirSync(next, { mode: 448 });
     } catch (error) {
-      try {
-        rmSync(copy, { force: true });
-      } catch {
-      }
-      throw error;
+      throw backupFailed(`the wallet could not make the folder ${place} (${error?.code === "EACCES" || error?.code === "EPERM" ? "no permission to write there" : error?.code === "ENOSPC" ? "the drive is full" : error?.code === "EEXIST" ? "another program made a part of it meanwhile" : "it cannot write there"}). Pick another place`);
     }
-    saved.push({ name, source: file, sha256: sha256Of(file) });
-  }
-  for (const entry of saved) {
-    if (sha256Of(join29(target, entry.name)) !== entry.sha256) throw backupFailed(`the copy in ${target} does not match the original. Pick another place`);
+    trail.dirs.push(identityOf(next));
+    if (!realFolderAt(next)) throw backupFailed(MOVED_WORDS(place));
+    refuse13(networkPlace(next, net4), next);
+    at = next;
   }
-  const code2 = cleared ? void 0 : backupCode();
-  writeRecord(home, { savedAt: (/* @__PURE__ */ new Date()).toISOString(), folder: target, cleared, ...code2 ? { codeSha256: code2.sha256 } : {} });
-  const warning = removable === true ? "Anyone who gets this USB stick can spend your money: keep it somewhere safe." : !ownerOnly ? "Other people who use this computer or drive may be able to open it: keep it somewhere only you can reach." : void 0;
-  return { folder: target, files: saved.map(({ name, sha256: sha25610 }) => ({ name, sha256: sha25610 })), ownerOnly, ...warning ? { warning } : {}, ...code2 ? { code: code2.code } : {} };
+  return { real: at };
 }
-function localForm(place, platform) {
-  if (platform !== "win32") return place;
-  const local = /^[\\/]{2}[?.][\\/]([A-Za-z]:(?:[\\/].*)?)$/.exec(place)?.[1];
-  return local ? local.length === 2 ? `${local}\\` : local : place;
+function identityOf(path) {
+  const stat2 = statSync(path, { bigint: true });
+  return { path, dev: stat2.dev, ino: stat2.ino };
+}
+function removeTrail(trail) {
+  const same2 = (entry, kind) => {
+    let stat2;
+    try {
+      stat2 = lstatSync(entry.path, { bigint: true });
+    } catch {
+      return false;
+    }
+    return !stat2.isSymbolicLink() && (kind === "file" ? stat2.isFile() : stat2.isDirectory()) && stat2.dev === entry.dev && stat2.ino === entry.ino;
+  };
+  for (const entry of [...trail.files].reverse()) {
+    if (same2(entry, "file")) try {
+      rmSync(entry.path);
+    } catch {
+    }
+  }
+  for (const entry of [...trail.dirs].reverse()) {
+    if (same2(entry, "dir")) try {
+      rmdirSync(entry.path);
+    } catch {
+    }
+  }
 }
 function realLocal(path, net4, refuse13) {
   let real;
@@ -125838,33 +126094,32 @@ function networkPlace(place, { platform = process.platform, driveType = windowsD
   const local = LOCAL_FS.has(mount.type) || mount.type === "drvfs" || mount.type === "9p" && /(^|,)aname=drvfs(,|$)/.test(mount.options ?? "");
   return local ? false : "unknown";
 }
-function linkToNetwork(place, options, hops = 0) {
-  if (hops > 20) return "unknown";
-  const local = localForm(place, options.platform);
-  if (options.platform === "win32" && !/^[A-Za-z]:/.test(local)) return "unknown";
+function linkOnWay(place, platform) {
+  const local = localForm(place, platform);
+  if (platform === "win32" && !/^[A-Za-z]:/.test(local)) return "unknown";
   const parts = local.split(/[\\/]+/).filter((part, index) => index === 0 || part !== "");
   for (let end2 = 2; end2 <= parts.length; end2 += 1) {
-    const prefix = parts.slice(0, end2).join(options.platform === "win32" ? "\\" : "/") || "/";
+    const prefix = parts.slice(0, end2).join(platform === "win32" ? "\\" : "/") || "/";
     let stat2;
     try {
-      stat2 = lstatSync(options.platform === "win32" && /^[A-Za-z]:$/.test(prefix) ? `${prefix}\\` : prefix);
+      stat2 = lstatSync(platform === "win32" && /^[A-Za-z]:$/.test(prefix) ? `${prefix}\\` : prefix);
     } catch (error) {
       return error?.code === "ENOENT" || error?.code === "ENOTDIR" ? "missing" : "unknown";
     }
-    if (!stat2.isSymbolicLink()) continue;
-    let target;
-    try {
-      target = readlinkSync(prefix);
-    } catch {
-      return "unknown";
-    }
-    const next = resolve25(dirname28(prefix), target, ...parts.slice(end2));
-    const found = networkPlace(target, options) || networkPlace(next, options);
-    if (found) return found;
-    return linkToNetwork(next, options, hops + 1);
+    if (stat2.isSymbolicLink() && !systemLink(prefix, stat2, platform)) return "link";
   }
   return false;
 }
+function systemLink(path, stat2, platform) {
+  if (platform === "win32" || stat2.uid !== 0) return false;
+  let holder;
+  try {
+    holder = lstatSync(posix.dirname(path));
+  } catch {
+    return false;
+  }
+  return holder.isDirectory() && !holder.isSymbolicLink() && holder.uid === 0 && (holder.mode & 18) === 0;
+}
 function windowsDriveType(letter) {
   try {
     const result = spawnSync3(
@@ -125938,7 +126193,7 @@ function recordBackupSkip(home) {
   if (backupRecord(home)?.cleared) return;
   writeRecord(home, { skippedAt: (/* @__PURE__ */ new Date()).toISOString() });
 }
-var backupRecordFile, sha256Of, isFolder, backupFailed, canBackUp, NETWORK_PLACE_WORDS, MOVED_WORDS, samePath, UNKNOWN_DRIVE_WORDS, NETWORK_FS, LOCAL_FS, SYSTEM_SID, ADMINISTRATORS_SID, backupNeeded;
+var backupRecordFile, sha256Of, isFolder, backupFailed, canBackUp, CLOUD_WORDS, NETWORK_PLACE_WORDS, MOVED_WORDS, WINDOWS_RESERVED, samePath, UNKNOWN_DRIVE_WORDS, NETWORK_FS, LOCAL_FS, LINK_WORDS, SYSTEM_SID, ADMINISTRATORS_SID, backupNeeded;
 var init_backup = __esm({
   "wallet/src/setup/backup.mjs"() {
     "use strict";
@@ -125963,8 +126218,10 @@ var init_backup = __esm({
       }
       return typeof config?.recoveryFile === "string" && existsSync(config.recoveryFile);
     };
+    CLOUD_WORDS = (place, service) => `${place} is synced to ${service === "a cloud service" ? "a cloud service" : `${service}'s cloud`}, so the backup would be uploaded there. Pick a USB drive or a folder that is not synced`;
     NETWORK_PLACE_WORDS = (place) => `${place} is on a network share or a network drive. A backup there can be read by the people who run that share, and the computer reaches it outside Tor, so the wallet does not save it there. Pick a USB drive or a folder on this computer`;
     MOVED_WORDS = (place) => `the folder ${place} changed while the wallet saved the backup (a part of its path now leads somewhere else), so the wallet stopped and removed what it wrote. Pick a USB drive or a folder on this computer, and try again`;
+    WINDOWS_RESERVED = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3])(\..*)?$/i;
     samePath = (a, b, platform) => platform === "win32" ? resolve25(a).toLowerCase() === resolve25(b).toLowerCase() : resolve25(a) === resolve25(b);
     UNKNOWN_DRIVE_WORDS = (place) => `the wallet could not tell whether the drive of ${place} is on this computer or on a network, so it does not save the backup there. Pick a USB drive or a folder on this computer, or try again`;
     NETWORK_FS = /^(nfs4?|cifs|smb[23]?|smbfs|afpfs|webdav|davfs|ncpfs|afs|ceph|glusterfs|lustre|fuse\.(sshfs|rclone|s3fs|davfs2?|gvfsd-fuse|smbnetfs))$/;
@@ -125990,6 +126247,7 @@ var init_backup = __esm({
       "tmpfs",
       "ramfs"
     ]);
+    LINK_WORDS = (place) => `a part of ${place} is a link to another place (a junction or a symbolic link), so the wallet does not save the backup there. Pick a USB drive or a normal folder`;
     SYSTEM_SID = "S-1-5-18";
     ADMINISTRATORS_SID = "S-1-5-32-544";
     backupNeeded = (home) => canBackUp(home) && backupRecord(home)?.cleared !== true && !backupSkipped(home);
@@ -126064,14 +126322,15 @@ function createBackup({ home, client, elicitTimeoutMs, unshown = () => false, lo
       });
     }
     const code2 = done.saved.code;
+    const say3 = code2 ? `Your backup code is ${code2}: say it back to me to add money. This backup is on this computer, so it does not help if this computer breaks; copy it to a USB stick too. ${savedLine(done.saved, done.removable)}` : savedLine(done.saved, done.removable);
     return json2({
-      say: code2 ? `Your backup code is ${code2}: say it back to me to add money with this backup. ${savedLine(done.saved, done.removable)} It does not help if this computer breaks.` : savedLine(done.saved, done.removable),
+      say: say3,
       ok: true,
       folder: done.saved.folder,
       files: done.saved.files.map((file) => file.name),
       checked: "sha256",
       ...code2 ? { waitsForCode: true } : {},
-      next: code2 ? "Tell the user the say line as it is, with the code. Only when the user says that code back, call wallet_backup with code set to it; never send the code yourself. A USB stick needs no code." : "Tell the user where the backup is. Deposits can go on now (call wallet_add_funds if the user asked for it)."
+      next: code2 ? `Say this to the user word for word, with the code (the user needs the code to add money): "${say3}" Only when the user says that code back, call wallet_backup with code set to it; never send the code yourself. A USB stick needs no code.` : "Tell the user where the backup is. Deposits can go on now (call wallet_add_funds if the user asked for it)."
     });
   }
   const boxWords = (asked) => asked.why === "failed" ? `The backup was not saved: ${asked.plain}. ` : asked.why === "declined" ? "The user closed the backup box without a choice. " : asked.why === "no_place" ? "The backup box came back with no place picked. " : asked.why === "timeout" ? "The backup box got no answer in time. " : "";
@@ -149501,7 +149760,7 @@ function successorChain(body, pool2) {
     at = next;
   }
 }
-function identityOf(facilitator, release, successors = []) {
+function identityOf2(facilitator, release, successors = []) {
   const served = { pool: release.pool, program: release.programId, network: release.network, asset: release.asset };
   if (new URL(facilitator).origin === new URL(PRODUCTION.memoService).origin) {
     const pool2 = successors.includes(served.pool) ? served.pool : PRODUCTION.pool;
@@ -149675,7 +149934,7 @@ async function runSetupSteps(options, deps, toolsSignal) {
         successions = void 0;
       }
     }
-    identity = identityOf(facilitator, release, successorChain(successions, PRODUCTION.pool));
+    identity = identityOf2(facilitator, release, successorChain(successions, PRODUCTION.pool));
     try {
       releasePools = parseReleasePools(release, facilitator);
     } catch {
@@ -156059,8 +156318,13 @@ function readJsonFile(file) {
   }
   if (size > HOST_CONFIG_MAX_BYTES) return null;
   try {
-    const text3 = readFileSync(file, "utf8");
-    const value2 = text3.trim() ? JSON.parse(text3) : {};
+    const text3 = readFileSync(file, "utf8").replace(/^/, "");
+    let value2;
+    try {
+      value2 = text3.trim() ? JSON.parse(text3) : {};
+    } catch {
+      value2 = parseJsonc(text3).value;
+    }
     return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
   } catch {
     return null;
@@ -156093,7 +156357,23 @@ function claudeCodeState(env, home) {
 function agentHostsOf(env, home) {
   const jsonHost = (target) => {
     const config = readJsonFile(hostConfigFile(target, { env, home: homedir3() }));
-    return config === void 0 ? false : config === null ? null : runsThisWallet(config.mcpServers, home);
+    return config === void 0 ? false : config === null ? null : runsThisWallet(config[hostServersKey(target)], home);
+  };
+  const continueHost = () => {
+    const file = hostConfigFile("continue", { env, home: homedir3() });
+    let size;
+    try {
+      size = statSync(file).size;
+    } catch (error) {
+      return error?.code === "ENOENT" ? false : null;
+    }
+    if (size > HOST_CONFIG_MAX_BYTES) return null;
+    try {
+      const servers = continueServersIn(readFileSync(file, "utf8"));
+      return servers ? runsThisWallet(servers, home) : null;
+    } catch {
+      return null;
+    }
   };
   const codexHost = () => {
     const file = hostConfigFile("codex", { env, home: homedir3() });
@@ -156115,7 +156395,9 @@ function agentHostsOf(env, home) {
     { app: "Claude Code", ...claudeCodeState(env, home) },
     { app: "Claude Desktop", linked: jsonHost("claude-desktop") },
     { app: "Cursor", linked: jsonHost("cursor") },
-    { app: "Codex", linked: codexHost() }
+    { app: "Codex", linked: codexHost() },
+    ...["vscode", "devin", "cline", "gemini", "antigravity"].map((target) => ({ app: HOST_NAMES[target], linked: jsonHost(target) })),
+    { app: HOST_NAMES.continue, linked: continueHost() }
   ];
 }
 function readHomeData({ env = process.env, walletVersion: walletVersion2, torRun } = {}) {
@@ -158738,12 +159020,14 @@ function privateInferencePath(config) {
 }
 function agentAppLines({ skip = /* @__PURE__ */ new Set() }) {
   if (inHomeJob()) return "To add the wallet to an agent app (Claude, Codex, Cursor and others), press [c] on the home screen.";
-  const lines = [];
-  for (const target of HOST_TARGETS) {
-    const app = target === "codex" ? "Codex (the Codex app or Codex CLI)" : HOST_NAMES[target];
-    if (!skip.has(target)) lines.push(`${app}, run this once (setup adds the wallet there):`, `  ${cli4()} setup --add-to ${target}`);
-  }
-  return lines.join("\n");
+  const targets = HOST_TARGETS.filter((target) => !skip.has(target));
+  return targets.length ? hostLines(targets).join("\n") : "";
+}
+function hostLines(targets) {
+  const commands = targets.map((target) => `${cli4()} setup --add-to ${target}`);
+  const width = Math.max(...commands.map((command) => command.length));
+  const label = { codex: "Codex (the Codex app or Codex CLI)", devin: "Devin Desktop (the app that was Windsurf)", vscode: "VS Code (GitHub Copilot)" };
+  return targets.map((target, index) => `  ${commands[index].padEnd(width)}   ${label[target] ?? HOST_NAMES[target]}`);
 }
 function setupNextText({ home, deps, npmVersion, config, fundAsked, rerun, targets = [], added = /* @__PURE__ */ new Set() }) {
   const parts = [];
@@ -158756,20 +159040,18 @@ function setupNextText({ home, deps, npmVersion, config, fundAsked, rerun, targe
       env: deps.env,
       platform: deps.platform ?? process.platform,
       npmVersion,
+      userHome: deps.homedir(),
       skip: new Set(HOST_TARGETS.filter((target) => !failed.includes(target)))
     });
     if (byHand) parts.push(`Or add it by hand:
 ${byHand}
 `);
   } else if (rerun && !targets.length) {
-    parts.push([
-      "To add the wallet to an agent app, run one of these:",
-      ...HOST_TARGETS.map((target) => `  ${cli4()} setup --add-to ${target}`),
-      ""
-    ].join("\n"));
+    parts.push(["To add the wallet to an agent app, run the line for that app:", ...hostLines(HOST_TARGETS), ""].join("\n"));
   } else {
     const hosts = agentAppLines({ skip: added });
-    if (hosts) parts.push(`${added.size ? "To add the wallet to another agent app" : "Use the wallet in your agent app"}:
+    const head = inHomeJob() ? added.size ? "To add the wallet to another agent app" : "Use the wallet in your agent app" : `${added.size ? "To add the wallet to another agent app" : "To use the wallet in your agent app"}, run the line for that app once (setup adds the wallet there)`;
+    if (hosts) parts.push(`${head}:
 ${hosts}
 `);
   }
@@ -159312,7 +159594,7 @@ async function addToHosts(targets, home, deps, { force = false, npmVersion, ask,
       continue;
     }
     try {
-      const write = (entry, writeForce) => (target === "codex" ? addToCodexHost : addToJsonHost)(file, entry, { force: writeForce });
+      const write = (entry, writeForce) => target === "codex" ? addToCodexHost(file, entry, { force: writeForce }) : target === "continue" ? addToContinueHost(file, hostEntry(target, entry), { force: writeForce }) : addToJsonHost(file, hostEntry(target, entry), { force: writeForce, key: hostServersKey(target) });
       let added = write(mcpServerEntry(options), force);
       for (const old of added.replaced ?? []) io.out(`Replaced the old ${old} entry in ${app}.
 `);
@@ -159326,7 +159608,7 @@ async function addToHosts(targets, home, deps, { force = false, npmVersion, ask,
       done.add(target);
     } catch (error) {
       const code2 = String(error.message).match(/^(setup_host_config_[a-z_]+): /)?.[1];
-      const why = code2 === "setup_host_config_conflict" ? `${file} already has another server named "${MCP_SERVER_NAME}", and the wallet did not change that file; to use the wallet there, put the entry below in its place` : code2 === "setup_host_config_unreadable" ? `the wallet cannot read the settings in ${file}, so it did not change that file; fix that file, then add the entry below to it by hand` : code2 === "setup_host_config_acl_failed" ? `the wallet could not limit a new copy of ${file} to you alone, so it did not change that file; add the entry below to it by hand` : `the wallet could not write ${file}, so that file is unchanged; add the entry below to it by hand`;
+      const why = code2 === "setup_host_config_conflict" ? `${file} already has another server named "${MCP_SERVER_NAME}", and the wallet did not change that file; to use the wallet there, put the entry below in its place` : code2 === "setup_host_config_unreadable" ? `the wallet cannot read the settings in ${file}, so it did not change that file; fix that file, then add the entry below to it by hand` : code2 === "setup_host_config_acl_failed" ? `the wallet could not limit a new copy of ${file} to you alone, so it did not change that file; add the entry below to it by hand` : code2 === "setup_host_config_changed" ? `${app} changed its settings while setup ran, so the wallet left ${file} as ${app} wrote it; run this step again` : code2 === "setup_host_config_link_broken" ? `${file} is a link to a file that does not exist, so the wallet did not change it; fix that link, or add the entry below by hand` : `the wallet could not write ${file}, so that file is unchanged; add the entry below to it by hand`;
       io.out(`Not added to ${app}: ${why}.
 `);
     }
@@ -160659,7 +160941,7 @@ var COMMANDS = [
       flag2("--own-address", "<address>", `optional, in your own terminal only (the same as the answer to setup's address question): your own wallet address (Phantom, Solflare, an exchange's deposit address), for sending money back to yourself: the MCP sends to it without asking each time (as mcp --unshield-to), also in an agent app that cannot show a question. Not this wallet's own key (the address this wallet itself receives on). Refused in a script, a pipe, or an agent's tool (no terminal), also with --yes: an agent must never approve an address. A rerun adds it to the ones config.json records (at most ${MAX_OWN_ADDRESSES})`),
       flag2("--passphrase-file", "<file>", "your own passphrase file (8 or more characters); default: setup writes a new random passphrase to <home>/passphrase.txt, readable by you alone. Needed for a wallet that exists already"),
       flag2("--facilitator", "<https origin>", `the server whose release, pool, and setup files setup uses; default ${GUIDE.facilitator}`, { check: "origin" }),
-      flag2("--add-to", "<claude-code|claude-desktop|cursor|codex>", `also add the server (npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp: the host starts this npm version; a wallet not installed from npm writes shinjuku-shield without a version) to this agent host's config; repeat it for more. Without it, setup prints the configs`, { repeat: true }),
+      flag2("--add-to", `<${HOST_TARGETS.join("|")}>`, `also add the server (npx -y --no-audit --no-fund ${NPX_AT_VERSION} mcp: the host starts this npm version; a wallet not installed from npm writes shinjuku-shield without a version) to this agent host's config; repeat it for more. Without it, setup prints the configs`, { repeat: true, check: "host" }),
       // 0.3.97 key rename: the host key is MCP_SERVER_NAME; the old keys go by themselves.
       bool2("--force", `with --add-to: replace a different ${MCP_SERVER_NAME} entry already in a JSON host config (the old file is backed up first, mode 0600), or in Claude Code (claude mcp remove of that one server, then add). An old ${OLD_MCP_SERVER_NAMES.join(" or ")} entry is replaced by itself, without --force`),
       flag2("--trust-proof-tools", "<sha256>", `ADVANCED: install the set of setup files whose SHA256SUMS has this SHA-256 instead of the set this wallet build pins (needed for a server the build does not pin). Check the set out of band first; the normal fix for a new set is to update the wallet: ${UPDATE_SETUP}`)
@@ -160677,7 +160959,8 @@ var COMMANDS = [
       "The passphrase is never printed and no MCP tool takes or returns it. The recovery file holds the seed and the key: copy it to two offline places, then delete it from this machine.",
       `The setup files are the set this wallet build PINS (its SHA256SUMS hash is in the wallet; --trust-proof-tools replaces it). A server whose /api/wallet/release names another set is refused (setup_proof_tools_pin_mismatch; to update the wallet, ${UPDATE_SETUP}). SHA256SUMS must have the pinned SHA-256, and every file must have the SHA-256 its line names, as /skill.md section 7b; bin/ and house/bin/ get the execute bit. A file that does not match is not kept. Each download has a hard size limit.`,
       "Your own --passphrase-file must be private: on Linux and macOS setup refuses a file that group or other may read or write, or that another user owns (setup_passphrase_file_insecure: chmod 600 <file>). On Windows setup cannot read the access list; it accepts the file with a warning.",
-      `--add-to for Claude Desktop or Cursor: a host config whose mcpServers is not a JSON object, or that has a different ${MCP_SERVER_NAME} entry (without --force), is left alone. Otherwise the old file is copied to <file>.bak-<time> (mode 0600 on Linux and macOS; on Windows the folder's access list) and the new file replaces it in one rename. An entry an older setup wrote (no version, another version, or an old package name, shinjuku or shinjuku-shielded; the same home) is replaced without --force, in a JSON host and in Claude Code. An entry under an old key (${OLD_MCP_SERVER_NAMES.join(" or ")}) is replaced by itself, in every host, so the host never starts two wallet servers. For Claude Code, a different ${MCP_SERVER_NAME} server (not an older entry of this wallet) needs --force.`,
+      `--add-to writes each app's own user file: vscode (VS Code with Copilot) mcp.json in VS Code's User folder, under "servers"; devin (Devin Desktop, the app that was Windsurf) mcp_config.json in AppData\\Roaming\\devin on Windows, else ~/.config/devin; cline ~/.cline/data/settings/cline_mcp_settings.json (or CLINE_MCP_SETTINGS_PATH, CLINE_DATA_DIR, CLINE_DIR); continue its own block file ~/.continue/mcpServers/shinjuku.yaml (or in CONTINUE_GLOBAL_DIR); gemini (Gemini CLI) ~/.gemini/settings.json (or in GEMINI_CLI_HOME); antigravity (Antigravity) ~/.gemini/config/mcp_config.json. Every other key and server in a file stays as it is.`,
+      `--add-to for a JSON file (Claude Desktop, Cursor and the apps above): a host config whose server list is not a JSON object, or that has a different ${MCP_SERVER_NAME} entry (without --force), is left alone. Otherwise the old file is copied to <file>.bak-<time> (mode 0600 on Linux and macOS; on Windows the folder's access list) and the new file replaces it in one rename. An entry an older setup wrote (no version, another version, or an old package name, shinjuku or shinjuku-shielded; the same home) is replaced without --force, in a JSON host and in Claude Code. An entry under an old key (${OLD_MCP_SERVER_NAMES.join(" or ")}) is replaced by itself, in every host, so the host never starts two wallet servers. For Claude Code, a different ${MCP_SERVER_NAME} server (not an older entry of this wallet) needs --force.`,
       `--add-to codex: the Codex app and Codex CLI read one file, config.toml in CODEX_HOME (else ~/.codex). Setup writes the [mcp_servers.${MCP_SERVER_NAME}] tables at its end with startup_timeout_sec = 120 (a first start downloads the wallet) and tool_timeout_sec = 300, and keeps every other line; the same rules as a JSON host (a different entry stays without --force; the old file is backed up first). Then type /mcp in Codex to see the tools.`,
       "The proof programs run natively: Windows x64, Linux x64 and Linux arm64 each download their own set (no WSL). Setup downloads the programs first and starts each one once before it makes a key; when Windows app control or an antivirus blocks one, setup stops and says which. macOS and other systems: not supported yet; setup says so and creates nothing.",
       "Run it again at any time: it never changes an existing wallet, keeps the recorded caps unless you pass new ones, checks every setup file again, downloads what is missing or newer, and rewrites config.json.",
@@ -161412,8 +161695,8 @@ function shortHelpText() {
     "Everyday commands:",
     ...rows2.map(([word, about]) => `  ${word.padEnd(width)}${about}`),
     "",
-    "Add the wallet to your agent app (claude-code, claude-desktop, cursor, or codex):",
-    `  ${cli4()} setup --add-to claude-code`,
+    "Add the wallet to your agent app: run the line for that app once.",
+    ...hostLines(HOST_TARGETS),
     "",
     `One command, with an example: ${cli4()} help <command>`,
     `All commands: ${cli4()} help all`,
@@ -161578,6 +161861,9 @@ var flagLabel = (index) => `the flag at position ${index + 1}`;
 var TRANSFER_START_FLAGS = /* @__PURE__ */ new Set(["--mint", "--token-mint", "--amount-atomic", "--amount", "--to", "--max-slippage-bps", "--allow-impact", "--yes"]);
 var NOT_SHOWN = "; the value given is not one (it is not repeated here)";
 function checkValue(spec, value2) {
+  if (spec.check === "host" && (Array.isArray(value2) ? value2 : [value2]).some((name) => !HOST_TARGETS.includes(name))) {
+    return `${spec.name} takes the name of an agent app: ${HOST_TARGETS.join(", ")}${NOT_SHOWN}`;
+  }
   if (spec.check === "atomic" && !(spec.usdc === "or-all" && value2 === "all") && !/^[1-9][0-9]*$/.test(value2)) {
     return `${spec.name} must be a whole number of atomic units above 0 (1 USDC = 1000000)${NOT_SHOWN}`;
   }
@@ -164730,6 +165016,7 @@ ${HOST_TARGETS.map((host, index) => `  ${index + 1}  ${hostNames[host] ?? host}`
         env: deps.env,
         platform: deps.platform ?? process.platform,
         npmVersion,
+        userHome: deps.homedir(),
         skip: new Set(HOST_TARGETS.filter((target) => target !== host))
       });
       if (byHand) io.out(`${byHand}