shinjuku-shielded 0.3.166 → 0.3.168

package/README.md

@@ -6,19 +6,19 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.166. The npm packages `shinjuku-shield` and
+This is version 0.3.168. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files. The command is `shinjuku`.
 
 ## Set up
 
 ```sh
-npm install -g shinjuku@0.3.166
+npm install -g shinjuku@0.3.168
 shinjuku setup
 ```
 
 Type the two lines as they are. `npx install shinjuku` does not work: npx
 reads `install` as the name of another npm package. To set up without
-installing, type `npx shinjuku@0.3.166 setup`.
+installing, type `npx shinjuku@0.3.168 setup`.
 
 Setup makes the wallet on this machine, a private passphrase file, and the
 checked proof tools (about 191 MB), and writes `config.json`. It also writes
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.166 mcp
+claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.168 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.166", "mcp"] } } }
+{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.168", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and
@@ -55,7 +55,7 @@ Codex (the Codex app and Codex CLI read the same file, `~/.codex/config.toml`):
 ```toml
 [mcp_servers.shinjuku]
 command = "npx"
-args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.166", "mcp"]
+args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.168", "mcp"]
 startup_timeout_sec = 120
 tool_timeout_sec = 300
 ```

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "162d3a005e0491faedec0df58d95385a183a68993d209faa54e51dbdc2c81afb",
-  "bytes": 9298964,
-  "sourceCommit": "4d37fd634d7539d6289106ed611016d77dd7249f",
+  "sha256": "7320b9c07d69b0d94e0ee25c1821e1f674dde5964c65e84fe3de3be6c1ff7170",
+  "bytes": 9306006,
+  "sourceCommit": "f3e7665265b2adae937b45163fff7116c6c7bd00",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1038,5 +1038,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-11-05T02:48:05.006Z"
+  "publishedAt": "2026-11-05T04:16:16.938Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.166",
+  "version": "0.3.168",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "162d3a00",
-  "shinjukuSha256": "162d3a005e0491faedec0df58d95385a183a68993d209faa54e51dbdc2c81afb",
+  "shinjukuRelease": "7320b9c0",
+  "shinjukuSha256": "7320b9c07d69b0d94e0ee25c1821e1f674dde5964c65e84fe3de3be6c1ff7170",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-shield#readme",

package/shinjuku-wallet.mjs

@@ -53952,28 +53952,175 @@ var init_processLock = __esm({
   }
 });
 
+// wallet/src/setup/userPath.mjs
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { basename as basename3, join as join8 } from "node:path";
+function commandFolder({ env = process.env, platform = process.platform } = {}) {
+  const prefix = env.npm_config_global_prefix || env.npm_config_prefix;
+  if (platform === "win32") return prefix || (env.APPDATA ? join8(env.APPDATA, "npm") : void 0);
+  return prefix ? `${String(prefix).replace(/\/+$/, "")}/bin` : void 0;
+}
+function commandFileIn(folder, platform = process.platform) {
+  if (!folder) return void 0;
+  const file = join8(folder, platform === "win32" ? `${COMMAND_PACKAGE}.cmd` : COMMAND_PACKAGE);
+  try {
+    if (!statSync(file).isFile()) return void 0;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return file;
+  } catch {
+    return void 0;
+  }
+}
+function shellPathEntries({ env = process.env, platform = process.platform } = {}) {
+  const pathValue = env.PATH ?? env.Path ?? env.path ?? "";
+  const entries = String(pathValue).split(platform === "win32" ? ";" : ":");
+  let last = -1;
+  entries.forEach((each, index) => {
+    if (/[\\/]node-gyp-bin[\\/]*$/i.test(each.trim())) last = index;
+  });
+  return entries.slice(last + 1);
+}
+function folderOnPath(folder, { env = process.env, platform = process.platform } = {}) {
+  const key = folderKey(folder, platform);
+  return shellPathEntries({ env, platform }).some((each) => each.trim() && folderKey(each, platform) === key);
+}
+function addFolderToUserPath(folder, { run: run2 = spawnSync2, env = process.env } = {}) {
+  let result;
+  try {
+    result = run2(
+      "powershell.exe",
+      [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-EncodedCommand",
+        Buffer.from(ADD_SCRIPT, "utf16le").toString("base64")
+      ],
+      { windowsHide: true, encoding: "utf8", timeout: 6e4, env: { ...env, SHINJUKU_PATH_FOLDER: folder } }
+    );
+  } catch {
+    return { state: "failed", reason: "Windows PowerShell did not start" };
+  }
+  const line = String(result?.stdout ?? "").trim().split(/\r?\n/).reverse().find((each) => each.startsWith("{"));
+  try {
+    const answer = JSON.parse(line ?? "");
+    if (["present", "added", "failed"].includes(answer?.state)) return answer;
+  } catch {
+  }
+  return { state: "failed", reason: "Windows PowerShell gave no answer" };
+}
+function shellProfileLine(folder, { env = process.env, platform = process.platform } = {}) {
+  const shell = basename3(String(env.SHELL ?? ""));
+  if (shell === "fish") return { file: "~/.config/fish/config.fish", line: `fish_add_path '${String(folder).replace(/[\\']/g, "\\$&")}'` };
+  const file = shell === "zsh" ? "~/.zshrc" : shell === "bash" ? platform === "darwin" ? "~/.bash_profile" : "~/.bashrc" : "~/.profile";
+  return { file, line: `export PATH='${String(folder).replace(/'/g, "'\\''")}':"$PATH"` };
+}
+function commandPathStep({ env = process.env, platform = process.platform, run: run2 = spawnSync2 } = {}) {
+  const folder = commandFolder({ env, platform });
+  if (!commandFileIn(folder, platform)) return { state: "no-command", folder };
+  if (platform !== "win32") {
+    return folderOnPath(folder, { env, platform }) ? { state: "on-path", folder } : { state: "profile", folder, ...shellProfileLine(folder, { env, platform }) };
+  }
+  return { folder, ...addFolderToUserPath(folder, { run: run2, env }), thisWindow: folderOnPath(folder, { env, platform }) };
+}
+function pathStepSays(step) {
+  return ["added", "failed", "profile"].includes(step?.state) || step?.state === "present" && step.thisWindow === false;
+}
+function commandPathLines(step, hereLine) {
+  const here3 = ["In this window, type the longer command, for example:", `  ${hereLine}`];
+  if (step?.state === "added") {
+    return [step.broadcast === false ? "Added Shinjuku to your PATH. Sign out of Windows and in again, then type shinjuku in a new window." : "Added Shinjuku to your PATH. Open a new window to type shinjuku.", ...here3];
+  }
+  if (step?.state === "present") return ["Shinjuku is on your PATH. Open a new window to type shinjuku.", ...here3];
+  if (step?.state === "failed") {
+    return [
+      `Setup could not add Shinjuku to your PATH (${step.reason}). To add it yourself: open Start, type environment variables, open "Edit environment variables for your account", pick Path, choose Edit, then New, and paste this folder:`,
+      `  ${step.folder}`,
+      "Then open a new window to type shinjuku.",
+      ...here3
+    ];
+  }
+  if (step?.state === "profile") {
+    return [
+      `Your terminal does not look in the folder where npm put the shinjuku command. Add this line to the end of ${step.file}, then open a new terminal to type shinjuku:`,
+      `  ${step.line}`,
+      ...here3
+    ];
+  }
+  return [];
+}
+var folderKey, ADD_SCRIPT;
+var init_userPath = __esm({
+  "wallet/src/setup/userPath.mjs"() {
+    "use strict";
+    init_fs();
+    init_config();
+    folderKey = (folder, platform) => {
+      const key = String(folder).trim().replace(/^"(.*)"$/, "$1").replace(/[\\/]+$/, "");
+      return platform === "win32" || platform === "darwin" ? key.toLowerCase() : key;
+    };
+    ADD_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$folder = $env:SHINJUKU_PATH_FOLDER
+function Key([string]$p) { ([Environment]::ExpandEnvironmentVariables($p.Trim().Trim('"'))).TrimEnd('\', '/').ToLowerInvariant() }
+try {
+  $raw = [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames
+  $want = Key $folder
+  $machineKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SYSTEM\CurrentControlSet\Control\Session Manager\Environment')
+  $machine = if ($machineKey) { [string]$machineKey.GetValue('Path', '', $raw) } else { '' }
+  $key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+  $user = $key.GetValue('Path', $null, $raw)
+  $kind = if ($null -ne $user) { $key.GetValueKind('Path') } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }
+  $entries = @(([string]$user).Split(';')) + @($machine.Split(';'))
+  if (@($entries | Where-Object { $_.Trim() -and (Key $_) -eq $want }).Count -gt 0) {
+    '{"state":"present"}'; exit 0
+  }
+  if ($kind -ne [Microsoft.Win32.RegistryValueKind]::ExpandString -and $kind -ne [Microsoft.Win32.RegistryValueKind]::String) {
+    '{"state":"failed","reason":"your PATH setting has a type setup does not change"}'; exit 0
+  }
+  $old = [string]$user
+  $new = if ($old -eq '') { $folder } elseif ($old.EndsWith(';')) { $old + $folder } else { $old + ';' + $folder }
+  if ($new.Length -ge 32767) { '{"state":"failed","reason":"your PATH setting is full"}'; exit 0 }
+  $key.SetValue('Path', $new, $kind)
+  if ([string]$key.GetValue('Path', '', $raw) -ne $new) { '{"state":"failed","reason":"the new PATH did not read back"}'; exit 0 }
+  $broadcast = $false
+  try {
+    Add-Type -Namespace ShinjukuPath -Name Native -MemberDefinition '[DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)] public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);'
+    $result = [UIntPtr]::Zero
+    $broadcast = [ShinjukuPath.Native]::SendMessageTimeout([IntPtr]0xffff, 0x1A, [UIntPtr]::Zero, 'Environment', 2, 5000, [ref]$result) -ne [IntPtr]::Zero
+  } catch { $broadcast = $false }
+  '{"state":"added","kind":"' + $kind + '","broadcast":' + $(if ($broadcast) { 'true' } else { 'false' }) + '}'
+} catch {
+  '{"state":"failed","reason":"Windows did not let setup change your PATH setting"}'
+}
+`;
+  }
+});
+
 // wallet/src/setup/config.mjs
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { randomBytes as randomBytes7 } from "node:crypto";
 import { homedir } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join8, resolve as resolve6 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join9, resolve as resolve6 } from "node:path";
 function retiredPoolText(pool2, npmVersion) {
   const next = RETIRED_POOLS[pool2];
   if (!next) return void 0;
   return `pool ${pool2} is retired: Shinjuku runs a newer pool now, and nothing serves the old pool. It held no user balance when it was retired. Your old wallet file stays where it is; run ${oneTimeCommandLine("setup", npmVersion)} to make a wallet for the new pool`;
 }
 function holdsWallet(dir) {
-  if (existsSync(join8(dir, CONFIG_FILE))) return true;
+  if (existsSync(join9(dir, CONFIG_FILE))) return true;
   try {
-    return readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && existsSync(join8(dir, entry.name, "wallet.json")));
+    return readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isDirectory() && existsSync(join9(dir, entry.name, "wallet.json")));
   } catch {
     return false;
   }
 }
 function setupHome(env = process.env, home = homedir()) {
   if (env.SHIELDED_WALLET_HOME) return resolve6(env.SHIELDED_WALLET_HOME);
-  const current = join8(home, HOME_FOLDER);
-  const older = join8(home, OLDER_HOME_FOLDER);
+  const current = join9(home, HOME_FOLDER);
+  const older = join9(home, OLDER_HOME_FOLDER);
   return !holdsWallet(current) && holdsWallet(older) ? older : current;
 }
 function checkConfig(value2) {
@@ -54067,7 +54214,7 @@ async function setAsideInvalidConfig(home, now = /* @__PURE__ */ new Date()) {
 function setAsideNow(home, now) {
   const path = configPath(home);
   const text3 = readFileSync(path, "utf8");
-  const keptAs = join8(home, `config.invalid-${now.toISOString().replace(/[:.]/g, "-")}.json`);
+  const keptAs = join9(home, `config.invalid-${now.toISOString().replace(/[:.]/g, "-")}.json`);
   copyFileSync(path, keptAs, constants.COPYFILE_EXCL);
   rmSync(path);
   let loose;
@@ -54275,11 +54422,57 @@ function claudeCodeCommand(options = {}) {
   const platform = options.platform ?? process.platform;
   const gitBash = options.gitBash ?? inGitBash(options);
   const words2 = claudeCodeArgs(options).map((word, index, all) => gitBash && platform === "win32" && word === "/c" && all[index - 1] === "cmd" ? "//c" : word);
-  return ["claude", ...words2].map((word) => hostShellWord(word, platform)).join(" ");
+  const program = claudeProgramWord(programOf(options), platform, options.shell ?? (gitBash ? "bash" : "cmd"));
+  return program === void 0 ? void 0 : [program, ...words2.map((word) => hostShellWord(word, platform))].join(" ");
+}
+function claudeCodeProgram({ env = process.env, platform = process.platform, userHome = homedir(), isProgram = programFileAt } = {}) {
+  const windows = platform === "win32";
+  const pathValue = String(env.PATH ?? env.Path ?? "");
+  if (windows) {
+    const endings = String(env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((each) => each.trim()).filter(Boolean);
+    for (const folder of pathValue.split(";").map((each) => each.trim().replace(/^"(.*)"$/, "$1")).filter(Boolean)) {
+      if (endings.some((ending) => isProgram(join9(folder, `claude${ending.toLowerCase()}`), platform))) return "claude";
+    }
+  } else {
+    for (const folder of pathValue.split(":")) {
+      if (isProgram(join9(folder === "" ? "." : folder, "claude"), platform)) return "claude";
+    }
+  }
+  const npmFolder = commandFolder({ env, platform });
+  const places = windows ? [join9(env.USERPROFILE || userHome, ".local", "bin", "claude.exe"), ...npmFolder ? [join9(npmFolder, "claude.cmd")] : []] : [join9(userHome, ".local", "bin", "claude"), ...npmFolder ? [join9(npmFolder, "claude")] : []];
+  return places.find((file) => isProgram(file, platform));
+}
+function programFileAt(file, platform = process.platform) {
+  try {
+    if (!statSync(file).isFile()) return false;
+    if (platform !== "win32") accessSync(file, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function claudeProgramWord(program, platform, shell = "cmd") {
+  if (!program || program === "claude") return "claude";
+  if (platform !== "win32") return hostShellWord(program, platform);
+  const slashed = program.replace(/\\/g, "/");
+  if (/^[A-Za-z0-9_./:=@-]+$/.test(slashed)) return slashed;
+  if (shell === "bash") return hostShellWord(slashed, "linux");
+  if (shell === "powershell") return `& '${program.replace(/'/g, "''")}'`;
+  return CMD_UNSAFE.test(program) ? void 0 : `"${program}"`;
+}
+function claudeProgramRunWhy(program, platform = process.platform) {
+  if (platform !== "win32" || !program || program === "claude" || /\.exe$/i.test(program) || !CMD_UNSAFE.test(program)) return null;
+  return `its folder path (${program}) holds a character that cmd reads as code, so setup cannot start it`;
 }
 function claudeCodeLines(options = {}) {
   if ((options.platform ?? process.platform) !== "win32") return ["Claude Code (run once):", `  ${claudeCodeCommand(options)}`];
-  const powershell = ["Claude Code (run once; in PowerShell or cmd):", `  ${claudeCodeCommand({ ...options, gitBash: false })}`];
+  const split4 = claudeLineDiffers(options);
+  const cmdLine = claudeCodeCommand({ ...options, gitBash: false, shell: "cmd" });
+  const powershell = split4 ? [
+    "Claude Code (run once; in PowerShell):",
+    `  ${claudeCodeCommand({ ...options, gitBash: false, shell: "powershell" })}`,
+    ...cmdLine ? ["Claude Code (run once; in cmd):", `  ${cmdLine}`] : ["Claude Code in cmd: its folder path holds %, which cmd reads as code; use the PowerShell or Git Bash line."]
+  ] : ["Claude Code (run once; in PowerShell or cmd):", `  ${cmdLine}`];
   const gitBash = ["Claude Code (run once; in Git Bash):", `  ${claudeCodeCommand({ ...options, gitBash: true })}`];
   return inGitBash(options) ? [...gitBash, ...powershell] : [...powershell, ...gitBash];
 }
@@ -54298,28 +54491,45 @@ function hostShellWord(word, platform = process.platform) {
 }
 function hostConfigFile(target, { platform = process.platform, env = process.env, home = homedir() } = {}) {
   const set = (name) => typeof env[name] === "string" && env[name].trim() ? env[name].trim() : void 0;
-  if (target === "cursor") return join8(home, ".cursor", "mcp.json");
-  if (target === "codex") return join8(env.CODEX_HOME || join8(home, ".codex"), "config.toml");
+  if (target === "cursor") return join9(home, ".cursor", "mcp.json");
+  if (target === "codex") return join9(env.CODEX_HOME || join9(home, ".codex"), "config.toml");
   if (target === "vscode") {
-    const appData = platform === "win32" ? env.APPDATA || join8(home, "AppData", "Roaming") : platform === "darwin" ? join8(home, "Library", "Application Support") : env.XDG_CONFIG_HOME || join8(home, ".config");
-    return join8(appData, "Code", "User", "mcp.json");
+    const appData = platform === "win32" ? env.APPDATA || join9(home, "AppData", "Roaming") : platform === "darwin" ? join9(home, "Library", "Application Support") : env.XDG_CONFIG_HOME || join9(home, ".config");
+    return join9(appData, "Code", "User", "mcp.json");
   }
   if (target === "devin") {
-    return join8(platform === "win32" ? join8(home, "AppData", "Roaming", "devin") : join8(env.XDG_CONFIG_HOME || join8(home, ".config"), "devin"), "mcp_config.json");
+    return join9(platform === "win32" ? join9(home, "AppData", "Roaming", "devin") : join9(env.XDG_CONFIG_HOME || join9(home, ".config"), "devin"), "mcp_config.json");
   }
   if (target === "cline") {
-    return set("CLINE_MCP_SETTINGS_PATH") ?? join8(set("CLINE_DATA_DIR") ?? join8(set("CLINE_DIR") ?? join8(home, ".cline"), "data"), "settings", "cline_mcp_settings.json");
+    return set("CLINE_MCP_SETTINGS_PATH") ?? join9(set("CLINE_DATA_DIR") ?? join9(set("CLINE_DIR") ?? join9(home, ".cline"), "data"), "settings", "cline_mcp_settings.json");
   }
-  if (target === "continue") return join8(set("CONTINUE_GLOBAL_DIR") ? resolve6(set("CONTINUE_GLOBAL_DIR")) : join8(home, ".continue"), "mcpServers", `${MCP_SERVER_NAME}.yaml`);
-  if (target === "gemini") return join8(set("GEMINI_CLI_HOME") ?? home, ".gemini", "settings.json");
-  if (target === "antigravity") return join8(home, ".gemini", "config", "mcp_config.json");
+  if (target === "continue") return join9(set("CONTINUE_GLOBAL_DIR") ? resolve6(set("CONTINUE_GLOBAL_DIR")) : join9(home, ".continue"), "mcpServers", `${MCP_SERVER_NAME}.yaml`);
+  if (target === "gemini") return join9(set("GEMINI_CLI_HOME") ?? home, ".gemini", "settings.json");
+  if (target === "antigravity") return join9(home, ".gemini", "config", "mcp_config.json");
   if (target === "claude-desktop") {
-    if (platform === "win32") return join8(env.APPDATA || join8(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
-    if (platform === "darwin") return join8(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-    return join8(env.XDG_CONFIG_HOME || join8(home, ".config"), "Claude", "claude_desktop_config.json");
+    if (platform === "win32") return packagedClaudeDesktopFile(env, home) ?? join9(env.APPDATA || join9(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+    if (platform === "darwin") return join9(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return join9(env.XDG_CONFIG_HOME || join9(home, ".config"), "Claude", "claude_desktop_config.json");
   }
   return void 0;
 }
+function packagedClaudeDesktopFile(env, home) {
+  const packages = join9(env.LOCALAPPDATA || join9(home, "AppData", "Local"), "Packages");
+  let names;
+  try {
+    names = readdirSync(packages);
+  } catch {
+    return void 0;
+  }
+  const files = names.filter((each) => /^Claude_[a-z0-9]+$/i.test(each)).map((name) => join9(packages, name, "LocalCache", "Roaming", "Claude", "claude_desktop_config.json")).filter((file) => existsSync(file));
+  if (files.length > 1) {
+    throw Object.assign(
+      new Error(`setup_host_config_ambiguous: this computer has ${files.length} Claude Desktop settings files (${files.join("; ")}), so the wallet did not pick one`),
+      { files }
+    );
+  }
+  return files[0];
+}
 function hostConfigText({ home, env = process.env, platform = process.platform, npmVersion, skip = /* @__PURE__ */ new Set(), userHome = homedir() } = {}) {
   const entry = mcpServerEntry({ home, platform, npmVersion });
   const more = ["vscode", "devin", "cline", "continue", "gemini", "antigravity"].filter((target) => !skip.has(target)).flatMap((target) => {
@@ -54332,7 +54542,10 @@ function hostConfigText({ home, env = process.env, platform = process.platform,
     ];
   });
   const member = `${JSON.stringify(MCP_SERVER_NAME)}: ${JSON.stringify(entry, null, 2)}`;
-  const files = [["claude-desktop", "Claude Desktop (claude_desktop_config.json)"], ["cursor", "Cursor (~/.cursor/mcp.json)"]].filter(([target]) => !skip.has(target)).map(([, label]) => label);
+  const files = [
+    ["claude-desktop", "Claude Desktop (claude_desktop_config.json: in Claude Desktop, Settings > Developer > Edit Config opens it)"],
+    ["cursor", "Cursor (~/.cursor/mcp.json)"]
+  ].filter(([target]) => !skip.has(target)).map(([, label]) => label);
   return [
     ...skip.has("claude-code") ? [] : claudeCodeShellWhy({ home, env, platform }) ? ["Claude Code:", `  ${claudeCodeShellWhy({ home, env, platform })}`] : claudeCodeLines({ home, env, platform, npmVersion }),
     ...files.length ? [
@@ -54340,7 +54553,7 @@ function hostConfigText({ home, env = process.env, platform = process.platform,
       ...member.split("\n").map((line) => `  ${line}`)
     ] : [],
     ...skip.has("codex") ? [] : [
-      "Codex (the Codex app and Codex CLI), at the end of ~/.codex/config.toml:",
+      "Codex (the Codex side of the ChatGPT desktop app, and Codex CLI), at the end of ~/.codex/config.toml:",
       ...codexTomlBlock(entry).trimEnd().split("\n").map((line) => `  ${line}`)
     ],
     ...more
@@ -54658,12 +54871,12 @@ function isSameClaudeCodeEntry(existing, options = {}) {
   return entry !== void 0 && sameJson(entry, mcpServerEntry(options));
 }
 function restrictToOwnerWindows(file, { run: run2 = execFileSync2 } = {}) {
-  const system32 = join8(process.env.SystemRoot || "C:/Windows", "System32");
+  const system32 = join9(process.env.SystemRoot || "C:/Windows", "System32");
   try {
-    const line = String(run2(join8(system32, "whoami.exe"), ["/user", "/fo", "csv", "/nh"], { encoding: "utf8", windowsHide: true }));
+    const line = String(run2(join9(system32, "whoami.exe"), ["/user", "/fo", "csv", "/nh"], { encoding: "utf8", windowsHide: true }));
     const sid = line.match(/"(S-1-[0-9-]+)"/)?.[1];
     if (!sid) throw new Error("no sid");
-    run2(join8(system32, "icacls.exe"), [file, "/inheritance:r", "/grant:r", `*${sid}:F`], { stdio: "ignore", windowsHide: true });
+    run2(join9(system32, "icacls.exe"), [file, "/inheritance:r", "/grant:r", `*${sid}:F`], { stdio: "ignore", windowsHide: true });
   } catch {
     throw new Error("setup_host_config_acl_failed: setup could not limit the file to only you on this computer (icacls), so it did not write it; add the printed entry by hand");
   }
@@ -54936,7 +55149,7 @@ function changeFileOnce(file, change, { now, platform, restrict, codec = JSON_CO
   }
   return { changed: true, ...backup ? { backup } : {} };
 }
-var import_web396, CONFIG_SCHEMA, CONFIG_FILE, NPM_PACKAGE_NAMES, COMMAND_PACKAGE, NPX_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, OLD_MCP_SERVER_NAMES, P03_BINDING, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC, HOME_FOLDER, OLDER_HOME_FOLDER, defaultHomeWords, configPath, homeWalletPath, invalid, isPubkey, MAX_OWN_ADDRESSES, isOwnAddressText, salvagePath, clearConfigSalvage, HOST_TARGETS, HOST_NAMES, hostServersKey, hostEntry, CODEX_STARTUP_TIMEOUT_SEC, CODEX_TOOL_TIMEOUT_SEC, PINNED_PACKAGE, LAUNCHER_PACKAGE, NPM_VERSION, knownNpmVersion, RECOVERY_WORDS, NPX_WALLET_LINE, RELEASES_URL, npmStartEnvironment, NPM_START_KEYS, defaultWalletHome, WINDOWS_SHELL_CODE, CONTINUE_HEADER, tomlString, tomlKey, codexEntryOf, isPlainObject, sameJson, claudeCodeEntry, READ_ONLY_TOOL_NAMES, claudeCodeAllowRules, claudeCodeSettingsFile, UNREADABLE_JSON, JSON_CODEC, indentAt, TEXT_CODEC, RACED;
+var import_web396, CONFIG_SCHEMA, CONFIG_FILE, NPM_PACKAGE_NAMES, COMMAND_PACKAGE, NPX_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, OLD_MCP_SERVER_NAMES, P03_BINDING, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC, HOME_FOLDER, OLDER_HOME_FOLDER, defaultHomeWords, configPath, homeWalletPath, invalid, isPubkey, MAX_OWN_ADDRESSES, isOwnAddressText, salvagePath, clearConfigSalvage, HOST_TARGETS, HOST_NAMES, hostServersKey, hostEntry, CODEX_STARTUP_TIMEOUT_SEC, CODEX_TOOL_TIMEOUT_SEC, PINNED_PACKAGE, LAUNCHER_PACKAGE, NPM_VERSION, knownNpmVersion, RECOVERY_WORDS, NPX_WALLET_LINE, RELEASES_URL, npmStartEnvironment, NPM_START_KEYS, defaultWalletHome, CMD_UNSAFE, programOf, claudeLineDiffers, WINDOWS_SHELL_CODE, CONTINUE_HEADER, tomlString, tomlKey, codexEntryOf, isPlainObject, sameJson, claudeCodeEntry, READ_ONLY_TOOL_NAMES, claudeCodeAllowRules, claudeCodeSettingsFile, UNREADABLE_JSON, JSON_CODEC, indentAt, TEXT_CODEC, RACED;
 var init_config = __esm({
   "wallet/src/setup/config.mjs"() {
     "use strict";
@@ -54944,6 +55157,7 @@ var init_config = __esm({
     import_web396 = __toESM(require_index_cjs(), 1);
     init_rpcDefault();
     init_processLock();
+    init_userPath();
     CONFIG_SCHEMA = "shinjuku-shielded/config/v1";
     CONFIG_FILE = "config.json";
     NPM_PACKAGE_NAMES = Object.freeze(["shinjuku-shield", "shinjuku-shielded"]);
@@ -54981,9 +55195,9 @@ var init_config = __esm({
     POSITIVE_ATOMIC = /^[1-9][0-9]{0,30}$/;
     HOME_FOLDER = ".shinjuku-shield";
     OLDER_HOME_FOLDER = ".carbon-shielded-wallet";
-    defaultHomeWords = (home = homedir()) => `~/${setupHome({}, home) === join8(home, HOME_FOLDER) ? HOME_FOLDER : OLDER_HOME_FOLDER}`;
-    configPath = (home) => join8(home, CONFIG_FILE);
-    homeWalletPath = (home, pool2) => join8(home, pool2, "wallet.json");
+    defaultHomeWords = (home = homedir()) => `~/${setupHome({}, home) === join9(home, HOME_FOLDER) ? HOME_FOLDER : OLDER_HOME_FOLDER}`;
+    configPath = (home) => join9(home, CONFIG_FILE);
+    homeWalletPath = (home, pool2) => join9(home, pool2, "wallet.json");
     invalid = (why) => new Error(`setup_config_invalid: config.json ${why}; rerun shinjuku setup (it keeps the wallet) or fix the file`);
     isPubkey = (value2) => {
       try {
@@ -54994,7 +55208,7 @@ var init_config = __esm({
     };
     MAX_OWN_ADDRESSES = 8;
     isOwnAddressText = (value2) => isPubkey(value2);
-    salvagePath = (home) => join8(home, "config.salvage.json");
+    salvagePath = (home) => join9(home, "config.salvage.json");
     clearConfigSalvage = (home) => rmSync(salvagePath(home), { force: true });
     HOST_TARGETS = Object.freeze(["claude-code", "claude-desktop", "cursor", "codex", "vscode", "devin", "cline", "continue", "gemini", "antigravity"]);
     HOST_NAMES = Object.freeze({
@@ -55023,6 +55237,9 @@ var init_config = __esm({
     npmStartEnvironment = (tor) => tor ? { npm_config_offline: "true" } : { npm_config_prefer_offline: "true" };
     NPM_START_KEYS = ["npm_config_offline", "npm_config_prefer_offline"];
     defaultWalletHome = (home = homedir()) => setupHome({}, home);
+    CMD_UNSAFE = /[%"\r\n]/;
+    programOf = (options) => "claudeProgram" in options ? options.claudeProgram : claudeCodeProgram(options);
+    claudeLineDiffers = (options) => claudeProgramWord(programOf(options), "win32", "cmd") !== claudeProgramWord(programOf(options), "win32", "powershell");
     WINDOWS_SHELL_CODE = /[%$`"\r\n]/;
     CONTINUE_HEADER = Object.freeze(["name: Shinjuku Shield", "version: 0.0.1", "schema: v1", "mcpServers:"]);
     tomlString = (value2) => `"${String(value2).replace(/[\\"]/g, (c) => `\\${c}`).replace(/[\u0000-\u001f\u007f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`)}"`;
@@ -55047,7 +55264,7 @@ var init_config = __esm({
       "inference_models"
     ]);
     claudeCodeAllowRules = () => READ_ONLY_TOOL_NAMES.map((name) => `mcp__${MCP_SERVER_NAME}__${name}`);
-    claudeCodeSettingsFile = ({ env = process.env, home = homedir() } = {}) => join8(env.CLAUDE_CONFIG_DIR || join8(home, ".claude"), "settings.json");
+    claudeCodeSettingsFile = ({ env = process.env, home = homedir() } = {}) => join9(env.CLAUDE_CONFIG_DIR || join9(home, ".claude"), "settings.json");
     UNREADABLE_JSON = "setup_host_config_unreadable: the host's config file is not a JSON object, so setup left it alone; add the printed entry by hand";
     JSON_CODEC = Object.freeze({
       empty: () => ({}),
@@ -55085,7 +55302,7 @@ var init_config = __esm({
 
 // wallet/src/setup/channel.mjs
 import { createPublicKey as createPublicKey2, randomBytes as randomBytes8, verify } from "node:crypto";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function canonicalJson(value2) {
   if (value2 === null || typeof value2 !== "object") {
     if (typeof value2 === "number" && !Number.isFinite(value2)) throw fail7("wallet_channel_invalid", "the channel body holds a number JSON cannot carry");
@@ -55170,7 +55387,7 @@ function verifyChannelDocument(document2, { publicKeyHex = CHANNEL_PUBLIC_KEY_HE
   return checkBody(document2.body);
 }
 function readSeq(home) {
-  const path = join9(home, CHANNEL_SEQ_FILE);
+  const path = join10(home, CHANNEL_SEQ_FILE);
   if (!existsSync(path)) return -1;
   let value2;
   try {
@@ -55198,9 +55415,9 @@ function acceptSeq(home, body, documentBytes) {
     throw fail7("wallet_channel_rollback", `Shinjuku serves channel ${body.seq}, older than channel ${seen} this wallet already saw; nothing was installed and the old setup files stay`);
   }
   mkdirSync(home, { recursive: true, mode: 448 });
-  if (body.seq > seen) writeAtomic(join9(home, CHANNEL_SEQ_FILE), `${JSON.stringify({ seq: body.seq })}
+  if (body.seq > seen) writeAtomic(join10(home, CHANNEL_SEQ_FILE), `${JSON.stringify({ seq: body.seq })}
 `);
-  if (documentBytes) writeAtomic(join9(home, CHANNEL_FILE), documentBytes);
+  if (documentBytes) writeAtomic(join10(home, CHANNEL_FILE), documentBytes);
 }
 function onChannelRegistered(listener) {
   registrationListeners.add(listener);
@@ -55275,7 +55492,7 @@ function applyStoredChannel({ home, publicKeyHex = CHANNEL_PUBLIC_KEY_HEX }) {
   } catch {
     return void 0;
   }
-  const path = join9(home, CHANNEL_FILE);
+  const path = join10(home, CHANNEL_FILE);
   if (!existsSync(path)) return void 0;
   let document2;
   try {
@@ -61655,16 +61872,16 @@ var init_incremental = __esm({
 // wallet/src/history/walletHistory.mjs
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import { createHmac as createHmac5 } from "node:crypto";
-import { dirname as dirname8, join as join10, resolve as resolve7 } from "node:path";
+import { dirname as dirname8, join as join11, resolve as resolve7 } from "node:path";
 function walletHistoryCache(store) {
-  return createHistoryCacheStore({ path: join10(dirname8(store.path), "history-cache.json"), hmacKey: historyCacheKey(store) });
+  return createHistoryCacheStore({ path: join11(dirname8(store.path), "history-cache.json"), hmacKey: historyCacheKey(store) });
 }
 function walletSuccessorHistoryCache(store, pool2) {
   if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(String(pool2))) throw new Error("wallet_succession_chain_invalid");
-  return createHistoryCacheStore({ path: join10(dirname8(store.path), `history-cache-successor-${pool2}.json`), hmacKey: historyCacheKey(store) });
+  return createHistoryCacheStore({ path: join11(dirname8(store.path), `history-cache-successor-${pool2}.json`), hmacKey: historyCacheKey(store) });
 }
 function walletCompactHistoryCache(store) {
-  return createCompactHistoryCacheStore({ path: join10(dirname8(store.path), "history-compact-cache.json"), hmacKey: historyCacheKey(store) });
+  return createCompactHistoryCacheStore({ path: join11(dirname8(store.path), "history-compact-cache.json"), hmacKey: historyCacheKey(store) });
 }
 async function loadWalletP03History(args) {
   const runKey = lastRunReportKey(args.store, args.programId, args.pool, args.deploymentIdentity, args.cache);
@@ -63210,7 +63427,7 @@ var init_production_proof_bundle = __esm({
 // wallet/src/prove/recoveredPayment.mjs
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash15 } from "node:crypto";
-import { dirname as dirname10, isAbsolute as isAbsolute4, join as join11, relative as relative4, resolve as resolve10 } from "node:path";
+import { dirname as dirname10, isAbsolute as isAbsolute4, join as join12, relative as relative4, resolve as resolve10 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 function fail9(reason) {
   throw new Error(`p03_recovered_payment_${reason}`);
@@ -63597,7 +63814,7 @@ async function proveRecoveredP03Payment({ request, tools, onMemoBundle }) {
   const bundle = loadBundle(tools);
   markPhase("bundle");
   const started = await takeEarlyTools(tools);
-  const scratch = started?.scratch ?? mkdtempSync(join11(tmpdir2(), "sx402-wallet-payment-"));
+  const scratch = started?.scratch ?? mkdtempSync(join12(tmpdir2(), "sx402-wallet-payment-"));
   try {
     const { vectors, primaryProofs } = scratchDirectories(scratch);
     if (!started) {
@@ -63653,7 +63870,7 @@ async function proveRecoveredP03Payment({ request, tools, onMemoBundle }) {
     } catch {
     }
     markPhase("payment-prover", Number.isSafeInteger(ownMs) && ownMs >= 0 ? `proof_ms${ownMs}` : void 0);
-    const primary = JSON.parse(readFileSync(join11(primaryProofs, "shielded-exact-v2.json"), "utf8"));
+    const primary = JSON.parse(readFileSync(join12(primaryProofs, "shielded-exact-v2.json"), "utf8"));
     if (JSON.stringify(primary.publicInputBytesHex) !== JSON.stringify(output2.primaryWitness.publicInputBytesHex)) {
       fail9("proof_public_inputs_mismatch");
     }
@@ -63689,7 +63906,7 @@ function startRecoveredPaymentTools(tools, { maxAgeMs = EARLY_TOOLS_MAX_AGE_MS }
 }
 async function launchEarlyTools(tools) {
   const bundle = loadBundle(tools);
-  const scratch = mkdtempSync(join11(tmpdir2(), "sx402-wallet-payment-"));
+  const scratch = mkdtempSync(join12(tmpdir2(), "sx402-wallet-payment-"));
   const runs = [];
   const stop3 = async () => {
     for (const run2 of runs) run2.send("");
@@ -63744,10 +63961,10 @@ async function proveP03Vector({ tools, relation, vector }) {
   const [toolName, outputName] = RELATION_PROVERS[relation] ?? fail9("relation_invalid");
   const tool = tools[toolName] ?? fail9(`${toolName}_missing`);
   const bundle = loadBundle(tools);
-  const scratch = mkdtempSync(join11(tmpdir2(), "sx402-wallet-vector-"));
+  const scratch = mkdtempSync(join12(tmpdir2(), "sx402-wallet-vector-"));
   try {
-    const vectorPath = join11(scratch, "vector.json");
-    const proofs = join11(scratch, "proof");
+    const vectorPath = join12(scratch, "vector.json");
+    const proofs = join12(scratch, "proof");
     mkdirSync(proofs, { mode: 448 });
     writeFileSync(vectorPath, jsonBytes(vector), { mode: 384 });
     try {
@@ -63760,7 +63977,7 @@ async function proveP03Vector({ tools, relation, vector }) {
     } catch (error) {
       throw new Error(`p03_recovered_payment_${relation.replaceAll("-", "_")}_prover_failed`, { cause: error });
     }
-    const proof = JSON.parse(readFileSync(join11(proofs, outputName), "utf8"));
+    const proof = JSON.parse(readFileSync(join12(proofs, outputName), "utf8"));
     return Object.freeze({ proofBytesHex: proof.proofBytesHex, publicInputBytesHex: proof.publicInputBytesHex });
   } finally {
     removeScratch(scratch);
@@ -63789,9 +64006,9 @@ var init_recoveredPayment = __esm({
 ${stamp}`;
     bundleStamps = (files) => files.map((file) => fileStamp(file)).join("\n");
     OPTIONAL_TOOL_KEYS = /* @__PURE__ */ new Set(["depositProver", "solanaCli", "moveWitness", "moveProver"]);
-    scratchDirectories = (scratch) => ({ vectors: join11(scratch, "vectors"), primaryProofs: join11(scratch, "payment-proof") });
+    scratchDirectories = (scratch) => ({ vectors: join12(scratch, "vectors"), primaryProofs: join12(scratch, "payment-proof") });
     paymentProverEnvironment = (bundle, vectors, primaryProofs) => ({
-      SHIELDED_X402_VECTOR_PATH: join11(vectors, "shielded-exact-v2.json"),
+      SHIELDED_X402_VECTOR_PATH: join12(vectors, "shielded-exact-v2.json"),
       SHIELDED_X402_PRODUCTION_PROOF_DIR: primaryProofs,
       SHIELDED_X402_PARAMETER_MANIFEST_SHA256: bundle.manifestSha256,
       SHIELDED_X402_PARAMETER_PATH: bundle.relations["shielded-exact-v2"].parameterPath
@@ -65945,10 +66162,10 @@ var init_deposit = __esm({
 
 // wallet/src/store/sealedCache.mjs
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHmac as createHmac7, randomBytes as randomBytes11 } from "node:crypto";
-import { dirname as dirname12, join as join12 } from "node:path";
+import { dirname as dirname12, join as join13 } from "node:path";
 function sealedCacheFile(store, { file, schema, keyLabel }) {
   if (typeof store?.path !== "string" || !/^[0-9a-f]{64}$/i.test(store?.state?.seedHex ?? "")) return void 0;
-  const path = join12(dirname12(store.path), file);
+  const path = join13(dirname12(store.path), file);
   const key = createHmac7("sha256", Buffer.from(store.state.seedHex, "hex")).update(keyLabel).digest();
   const aad = Buffer.from(schema, "utf8");
   return Object.freeze({
@@ -66570,14 +66787,14 @@ var init_successorHistories = __esm({
 
 // wallet/src/recovery/recover.mjs
 import { createHash as createHash16 } from "node:crypto";
-import { join as join13, resolve as resolve11 } from "node:path";
+import { join as join14, resolve as resolve11 } from "node:path";
 import { performance as performance4 } from "node:perf_hooks";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function pinnedGenerator2(profileVector) {
   if (profileVector?.payerKeys?.generator) return profileVector.payerKeys.generator;
   if (!committedGenerator) {
     const committed2 = JSON.parse(readFileSync(
-      join13(MODEL_DIR, "vectors", "rust-vectors.json"),
+      join14(MODEL_DIR, "vectors", "rust-vectors.json"),
       "utf8"
     ));
     committedGenerator = Object.freeze(committed2.payerKeys.generator);
@@ -75621,7 +75838,7 @@ var init_production_proof_bundle2 = __esm({
 // spikes/shielded-x402-wallet/lib/p03-recovered-exit.mjs
 import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash18 } from "node:crypto";
-import { dirname as dirname14, isAbsolute as isAbsolute6, join as join14, relative as relative6, resolve as resolve14 } from "node:path";
+import { dirname as dirname14, isAbsolute as isAbsolute6, join as join15, relative as relative6, resolve as resolve14 } from "node:path";
 import { tmpdir as tmpdir3 } from "node:os";
 function fail15(reason) {
   throw new Error(`p03_recovered_exit_${reason}`);
@@ -75909,11 +76126,11 @@ function proveRecoveredP03Exit({ request, tools }) {
   return proveLoadedExit({ request, tools, kind, primaryProver, bundle });
 }
 async function proveLoadedExit({ request, tools, kind, primaryProver, bundle }) {
-  const scratch = mkdtempSync(join14(tmpdir3(), kind.scratchPrefix));
+  const scratch = mkdtempSync(join15(tmpdir3(), kind.scratchPrefix));
   try {
-    const vectors = join14(scratch, "vectors");
-    const primaryProofs = join14(scratch, "primary-proof");
-    const appendProofs = join14(scratch, "append-proof");
+    const vectors = join15(scratch, "vectors");
+    const primaryProofs = join15(scratch, "primary-proof");
+    const appendProofs = join15(scratch, "append-proof");
     mkdirSync(vectors, { recursive: true, mode: 448 });
     mkdirSync(primaryProofs, { recursive: true, mode: 448 });
     mkdirSync(appendProofs, { recursive: true, mode: 448 });
@@ -75931,10 +76148,10 @@ async function proveLoadedExit({ request, tools, kind, primaryProver, bundle })
     if (output2?.schema !== "carbon-shielded-x402/p03-recovered-exit-witness/v1" || output2.relation !== request.exitKind || output2.ownerRole !== kind.ownerRole) {
       fail15("witness_output_invalid");
     }
-    const primaryVector = join14(vectors, kind.vectorName);
+    const primaryVector = join15(vectors, kind.vectorName);
     const appendVector = oneItemAppendVector(
-      join14(vectors, "tree-append-v1.json"),
-      join14(vectors, "tree-append-sequence.json")
+      join15(vectors, "tree-append-v1.json"),
+      join15(vectors, "tree-append-sequence.json")
     );
     try {
       await runTool2(primaryProver, [kind.command], {
@@ -75956,8 +76173,8 @@ async function proveLoadedExit({ request, tools, kind, primaryProver, bundle })
     } catch (error) {
       throw new Error("p03_recovered_exit_append_prover_phase_failed", { cause: error });
     }
-    const primary = JSON.parse(readFileSync(join14(primaryProofs, kind.proofName), "utf8"));
-    const append = JSON.parse(readFileSync(join14(appendProofs, "tree-append-v1-deposit.json"), "utf8"));
+    const primary = JSON.parse(readFileSync(join15(primaryProofs, kind.proofName), "utf8"));
+    const append = JSON.parse(readFileSync(join15(appendProofs, "tree-append-v1-deposit.json"), "utf8"));
     if (JSON.stringify(primary.publicInputBytesHex) !== JSON.stringify(output2.primaryWitness.publicInputBytesHex) || JSON.stringify(append.publicInputBytesHex) !== JSON.stringify(output2.treeAppendWitness.publicInputBytesHex)) {
       fail15("proof_public_inputs_mismatch");
     }
@@ -76018,13 +76235,13 @@ var init_p03_recovered_exit = __esm({
 
 // spikes/shielded-x402-wallet/bin/shielded-wallet.mjs
 import { createHash as createHash19 } from "node:crypto";
-import { join as join15, resolve as resolve15 } from "node:path";
+import { join as join16, resolve as resolve15 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function walletHome() {
   return setupHome(process.env);
 }
 function walletPath(pool2) {
-  return join15(walletHome(), pool2, "wallet.json");
+  return join16(walletHome(), pool2, "wallet.json");
 }
 function initialWalletState({ pool: pool2, network, asset, decimals, binding, config, keys: keys3, memoStart }) {
   const seedHex = keys3?.seedHex ?? Buffer.from(generateSeed()).toString("hex");
@@ -76082,16 +76299,16 @@ function readCallerJson(path, code2) {
 }
 function loadProfileDirectory(profileDir) {
   const directory = resolve15(profileDir);
-  const profile = readCallerJson(join15(directory, "profile.json"), "profile_json_invalid");
-  const vector = readCallerJson(join15(directory, "rust-vectors.json"), "profile_vectors_json_invalid");
+  const profile = readCallerJson(join16(directory, "profile.json"), "profile_json_invalid");
+  const vector = readCallerJson(join16(directory, "rust-vectors.json"), "profile_vectors_json_invalid");
   const production = profile.schema === "carbon-shielded-exact/svm-mainnet-bounded-alpha-profile/v4";
-  const artifactDir = join15(directory, production ? "proofs" : "artifacts");
+  const artifactDir = join16(directory, production ? "proofs" : "artifacts");
   return { directory, profile, vector, production, artifactDir };
 }
 function pinnedGenerator3(profileVector) {
   if (profileVector?.payerKeys?.generator) return profileVector.payerKeys.generator;
   const committed2 = JSON.parse(readFileSync(
-    join15(MODEL_DIR2, "vectors", "rust-vectors.json"),
+    join16(MODEL_DIR2, "vectors", "rust-vectors.json"),
     "utf8"
   ));
   return committed2.payerKeys.generator;
@@ -76251,7 +76468,7 @@ function proveFromProfile({ binding, profileDir }) {
   const proved = provePayment({
     binding,
     modelDir: MODEL_DIR2,
-    vectorPath: join15(resolve15(profileDir), "rust-vectors.json"),
+    vectorPath: join16(resolve15(profileDir), "rust-vectors.json"),
     artifactDir,
     production: production ? {
       parameterPathByRelation: profile.parameterBundle?.parameterPathByRelation,
@@ -77549,7 +77766,7 @@ async function main(argv2 = process.argv.slice(2)) {
     case "backup-verify": {
       const pool2 = flag(args, "--pool") ?? requiredPoolFromHome();
       const backupDir = flag(args, "--backup-dir");
-      const path = backupDir ? join15(backupDir, "wallet.json") : walletPath(pool2);
+      const path = backupDir ? join16(backupDir, "wallet.json") : walletPath(pool2);
       const store = openWalletStore(path, passphrase());
       if (store.state.pool !== pool2) throw new Error("backup-verify pool does not match wallet");
       const bundle = backupDir ? verifyWalletRecoveryBundle(backupDir, passphrase()) : void 0;
@@ -77715,7 +77932,7 @@ async function runValueMove(command, args) {
   const vault = vaultAddress(programId, pool2, mint);
   const poolState2 = await readPoolState(connection, pool2);
   if (!poolState2) throw new Error("pool account not found");
-  const readProof = (name) => JSON.parse(readFileSync(join15(artifactDir, name), "utf8"));
+  const readProof = (name) => JSON.parse(readFileSync(join16(artifactDir, name), "utf8"));
   if (command === "deposit") {
     const proofName = production ? "deposit-v1.json" : "UNSAFE_TEST_ONLY-deposit-v1-proof.json";
     const appendName2 = production ? "tree-append-v1-deposit.json" : "UNSAFE_TEST_ONLY-tree-append-v1-deposit-proof.json";
@@ -78103,153 +78320,6 @@ var init_secretFile = __esm({
   }
 });
 
-// wallet/src/setup/userPath.mjs
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { basename as basename3, join as join16 } from "node:path";
-function commandFolder({ env = process.env, platform = process.platform } = {}) {
-  const prefix = env.npm_config_global_prefix || env.npm_config_prefix;
-  if (platform === "win32") return prefix || (env.APPDATA ? join16(env.APPDATA, "npm") : void 0);
-  return prefix ? `${String(prefix).replace(/\/+$/, "")}/bin` : void 0;
-}
-function commandFileIn(folder, platform = process.platform) {
-  if (!folder) return void 0;
-  const file = join16(folder, platform === "win32" ? `${COMMAND_PACKAGE}.cmd` : COMMAND_PACKAGE);
-  try {
-    if (!statSync(file).isFile()) return void 0;
-    if (platform !== "win32") accessSync(file, constants.X_OK);
-    return file;
-  } catch {
-    return void 0;
-  }
-}
-function shellPathEntries({ env = process.env, platform = process.platform } = {}) {
-  const pathValue = env.PATH ?? env.Path ?? env.path ?? "";
-  const entries = String(pathValue).split(platform === "win32" ? ";" : ":");
-  let last = -1;
-  entries.forEach((each, index) => {
-    if (/[\\/]node-gyp-bin[\\/]*$/i.test(each.trim())) last = index;
-  });
-  return entries.slice(last + 1);
-}
-function folderOnPath(folder, { env = process.env, platform = process.platform } = {}) {
-  const key = folderKey(folder, platform);
-  return shellPathEntries({ env, platform }).some((each) => each.trim() && folderKey(each, platform) === key);
-}
-function addFolderToUserPath(folder, { run: run2 = spawnSync2, env = process.env } = {}) {
-  let result;
-  try {
-    result = run2(
-      "powershell.exe",
-      [
-        "-NoProfile",
-        "-NonInteractive",
-        "-ExecutionPolicy",
-        "Bypass",
-        "-EncodedCommand",
-        Buffer.from(ADD_SCRIPT, "utf16le").toString("base64")
-      ],
-      { windowsHide: true, encoding: "utf8", timeout: 6e4, env: { ...env, SHINJUKU_PATH_FOLDER: folder } }
-    );
-  } catch {
-    return { state: "failed", reason: "Windows PowerShell did not start" };
-  }
-  const line = String(result?.stdout ?? "").trim().split(/\r?\n/).reverse().find((each) => each.startsWith("{"));
-  try {
-    const answer = JSON.parse(line ?? "");
-    if (["present", "added", "failed"].includes(answer?.state)) return answer;
-  } catch {
-  }
-  return { state: "failed", reason: "Windows PowerShell gave no answer" };
-}
-function shellProfileLine(folder, { env = process.env, platform = process.platform } = {}) {
-  const shell = basename3(String(env.SHELL ?? ""));
-  if (shell === "fish") return { file: "~/.config/fish/config.fish", line: `fish_add_path '${String(folder).replace(/[\\']/g, "\\$&")}'` };
-  const file = shell === "zsh" ? "~/.zshrc" : shell === "bash" ? platform === "darwin" ? "~/.bash_profile" : "~/.bashrc" : "~/.profile";
-  return { file, line: `export PATH='${String(folder).replace(/'/g, "'\\''")}':"$PATH"` };
-}
-function commandPathStep({ env = process.env, platform = process.platform, run: run2 = spawnSync2 } = {}) {
-  const folder = commandFolder({ env, platform });
-  if (!commandFileIn(folder, platform)) return { state: "no-command", folder };
-  if (platform !== "win32") {
-    return folderOnPath(folder, { env, platform }) ? { state: "on-path", folder } : { state: "profile", folder, ...shellProfileLine(folder, { env, platform }) };
-  }
-  return { folder, ...addFolderToUserPath(folder, { run: run2, env }), thisWindow: folderOnPath(folder, { env, platform }) };
-}
-function pathStepSays(step) {
-  return ["added", "failed", "profile"].includes(step?.state) || step?.state === "present" && step.thisWindow === false;
-}
-function commandPathLines(step, hereLine) {
-  const here3 = ["In this window, type the longer command, for example:", `  ${hereLine}`];
-  if (step?.state === "added") {
-    return [step.broadcast === false ? "Added Shinjuku to your PATH. Sign out of Windows and in again, then type shinjuku in a new window." : "Added Shinjuku to your PATH. Open a new window to type shinjuku.", ...here3];
-  }
-  if (step?.state === "present") return ["Shinjuku is on your PATH. Open a new window to type shinjuku.", ...here3];
-  if (step?.state === "failed") {
-    return [
-      `Setup could not add Shinjuku to your PATH (${step.reason}). To add it yourself: open Start, type environment variables, open "Edit environment variables for your account", pick Path, choose Edit, then New, and paste this folder:`,
-      `  ${step.folder}`,
-      "Then open a new window to type shinjuku.",
-      ...here3
-    ];
-  }
-  if (step?.state === "profile") {
-    return [
-      `Your terminal does not look in the folder where npm put the shinjuku command. Add this line to the end of ${step.file}, then open a new terminal to type shinjuku:`,
-      `  ${step.line}`,
-      ...here3
-    ];
-  }
-  return [];
-}
-var folderKey, ADD_SCRIPT;
-var init_userPath = __esm({
-  "wallet/src/setup/userPath.mjs"() {
-    "use strict";
-    init_fs();
-    init_config();
-    folderKey = (folder, platform) => {
-      const key = String(folder).trim().replace(/^"(.*)"$/, "$1").replace(/[\\/]+$/, "");
-      return platform === "win32" || platform === "darwin" ? key.toLowerCase() : key;
-    };
-    ADD_SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-$ProgressPreference = 'SilentlyContinue'
-$folder = $env:SHINJUKU_PATH_FOLDER
-function Key([string]$p) { ([Environment]::ExpandEnvironmentVariables($p.Trim().Trim('"'))).TrimEnd('\', '/').ToLowerInvariant() }
-try {
-  $raw = [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames
-  $want = Key $folder
-  $machineKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SYSTEM\CurrentControlSet\Control\Session Manager\Environment')
-  $machine = if ($machineKey) { [string]$machineKey.GetValue('Path', '', $raw) } else { '' }
-  $key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
-  $user = $key.GetValue('Path', $null, $raw)
-  $kind = if ($null -ne $user) { $key.GetValueKind('Path') } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }
-  $entries = @(([string]$user).Split(';')) + @($machine.Split(';'))
-  if (@($entries | Where-Object { $_.Trim() -and (Key $_) -eq $want }).Count -gt 0) {
-    '{"state":"present"}'; exit 0
-  }
-  if ($kind -ne [Microsoft.Win32.RegistryValueKind]::ExpandString -and $kind -ne [Microsoft.Win32.RegistryValueKind]::String) {
-    '{"state":"failed","reason":"your PATH setting has a type setup does not change"}'; exit 0
-  }
-  $old = [string]$user
-  $new = if ($old -eq '') { $folder } elseif ($old.EndsWith(';')) { $old + $folder } else { $old + ';' + $folder }
-  if ($new.Length -ge 32767) { '{"state":"failed","reason":"your PATH setting is full"}'; exit 0 }
-  $key.SetValue('Path', $new, $kind)
-  if ([string]$key.GetValue('Path', '', $raw) -ne $new) { '{"state":"failed","reason":"the new PATH did not read back"}'; exit 0 }
-  $broadcast = $false
-  try {
-    Add-Type -Namespace ShinjukuPath -Name Native -MemberDefinition '[DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)] public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);'
-    $result = [UIntPtr]::Zero
-    $broadcast = [ShinjukuPath.Native]::SendMessageTimeout([IntPtr]0xffff, 0x1A, [UIntPtr]::Zero, 'Environment', 2, 5000, [ref]$result) -ne [IntPtr]::Zero
-  } catch { $broadcast = $false }
-  '{"state":"added","kind":"' + $kind + '","broadcast":' + $(if ($broadcast) { 'true' } else { 'false' }) + '}'
-} catch {
-  '{"state":"failed","reason":"Windows did not let setup change your PATH setting"}'
-}
-`;
-  }
-});
-
 // wallet/src/cli/commandName.mjs
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { basename as basename4, dirname as dirname15, join as join17 } from "node:path";
@@ -142299,7 +142369,7 @@ var init_tools = __esm({
       "--max-shield / --max-unshield": "shield and unshield limits"
     };
     capName = (flag3) => CAP_NAMES[flag3] ?? "spending limit";
-    entryPlaces = (change) => `Where the entry is: Claude Desktop: claude_desktop_config.json; Cursor: ~/.cursor/mcp.json; Claude Code: claude mcp get ${MCP_SERVER_NAME} shows the entry (an entry added by hand can have another name: claude mcp list shows it), then claude mcp remove ${MCP_SERVER_NAME} and claude mcp add it again ${change}; Hermes: config.yaml.`;
+    entryPlaces = (change) => `Where the entry is: Claude Desktop: claude_desktop_config.json (Settings > Developer > Edit Config opens it); Cursor: ~/.cursor/mcp.json; Claude Code: claude mcp get ${MCP_SERVER_NAME} shows the entry (an entry added by hand can have another name: claude mcp list shows it), then claude mcp remove ${MCP_SERVER_NAME} and claude mcp add it again ${change}; Hermes: config.yaml.`;
     capRaiseText = (flag3) => {
       if (capFlagFromLaunchLine(flag3)) {
         const both = flag3 === "--max-payment" ? " (raise the 24-hour payment limit there too when it is below the new amount: the wallet does not start with it lower)" : "";
@@ -156835,7 +156905,13 @@ function claudeCodeState(env, home) {
 }
 function agentHostsOf(env, home) {
   const jsonHost = (target) => {
-    const config = readJsonFile(hostConfigFile(target, { env, home: homedir3() }));
+    let file;
+    try {
+      file = hostConfigFile(target, { env, home: homedir3() });
+    } catch {
+      return null;
+    }
+    const config = readJsonFile(file);
     return config === void 0 ? false : config === null ? null : runsThisWallet(config[hostServersKey(target)], home);
   };
   const continueHost = () => {
@@ -159631,7 +159707,7 @@ function agentAppLines({ skip = /* @__PURE__ */ new Set() }) {
 function hostLines(targets) {
   const commands = targets.map((target) => `${setupCli2()} setup --add-to ${target}`);
   const width = Math.max(...commands.map((command) => command.length));
-  const label = { codex: "Codex (the Codex app or Codex CLI)", devin: "Devin Desktop (the app that was Windsurf)", vscode: "VS Code (GitHub Copilot)" };
+  const label = { codex: "Codex (the ChatGPT desktop app's Codex side, or Codex CLI)", devin: "Devin Desktop (the app that was Windsurf)", vscode: "VS Code (GitHub Copilot)" };
   return targets.map((target, index) => `  ${commands[index].padEnd(width)}   ${label[target] ?? HOST_NAMES[target]}`);
 }
 function setupNextText({ home, deps, npmVersion, config, fundAsked, rerun, targets = [], added = /* @__PURE__ */ new Set() }) {
@@ -160056,7 +160132,33 @@ function claudeCodeEntryOf(deps) {
     return void 0;
   }
 }
+function runClaude(args, program = "claude", stdio = "inherit") {
+  const options = { stdio, windowsHide: true, timeout: 12e4 };
+  const programWord = program === "claude" ? program : `"${program}"`;
+  const result = process.platform === "win32" && !/\.exe$/i.test(program) ? spawnSync10([programWord, ...args.map((word) => hostShellWord(word, "win32"))].join(" "), { ...options, shell: true }) : spawnSync10(program, args, options);
+  return result.status ?? 1;
+}
+function claudeRemoveLines(program, platform) {
+  const tail = `mcp remove --scope user ${MCP_SERVER_NAME}`;
+  const shells = platform === "win32" ? ["powershell", "cmd", "bash"] : ["bash"];
+  const words2 = shells.map((shell) => claudeProgramWord(program, platform, shell));
+  if (new Set(words2).size === 1) return `  ${words2[0]} ${tail}`;
+  const names = { powershell: "PowerShell", cmd: "cmd", bash: "Git Bash" };
+  return shells.map((shell, index) => words2[index] === void 0 ? void 0 : `  In ${names[shell]}:
+    ${words2[index]} ${tail}`).filter((line) => line !== void 0).join("\n");
+}
 var RESTART_APP = (app) => `If ${app} is open now, quit it and start it again.`;
+function hostAddedNext(target, app, platform) {
+  const ask = 'then ask in plain words, for example "what is my Shinjuku balance".';
+  if (target === "claude-desktop") {
+    const quit = platform === "win32" ? "If Claude Desktop is open now, quit it: right-click its icon by the clock and choose Quit (closing its window does not quit it). Then open it again" : platform === "darwin" ? "If Claude Desktop is open now, quit it (Claude > Quit Claude, or Command+Q) and open it again" : `${RESTART_APP(app).slice(0, -1)}`;
+    return `${quit}. In a new chat, click + and choose Connectors to see Shinjuku there, ${ask}`;
+  }
+  if (target === "codex") {
+    return `If the ChatGPT desktop app or Codex CLI is open now, quit it and start it again. In the app, use its Codex side (ChatGPT's own chat cannot start a server on this computer). In Codex, type /mcp to see the wallet's tools, ${ask}`;
+  }
+  return RESTART_APP(app);
+}
 function allowWalletChecks(deps) {
   const file = claudeCodeSettingsFile({ env: deps.env, home: deps.homedir() });
   try {
@@ -160150,7 +160252,23 @@ async function addToHosts(targets, home, deps, { force = false, npmVersion, ask,
 `);
         continue;
       }
-      const quiet = deps.runClaudeCliQuiet ?? deps.runClaudeCli;
+      const claudeProgram = claudeCodeProgram({ env: deps.env ?? process.env, platform: options.platform, userHome: deps.homedir() });
+      const claudeOptions = { ...options, userHome: deps.homedir() };
+      if (claudeProgram === void 0) {
+        io.out(`Not added to Claude Code: its command, claude, is not on this computer's PATH and not in the folders where Claude Code's installers put it (${options.platform === "win32" ? "%USERPROFILE%\\.local\\bin, or npm's folder" : "~/.local/bin"}). If Claude Code is not installed, install it (https://code.claude.com/docs/en/setup), then do this step again. If it is in another folder, run this line in a window where claude works:
+  ${claudeCodeCommand({ ...claudeOptions, claudeProgram: "claude" })}
+`);
+        continue;
+      }
+      const runWhy = claudeProgramRunWhy(claudeProgram, options.platform);
+      if (runWhy) {
+        io.out(`Not added to Claude Code: ${runWhy}. Run this yourself:
+${claudeCodeLines({ ...claudeOptions, claudeProgram }).map((line) => `  ${line}`).join("\n")}
+`);
+        continue;
+      }
+      const quiet = (args) => (deps.runClaudeCliQuiet ?? deps.runClaudeCli)(args, claudeProgram);
+      const runClaudeCli = (args) => deps.runClaudeCli(args, claudeProgram);
       for (const old of OLD_MCP_SERVER_NAMES) {
         if (quiet(["mcp", "remove", "--scope", "user", old]) === 0) io.out(`Replaced the old ${old} entry in Claude Code.
 `);
@@ -160173,9 +160291,9 @@ async function addToHosts(targets, home, deps, { force = false, npmVersion, ask,
         continue;
       }
       const replacedOther = replace === true && quiet(["mcp", "remove", "--scope", "user", MCP_SERVER_NAME]) === 0;
-      let status = deps.runClaudeCli(claudeCodeArgs(options));
+      let status = runClaudeCli(claudeCodeArgs(options));
       const removed = olderOwn || replacedOther || status !== 0 && force && quiet(["mcp", "remove", "--scope", "user", MCP_SERVER_NAME]) === 0;
-      if (removed && status !== 0) status = deps.runClaudeCli(claudeCodeArgs(options));
+      if (removed && status !== 0) status = runClaudeCli(claudeCodeArgs(options));
       if (status === 0) done.add(target);
       const check = status === 0 ? await hostStartCheck("Claude Code", options, deps, { terminal: true, noTor }) : void 0;
       if (check && !check.ok) io.out(`${hostCheckWords("Claude Code", check)}
@@ -160183,15 +160301,23 @@ async function addToHosts(targets, home, deps, { force = false, npmVersion, ask,
       const homeNow = replacedOther ? ` Claude Code now uses the wallet in ${home}; the wallet in ${otherHome} is unchanged.` : "";
       io.out(status === 0 ? `${removed ? "Replaced the wallet in" : "Added the wallet to"} Claude Code, for all your folders.${homeNow} ${allowWalletChecks(deps).say} ${RESTART_APP("Claude Code")}
 ` : `Claude Code did not take the server; its message is above. Run this yourself:
-  ${claudeCodeCommand(options)}
+${claudeCodeLines({ ...claudeOptions, claudeProgram }).map((line) => `  ${line}`).join("\n")}
 ` + (removed ? `Setup removed the old ${MCP_SERVER_NAME} entry first, so Claude Code has none until that line runs.
 ` : `If it says the server already exists, remove that entry with this command, then run the line above:
-  claude mcp remove --scope user ${MCP_SERVER_NAME}
+${claudeRemoveLines(claudeProgram, options.platform)}
 `));
       continue;
     }
-    const file = hostConfigFile(target, { ...options, home: deps.homedir() });
     const app = HOST_NAMES[target];
+    let file;
+    try {
+      file = hostConfigFile(target, { ...options, home: deps.homedir() });
+    } catch (error) {
+      if (!String(error?.message).startsWith("setup_host_config_ambiguous:")) throw error;
+      io.out(`Not added to ${app}: this computer has more than one ${app} settings file (${error.files.join("; ")}), so the wallet did not pick one. In ${app}, Settings > Developer > Edit Config opens the file it reads: add the entry below to it by hand.
+`);
+      continue;
+    }
     const first = torOn ? await hostStartCheck(app, options, deps, { terminal: false, noTor }) : void 0;
     if (first && !first.ok) {
       io.out(`Not added to ${app}: ${hostCheckWords(app, first)}
@@ -160205,8 +160331,8 @@ async function addToHosts(targets, home, deps, { force = false, npmVersion, ask,
 `);
       const check = await hostStartCheck(app, options, deps, { terminal: false, noTor });
       if (check.path) added = { ...write(mcpServerEntry({ ...options, path: check.path }), false), changed: true };
-      io.out(!added.changed ? `${app} already has the wallet: ${file} (nothing changed).${check.ok ? ` ${app} starts it (checked).` : ""}
-` : `Added the wallet to ${app}: ${file}${added.backup ? ` (the old file was copied to ${added.backup}, readable by you alone)` : ""}.${check.ok ? ` ${app} starts it (checked).` : ""} ${RESTART_APP(target === "codex" ? "the Codex app or Codex CLI" : app)}${target === "codex" ? ` In Codex, type /mcp to see the wallet's tools, then ask in plain words, for example "what is my Shinjuku balance".` : ""}
+      io.out(!added.changed ? `${app} already has the wallet: ${file} (nothing changed).${check.ok ? ` ${app} starts it (checked).` : ""} If ${app} does not show the wallet yet: ${hostAddedNext(target, app, options.platform)}
+` : `Added the wallet to ${app}: ${file}${added.backup ? ` (the old file was copied to ${added.backup}, readable by you alone)` : ""}.${check.ok ? ` ${app} starts it (checked).` : ""} ${hostAddedNext(target, app, options.platform)}
 `);
       if (!check.ok) io.out(`${hostCheckWords(app, check)}
 `);
@@ -161593,7 +161719,7 @@ var COMMANDS = [
       "Your own --passphrase-file must be private: on Linux and macOS setup refuses a file that group or other may read or write, or that another user owns (setup_passphrase_file_insecure: chmod 600 <file>). On Windows setup cannot read the access list; it accepts the file with a warning.",
       `--add-to writes each app's own user file: vscode (VS Code with Copilot) mcp.json in VS Code's User folder, under "servers"; devin (Devin Desktop, the app that was Windsurf) mcp_config.json in AppData\\Roaming\\devin on Windows, else ~/.config/devin; cline ~/.cline/data/settings/cline_mcp_settings.json (or CLINE_MCP_SETTINGS_PATH, CLINE_DATA_DIR, CLINE_DIR); continue its own block file ~/.continue/mcpServers/shinjuku.yaml (or in CONTINUE_GLOBAL_DIR); gemini (Gemini CLI) ~/.gemini/settings.json (or in GEMINI_CLI_HOME); antigravity (Antigravity) ~/.gemini/config/mcp_config.json. Every other key and server in a file stays as it is.`,
       `--add-to for a JSON file (Claude Desktop, Cursor and the apps above): a host config whose server list is not a JSON object, or that has a different ${MCP_SERVER_NAME} entry (without --force), is left alone. Otherwise the old file is copied to <file>.bak-<time> (mode 0600 on Linux and macOS; on Windows the folder's access list) and the new file replaces it in one rename. An entry an older setup wrote (no version, another version, or an old package name, shinjuku or shinjuku-shielded; the same home) is replaced without --force, in a JSON host and in Claude Code. An entry under an old key (${OLD_MCP_SERVER_NAMES.join(" or ")}) is replaced by itself, in every host, so the host never starts two wallet servers. For Claude Code, a different ${MCP_SERVER_NAME} server (not an older entry of this wallet) needs --force.`,
-      `--add-to codex: the Codex app and Codex CLI read one file, config.toml in CODEX_HOME (else ~/.codex). Setup writes the [mcp_servers.${MCP_SERVER_NAME}] tables at its end with startup_timeout_sec = 120 (a first start downloads the wallet) and tool_timeout_sec = 300, and keeps every other line; the same rules as a JSON host (a different entry stays without --force; the old file is backed up first). Then type /mcp in Codex to see the tools.`,
+      `--add-to codex: the ChatGPT desktop app (its Codex side) and Codex CLI read one file, config.toml in CODEX_HOME (else ~/.codex). Setup writes the [mcp_servers.${MCP_SERVER_NAME}] tables at its end with startup_timeout_sec = 120 (a first start downloads the wallet) and tool_timeout_sec = 300, and keeps every other line; the same rules as a JSON host (a different entry stays without --force; the old file is backed up first). Then type /mcp in Codex to see the tools.`,
       "The proof programs run natively: Windows x64, Linux x64 and Linux arm64 each download their own set (no WSL). Setup downloads the programs first and starts each one once before it makes a key; when Windows app control or an antivirus blocks one, setup stops and says which. macOS and other systems: not supported yet; setup says so and creates nothing.",
       "Run it again at any time: it never changes an existing wallet, keeps the recorded caps unless you pass new ones, checks every setup file again, downloads what is missing or newer, and rewrites config.json.",
       `A wallet that ${SETUP_CLI_WORD} restore made and did not read back yet (the restore stopped): setup reads its money back from the chain in place of the add-money question, so setup finishes that restore.`,
@@ -165386,16 +165512,8 @@ function defaultDependencies() {
       });
     }),
     /** claude with no output on the terminal (setup's probe of an old entry, and its remove); the exit status. */
-    runClaudeCliQuiet: (args) => {
-      const windows = process.platform === "win32";
-      const result = windows ? spawnSync10(["claude", ...args].map((word) => hostShellWord(word, "win32")).join(" "), { stdio: "ignore", shell: true, windowsHide: true, timeout: 12e4 }) : spawnSync10("claude", args, { stdio: "ignore", windowsHide: true, timeout: 12e4 });
-      return result.status ?? 1;
-    },
-    runClaudeCli: (args) => {
-      const windows = process.platform === "win32";
-      const result = windows ? spawnSync10(["claude", ...args].map((word) => hostShellWord(word, "win32")).join(" "), { stdio: "inherit", shell: true, windowsHide: true, timeout: 12e4 }) : spawnSync10("claude", args, { stdio: "inherit", windowsHide: true, timeout: 12e4 });
-      return result.status ?? 1;
-    },
+    runClaudeCliQuiet: (args, program) => runClaude(args, program, "ignore"),
+    runClaudeCli: (args, program) => runClaude(args, program, "inherit"),
     /**
      * The --tor entry of this CLI: re-execute `args` behind Tor (proxy.mjs proves Tor first). `startedFile`
      * (torRunOf) reaches the Tor run in its environment, which proxy.mjs copies from this process at the spawn.