shinjuku-shielded 0.3.61 → 0.3.63

package/README.md

@@ -7,7 +7,7 @@ local MCP server (stdio) for your agent. Your keys never leave your machine.
 ## Set up
 
 ```sh
-npx -y shinjuku-shielded setup
+npx -y --no-audit --no-fund shinjuku-shielded setup
 ```
 
 Setup makes the wallet on this machine, a private passphrase file, and the
@@ -21,13 +21,13 @@ server to that host's config.
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku-shielded -- npx -y shinjuku-shielded mcp
+claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shielded mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "shinjuku-shielded", "mcp"] } } }
+{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shielded", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "fd8f40cfc0110953e30d8479bfe751545e04952df8faf03b634073d7fd308c78",
-  "bytes": 12166389,
-  "sourceCommit": "c40abda927c59b08675a7e8c6067ace24cf24e78",
+  "sha256": "f3c652001435e22d3e54232fe742166dd8dd5ae183b92c1a24274c7a52ed137c",
+  "bytes": 12174893,
+  "sourceCommit": "46ac2745bf8ffeabba0e0cfaf8d052b20d6313e4",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1282,5 +1282,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-22T06:27:33.519Z"
+  "publishedAt": "2026-10-22T08:20:53.830Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.61",
+  "version": "0.3.63",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "fd8f40cf",
-  "shinjukuSha256": "fd8f40cfc0110953e30d8479bfe751545e04952df8faf03b634073d7fd308c78",
+  "shinjukuRelease": "f3c65200",
+  "shinjukuSha256": "f3c652001435e22d3e54232fe742166dd8dd5ae183b92c1a24274c7a52ed137c",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -42754,6 +42754,7 @@ async function routeFacilitatorsOverOnion(argv2, {
           live: onions.length,
           spares,
           waitMs: routeWaitMs,
+          label: origin,
           onSpares: () => err(`tor: no onion of ${origin} has answered yet; its ${spares.length} spare onions ${spareHosts} join (Tor may still be fetching the onion addresses)
 `),
           onNone: () => err(`tor: no onion of ${origin} answered its start probe (${liveOnions(group).length} tried); its requests go to its onions in turn and wait for them (Tor may still be building circuits)
@@ -42774,7 +42775,7 @@ async function routeFacilitatorsOverOnion(argv2, {
     }
   }
   for (const [origin, onions] of Object.entries(PINNED_HISTORY_ONIONS)) {
-    const group = { onions, path: HISTORY_PROBE_PATH, onNone: () => err(`tor: no history-proxy onion answered its start probe (${onions.length} tried); the pool history reads go to the pinned onion ${new URL(onions[0]).host.slice(0, 8)}... and wait for it
+    const group = { onions, path: HISTORY_PROBE_PATH, label: "the history proxy", onNone: () => err(`tor: no history-proxy onion answered its start probe (${onions.length} tried); the pool history reads go to the pinned onion ${new URL(onions[0]).host.slice(0, 8)}... and wait for it
 `) };
     groups.set(onions.join(" "), group);
     routes.set(origin, group);
@@ -42783,6 +42784,33 @@ async function routeFacilitatorsOverOnion(argv2, {
   } };
   for (const [origin, group] of routes) routedOrigins.set(origin, group.onions);
   const aborts = [];
+  let stopped = false;
+  const race = (group, onions, options) => {
+    let unanswered2 = false;
+    const onNone = options.onNone;
+    const raced = raceOnions(onions, {
+      fetchImpl,
+      timeoutMs: raceTimeoutMs,
+      ...group.path ? { path: group.path } : {},
+      ...options,
+      onNone: () => {
+        unanswered2 = true;
+        onNone?.();
+      }
+    });
+    group.pending = raced.winner.then((onion) => {
+      group.winner = onion;
+      group.pending = void 0;
+      if (!unanswered2 && !raced.stopped) err(`tor: the onion ${hostOf(onion)} of ${group.label} answered first; it serves this run's requests to it
+`);
+      return onion;
+    });
+    aborts.push(() => {
+      raced.stopped = true;
+      raced.abort();
+    });
+    return raced;
+  };
   for (const group of groups.values()) {
     routedGroups.push(group);
     if (group.onions.length === 1) {
@@ -42791,24 +42819,33 @@ async function routeFacilitatorsOverOnion(argv2, {
       continue;
     }
     const spares = group.spares ?? [];
-    const race = raceOnions(liveOnions(group), {
-      fetchImpl,
-      timeoutMs: raceTimeoutMs,
-      ...group.path ? { path: group.path } : {},
+    group.startSpares = race(group, liveOnions(group), {
       ...group.onNone ? { onNone: group.onNone } : {},
       ...spares.length > 0 ? { spares, spareAfterMs, onSpares: () => {
         group.live = group.onions.length;
         group.onSpares?.();
       } } : {}
-    });
-    group.startSpares = race.startSpares;
-    group.pending = race.winner.then((onion) => {
-      group.winner = onion;
-      group.pending = void 0;
-      return onion;
-    });
-    aborts.push(race.abort);
-  }
+    }).startSpares;
+  }
+  const moveOn = (group, onion, why) => {
+    if (stopped || group.winner !== onion || group.pending) return;
+    group.moves = (group.moves ?? 0) + 1;
+    const max = group.onions.length;
+    if (group.moves > max) {
+      if (group.moves === max + 1) err(`tor: no onion of ${group.label} answered after ${max} moves; this run keeps ${hostOf(onion)} and retries there
+`);
+      return;
+    }
+    (group.down ??= /* @__PURE__ */ new Set()).add(onion);
+    const fresh = group.onions.filter((other) => !group.down.has(other));
+    const others = fresh.length > 0 ? fresh : group.onions.filter((other) => other !== onion);
+    group.live = group.onions.length;
+    group.winner = void 0;
+    err(`tor: the onion ${hostOf(onion)} of ${group.label} gave no answer (${why}); its requests move to the first of ${others.map(hostOf).join(", ")} to answer (move ${group.moves} of ${max})
+`);
+    race(group, others, { onNone: () => err(`tor: no other onion of ${group.label} answered; its requests go to ${hostOf(others[0])} and wait for it
+`) });
+  };
   const original = globalThis.fetch;
   const urlOf = (value) => {
     try {
@@ -42821,17 +42858,30 @@ async function routeFacilitatorsOverOnion(argv2, {
     const url = typeof input === "string" || input instanceof URL ? urlOf(String(input)) : input instanceof Request ? urlOf(input.url) : void 0;
     const group = url && routes.get(url.origin);
     if (!group) return original(input, init);
+    const signal = init?.signal ?? (input instanceof Request ? input.signal : void 0);
     const send3 = (onion) => {
       if (onion === void 0) {
         group.startSpares?.();
-        const live = liveOnions(group);
+        const up = liveOnions(group).filter((other) => !group.down?.has(other));
+        const live = up.length > 0 ? up : liveOnions(group);
         onion = live[(group.sent = (group.sent ?? 0) + 1) % live.length];
       }
       const target = `${onion}${url.pathname}${url.search}`;
-      return original(input instanceof Request ? new Request(target, input) : target, onionInit(init));
+      const sent = original(input instanceof Request ? new Request(target, input) : target, onionInit(init));
+      if (group.onions.length < 2) return sent;
+      return sent.then((response) => {
+        if (onion === group.winner) {
+          group.moves = 0;
+          group.down?.clear();
+        }
+        return response;
+      }, (error) => {
+        const why = noAnswer(error, signal);
+        if (why) moveOn(group, onion, why);
+        throw error;
+      });
     };
     if (group.winner) return send3(group.winner);
-    const signal = init?.signal ?? (input instanceof Request ? input.signal : void 0);
     if (!group.waitMs) return untilAborted(group.pending, signal).then(send3);
     let timer;
     const bound = new Promise((resolve38) => {
@@ -42843,12 +42893,13 @@ async function routeFacilitatorsOverOnion(argv2, {
   return {
     routes: new Map([...routes].map(([origin, group]) => [origin, group.onions])),
     stop: () => {
+      stopped = true;
       for (const abort of aborts) abort();
       closeOnionDispatchers();
     }
   };
 }
-var SITE_ONIONS, SITE_SPARE_ONIONS, PINNED_FACILITATOR_ONIONS, PINNED_SPARE_ONIONS, HISTORY_ONIONS, PINNED_HISTORY_ONIONS, HISTORY_PROBE_PATH, FACILITATOR_FLAGS, V3_ONION, DISCOVERY_TIMEOUT_MS, WARM_TIMEOUT_MS, RACE_TIMEOUT_MS, ROUTE_WAIT_MS, SPARE_AFTER_MS, routedGroups, liveOnions, routedOnions, routedOrigins, onionsOfOrigin, routesOverOnion, GLOBAL_DISPATCHER, onionDispatchers;
+var SITE_ONIONS, SITE_SPARE_ONIONS, PINNED_FACILITATOR_ONIONS, PINNED_SPARE_ONIONS, HISTORY_ONIONS, PINNED_HISTORY_ONIONS, HISTORY_PROBE_PATH, FACILITATOR_FLAGS, V3_ONION, DISCOVERY_TIMEOUT_MS, WARM_TIMEOUT_MS, RACE_TIMEOUT_MS, ROUTE_WAIT_MS, SPARE_AFTER_MS, routedGroups, liveOnions, hostOf, noAnswer, routedOnions, routedOrigins, onionsOfOrigin, routesOverOnion, GLOBAL_DISPATCHER, onionDispatchers;
 var init_facilitatorOnion = __esm({
   "wallet/src/net/facilitatorOnion.mjs"() {
     "use strict";
@@ -42888,6 +42939,12 @@ var init_facilitatorOnion = __esm({
     SPARE_AFTER_MS = ROUTE_WAIT_MS;
     routedGroups = [];
     liveOnions = (group) => group.onions.slice(0, group.live ?? group.onions.length);
+    hostOf = (onion) => `${new URL(onion).host.slice(0, 8)}...`;
+    noAnswer = (error, signal) => {
+      if (signal?.aborted) return signal.reason?.name === "TimeoutError" ? "no answer before the request's timeout" : void 0;
+      if (error?.name === "TimeoutError") return "no answer before the request's timeout";
+      return error instanceof TypeError ? "the stream failed" : void 0;
+    };
     routedOnions = () => [...new Set(routedGroups.flatMap((group) => group.winner ? [group.winner] : liveOnions(group)))];
     routedOrigins = /* @__PURE__ */ new Map();
     onionsOfOrigin = (origin) => routedOrigins.get(origin) ?? PINNED_FACILITATOR_ONIONS[origin] ?? [];
@@ -46874,11 +46931,11 @@ function childRunProxy(env = process.env) {
   return { args, env: clean5 };
 }
 function mayMoveTorCircuit(why = "rate") {
-  if (torRotations < TOR_MAX_ROTATIONS && canSwitchTorTag()) return true;
-  if (!torRotationsRefused) {
-    torRotationsRefused = true;
+  if (torMoves[why] < TOR_MAX_ROTATIONS && canSwitchTorTag()) return true;
+  if (!torMovesRefused[why]) {
+    torMovesRefused[why] = true;
     const what = why === "stall" ? "a request stalled until its timeout" : "the RPC answered HTTP 429";
-    process.stderr.write(torRotations >= TOR_MAX_ROTATIONS ? why === "stall" ? `tor: a request stalled again after ${TOR_MAX_ROTATIONS} new circuits; this run keeps its circuit and retries there
+    process.stderr.write(torMoves[why] >= TOR_MAX_ROTATIONS ? why === "stall" ? `tor: a request stalled again after ${TOR_MAX_ROTATIONS} new circuits in a row; this run keeps its circuit and retries there until one answers
 ` : `tor: the RPC still answers HTTP 429 after ${TOR_MAX_ROTATIONS} new circuits; this run keeps its circuit and waits as the RPC asks
 ` : `tor: ${what}, and Node ${process.versions.node} cannot move a run to a new Tor circuit (it has no http.setGlobalProxyFromEnv and no proxy dispatcher of its own); this run keeps its circuit
 `);
@@ -46950,12 +47007,19 @@ function noteAnswer(response) {
   rpcAnswered += 1;
   lastAnswerAt = Date.now();
 }
+function noteCircuitAnswer(response, circuit) {
+  if (!response.ok || torMoves.stall === 0 || circuit !== torCircuitId) return;
+  torMoves.stall = 0;
+  torMovesRefused.stall = false;
+  process.stderr.write(`tor: the new circuit answered, so this run may again move to a new circuit (up to ${TOR_MAX_ROTATIONS} in a row) when a request stalls
+`);
+}
 async function moveToNewTorCircuit(why = "rate") {
   if (!mayMoveTorCircuit(why)) return false;
   switchTorTag();
-  torRotations += 1;
-  process.stderr.write(why === "stall" ? `tor: a request on this circuit stalled until its timeout, so this run moved to a new Tor circuit (${torRotations} of ${TOR_MAX_ROTATIONS})
-` : `tor: this circuit kept answering HTTP 429 after the full wait the RPC asked for, so this run moved to a new Tor circuit (${torRotations} of ${TOR_MAX_ROTATIONS})
+  torMoves[why] += 1;
+  process.stderr.write(why === "stall" ? `tor: a request on this circuit stalled until its timeout, so this run moved to a new Tor circuit (${torMoves.stall} of ${TOR_MAX_ROTATIONS} in a row)
+` : `tor: this circuit kept answering HTTP 429 after the full wait the RPC asked for, so this run moved to a new Tor circuit (${torMoves.rate} of ${TOR_MAX_ROTATIONS})
 `);
   return true;
 }
@@ -47021,8 +47085,10 @@ async function rpcFetch(input, init) {
   });
   const post = typeof init?.body === "string" ? describeRpcPost(input, init.body) : void 0;
   if (!post?.resendable) {
+    const startedOn = torCircuitId;
     const response = await fetch2(input, init);
     noteAnswer(response);
+    noteCircuitAnswer(response, startedOn);
     markRefusal(response, post);
     return response;
   }
@@ -47038,6 +47104,7 @@ async function rpcFetch(input, init) {
     const circuit = torCircuitId;
     const response = await fetch2(input, init);
     noteAnswer(response);
+    noteCircuitAnswer(response, circuit);
     markRefusal(response, post);
     if (response.status !== 429) return response;
     await response.body?.cancel().catch(() => {
@@ -47141,7 +47208,7 @@ async function proxyEntry(argv2, run5, { err = (text3) => process.stderr.write(t
   }
   return reexec(options.args, options.mode, options.proxy);
 }
-var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torRotations, torCircuitId, torRotationsRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TUNNEL_LINE, TOR_INSTALL, OS_NAMES, osKey, torNotRunningMessage, NOTICE, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop;
+var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TUNNEL_LINE, TOR_INSTALL, OS_NAMES, osKey, torNotRunningMessage, NOTICE, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop;
 var init_proxy = __esm({
   "wallet/src/net/proxy.mjs"() {
     "use strict";
@@ -47175,9 +47242,9 @@ var init_proxy = __esm({
     lastAnswerAt = runStartedAt;
     readSteps = /* @__PURE__ */ new Set();
     pacingSamples = [];
-    torRotations = 0;
+    torMoves = { rate: 0, stall: 0 };
     torCircuitId = 0;
-    torRotationsRefused = false;
+    torMovesRefused = { rate: false, stall: false };
     inTorRun = () => String(process.env[MARK] ?? "").startsWith("tor ");
     runNetworkMode = () => {
       const mode = String(process.env[MARK] ?? "").split(" ")[0];
@@ -50846,7 +50913,7 @@ function markHistoryChoice(own, choice) {
 function connectSplit(own, historyUrl, commitment = "finalized", { pause: pause3 = pauseFor, notice = noticeOnStderr } = {}) {
   if (historyUrl === void 0) return markHistoryChoice(own, "default");
   if (historyUrl === HISTORY_RPC_OWN) return markHistoryChoice(own, "own");
-  const history = connect2(historyUrl, commitment, { timeoutMs: HISTORY_RPC_REQUEST_TIMEOUT_MS });
+  const history = connect2(historyUrl, commitment, { timeoutMs: HISTORY_RPC_REQUEST_TIMEOUT_MS, wrapFetch: trackHistoryAnswers });
   const ownRouted = COUNTED_RPC_METHODS.filter((name) => !HISTORY_RPC_METHODS.includes(name));
   const counts = Object.freeze({
     history: Object.fromEntries([...HISTORY_RPC_METHODS, "getTransactions"].map((name) => [name, 0])),
@@ -51561,7 +51628,7 @@ function depositIntentAddress2({ programId, pool: pool2, depositPublicInputBytes
     programId
   )[0];
 }
-var import_web395, POOL_STATE_LEN2, POOL_STATE_LEN_RING2, POOL_STATE_LEN_RING_642, ANCHOR_MODE_RING2, ANCHOR_RING_HEADER2, ANCHOR_RING_FIRST_SLOT2, ANCHOR_RING_SLOT_LEN2, POOL_LAYOUTS, POOL_STATE_LEN_V22, BUFFER_HEADER_LEN2, MEMO_BUNDLE_BYTES2, PAYLOAD_LENGTH2, PAYLOAD_LENGTH_V22, TRANSITION_KIND2, INSTRUCTION2, COUNTED_RPC_METHODS, HISTORY_RPC_METHODS, PINNED_HISTORY_PROXIES, PINNED_HISTORY_HTTPS, HISTORY_RPC_OWN, historyRpcErrors, HISTORY_RPC_BEHIND_WAIT_MS, HISTORY_RPC_REQUEST_TIMEOUT_MS, HISTORY_RPC_BEHIND_FAST_MS, HISTORY_RPC_BEHIND_FAST_TRIES, HISTORY_RPC_BEHIND_RETRY_STEPS_MS, HISTORY_RPC_BEHIND_CODE, ED25519_SPKI_PREFIX, SIGNATURE_BYTES, VERSION_1_PREFIX, HISTORY_CROSS_CHECK_COUNT, runTransactions, warmedSources, bytes323, MEMO_BATCH_MAX, MEMO_LANES, MEMO_HEDGE_AFTER_MS, MEMO_ATTEMPTS, MEMO_MAX_WAIT_SECONDS, MEMO_RATE_LIMIT_BUDGET_SECONDS, memoGatesByFetch, MEMO_ANSWER_TIMEOUT_MS, MEMO_BODY_TIMEOUT_MS, pauseFor, noticeOnStderr, memoDigestHex, memoFailureText, prefetchedMemosByFetch, MEMO_PREFETCH_LIFE_MS;
+var import_web395, POOL_STATE_LEN2, POOL_STATE_LEN_RING2, POOL_STATE_LEN_RING_642, ANCHOR_MODE_RING2, ANCHOR_RING_HEADER2, ANCHOR_RING_FIRST_SLOT2, ANCHOR_RING_SLOT_LEN2, POOL_LAYOUTS, POOL_STATE_LEN_V22, BUFFER_HEADER_LEN2, MEMO_BUNDLE_BYTES2, PAYLOAD_LENGTH2, PAYLOAD_LENGTH_V22, TRANSITION_KIND2, INSTRUCTION2, COUNTED_RPC_METHODS, HISTORY_RPC_METHODS, PINNED_HISTORY_PROXIES, PINNED_HISTORY_HTTPS, HISTORY_RPC_OWN, historyRpcErrors, HISTORY_RPC_BEHIND_WAIT_MS, HISTORY_RPC_REQUEST_TIMEOUT_MS, HISTORY_SOURCE_SILENT_MS, historySilentSince, historyRequestsSent, historySourceState, trackHistoryAnswers, HISTORY_RPC_BEHIND_FAST_MS, HISTORY_RPC_BEHIND_FAST_TRIES, HISTORY_RPC_BEHIND_RETRY_STEPS_MS, HISTORY_RPC_BEHIND_CODE, ED25519_SPKI_PREFIX, SIGNATURE_BYTES, VERSION_1_PREFIX, HISTORY_CROSS_CHECK_COUNT, runTransactions, warmedSources, bytes323, MEMO_BATCH_MAX, MEMO_LANES, MEMO_HEDGE_AFTER_MS, MEMO_ATTEMPTS, MEMO_MAX_WAIT_SECONDS, MEMO_RATE_LIMIT_BUDGET_SECONDS, memoGatesByFetch, MEMO_ANSWER_TIMEOUT_MS, MEMO_BODY_TIMEOUT_MS, pauseFor, noticeOnStderr, memoDigestHex, memoFailureText, prefetchedMemosByFetch, MEMO_PREFETCH_LIFE_MS;
 var init_chain2 = __esm({
   "wallet/src/chain.mjs"() {
     "use strict";
@@ -51661,6 +51728,16 @@ var init_chain2 = __esm({
     historyRpcErrors = /* @__PURE__ */ new WeakSet();
     HISTORY_RPC_BEHIND_WAIT_MS = 6e4;
     HISTORY_RPC_REQUEST_TIMEOUT_MS = 2e4;
+    HISTORY_SOURCE_SILENT_MS = 6e4;
+    historyRequestsSent = 0;
+    historySourceState = () => ({ silentSince: historySilentSince, sent: historyRequestsSent });
+    trackHistoryAnswers = (fetch2) => async (input, init) => {
+      historyRequestsSent += 1;
+      historySilentSince ??= Date.now();
+      const response = await fetch2(input, init);
+      historySilentSince = void 0;
+      return response;
+    };
     HISTORY_RPC_BEHIND_FAST_MS = 150;
     HISTORY_RPC_BEHIND_FAST_TRIES = 12;
     HISTORY_RPC_BEHIND_RETRY_STEPS_MS = Object.freeze([500, 1e3, 2e3, 5e3]);
@@ -58781,9 +58858,32 @@ function walletHistoryHomeMarks(store) {
 function latestPrewarmedWalletHistory() {
   return latestPrewarm;
 }
+function untilHistorySourceSilent(walking, startedAt) {
+  const sentBefore = historySourceState().sent;
+  let timer;
+  const silent = new Promise((_resolve, reject) => {
+    const check = () => {
+      const { silentSince, sent } = historySourceState();
+      if (sent > sentBefore && silentSince !== void 0 && Date.now() - Math.max(silentSince, startedAt) >= HISTORY_SOURCE_SILENT_MS) {
+        markPhase("history-source-silent");
+        reject(new Error("history_rpc_failed", { cause: new Error(
+          `history_source_silent: the history source answered no request for ${HISTORY_SOURCE_SILENT_MS / 1e3} s`
+        ) }));
+        return;
+      }
+      timer = setTimeout(check, 1e3);
+      timer.unref?.();
+    };
+    timer = setTimeout(check, 1e3);
+    timer.unref?.();
+  });
+  walking.catch(() => {
+  });
+  return Promise.race([walking, silent]).finally(() => clearTimeout(timer));
+}
 async function loadWalletP03HistoryNow(args) {
   const startedAt = Date.now();
-  const report = await walkWalletP03HistoryNow(args);
+  const report = await untilHistorySourceSilent(walkWalletP03HistoryNow(args), startedAt);
   if (report !== null && typeof report === "object" && !REPORT_STARTED_AT.has(report)) REPORT_STARTED_AT.set(report, startedAt);
   return report;
 }
@@ -63977,6 +64077,7 @@ var init_errorCodes = __esm({
       "history_rpc_failed",
       "history_rpc_invalid",
       "history_shared_walk_slow",
+      "history_source_silent",
       "house_budget_exhausted",
       "house_deposit_above_pool_cap",
       "house_deposit_below_minimum",
@@ -75474,12 +75575,23 @@ async function readFinalizedClock(connection) {
   return Number(timestamp);
 }
 function startFinalizedChainTime(connection, { reuseRecent = false } = {}) {
+  const keyed = typeof connection === "object" && connection !== null;
   const recentClock = () => {
-    const last = typeof connection === "object" && connection !== null ? lastClockAnswers.get(connection) : void 0;
+    const last = keyed ? lastClockAnswers.get(connection) : void 0;
     const age = last === void 0 ? Infinity : performance.now() - last.arrivedAt;
     return age <= PROOF_CHAIN_TIME_REUSE_MS ? { time: last.time, age } : void 0;
   };
   const recent = reuseRecent ? recentClock() : void 0;
+  const inFlight = reuseRecent && recent === void 0 && keyed ? clockReadsInFlight.get(connection) : void 0;
+  if (inFlight !== void 0 && performance.now() - inFlight.startedAt <= PROOF_CHAIN_TIME_REUSE_MS) {
+    return async () => {
+      const answer = await inFlight.answer.catch(() => void 0);
+      const age = answer?.time === void 0 ? Infinity : performance.now() - answer.arrivedAt;
+      if (age > EARLY_CHAIN_TIME_MAX_AGE_MS) return readFinalizedClock(connection);
+      markPhase("chain-time-joined");
+      return answer.time + Math.floor(age / 1e3);
+    };
+  }
   if (recent !== void 0) {
     let fallback;
     const timer = setTimeout(() => {
@@ -75504,6 +75616,16 @@ function startFinalizedChainTime(connection, { reuseRecent = false } = {}) {
   });
   early.catch(() => {
   });
+  if (keyed) {
+    const entry = { startedAt, answer: early.then((time) => ({ time, arrivedAt })) };
+    entry.answer.catch(() => {
+    });
+    clockReadsInFlight.set(connection, entry);
+    early.finally(() => {
+      if (clockReadsInFlight.get(connection) === entry) clockReadsInFlight.delete(connection);
+    }).catch(() => {
+    });
+  }
   return async () => {
     const now = performance.now();
     if (arrivedAt === void 0 && now - startedAt > EARLY_CHAIN_TIME_MAX_AGE_MS) return readFinalizedClock(connection);
@@ -75946,7 +76068,7 @@ function assertProvedPaymentBinding(proved, { poolDomain, inputAccountCommitment
     fail15("proved_request_binding_invalid");
   }
 }
-var import_web3106, MODEL_DIR3, seedBytes5, EARLY_CHAIN_TIME_MAX_AGE_MS, settledNoteExits, PROOF_CHAIN_TIME_REUSE_MS, lastClockAnswers, lastProofRecoveries, lastProofRecovery;
+var import_web3106, MODEL_DIR3, seedBytes5, EARLY_CHAIN_TIME_MAX_AGE_MS, settledNoteExits, PROOF_CHAIN_TIME_REUSE_MS, lastClockAnswers, clockReadsInFlight, lastProofRecoveries, lastProofRecovery;
 var init_prepareRecoveredPayment = __esm({
   "wallet/src/pay/prepareRecoveredPayment.mjs"() {
     "use strict";
@@ -75970,6 +76092,7 @@ var init_prepareRecoveredPayment = __esm({
     settledNoteExits = /* @__PURE__ */ new Map();
     PROOF_CHAIN_TIME_REUSE_MS = 5e3;
     lastClockAnswers = /* @__PURE__ */ new WeakMap();
+    clockReadsInFlight = /* @__PURE__ */ new WeakMap();
     lastProofRecoveries = /* @__PURE__ */ new Map();
     lastProofRecovery = (store) => lastProofRecoveries.get(store.path);
   }
@@ -103224,7 +103347,7 @@ import { dirname as dirname18, isAbsolute as isAbsolute6, join as join18, resolv
 function retiredPoolText(pool2) {
   const next = RETIRED_POOLS[pool2];
   if (!next) return void 0;
-  return `pool ${pool2} is retired: the production facilitator now runs pool ${next}, and nothing serves the old pool. It held no user balance when it was retired. Your old wallet file stays where it is; run npx -y shinjuku-shielded@latest setup to make a wallet for the new pool`;
+  return `pool ${pool2} is retired: the production facilitator now runs pool ${next}, and nothing serves the old pool. It held no user balance when it was retired. Your old wallet file stays where it is; run npx -y --no-audit --no-fund shinjuku-shielded@latest setup to make a wallet for the new pool`;
 }
 function setupHome(env = process.env) {
   return resolve18(env.SHIELDED_WALLET_HOME || join18(homedir2(), ".carbon-shielded-wallet"));
@@ -103327,7 +103450,7 @@ function mcpFlagsFromConfig(home, config) {
 }
 function mcpServerEntry({ home, env = process.env } = {}) {
   const custom2 = env.SHIELDED_WALLET_HOME ? { env: { SHIELDED_WALLET_HOME: home } } : {};
-  return { command: "npx", args: ["-y", NPX_PACKAGE, "mcp"], ...custom2 };
+  return { command: "npx", args: ["-y", ...NPX_INSTALL_FLAGS, NPX_PACKAGE, "mcp"], ...custom2 };
 }
 function claudeCodeArgs({ home, env = process.env, platform = process.platform } = {}) {
   return [
@@ -103341,6 +103464,7 @@ function claudeCodeArgs({ home, env = process.env, platform = process.platform }
     ...platform === "win32" ? ["cmd", "/c"] : [],
     "npx",
     "-y",
+    ...NPX_INSTALL_FLAGS,
     NPX_PACKAGE,
     "mcp"
   ];
@@ -103390,6 +103514,11 @@ function hostConfigText({ home, env = process.env, platform = process.platform }
     ...json3.split("\n").map((line) => `  ${line}`)
   ].join("\n");
 }
+function isOlderSetupEntry(existing, entry) {
+  if (!isPlainObject3(existing) || entry.command !== "npx" || !Array.isArray(entry.args)) return false;
+  const older = { ...entry, args: entry.args.filter((arg) => !NPX_INSTALL_FLAGS.includes(arg)) };
+  return older.args.length !== entry.args.length && sameJson(existing, older);
+}
 function restrictToOwnerWindows(file, { run: run5 = execFileSync2 } = {}) {
   const system32 = join18(process.env.SystemRoot || "C:/Windows", "System32");
   try {
@@ -103422,7 +103551,7 @@ function addToJsonHost(file, entry, { now = /* @__PURE__ */ new Date(), force =
     const existing = current.mcpServers?.[MCP_SERVER_NAME];
     if (existing !== void 0) {
       if (sameJson(existing, entry)) return { file, changed: false };
-      if (!force) {
+      if (!force && !isOlderSetupEntry(existing, entry)) {
         throw new Error(`setup_host_config_conflict: the host's config file already has a different "${MCP_SERVER_NAME}" server, so setup left it alone; rerun setup with --force to replace it (the old file is backed up first), or edit it by hand`);
       }
     }
@@ -103469,7 +103598,7 @@ function addToJsonHost(file, entry, { now = /* @__PURE__ */ new Date(), force =
   }
   return { file, changed: true, ...backup ? { backup } : {} };
 }
-var import_web3118, CONFIG_SCHEMA, CONFIG_FILE, NPX_PACKAGE, MCP_SERVER_NAME, P03_BINDING2, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC2, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC2, configPath, homeWalletPath, invalid3, isPubkey, HOST_TARGETS, WINDOWS_SHELL_CODE, isPlainObject3, sameJson;
+var import_web3118, CONFIG_SCHEMA, CONFIG_FILE, NPX_PACKAGE, NPX_INSTALL_FLAGS, MCP_SERVER_NAME, P03_BINDING2, PRODUCTION, RETIRED_POOLS, NO_LIMIT_ATOMIC2, DEFAULT_CAPS, OLD_DEFAULT_SETUP_CAPS, OLD_DEFAULT_WALLET_BUDGETS, capText, POSITIVE_ATOMIC2, configPath, homeWalletPath, invalid3, isPubkey, HOST_TARGETS, WINDOWS_SHELL_CODE, isPlainObject3, sameJson;
 var init_config2 = __esm({
   "wallet/src/setup/config.mjs"() {
     "use strict";
@@ -103479,6 +103608,7 @@ var init_config2 = __esm({
     CONFIG_SCHEMA = "shinjuku-shielded/config/v1";
     CONFIG_FILE = "config.json";
     NPX_PACKAGE = "shinjuku-shielded";
+    NPX_INSTALL_FLAGS = Object.freeze(["--no-audit", "--no-fund"]);
     MCP_SERVER_NAME = "shinjuku-shielded";
     P03_BINDING2 = "carbon-shielded-exact/svm-v3";
     PRODUCTION = Object.freeze({
@@ -104634,7 +104764,7 @@ function canonicalJson(value) {
 }
 function channelPublicKey(publicKeyHex = CHANNEL_PUBLIC_KEY_HEX) {
   if (typeof publicKeyHex !== "string" || !HEX642.test(publicKeyHex)) {
-    throw fail25("wallet_channel_key_unset", "this wallet build carries no release-channel key, so it trusts only the proof-tool set it pins. Update the wallet: npx -y shinjuku-shielded@latest setup");
+    throw fail25("wallet_channel_key_unset", "this wallet build carries no release-channel key, so it trusts only the proof-tool set it pins. Update the wallet: npx -y --no-audit --no-fund shinjuku-shielded@latest setup");
   }
   return createPublicKey5({ key: Buffer.concat([ED25519_SPKI_PREFIX3, Buffer.from(publicKeyHex, "hex")]), format: "der", type: "spki" });
 }
@@ -105387,7 +105517,7 @@ var init_proofTools = __esm({
         sumsSha256: "a9af32df6b7ff7e3243bd607b7ff582da5732fa422f28afd9b8bc3e9f0d6c741"
       })
     });
-    UPDATE_NEXT = "update the wallet: npx -y shinjuku-shielded@latest setup";
+    UPDATE_NEXT = "update the wallet: npx -y --no-audit --no-fund shinjuku-shielded@latest setup";
     HEX643 = /^[0-9a-f]{64}$/;
     DIR2 = /^[0-9a-f]{8}$/;
     SUMS_LINE = /^([0-9a-f]{64}) [ *]([A-Za-z0-9._/-]{1,200})$/;
@@ -106667,7 +106797,7 @@ async function poolProofTools({ home, config, entry, release, facilitator, trust
       });
     } catch (error) {
       if (!UNTRUSTED.test(String(error?.message))) throw error;
-      throw fail32("wallet_move_proof_tools_untrusted", `the facilitator names proof-tool set ${set.dir} (SHA256SUMS ${set.sumsSha256}) for pool ${entry.pool}, and neither this wallet build's pin nor the signed release channel vouches for it; nothing was downloaded or moved. Update the wallet (npx -y shinjuku-shielded@latest), or (advanced) after you checked that set out of band run shinjuku-wallet move --trust-proof-tools ${set.sumsSha256} (repeat the flag once per set)`);
+      throw fail32("wallet_move_proof_tools_untrusted", `the facilitator names proof-tool set ${set.dir} (SHA256SUMS ${set.sumsSha256}) for pool ${entry.pool}, and neither this wallet build's pin nor the signed release channel vouches for it; nothing was downloaded or moved. Update the wallet (npx -y --no-audit --no-fund shinjuku-shielded@latest), or (advanced) after you checked that set out of band run shinjuku-wallet move --trust-proof-tools ${set.sumsSha256} (repeat the flag once per set)`);
     }
   }
   const tools = await (deps.installProofTools ?? installProofTools)({ facilitator, toolsRoot: join23(home, "proof-tools"), expected: trusted, fetchImpl });
@@ -106803,7 +106933,7 @@ var init_migration = __esm({
     fail32 = (code2, detail) => new Error(`${code2}: ${detail}`);
     releaseInvalid = (why) => fail32(
       "wallet_move_release_invalid",
-      `the facilitator's release document names its pools in a shape this wallet does not accept (${why}); nothing was moved. Update the wallet (npx -y shinjuku-shielded@latest), then run shinjuku-wallet move again`
+      `the facilitator's release document names its pools in a shape this wallet does not accept (${why}); nothing was moved. Update the wallet (npx -y --no-audit --no-fund shinjuku-shielded@latest), then run shinjuku-wallet move again`
     );
     isPubkey2 = (value) => {
       try {
@@ -108027,7 +108157,7 @@ function refusalSay(a, tool, again) {
     return unshown ? "Not sent. This app answered the send question before you could see it. Use an app that shows the question." : "Not sent. The send was not confirmed.";
   }
   if (code2 === "mcp_setup_declined" && unshown) {
-    return "Not set up. This app cannot show the setup question. Run npx -y shinjuku-shielded setup in a terminal, then restart this app.";
+    return "Not set up. This app cannot show the setup question. Run npx -y --no-audit --no-fund shinjuku-shielded setup in a terminal, then restart this app.";
   }
   if (code2 === "mcp_setup_declined") return "Not set up. The setup was not confirmed; nothing was created.";
   if (code2 === "mcp_tool_disabled") return "Nothing was paid or moved. This tool is off; only your owner can turn it on when starting the wallet.";
@@ -108135,8 +108265,8 @@ function addFundsHeldSay(entries, have = "") {
   if (!nowAny && waiting === 0n) return "";
   const lead = (text3) => have ? `${have}; ${text3}` : `${text3[0].toUpperCase()}${text3.slice(1)}`;
   const now = !nowUnknown ? `${usdcText(nowHeld)} USDC is becoming private now` : nowHeld > 0n ? `${usdcText(nowHeld)} USDC and an amount still being read are becoming private now` : "an amount still being read is becoming private now";
-  const later = startMinutes !== null ? `within about 1 minute of your next wallet request${startMinutes > 0 ? ` after about ${minutesText(startMinutes)}` : ""}` : minutesKnown && minutes !== null ? `in about ${minutesText(minutes)}` : "in a few minutes";
-  const askLater = startMinutes !== null && startMinutes > 0 ? `a random privacy wait ends in about ${minutesText(startMinutes)}: ask then; it is private 1 minute later` : null;
+  const later = startMinutes !== null ? "in about 1 minute (or at your next ask)" : minutesKnown && minutes !== null ? `in about ${minutesText(minutes)}` : "in a few minutes";
+  const askLater = startMinutes !== null && startMinutes > 0 ? `a random privacy wait ends in about ${minutesText(startMinutes)}: ask then, and again 1 minute later` : null;
   if (nowAny && waiting > 0n) return askLater ? `${lead(`${now}; ${usdcText(waiting)} USDC more is in a random privacy wait: ask in about ${minutesText(startMinutes)}`)}.` : `${lead(`${now}, and ${usdcText(waiting)} USDC more ${later}`)}.`;
   if (nowAny) return `${lead(now)}. Nothing to do.`;
   const arrived = askLater ? `${usdcText(waiting)} USDC arrived; ${askLater}` : `${usdcText(waiting)} USDC arrived and becomes private ${later === "in a few minutes" ? "within a few minutes of your next wallet request" : later}`;
@@ -109679,7 +109809,7 @@ var init_job = __esm({
       ],
       wallet_move_proof_tools_untrusted: [
         "the facilitator names a proof-tool set for a pool of this move that neither this wallet build's pin nor the signed release channel vouches for (see proofToolSet); nothing was downloaded or moved",
-        "update the wallet (npx -y shinjuku-shielded@latest), or (advanced) after you checked that set out of band run shinjuku-wallet move --trust-proof-tools <its SHA256SUMS hash>, once per set"
+        "update the wallet (npx -y --no-audit --no-fund shinjuku-shielded@latest), or (advanced) after you checked that set out of band run shinjuku-wallet move --trust-proof-tools <its SHA256SUMS hash>, once per set"
       ],
       wallet_move_proof_tools_unavailable: [
         "the proof tools of a pool of this move could not be downloaded or checked (see toolsCode); nothing was moved, and the tools recorded before stay",
@@ -109736,7 +109866,7 @@ var init_job = __esm({
       wallet_succession_leg_in_flight: ["a move to the new pool is on its way; your money is safe and counts once in your balance", "nothing to do; it lands in about a minute"],
       wallet_succession_target_untrusted: [
         "the switch record names a new pool this wallet does not trust, so nothing moves; your money is safe in the old pool",
-        "tell the operator; update the wallet (npx -y shinjuku-shielded@latest)"
+        "tell the operator; update the wallet (npx -y --no-audit --no-fund shinjuku-shielded@latest)"
       ],
       wallet_succession_leg_conflict: ["another copy of this wallet used the same money in the new pool, so this move stopped; nothing was paid", "tell the operator"]
     });
@@ -116433,7 +116563,7 @@ function floatRefusal(error) {
       return [
         code2,
         `Shinjuku refused to forward this seller's payment terms${why}; nothing was paid`,
-        "Nothing was paid. Do not retry this URL unchanged. If Shinjuku's words name this wallet's pool, tell your owner to run npx -y shinjuku-shielded@latest setup"
+        "Nothing was paid. Do not retry this URL unchanged. If Shinjuku's words name this wallet's pool, tell your owner to run npx -y --no-audit --no-fund shinjuku-shielded@latest setup"
       ];
     }
     default:
@@ -118640,7 +118770,7 @@ ${canonical5}`;
       return refuse11(
         code2,
         rest || "your private connection (the Tor proxy) is not answering; nothing was paid",
-        `Nothing was paid and nothing was sent. Start Tor (or run npx -y shinjuku-shielded@latest setup again), then call ${tool} again with request_id "${requestId}" and ${same2} (it never pays twice)`,
+        `Nothing was paid and nothing was sent. Start Tor (or run npx -y --no-audit --no-fund shinjuku-shielded@latest setup again), then call ${tool} again with request_id "${requestId}" and ${same2} (it never pays twice)`,
         { requestId, paid: false }
       );
     } else if (code2.startsWith("wallet_quote_refused_") || code2.startsWith("fetch_")) {
@@ -118648,7 +118778,8 @@ ${canonical5}`;
     } else {
       next = inference ? `the outcome is not known to be final: ${resume}. Or close an unsent payment with wallet_cancel request_id "${requestId}"; wallet_receipts lists it if it was paid` : `the outcome is not known to be final: call x402_pay again with request_id "${requestId}" (it never pays twice), or close an unsent payment with wallet_cancel request_id "${requestId}"; wallet_receipts lists it if it was paid`;
     }
-    return refuse11(code2, rest || "the payment did not finish", next, { requestId });
+    const plainRest = /^[a-z0-9]+(_[a-z0-9]+)+$/.test(rest ?? "") ? PLAIN_REASONS.find(([match]) => match.test(rest))?.[1] : void 0;
+    return refuse11(code2, plainRest ? `the payment did not finish: ${plainRest}` : rest || "the payment did not finish", next, { requestId });
   }
   const linkHeldSeen = /* @__PURE__ */ new Map();
   const LINK_HELD_FRESH_MS = 6e4;
@@ -119044,7 +119175,7 @@ ${canonical5}`;
       const arrivingAll = addFundsOpen.filter((link2) => link2.landed !== true && (link2.state === "shielding" || /^[1-9][0-9]*$/.test(String(link2.heldAtomic ?? ""))));
       const arrivingLine = (arriving) => {
         const amount = /^[1-9][0-9]*$/.test(String(arriving.shieldingAtomic ?? "")) ? `${usdcText2(arriving.shieldingAtomic)} USDC` : /^[1-9][0-9]*$/.test(String(arriving.heldAtomic ?? "")) ? `${usdcText2(arriving.heldAtomic)} USDC` : "USDC (an amount still being read)";
-        const when = arriving.state === "shielding" && !arriving.startsAtNextRequest ? "is becoming private now (its deposit transaction was sent; about 1 minute)" : arriving.startsInMinutes > 0 ? `waits about ${minutesText2(arriving.startsInMinutes)} (a random wait hides the link to the deposit); call wallet_balance again after that, and it becomes private within about 1 minute of that request; no step for the user` : "becomes private: its deposit started with this request and takes about 1 minute; if this wallet process ends first, the next wallet request continues it";
+        const when = arriving.state === "shielding" && !arriving.startsAtNextRequest ? "is becoming private now (its deposit transaction was sent; about 1 minute)" : arriving.startsInMinutes > 0 ? `waits about ${minutesText2(arriving.startsInMinutes)} (a random wait hides the link to the deposit); call wallet_balance again after that (that request starts the deposit), and once more about 1 minute later if it is not private yet (a host that ends this process after each answer needs that one); no step for the user` : "becomes private: its deposit started with this request and takes about 1 minute; if this wallet process ends first, the next wallet request continues it";
         return `${amount} arrived at add-funds address "${arriving.requestId}" and ${when}`;
       };
       if (arrivingAll.length === 1) {
@@ -119120,7 +119251,7 @@ ${canonical5}`;
       } catch {
       }
       const sessionLeft = sessionLeftShown(policy, countStore);
-      const sessionSummary = `Spending limits: ${capWords(policy.limits.maxPaymentAtomic)} per payment and ${capWords(policy.limits.maxSessionAtomic)} in any 24 hours, for this wallet (every MCP process counts; a pool upgrade starts a new 24-hour count)${sessionLeft === null ? "" : ` (${usdcText2(sessionLeft)} USDC left now)`}; ${usdcText2(policy.sessionSpentAtomic) ?? "0"} USDC paid in the last 24 hours. They come from this MCP server's launch line in the host (--max-payment and --max-session, in USDC like 0.05), else from the limits setup recorded. To change them, edit those flags in the host's MCP entry, or run npx -y shinjuku-shielded setup --yes --max-payment <usdc> --max-session <usdc> in a terminal; then restart the host. The wallet file also holds its own limits (--max-payment, and --max-cumulative for all payments together): npx -y shinjuku-shielded limits shows and changes them`;
+      const sessionSummary = `Spending limits: ${capWords(policy.limits.maxPaymentAtomic)} per payment and ${capWords(policy.limits.maxSessionAtomic)} in any 24 hours, for this wallet (every MCP process counts; a pool upgrade starts a new 24-hour count)${sessionLeft === null ? "" : ` (${usdcText2(sessionLeft)} USDC left now)`}; ${usdcText2(policy.sessionSpentAtomic) ?? "0"} USDC paid in the last 24 hours. They come from this MCP server's launch line in the host (--max-payment and --max-session, in USDC like 0.05), else from the limits setup recorded. To change them, edit those flags in the host's MCP entry, or run npx -y --no-audit --no-fund shinjuku-shielded setup --yes --max-payment <usdc> --max-session <usdc> in a terminal; then restart the host. The wallet file also holds its own limits (--max-payment, and --max-cumulative for all payments together): npx -y --no-audit --no-fund shinjuku-shielded limits shows and changes them`;
       return json2({
         ok: true,
         ...reportPublic,
@@ -119915,7 +120046,10 @@ ${canonical5}`;
   function jobFailure(kind, job, error, linkHeld = /* @__PURE__ */ new Map()) {
     const line = describeError(error, { fallback: KINDS[kind].failCode, safeText: SAFE_TEXT });
     let code2 = line.split(/[\s:;(]/, 1)[0];
-    let detail = line.slice(code2.length).replace(/^[:;]\s*/, "").trim() || `the ${KINDS[kind].noun} did not finish`;
+    const plain = PLAIN_REASONS.find(([match]) => match.test(code2))?.[1];
+    let detail = line.slice(code2.length).replace(/^[:;]\s*/, "").trim() || (plain ? `the ${KINDS[kind].noun} did not finish: ${plain}` : `the ${KINDS[kind].noun} did not finish`);
+    const plainDetail = /^[a-z0-9]+(_[a-z0-9]+)+$/.test(detail) ? PLAIN_REASONS.find(([match]) => match.test(detail))?.[1] : void 0;
+    if (plainDetail) detail = `the ${KINDS[kind].noun} did not finish: ${plainDetail}`;
     let next;
     let joinStage = false;
     const joinAt = () => job.joinAtMs ??= joinStartOf(job);
@@ -122782,7 +122916,7 @@ ${canonical5}`;
   const torRefusal = () => refuse11(
     "inference_tor_required",
     "inference sends the prompt to usePod and the model's provider, so this wallet sends it only from a --tor or --proxy run, where they see the proxy's exit and not this machine's IP. This MCP server was started without --tor or --proxy; nothing was sent or paid",
-    "Tell the user to add --tor to this MCP server's launch line in the host (for example `npx -y shinjuku-shielded mcp --tor`, with Tor's HTTPTunnelPort 127.0.0.1:9080 on), or --proxy http://host:port for an HTTP proxy they trust, then restart the server and call inference_chat again"
+    "Tell the user to add --tor to this MCP server's launch line in the host (for example `npx -y --no-audit --no-fund shinjuku-shielded mcp --tor`, with Tor's HTTPTunnelPort 127.0.0.1:9080 on), or --proxy http://host:port for an HTTP proxy they trust, then restart the server and call inference_chat again"
   );
   const inferenceModels = {
     name: "inference_models",
@@ -124067,6 +124201,9 @@ var init_tools = __esm({
       [/^mcp_balance_unknown$|no_spendable_account/, "the balance could not be read yet"],
       [/insufficient/, "an open payment held part of the balance"],
       [POOL_LAYOUT_CODE, "this wallet version cannot read the pool (a newer version can)"],
+      // ab-18 2026-10-22: a 445 s unshield answered only "the unshield did not finish".
+      [/^history_source_silent$/, "the pool's public history source answered nothing for 60 s (with --tor, a slow or dead Tor circuit)"],
+      [/^history_rpc_failed$|compact_history_source_unavailable/, "the pool's public history did not answer in time (with --tor, a slow or dead Tor circuit)"],
       [/memo_service|relay|facilitator|unavailable|rate_limited|fetch|timeout|timed_out|network|socket|econn|rpc|blockhash/i, "the facilitator or the network did not answer"],
       [/prove|proof|prover/, "the private proof did not finish"]
     ];
@@ -124178,7 +124315,7 @@ var init_tools = __esm({
       "inference_models",
       "wallet_receive_shielded"
     ]);
-    SETUP_TERMINAL_NEXT = "Tell the user to run `npx -y shinjuku-shielded setup` in a terminal on this machine, then restart this MCP server in the host";
+    SETUP_TERMINAL_NEXT = "Tell the user to run `npx -y --no-audit --no-fund shinjuku-shielded setup` in a terminal on this machine, then restart this MCP server in the host";
     SETUP_POLL_NEXT = `call shinjuku_setup again in ${POLL_SECONDS3} s for the status (it never creates a second wallet)`;
     PRIVATE_INFERENCE_WHY = "Your agent then buys AI answers from usePod, paid from your shielded balance over Tor; usePod and the model see the prompt, not who paid.";
     PRIVATE_INFERENCE_NEXT = " Private inference is on: config.json records Tor, so restart this MCP server in the host now; it then runs behind Tor (Tor must run with HTTPTunnelPort 127.0.0.1:9080), and until then every wallet tool and inference_chat stay refused. After the restart: fund the wallet with wallet_add_funds (it gives a one-time address; USDC sent there from any wallet becomes private a few minutes after it arrives, at the next wallet call; no other step), then call inference_chat (with no prompt it lists the models; a short qwen3-8-flash answer costs about 0.001 USDC, 0.011 USDC when usePod offers only its standard payment).";
@@ -124510,11 +124647,11 @@ function startUpdateNotice({ facilitator, log = () => {
   const ready = check === false ? Promise.resolve() : Promise.resolve().then(() => check({ facilitator })).then((found) => {
     if (!found) return;
     update3 = found;
-    log(`MCP_UPDATE_AVAILABLE release=${found.current} running=${found.running}: restart this MCP server to load it (a fixed-version host: npx -y ${NPX_PACKAGE}@latest mcp); nothing was downloaded`);
+    log(`MCP_UPDATE_AVAILABLE release=${found.current} running=${found.running}: restart this MCP server to load it (a fixed-version host: npx -y --no-audit --no-fund ${NPX_PACKAGE}@latest mcp); nothing was downloaded`);
   }, () => {
   });
   let shown = false;
-  const field4 = () => ({ available: true, release: update3.current, running: update3.running, command: `npx -y ${NPX_PACKAGE}@latest mcp`, detail: updateNoticeLine(update3) });
+  const field4 = () => ({ available: true, release: update3.current, running: update3.running, command: `npx -y --no-audit --no-fund ${NPX_PACKAGE}@latest mcp`, detail: updateNoticeLine(update3) });
   return {
     ready,
     current: () => update3,
@@ -124792,6 +124929,17 @@ async function openWalletServer({
   if (typeof tools.warmHistory === "function") tools.warmHistory({ afterBoot: warmDiscover });
   else warmDiscover?.();
   let rootsLanded = Promise.resolve();
+  let toolRootsLanded;
+  const rootsForTools = (install, started) => {
+    let timer;
+    const bound = new Promise((done) => {
+      timer = setTimeout(done, TOOL_ROOTS_WAIT_MS);
+      timer.unref?.();
+    });
+    return Promise.race([Promise.resolve(install).then(() => {
+    }, () => {
+    }), bound]).finally(() => clearTimeout(timer)).then(() => started);
+  };
   if (proofToolsRefresh?.home) {
     let timer;
     const late2 = new Promise((done) => {
@@ -124817,15 +124965,19 @@ async function openWalletServer({
       setFamilyRootResolver(() => void 0);
       return { state: "unproven" };
     };
-    const land = Promise.race([install(), late2]).finally(() => clearTimeout(timer)).then((installed) => {
+    const installing = install();
+    const land = Promise.race([installing, late2]).finally(() => clearTimeout(timer)).then((installed) => {
       if (installed.state === "timeout") setFamilyRootResolver(() => void 0);
       if (installed.state !== "none") log(`FAMILY_ROOTS ${installed.state}${installed.seq === void 0 ? "" : ` seq=${installed.seq}`}${installed.count === void 0 ? "" : ` count=${installed.count}`}${installed.code ? ` code=${installed.code}` : ""}`);
     });
     if (!rootsInBackground) await land;
-    else rootsLanded = land.catch((error) => {
-      setFamilyRootResolver(() => void 0);
-      log(`FAMILY_ROOTS failed code=${String(error?.message ?? error).split(/[\s:;(]/, 1)[0]}`);
-    });
+    else {
+      rootsLanded = land.catch((error) => {
+        setFamilyRootResolver(() => void 0);
+        log(`FAMILY_ROOTS failed code=${String(error?.message ?? error).split(/[\s:;(]/, 1)[0]}`);
+      });
+      toolRootsLanded = rootsForTools(installing, rootsLanded);
+    }
   } else if (rootsInBackground && cliRootsLate !== void 0) {
     let timer;
     const late2 = new Promise((done) => {
@@ -124838,6 +124990,7 @@ async function openWalletServer({
       setFamilyRootResolver(() => void 0);
       log("FAMILY_ROOTS timeout");
     });
+    toolRootsLanded = rootsForTools(cliRootsLate, rootsLanded);
   }
   if (rootsInBackground) {
     for (let index = 0; index < tools.length; index += 1) {
@@ -124845,7 +124998,7 @@ async function openWalletServer({
       if (ROOTS_FREE_TOOLS.has(tool.name)) continue;
       tools[index] = { ...tool, run: async (...args) => {
         const startedAt = Date.now();
-        await rootsLanded;
+        await (toolRootsLanded ?? rootsLanded);
         if (Date.now() - startedAt >= 20) log(`MCP_ROOTS_WAIT tool=${tool.name} ms=${Date.now() - startedAt}`);
         return tool.run(...args);
       } };
@@ -125123,7 +125276,7 @@ async function runSetupModeServer({
   }
   return { closed: ended };
 }
-var import_web3134, SUPPORTED_PROTOCOL_VERSIONS, SERVER_VERSION, MAX_LINE_BYTES, POSITIVE_ATOMIC7, INSTRUCTIONS, MCP_LOG_LEVELS, POOL_SWITCH_LOG_LEVEL, validId, BUNDLED_SOURCE_DIR, SHA256_HEX, UPDATE_NOTICE_TOOLS, UPDATE_NOTICE_MAX_TEXT, UPDATE_NOTICE_TEXT, updateNoticeLine, LAUNCH_NOTICE_TOOLS, withLaunchLine, capRequired, setupInvalid, ROOTS_FREE_TOOLS, MCP_CLOSE_BOUND_MS, MCP_CLOSE_HISTORY_BOUND_MS, MCP_CLOSE_UNREADABLE_BOUND_MS, MCP_CLOSE_POLL_MS, closeHistoryBusy, SETUP_INSTRUCTIONS;
+var import_web3134, SUPPORTED_PROTOCOL_VERSIONS, SERVER_VERSION, MAX_LINE_BYTES, POSITIVE_ATOMIC7, INSTRUCTIONS, MCP_LOG_LEVELS, POOL_SWITCH_LOG_LEVEL, validId, BUNDLED_SOURCE_DIR, SHA256_HEX, UPDATE_NOTICE_TOOLS, UPDATE_NOTICE_MAX_TEXT, UPDATE_NOTICE_TEXT, updateNoticeLine, LAUNCH_NOTICE_TOOLS, withLaunchLine, capRequired, setupInvalid, TOOL_ROOTS_WAIT_MS, ROOTS_FREE_TOOLS, MCP_CLOSE_BOUND_MS, MCP_CLOSE_HISTORY_BOUND_MS, MCP_CLOSE_UNREADABLE_BOUND_MS, MCP_CLOSE_POLL_MS, closeHistoryBusy, SETUP_INSTRUCTIONS;
 var init_stdioServer = __esm({
   "wallet/src/mcp/stdioServer.mjs"() {
     "use strict";
@@ -125162,7 +125315,7 @@ var init_stdioServer = __esm({
     UPDATE_NOTICE_TOOLS = Object.freeze(["wallet_balance", "x402_pay", "inference_chat"]);
     UPDATE_NOTICE_MAX_TEXT = 262144;
     UPDATE_NOTICE_TEXT = "A new wallet version is ready. Restart this MCP server in your app (or restart the app): each start loads the latest version. Nothing was downloaded or changed yet, and this version keeps working until then.";
-    updateNoticeLine = (update3) => `Tell the user: ${UPDATE_NOTICE_TEXT} (release ${update3.current}; this wallet runs ${update3.running}; a host that starts a fixed version runs npx -y ${NPX_PACKAGE}@latest mcp instead.)`;
+    updateNoticeLine = (update3) => `Tell the user: ${UPDATE_NOTICE_TEXT} (release ${update3.current}; this wallet runs ${update3.running}; a host that starts a fixed version runs npx -y --no-audit --no-fund ${NPX_PACKAGE}@latest mcp instead.)`;
     LAUNCH_NOTICE_TOOLS = Object.freeze(["wallet_balance", "wallet_status"]);
     withLaunchLine = (instructions2, line) => !line ? instructions2 : () => `${typeof instructions2 === "function" ? instructions2() : instructions2} Tell the user: ${line}`;
     capRequired = (detail) => {
@@ -125171,6 +125324,7 @@ var init_stdioServer = __esm({
     setupInvalid = (detail) => {
       throw new Error(`mcp_setup_invalid: ${detail}; the MCP server did not start and nothing was moved`);
     };
+    TOOL_ROOTS_WAIT_MS = 6e4;
     ROOTS_FREE_TOOLS = /* @__PURE__ */ new Set(["x402_pay", "inference_chat", "inference_models", "x402_preview", "x402_discover"]);
     MCP_CLOSE_BOUND_MS = 5e3;
     MCP_CLOSE_HISTORY_BOUND_MS = 45e3;
@@ -145998,7 +146152,7 @@ function identityOf(facilitator, release, successors = []) {
     const pool2 = successors.includes(served.pool) ? served.pool : PRODUCTION.pool;
     for (const [name, value] of Object.entries(served)) {
       if (value !== null && value !== void 0 && value !== (name === "pool" ? pool2 : PRODUCTION[name])) {
-        throw fail40("setup_identity_mismatch", `the production facilitator's release names another ${name} than this wallet build, and no signed succession links it; nothing was created. Run npx -y shinjuku-shielded@latest setup; if the latest build says the same, the facilitator is not serving the production pool`);
+        throw fail40("setup_identity_mismatch", `the production facilitator's release names another ${name} than this wallet build, and no signed succession links it; nothing was created. Run npx -y --no-audit --no-fund shinjuku-shielded@latest setup; if the latest build says the same, the facilitator is not serving the production pool`);
       }
     }
     return { pool: pool2, program: PRODUCTION.program, network: PRODUCTION.network, asset: PRODUCTION.asset };
@@ -151311,7 +151465,7 @@ async function runMcpFirstRun(values, deps) {
 ` : "Shinjuku Shielded is not set up on this machine yet (no config.json, wallet, passphrase file, or proof tools).\n");
     const answer = String(await deps.ask("Set up Shinjuku Shielded now? (y/n) ")).trim();
     if (!/^y(es)?$/i.test(answer)) {
-      throw new PublicFailure("mcp_not_set_up: the wallet is not set up, so the MCP server did not start and nothing was created; run shinjuku-wallet setup (npx -y shinjuku-shielded setup) when you are ready");
+      throw new PublicFailure("mcp_not_set_up: the wallet is not set up, so the MCP server did not start and nothing was created; run shinjuku-wallet setup (npx -y --no-audit --no-fund shinjuku-shielded setup) when you are ready");
     }
     const setupValues = new Map(Object.entries(setupOptionsOf(values, home)).filter(([key]) => key !== "home").map(([key, value]) => [`--${key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)}`, value]));
     await runSetupCommand(setupValues, deps);
@@ -151559,6 +151713,7 @@ function addToHosts(targets, home, deps, { force = false } = {}) {
       const status = deps.runClaudeCli(claudeCodeArgs(options));
       io.out(status === 0 ? "Added to Claude Code (user scope).\n" : `Claude Code did not take the server (claude CLI exit ${status}); run it yourself:
   ${claudeCodeCommand(options)}
+  (if it says the server already exists, run claude mcp remove --scope user ${MCP_SERVER_NAME} first, then the line above)
 `);
       continue;
     }
@@ -151607,7 +151762,7 @@ async function runSetupCommand(values, deps) {
   if (interactive && !deps.stdinIsTTY()) {
     const line = ["setup", "--yes", ...setupArgvOf(values), ...childRunProxy(deps.env).args].map(shellWord).join(" ");
     throw new UsageError(
-      `setup asks its questions in a terminal; in a script or a pipe pass --yes: npx -y shinjuku-shielded ${line} (add any of --max-payment, --max-session, --max-cumulative, --prefer-tor, --private-inference)`,
+      `setup asks its questions in a terminal; in a script or a pipe pass --yes: npx -y --no-audit --no-fund shinjuku-shielded ${line} (add any of --max-payment, --max-session, --max-cumulative, --prefer-tor, --private-inference)`,
       COMMAND_BY_NAME.get("setup")
     );
   }
@@ -151622,7 +151777,7 @@ async function runSetupCommand(values, deps) {
     ...introduced ? [] : [
       "Shinjuku Shielded: a self-custody wallet that pays x402 URLs privately from a shielded USDC balance.",
       "Setup makes the wallet on this machine (your keys never leave it), downloads and checks the proof tools, and writes config.json.",
-      "An agent host then starts it with one command: npx -y shinjuku-shielded mcp",
+      "An agent host then starts it with one command: npx -y --no-audit --no-fund shinjuku-shielded mcp",
       ""
     ],
     old ? `Status: ${missing.includes("pool-retired") ? `set up before for a retired pool: ${retiredPoolText(old.pool).split("; run ")[0]}. This run moves config.json to the new pool and makes its wallet` : missing.length ? `set up before; missing now: ${missing.join(", ")}` : "set up; every piece is checked again"} (home ${home}).` : `Home: ${home}`,
@@ -152407,7 +152562,7 @@ var COMMANDS = [
       `${CLI2} mcp --max-payment 0.05 --max-session 0.2 --max-shield 2 --unshield-to <your public address> --max-unshield 1 --exit-proof-tools exit-proof-tools.json --profile public-profile.json ${PAYER_SESSION_BASE}`
     ],
     notes: [
-      `Zero config: after ${CLI2} setup (npx -y shinjuku-shielded setup), mcp with no --pool and no --wallet reads config.json from SHIELDED_WALLET_HOME (default ~/.carbon-shielded-wallet): the wallet, the passphrase file, the proof tools, the caps, and Tor. A flag on the command line still wins. Agent host config: npx -y shinjuku-shielded mcp (Claude Code: claude mcp add --scope user shinjuku-shielded -- npx -y shinjuku-shielded mcp). Before setup, mcp in a terminal asks to run setup; started by an agent host (stdin is not a terminal), it serves SETUP MODE: shinjuku_setup and wallet_status, and every money tool answers wallet_not_set_up. shinjuku_setup asks the user to confirm in the host (MCP elicitation; never a secret), runs setup in the background (the same call answers its stage), then switches the same server to the wallet tools (notifications/tools/list_changed). A host without elicitation is told to run setup in a terminal.`,
+      `Zero config: after ${CLI2} setup (npx -y --no-audit --no-fund shinjuku-shielded setup), mcp with no --pool and no --wallet reads config.json from SHIELDED_WALLET_HOME (default ~/.carbon-shielded-wallet): the wallet, the passphrase file, the proof tools, the caps, and Tor. A flag on the command line still wins. Agent host config: npx -y --no-audit --no-fund shinjuku-shielded mcp (Claude Code: claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shielded mcp). Before setup, mcp in a terminal asks to run setup; started by an agent host (stdin is not a terminal), it serves SETUP MODE: shinjuku_setup and wallet_status, and every money tool answers wallet_not_set_up. shinjuku_setup asks the user to confirm in the host (MCP elicitation; never a secret), runs setup in the background (the same call answers its stage), then switches the same server to the wallet tools (notifications/tools/list_changed). A host without elicitation is told to run setup in a terminal.`,
       `Add it to an agent host with one line, for example Claude Code: claude mcp add shinjuku-pay -- node shinjuku-wallet.mjs mcp --max-payment 0.05 --max-session 0.2 --tor ${PAYER_SESSION_BASE} (the passphrase comes from ${PASSPHRASE_ENV2} or --passphrase-file; never a tool argument).`,
       `Claude Desktop, or any MCP host that takes a JSON config (claude_desktop_config.json: "mcpServers"), with absolute paths (yours differ; on Windows write C:/Users/you/...): {"mcpServers":{"shinjuku-pay":{"command":"node","args":["/home/you/shinjuku/shinjuku-wallet.mjs","mcp","--max-payment","0.05","--max-session","0.2","--pool","${GUIDE.pool}","--passphrase-file","/home/you/shinjuku/passphrase.txt","--proof-tools","/home/you/shinjuku/proof-tools.json","--program","${GUIDE.program}","--memo-service","${GUIDE.facilitator}","--tor"],"env":{"SHIELDED_WALLET_HOME":"/home/you/.shielded-wallet"}}}}. A host starts the server from its own folder, so a relative path does not work there. Without --rpc-file the RPC reads go to the facilitator relay.`,
       "Payments, in this order: shielded-exact (needs --proof-tools), then standard exact through Shinjuku (you pay Shinjuku privately, price + a small fee; Shinjuku pays the seller). A seller that offers only scheme confidential (hidden amounts) is refused, and nothing is paid: hidden-amount payments are retired (the program behind them closed on 2026-10-11).",
@@ -152445,9 +152600,9 @@ var COMMANDS = [
       bool2("--private-inference", 'answer yes to "Set your LLM to private inference now?": your agent buys AI answers from usePod, paid from your shielded balance over Tor. Records inference.enabled and Tor (as --prefer-tor) in config.json, and prints the path to the first private call. Without it, --yes keeps what config.json records'),
       flag2("--passphrase-file", "<file>", "your own passphrase file (8 or more characters); default: setup writes a new random passphrase to <home>/passphrase.txt, readable by you alone. Needed for a wallet that exists already"),
       flag2("--facilitator", "<https origin>", `the facilitator whose release, pool, and proof tools setup uses; default ${GUIDE.facilitator}`, { check: "origin" }),
-      flag2("--add-to", "<claude-code|claude-desktop|cursor>", "also add the server (npx -y shinjuku-shielded mcp) to this agent host's config; repeat it for more. Without it, setup prints the configs", { repeat: true }),
+      flag2("--add-to", "<claude-code|claude-desktop|cursor>", "also add the server (npx -y --no-audit --no-fund shinjuku-shielded mcp) to this agent host's config; repeat it for more. Without it, setup prints the configs", { repeat: true }),
       bool2("--force", "with --add-to: replace a different shinjuku-shielded entry already in a JSON host config (the old file is backed up first, mode 0600)"),
-      flag2("--trust-proof-tools", "<sha256>", "ADVANCED: install the proof-tool set whose SHA256SUMS has this SHA-256 instead of the set this wallet build pins (needed for a facilitator the build does not pin). Check the set out of band first; the normal fix for a new set is npx -y shinjuku-shielded@latest setup")
+      flag2("--trust-proof-tools", "<sha256>", "ADVANCED: install the proof-tool set whose SHA256SUMS has this SHA-256 instead of the set this wallet build pins (needed for a facilitator the build does not pin). Check the set out of band first; the normal fix for a new set is npx -y --no-audit --no-fund shinjuku-shielded@latest setup")
     ],
     examples: [
       `${CLI2} setup --yes`,
@@ -152455,20 +152610,20 @@ var COMMANDS = [
       `${CLI2} setup --yes --private-inference`
     ],
     notes: [
-      "npx -y shinjuku-shielded setup runs the same command. Without --yes it asks in the terminal: the caps (Enter keeps the default), Tor, and private inference.",
+      "npx -y --no-audit --no-fund shinjuku-shielded setup runs the same command. Without --yes it asks in the terminal: the caps (Enter keeps the default), Tor, and private inference.",
       `When Tor is recorded or asked for (a yes, --tor, --prefer-tor, or --private-inference), setup itself runs behind Tor: the release, the proof-tool downloads, and the RPC requests go over Tor, so the facilitator never sees this machine's IP address make the wallet. config.json then records Tor for mcp ("tor": true), so the MCP runs behind Tor too. Tor must run first (torrc: HTTPTunnelPort 127.0.0.1:9080); --no-tor runs it without Tor.`,
       `Private inference (a yes, or --private-inference): ${PRIVATE_INFERENCE_WHY} Setup records Tor, then prints five steps with real commands: add-funds (it shields the USDC), the first call (${CLI2} infer - --model qwen3-8-flash ... --tor, about 0.0011 USDC = 1100 atomic; its --max-payment must cover the 10000 = 0.01 USDC ceiling plus the fee), infer serve for an OpenAI client, and an MCP restart for inference_chat. In a terminal it then offers to run add-funds; it never pays an inference call.`,
       "The wallet home is SHIELDED_WALLET_HOME, default ~/.carbon-shielded-wallet (every command of this CLI uses it). setup writes there: config.json, passphrase.txt (mode 0600; on Windows an access list of your account alone), the wallet (<pool>/wallet.json, made by init with the production pool, program, network, and USDC), a recovery file recovery-<time>.txt, and proof-tools/<dir>/.",
       "The passphrase is never printed and no MCP tool takes or returns it. The recovery file holds the seed and the key: copy it to two offline places, then delete it from this machine.",
-      "The proof tools are the set this wallet build PINS (its SHA256SUMS hash is in the wallet; --trust-proof-tools replaces it). A facilitator whose /api/wallet/release names another set is refused (setup_proof_tools_pin_mismatch: update the wallet, npx -y shinjuku-shielded@latest setup). SHA256SUMS must have the pinned SHA-256, and every file must have the SHA-256 its line names, as /skill.md section 7b; bin/ and house/bin/ get the execute bit. A file that does not match is not kept. Each download has a hard size limit.",
+      "The proof tools are the set this wallet build PINS (its SHA256SUMS hash is in the wallet; --trust-proof-tools replaces it). A facilitator whose /api/wallet/release names another set is refused (setup_proof_tools_pin_mismatch: update the wallet, npx -y --no-audit --no-fund shinjuku-shielded@latest setup). SHA256SUMS must have the pinned SHA-256, and every file must have the SHA-256 its line names, as /skill.md section 7b; bin/ and house/bin/ get the execute bit. A file that does not match is not kept. Each download has a hard size limit.",
       "Your own --passphrase-file must be private: on Linux and macOS setup refuses a file that group or other may read or write, or that another user owns (setup_passphrase_file_insecure: chmod 600 <file>). On Windows setup cannot read the access list; it accepts the file with a warning.",
       "--add-to for Claude Desktop or Cursor: a host config whose mcpServers is not a JSON object, or that has a different shinjuku-shielded entry (without --force), is left alone. Otherwise the old file is copied to <file>.bak-<time> (mode 0600 on Linux and macOS; on Windows the folder's access list) and the new file replaces it in one rename.",
       "The provers are Linux programs. Linux: ready. Windows: the wallet runs them through WSL; setup checks that wsl.exe runs (wsl --install -d Ubuntu otherwise). macOS: not supported; setup says so and creates nothing.",
       "Run it again at any time: it never changes an existing wallet, keeps the recorded caps unless you pass new ones, checks every proof-tool file again, downloads what is missing or newer, and rewrites config.json.",
-      "Then mcp needs no flags: npx -y shinjuku-shielded mcp reads config.json (a flag on the command line still wins). Before setup, mcp in a terminal offers to run setup; started by an agent host, it serves shinjuku_setup, which runs this same setup after you confirm in the host.",
+      "Then mcp needs no flags: npx -y --no-audit --no-fund shinjuku-shielded mcp reads config.json (a flag on the command line still wins). Before setup, mcp in a terminal offers to run setup; started by an agent host, it serves shinjuku_setup, which runs this same setup after you confirm in the host.",
       "A command that takes --pool (balance, recover, deposit, add-funds, and others) takes it, and the passphrase of this home's wallet, from config.json when you leave them out: shinjuku-wallet balance needs no flags. A pocket command (pocket list, scan, reshield, release, fill) takes this home's --wallet and passphrase file the same way, and --program, --proof-tools, --facilitator when it needs them. A flag or SHIELDED_WALLET_PASSPHRASE still wins; init and restore never use config.json, and move reads it itself."
     ],
-    next: `start it from your agent host with npx -y shinjuku-shielded mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
+    next: `start it from your agent host with npx -y --no-audit --no-fund shinjuku-shielded mcp (or ${CLI2} mcp), then ask your agent "what is my balance"`,
     run: (args, values, deps, io) => deps.setupMain(values, { ...deps, io })
   },
   {
@@ -152834,7 +152989,7 @@ var COMMANDS = [
     flags: [
       bool2("--dry-run", "show what would move from local files only: no network call, nothing changes"),
       flag2("--rpc-file", "<file>", RPC_FILE_ABOUT),
-      flag2("--trust-proof-tools", "<sha256>", "ADVANCED: trust the proof-tool set whose SHA256SUMS has this SHA-256 for a pool of this move, when neither this wallet build's pin nor the signed release channel vouches for it (wallet_move_proof_tools_untrusted names the set). Repeat it once per set. Check each set out of band first; the normal fix is npx -y shinjuku-shielded@latest", { repeat: true })
+      flag2("--trust-proof-tools", "<sha256>", "ADVANCED: trust the proof-tool set whose SHA256SUMS has this SHA-256 for a pool of this move, when neither this wallet build's pin nor the signed release channel vouches for it (wallet_move_proof_tools_untrusted names the set). Repeat it once per set. Check each set out of band first; the normal fix is npx -y --no-audit --no-fund shinjuku-shielded@latest", { repeat: true })
     ],
     examples: [`${CLI2} move --dry-run`, `${CLI2} move`],
     notes: [
@@ -153058,9 +153213,9 @@ function overviewText() {
     `Usage: ${CLI2} <command> [flags]`,
     `       ${CLI2} help <command>     one command, with an example that works`,
     "",
-    "Start here (one command): npx -y shinjuku-shielded setup",
+    "Start here (one command): npx -y --no-audit --no-fund shinjuku-shielded setup",
     "  It makes the wallet, a private passphrase file, the checked proof tools, and config.json, and prints the lines for your agent host",
-    "  (the host then runs npx -y shinjuku-shielded mcp). Then ask your agent to add funds (wallet_add_funds, from 0.01 USDC).",
+    "  (the host then runs npx -y --no-audit --no-fund shinjuku-shielded mcp). Then ask your agent to add funds (wallet_add_funds, from 0.01 USDC).",
     "",
     "Manual set up (advanced, without setup):",
     "  export SHIELDED_WALLET_HOME=<a private directory>",
@@ -153087,7 +153242,7 @@ function overviewText() {
     `  facilitator  ${GUIDE.facilitator}`,
     "",
     "Exit codes: 0 done; 1 the command ran and failed (one-line reason); 2 the command line is wrong (shows a working example).",
-    `Start here: npx -y shinjuku-shielded setup (or ${CLI2} setup), then the agent host runs npx -y shinjuku-shielded mcp, and your agent adds funds with wallet_add_funds (from 0.01 USDC).`,
+    `Start here: npx -y --no-audit --no-fund shinjuku-shielded setup (or ${CLI2} setup), then the agent host runs npx -y --no-audit --no-fund shinjuku-shielded mcp, and your agent adds funds with wallet_add_funds (from 0.01 USDC).`,
     `Manual path, without setup: ${CLI2} help init, then ${CLI2} help add-funds (whole USDC only).`,
     `Lost the wallet file? ${CLI2} help restore (from the init recovery file)`,
     ""
@@ -154417,7 +154572,7 @@ function floatFailureHint(reason, floatError) {
   if (/p03_float_origin_missing/.test(reason)) return "nothing was paid: pass --memo-service, the facilitator that pays standard exact sellers for you";
   if (/p03_float_body_too_large/.test(reason)) return "nothing was paid: this seller's payment terms are larger than 12 KiB, too large to forward. Do not pay this seller";
   if (/p03_float_request_refused/.test(reason)) {
-    return "nothing was paid: Shinjuku refused to forward this seller's payment terms (its code follows p03_float_request_refused). Do not retry unchanged; float_body_invalid about refundTo means this wallet is on another pool than the facilitator: run npx -y shinjuku-shielded@latest setup";
+    return "nothing was paid: Shinjuku refused to forward this seller's payment terms (its code follows p03_float_request_refused). Do not retry unchanged; float_body_invalid about refundTo means this wallet is on another pool than the facilitator: run npx -y --no-audit --no-fund shinjuku-shielded@latest setup";
   }
   if (/p03_float_already_paid/.test(reason)) {
     return "Shinjuku records this payment as paid, but this wallet holds no record of that payment: do not pay again. Keep the wallet folder as it is and rerun the same command with the same --request-id";