feat(privacy): route source searches through Tor via TORLINK_TOR

[AdinathChaudhari]

What

Add an opt-in TORLINK_TOR env var that routes source searches (scouting) through a local Tor SOCKS proxy. Searching the indexers otherwise exposes your IP to every site; this hides it and reaches their .onion mirrors.

TORLINK_TOR=1 npx torlnk                       # Tor daemon on 127.0.0.1:9050
TORLINK_TOR=socks5h://127.0.0.1:9150 npx torlnk # Tor Browser's port

Scope: search only (stated plainly in README + --help)

Downloads still connect to the swarm directly — Tor can't safely carry BitTorrent (UDP/DHT, no torrent peers of its own), so anonymising the download side would be a false promise. For that, use a VPN with a kill switch or a seedbox. This PR is deliberately honest about that boundary.

Design — matching the grain

• Single chokepoint. Every source already funnels through fetchResilient (src/util/net.ts), so a swappable defaultFetch routes them all with zero per-source changes.
• Fail closed. Once enabled, searches always go through Tor. A proxy that's down makes searches error (sources show offline, existing behaviour); a misconfigured TORLINK_TOR exits at startup. Neither ever silently falls back to a direct, de-anonymising connection — that would defeat the entire point.
• socks5h (remote DNS). Tor resolves the hostname at the exit, so .onion works and no lookup leaks to the local resolver.
• No new packages. undici and socks were already transitive deps (via webtorrent); this only promotes them to direct deps (lockfile grows 12 lines).

Tests

src/util/proxy.test.ts covers env parsing, proxy-URL parsing, install, the fail-closed misconfig path, and the reachability probe. Full suite green (277 tests), typecheck clean, build clean.

Not covered here

• Live Tor routing wasn't exercised in this environment (no tor binary present). The SOCKS→undici path uses the standard socks + buildConnector pattern; I'd appreciate a maintainer smoke-test with a real Tor daemon.
• TUI status surface: the enabled/‑down notices print to stderr, which the alt-screen clears for the interactive TUI (they're visible in headless modes). A small in-TUI indicator could be a nice follow-up, but I kept UI wiring out to stay tight and one-concern.

🤖 Generated with Claude Code