gemini-computer-use 0.2.3 → 0.4.1

package/ops/mesh-domain.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# ==============================================================================
+#  Antigravity Mesh - resolve the public domain, once, for every shell script.
+#
+#  Sourced by deploy_gateway.sh and ops/nginx/render-domain.sh. The order below
+#  is the same order core/domain.py implements for the runtime; keeping the shell
+#  side in one file means "where does the domain come from" has a single answer
+#  for scripts too.
+#
+#    1. MESH_PUBLIC_URL in the environment;
+#    2. MESH_PUBLIC_URL (or the AGY_PUBLIC_BASE_URL alias) in the domain file -
+#       /etc/antigravity-mesh/domain.env by default, MESH_DOMAIN_FILE overrides;
+#    3. core/domain.py's DEFAULT_PUBLIC_BASE_URL, read from the checkout.
+#
+#  On success exports:
+#    MESH_DOMAIN_URL   https://mesh.example.com   (no trailing slash)
+#    MESH_DOMAIN_HOST  mesh.example.com
+#    MESH_DOMAIN_SOURCE  human-readable origin, for logs
+#    MESH_DOMAIN_FILE_RESOLVED  the domain file path that was consulted
+#  and returns 0. Returns 1 when nothing yields a domain.
+# ==============================================================================
+
+mesh_resolve_domain() {
+    local repo_dir="${1:-.}"
+    local value="" candidate_python="" source=""
+
+    MESH_DOMAIN_FILE_RESOLVED="${MESH_DOMAIN_FILE:-/etc/antigravity-mesh/domain.env}"
+
+    if [ -n "${MESH_PUBLIC_URL:-}" ]; then
+        value="$MESH_PUBLIC_URL"
+        source="MESH_PUBLIC_URL environment variable"
+    fi
+
+    local domain_file="$MESH_DOMAIN_FILE_RESOLVED"
+    if [ -z "$value" ] && [ -f "$domain_file" ]; then
+        # Windows PowerShell writes a UTF-8 BOM, and it would sit in front of the
+        # first key, so 'MESH_PUBLIC_URL=' would never match. Strip it first.
+        local domain_text
+        if [ "$(head -c 3 "$domain_file" 2>/dev/null | od -An -tx1 | tr -d ' \n')" = "efbbbf" ]; then
+            domain_text="$(tail -c +4 "$domain_file")"
+        else
+            domain_text="$(cat "$domain_file")"
+        fi
+        value="$(printf '%s\n' "$domain_text" | sed -n 's/^[[:space:]]*MESH_PUBLIC_URL[[:space:]]*=[[:space:]]*//p' | head -n 1)"
+        if [ -z "$value" ]; then
+            value="$(printf '%s\n' "$domain_text" | sed -n 's/^[[:space:]]*AGY_PUBLIC_BASE_URL[[:space:]]*=[[:space:]]*//p' | head -n 1)"
+        fi
+        value="$(printf '%s' "$value" | tr -d '"' | tr -d "'" | tr -d '\r')"
+        [ -n "$value" ] && source="$domain_file"
+    fi
+
+    if [ -z "$value" ]; then
+        # Path candidates, in order. The Microsoft Store "python.exe" (and its
+        # python3.exe twin) is an App Execution Alias: it is on PATH, it prints
+        # nothing usable, and it stops working after a Store repair - the same trap
+        # the Windows installer refuses to pin into an autostart entry. Skipping it
+        # by path is what lets the real interpreter behind it be found, or makes the
+        # resolver refuse honestly instead of trusting a stub.
+        local resolved_python=""
+        for candidate_python in python3 python py; do
+            command -v "$candidate_python" >/dev/null 2>&1 || continue
+            resolved_python="$(command -v "$candidate_python")"
+            case "$resolved_python" in
+                *[Ww]indows[Aa]pps*) continue ;;
+            esac
+            value="$("$resolved_python" -c "import sys; sys.path.insert(0, r'$repo_dir'); from core import domain; print(domain.DEFAULT_PUBLIC_BASE_URL)" 2>/dev/null || true)"
+            [ -n "$value" ] && { source="$repo_dir/core/domain.py default"; break; }
+        done
+    fi
+
+    if [ -z "$value" ]; then
+        MESH_DOMAIN_URL=""; MESH_DOMAIN_HOST=""; MESH_DOMAIN_SOURCE=""
+        export MESH_DOMAIN_URL MESH_DOMAIN_HOST MESH_DOMAIN_SOURCE MESH_DOMAIN_FILE_RESOLVED
+        return 1
+    fi
+
+    case "$value" in
+        http://*|https://*) ;;
+        *) value="https://$value" ;;
+    esac
+    MESH_DOMAIN_URL="${value%/}"
+    MESH_DOMAIN_HOST="$(printf '%s' "$MESH_DOMAIN_URL" | sed -e 's|^[A-Za-z][A-Za-z0-9+.-]*://||' -e 's|/.*$||')"
+    MESH_DOMAIN_SOURCE="$source"
+    export MESH_DOMAIN_URL MESH_DOMAIN_HOST MESH_DOMAIN_SOURCE MESH_DOMAIN_FILE_RESOLVED
+    return 0
+}

package/ops/nginx/README.md

@@ -0,0 +1,77 @@
+# Gateway nginx configuration
+
+Two files, and neither holds a domain literal:
+
+| File | Role |
+| :--- | :--- |
+| `antigravity-mesh-mcp.conf` | the snippet included from the gateway server block: installers, node bootstrap payload, public file shares, MCP endpoints |
+| `mesh-domain.vhost.template` | the HTTPS vhost for the gateway, with `__MESH_DOMAIN__` and `__MESH_CERT_NAME__` placeholders |
+| `render-domain.sh` | renders the template from the one place the domain is declared |
+
+## Where the domain comes from
+
+`render-domain.sh` sources `ops/mesh-domain.sh`, which resolves the domain exactly
+as `core/domain.py` does at runtime:
+
+1. `MESH_PUBLIC_URL` in the environment;
+2. `MESH_PUBLIC_URL` (or the `AGY_PUBLIC_BASE_URL` alias) in the domain file —
+   `/etc/antigravity-mesh/domain.env` by default, `MESH_DOMAIN_FILE` overrides it;
+3. `core/domain.py`'s `DEFAULT_PUBLIC_BASE_URL`, the single declaration of the
+   project default.
+
+`deploy_gateway.sh` uses the same script, so the gateway, the node, the installers
+and nginx all agree on one value.
+
+## Rendering
+
+```bash
+ops/nginx/render-domain.sh                 # render into ./rendered/, change nothing
+ops/nginx/render-domain.sh --out DIR       # render into DIR
+ops/nginx/render-domain.sh --check         # diff the rendered vhost against the live one
+ops/nginx/render-domain.sh --apply         # install into /etc/nginx
+```
+
+`--apply` backs up the current vhost and snippet into
+`/root/backups/antigravity-mesh/nginx-<timestamp>/`, runs `nginx -t`, and only then
+reloads; on a failed test nothing is reloaded and the rollback command is printed.
+
+`--check` is the way to prove the live host still matches the repository: with the
+domain configured correctly it renders byte-identically to
+`/etc/nginx/sites-available/<domain>`.
+
+## Switching the domain
+
+1. Put the new value in the one place — `MESH_PUBLIC_URL` in
+   `/etc/antigravity-mesh/domain.env` (node hosts:
+   `%USERPROFILE%\.config\antigravity-mesh\domain.env`).
+2. Issue the certificate for the new name (certbot, or `tailscale cert` when the
+   name is a Tailscale node name).
+3. `ops/nginx/render-domain.sh --apply`.
+4. `MESH_GATEWAY=… deploy_gateway.sh` to publish installers carrying the new
+   default, if the domain is also served from that host.
+
+## Two lines in the snippet are load-bearing for MCP clients
+
+### `Connection ""` on `/sse`, `/mcp`, `/messages`
+
+These are plain HTTP endpoints. The WebSocket idiom
+`proxy_set_header Connection "upgrade"` was applied to them too, which advertises
+an upgrade on every POST. Only `/ws/tunnel` is a real WebSocket and keeps it.
+
+### `keepalive_timeout 0` on `/sse`, `/mcp`, `/messages`
+
+Google's MCP frontend sends a chunked `DELETE` whose terminator can arrive after
+nginx has already answered. On a kept-alive connection those leftover bytes were
+parsed as a new request line — nginx logged `"0" 400` for it (79 times in 12
+minutes) and closed the connection, losing whatever the client had in flight;
+the client then reported `DEADLINE_EXCEEDED` after its 60 s deadline while the
+tool had already run on the node. Closing the connection after each response
+removes the desync entirely.
+
+### `default_type text/plain`, never `add_header Content-Type`
+
+`add_header Content-Type …` *appends* a header, and `alias` has already set one by
+extension, so the response carried two `Content-Type` values
+(`application/octet-stream` then `text/plain; charset=utf-8`). A client that honours
+the first treats the installer as binary: PowerShell's `Invoke-WebRequest` then
+hands `Invoke-Expression` a byte array, and `irm …/install.ps1 | iex` cannot work.

package/ops/nginx/antigravity-mesh-mcp.conf

@@ -0,0 +1,172 @@
+    # --- Antigravity Mesh FastMCP Gateway Endpoints ---
+    # --- Scanner / secret-hunting noise control ---
+    # Automated probes for .env, secrets, backups and WordPress files always
+    # 404. Answer them here so they never reach the app or its logs.
+    location ~* \.(env|git|svn|bak|old|sql|log|ini|conf|yml|yaml|json)$ {
+        access_log off;
+        return 404;
+    }
+    location ~* /(wp-content|wp-admin|wp-config|vendor|node_modules)/ {
+        access_log off;
+        return 404;
+    }
+
+    # --- Served bootstrap files -------------------------------------------
+    # "default_type text/plain", never "add_header Content-Type ...": add_header
+    # APPENDS a header, and `alias` has already set Content-Type by extension, so
+    # the response carried TWO Content-Type values
+    # ("application/octet-stream" then "text/plain; charset=utf-8"). A client that
+    # honours the first one treats the script as binary: PowerShell's
+    # Invoke-WebRequest then hands Invoke-Expression a byte array instead of text,
+    # and the documented `irm .../install.ps1 | iex` cannot work.
+    location /install.sh {
+        alias /var/www/antigravity-mesh/install.sh;
+        default_type text/plain;
+        charset utf-8;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    location /install.ps1 {
+        alias /var/www/antigravity-mesh/install.ps1;
+        default_type text/plain;
+        charset utf-8;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    location = /gateway.py {
+        # Source is published in the GitHub repository; the live gateway does not
+        # need to serve it. Keeps the auth/tunnel logic off the public surface.
+        access_log off;
+        return 404;
+    }
+
+    # --- Only the bootstrap files are public -------------------------------
+    # A curl/npx install needs exactly these; the rest of core/ (hooks, policies,
+    # schemas, subagents, triggers, code_cache, agent_harness) is internal and is
+    # not fetched by any installer, so it is not served.
+    location ~ ^/core/(hooks|policies|schemas|subagents|triggers|code_cache|agent_harness)\.py$ {
+        access_log off;
+        return 404;
+    }
+
+    location /core/ {
+        alias /var/www/antigravity-mesh/core/;
+        default_type text/plain;
+        charset utf-8;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    location /skills/ {
+        alias /var/www/antigravity-mesh/skills/;
+        default_type text/plain;
+        charset utf-8;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    # The Windows watchdog and the doctor travel with the node bootstrap: the
+    # served install.ps1 registers the scheduled task that runs the watchdog, and
+    # the README tells the operator to run the doctor, so both must be fetchable
+    # by a node that installed itself from this domain.
+    location /ops/ {
+        alias /var/www/antigravity-mesh/ops/;
+        default_type text/plain;
+        charset utf-8;
+        add_header Access-Control-Allow-Origin *;
+    }
+
+    location /mcp {
+        proxy_pass http://127.0.0.1:8096;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "";
+        keepalive_timeout 0;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Target-User "";
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    location /sse {
+        proxy_pass http://127.0.0.1:8096/sse;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "";
+        keepalive_timeout 0;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Target-User "";
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    location /messages {
+        proxy_pass http://127.0.0.1:8096/messages;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "";
+        keepalive_timeout 0;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Target-User "";
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    location /ws/tunnel {
+        proxy_pass http://127.0.0.1:8096/ws/tunnel;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Target-User "";
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    location /api/register {
+        limit_req zone=mesh_register burst=5 nodelay;
+        proxy_pass http://127.0.0.1:8096/api/register;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Target-User "";
+    }
+
+    location /health-mesh {
+        proxy_pass http://127.0.0.1:8096/health;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Target-User "";
+    }
+
+    location = /.well-known/oauth-protected-resource {
+        proxy_pass http://127.0.0.1:8096;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+    }
+
+    location ^~ /.well-known/oauth-protected-resource/ {
+        proxy_pass http://127.0.0.1:8096;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+    }

package/ops/nginx/mesh-domain.vhost.template

@@ -0,0 +1,58 @@
+# ==============================================================================
+#  Antigravity Mesh - the gateway's HTTPS vhost, as a template
+#
+#  Rendered by ops/nginx/render-domain.sh, which takes the domain from the one
+#  place that declares it (MESH_PUBLIC_URL, the domain file, or core/domain.py).
+#  Do not edit the rendered file on the host: edit this template and re-render,
+#  or the domain ends up in two places again.
+#
+#  Placeholders:
+#    __MESH_DOMAIN__     the public domain, e.g. mesh.example.com
+#    __MESH_CERT_NAME__  the certbot lineage name (usually the same as the domain)
+#
+#  Only the Mesh surface lives here. Other names that may share a host
+#  (api-agy., agy/, /v1/, ...) belong to other services and keep their own files.
+# ==============================================================================
+
+# HTTP -> HTTPS, plus the ACME path so certificate renewal keeps working.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name __MESH_DOMAIN__;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/acme;
+        default_type text/plain;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# HTTPS: the Mesh gateway itself.
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name __MESH_DOMAIN__;
+
+    ssl_certificate     /etc/letsencrypt/live/__MESH_CERT_NAME__/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/__MESH_CERT_NAME__/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    # The installers, the node bootstrap payload and the public file shares.
+    include /etc/nginx/snippets/antigravity-mesh-mcp.conf;
+
+    # The MCP surface: SSE and Streamable HTTP stream, so buffering stays off.
+    location / {
+        proxy_pass http://127.0.0.1:8096;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400;
+    }
+}

package/ops/nginx/render-domain.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# ==============================================================================
+#  Antigravity Mesh - render the nginx configuration for the public domain.
+#
+#  The domain comes from the one place ops/mesh-domain.sh resolves it from:
+#  MESH_PUBLIC_URL, then the domain file, then core/domain.py's single default.
+#  Nothing here holds a domain literal.
+#
+#  Usage:
+#     ops/nginx/render-domain.sh                 # render into ./rendered/
+#     ops/nginx/render-domain.sh --out DIR       # render into DIR
+#     ops/nginx/render-domain.sh --apply         # install into /etc/nginx
+#                                                # (backup + nginx -t + reload)
+#     ops/nginx/render-domain.sh --check         # fail if the rendered vhost
+#                                                # differs from the live one
+#  Env:
+#     MESH_DOMAIN_FILE       path to the domain file
+#     MESH_CERT_NAME         certbot lineage name (default: the domain)
+#     MESH_NGINX_DIR         nginx config root for --apply (default /etc/nginx)
+# ==============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+TEMPLATE="$SCRIPT_DIR/mesh-domain.vhost.template"
+SNIPPET="$SCRIPT_DIR/antigravity-mesh-mcp.conf"
+
+# shellcheck source=../mesh-domain.sh
+. "$REPO_DIR/ops/mesh-domain.sh"
+
+BOLD=""; GREEN=""; YELLOW=""; RED=""; RESET=""
+if [ -t 1 ]; then
+    BOLD="\033[1m"; GREEN="\033[0;32m"; YELLOW="\033[1;33m"; RED="\033[0;31m"; RESET="\033[0m"
+fi
+info() { printf "${BOLD}%s${RESET}\n" "$*"; }
+ok()   { printf "${GREEN}✓ %s${RESET}\n" "$*"; }
+die()  { printf "${RED}✗ %s${RESET}\n" "$*" >&2; exit 1; }
+
+OUT_DIR=""
+APPLY=false
+CHECK=false
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --out)   OUT_DIR="${2:-}"; [ -n "$OUT_DIR" ] || die "--out needs a directory"; shift 2 ;;
+        --apply) APPLY=true; shift ;;
+        --check) CHECK=true; shift ;;
+        -h|--help) sed -n '2,26p' "$0" | sed 's/^#\{1,2\} \{0,1\}//'; exit 0 ;;
+        *) die "Unknown parameter: $1 (try --help)" ;;
+    esac
+done
+
+mesh_resolve_domain "$REPO_DIR" \
+    || die "Cannot determine the public domain: export MESH_PUBLIC_URL, write MESH_PUBLIC_URL into ${MESH_DOMAIN_FILE:-/etc/antigravity-mesh/domain.env}, or run from a checkout that has core/domain.py"
+
+CERT_NAME="${MESH_CERT_NAME:-$MESH_DOMAIN_HOST}"
+NGINX_DIR="${MESH_NGINX_DIR:-/etc/nginx}"
+
+info "Rendering the Mesh nginx configuration"
+echo "  domain      : $MESH_DOMAIN_URL"
+echo "  server_name : $MESH_DOMAIN_HOST"
+echo "  cert name   : $CERT_NAME"
+echo "  source      : $MESH_DOMAIN_SOURCE"
+
+render() {
+    local dst="$1"
+    mkdir -p "$(dirname "$dst")"
+    sed -e "s|__MESH_DOMAIN__|$MESH_DOMAIN_HOST|g" \
+        -e "s|__MESH_CERT_NAME__|$CERT_NAME|g" \
+        "$TEMPLATE" > "$dst"
+    grep -q '__MESH_' "$dst" && die "unsubstituted placeholder left in $dst"
+    return 0
+}
+
+if [ "$CHECK" = true ]; then
+    live_vhost="$NGINX_DIR/sites-available/$MESH_DOMAIN_HOST"
+    [ -f "$live_vhost" ] || die "no live vhost at $live_vhost to compare against"
+    tmp="$(mktemp)"
+    trap 'rm -f "$tmp"' EXIT
+    render "$tmp"
+    if diff -u "$live_vhost" "$tmp" >/dev/null; then
+        ok "the live vhost matches the rendered template"
+        exit 0
+    fi
+    diff -u "$live_vhost" "$tmp" || true
+    die "the live vhost differs from the rendered template (see the diff above)"
+fi
+
+if [ "$APPLY" = true ]; then
+    command -v nginx >/dev/null 2>&1 || die "nginx is not installed here; use --out to render elsewhere"
+    TS="$(date +%Y%m%d-%H%M%S)"
+    backup_dir="/root/backups/antigravity-mesh/nginx-$TS"
+    mkdir -p "$backup_dir"
+    vhost_target="$NGINX_DIR/sites-available/$MESH_DOMAIN_HOST"
+    snippet_target="$NGINX_DIR/snippets/antigravity-mesh-mcp.conf"
+
+    [ -f "$vhost_target" ] && cp -a "$vhost_target" "$backup_dir/" || true
+    [ -f "$snippet_target" ] && cp -a "$snippet_target" "$backup_dir/" || true
+
+    render "$vhost_target"
+    install -m 644 "$SNIPPET" "$snippet_target"
+    ln -sfn "$vhost_target" "$NGINX_DIR/sites-enabled/$MESH_DOMAIN_HOST"
+
+    if ! nginx -t 2>&1; then
+        warn_rollback="cp -a $backup_dir/. $NGINX_DIR/ && nginx -t && systemctl reload nginx"
+        printf "${RED}✗ nginx rejected the rendered configuration${RESET}\n" >&2
+        echo "  the previous files are in $backup_dir" >&2
+        echo "  rollback: $warn_rollback" >&2
+        exit 1
+    fi
+    systemctl reload nginx
+    ok "applied; backup in $backup_dir"
+    echo "  rollback: cp -a $backup_dir/. $NGINX_DIR/ && nginx -t && systemctl reload nginx"
+    exit 0
+fi
+
+# Default: render next to the caller, so nothing on the host changes.
+OUT_DIR="${OUT_DIR:-$PWD/rendered}"
+render "$OUT_DIR/$MESH_DOMAIN_HOST"
+install -m 644 "$SNIPPET" "$OUT_DIR/antigravity-mesh-mcp.conf"
+ok "rendered into $OUT_DIR"
+echo "  vhost   : $OUT_DIR/$MESH_DOMAIN_HOST"
+echo "  snippet : $OUT_DIR/antigravity-mesh-mcp.conf"
+echo "  apply   : $0 --apply"