gemini-computer-use 0.4.2 → 0.4.4

package/install.sh

@@ -1,1998 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-#  Antigravity Mesh - Universal Turnkey Installer (v0.1.2)
-#  Bilingual: English (Default) & Russian, Device Detection, SSH & Autostart
-#  Targets: Linux, macOS, Windows (Git Bash) and Android/Termux (phone/tablet)
-# ==============================================================================
-set -e
-
-# Defaults
-MODE=""
-TLS="none"
-PORT="8096"
-DOMAIN=""
-GATEWAY=""
-USERNAME=""
-TOKEN=""
-DRY_RUN=false
-QUICK=false
-SSH_TARGET=""
-SSH_PORT="22"
-LANG_CHOICE=""
-EXPLICIT_LANG=""
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
-[ -z "$SCRIPT_DIR" ] && SCRIPT_DIR="."
-
-# ------------------------------------------------------------------------------
-#  PUBLIC DOMAIN - resolved from the one source of truth
-#
-#  The domain is declared exactly once, in core/domain.py. Everything below asks
-#  that same chain, in the same order, and this is the ONLY place in this script
-#  that picks a hostname:
-#
-#    1. an explicit --domain= / --gateway= on the command line;
-#    2. MESH_PUBLIC_URL in the environment;
-#    3. AGY_PUBLIC_BASE_URL in the environment (legacy alias, same meaning);
-#    4. the domain file - MESH_DOMAIN_FILE when set, otherwise
-#       /etc/antigravity-mesh/domain.env, or on Windows/Git Bash
-#       %USERPROFILE%\.config\antigravity-mesh\domain.env;
-#    5. $PUBLISHED_DOMAIN - the domain this copy was published with. The repository
-#       carries the placeholder __MESH_DOMAIN__ here and deploy_gateway.sh rewrites
-#       that line while publishing, so a served copy already knows its domain;
-#    6. core/domain.py's DEFAULT_PUBLIC_BASE_URL, but only when that module sits
-#       next to this script (a repository checkout, or a node that already
-#       bootstrapped). A clone has no published value and refusing to install from
-#       a clone would be wrong.
-#
-#  If none of them yields a real hostname the installer stops: registering a node
-#  against a domain that does not resolve produces a node that can never connect
-#  and an autostart entry that retries forever.
-# ------------------------------------------------------------------------------
-DOMAIN_PLACEHOLDER="__MESH_DOMAIN__"
-# deploy_gateway.sh rewrites THIS line only (it is anchored on PUBLISHED_DOMAIN=),
-# so the placeholder token above survives and still proves whether this copy was
-# published. In the repository the two are equal, which means "not published".
-PUBLISHED_DOMAIN="__MESH_DOMAIN__"
-
-# ------------------------------------------------------------------------------
-#  TERMUX / ANDROID
-#
-#  Termux is NOT FHS-compliant: there is no /etc, no /bin and no /usr at the
-#  usual locations, there is no root and no sudo, and its packages are built
-#  against Android's bionic libc. A phone is therefore neither "just Linux" (the
-#  Debian package names and the host-level domain file do not exist) nor
-#  something the Linux branches can serve unchanged. Everything Termux-specific
-#  in this script keys off the single flag below:
-#
-#    IS_TERMUX      - the one question every branch asks;
-#    TERMUX_PREFIX  - $PREFIX, the Termux root (.../com.termux/files/usr);
-#    TERMUX_SUPERVISED - set by configure_termux_node when runit supervises.
-#
-#  Detection never trusts one signal: Termux exports TERMUX_VERSION, its $PREFIX
-#  points into com.termux, and its application data directory has a fixed path.
-#  A Linux host that happens to export an unrelated $PREFIX is not a phone.
-# ------------------------------------------------------------------------------
-IS_TERMUX=false
-if [ -n "${TERMUX_VERSION:-}" ]; then
-    IS_TERMUX=true
-fi
-if [ "$IS_TERMUX" = false ] && [ -n "${PREFIX:-}" ]; then
-    case "$PREFIX" in
-        *com.termux*) IS_TERMUX=true ;;
-    esac
-fi
-if [ "$IS_TERMUX" = false ] && [ -d /data/data/com.termux/files/usr/bin ]; then
-    IS_TERMUX=true
-fi
-
-TERMUX_PREFIX=""
-TERMUX_SUPERVISED=false
-if [ "$IS_TERMUX" = true ]; then
-    TERMUX_PREFIX="${PREFIX:-}"
-    if [ -z "$TERMUX_PREFIX" ] || [ ! -d "$TERMUX_PREFIX/bin" ]; then
-        TERMUX_PREFIX="/data/data/com.termux/files/usr"
-    fi
-fi
-
-case "$(uname -s 2>/dev/null)" in
-    MINGW*|MSYS*|CYGWIN*) DEFAULT_DOMAIN_DIR="${USERPROFILE:-$HOME}/.config/antigravity-mesh" ;;
-    *)                    DEFAULT_DOMAIN_DIR="/etc/antigravity-mesh" ;;
-esac
-# A phone has no /etc and no root, so the per-user directory is the only place
-# that can hold the domain file there. core/domain.py answers the same question
-# in default_domain_file(), so the installer and the node never disagree about
-# where the domain lives.
-if [ "$IS_TERMUX" = true ]; then
-    DEFAULT_DOMAIN_DIR="$HOME/.config/antigravity-mesh"
-fi
-DEFAULT_DOMAIN_FILE="${MESH_DOMAIN_FILE:-$DEFAULT_DOMAIN_DIR/domain.env}"
-
-# The command that stores the domain, spelled for the platform it is printed on:
-# there is no sudo in Termux and no writable /etc, so the hint must not send a
-# phone user to a command that cannot exist there.
-domain_file_write_cmd() {
-    if [ "$IS_TERMUX" = true ]; then
-        printf "mkdir -p %s && echo 'MESH_PUBLIC_URL=%s' > %s" \
-            "$DEFAULT_DOMAIN_DIR" "$1" "$DEFAULT_DOMAIN_FILE"
-    else
-        printf "echo 'MESH_PUBLIC_URL=%s' | sudo tee %s" "$1" "$DEFAULT_DOMAIN_FILE"
-    fi
-}
-
-# https://mesh.example.com/path/ -> mesh.example.com (the authority only)
-normalise_host() {
-    printf '%s' "$1" | sed -e 's|^[A-Za-z][A-Za-z0-9+.-]*://||' -e 's|/.*$||' \
-        -e 's|^[[:space:]]*||' -e 's|[[:space:]]*$||'
-}
-
-# A KEY=VALUE file without its leading UTF-8 BOM (Windows PowerShell writes one).
-strip_bom() {
-    if [ "$(head -c 3 "$1" 2>/dev/null | od -An -tx1 | tr -d ' \n')" = "efbbbf" ]; then
-        tail -c +4 "$1"
-    else
-        cat "$1"
-    fi
-}
-
-# MESH_PUBLIC_URL outranks the legacy alias, whatever their order in the file.
-domain_file_value() {
-    local file="$1" value=""
-    if [ ! -f "$file" ]; then
-        return 0
-    fi
-    value="$(strip_bom "$file" | sed -n 's/^[[:space:]]*MESH_PUBLIC_URL[[:space:]]*=[[:space:]]*//p' | head -n 1)"
-    if [ -z "$value" ]; then
-        value="$(strip_bom "$file" | sed -n 's/^[[:space:]]*AGY_PUBLIC_BASE_URL[[:space:]]*=[[:space:]]*//p' | head -n 1)"
-    fi
-    printf '%s' "$value" | tr -d '"' | tr -d "'" | tr -d '\r' | sed -e 's|^[[:space:]]*||' -e 's|[[:space:]]*$||'
-}
-
-# The project default, taken from core/domain.py when that file is available here.
-module_default_domain() {
-    local module="$SCRIPT_DIR/core/domain.py" value=""
-    if [ ! -f "$module" ]; then
-        return 0
-    fi
-    if command -v python3 >/dev/null 2>&1; then
-        value="$(cd "$SCRIPT_DIR" 2>/dev/null && python3 -c 'from core import domain; print(domain.DEFAULT_PUBLIC_BASE_URL)' 2>/dev/null)" || true
-    fi
-    if [ -z "$value" ]; then
-        value="$(sed -n 's/^DEFAULT_PUBLIC_BASE_URL[[:space:]]*=[[:space:]]*"\(.*\)".*/\1/p' "$module" | head -n 1)"
-    fi
-    printf '%s' "$value"
-}
-
-resolve_domain() {
-    local explicit_value="${1:-}" candidate=""
-    if [ -n "$explicit_value" ]; then
-        printf '%s' "$(normalise_host "$explicit_value")"
-        return 0
-    fi
-    for candidate in "${MESH_PUBLIC_URL:-}" "${AGY_PUBLIC_BASE_URL:-}"; do
-        if [ -n "$candidate" ]; then
-            printf '%s' "$(normalise_host "$candidate")"
-            return 0
-        fi
-    done
-    candidate="$(domain_file_value "$DEFAULT_DOMAIN_FILE")"
-    if [ -n "$candidate" ]; then
-        printf '%s' "$(normalise_host "$candidate")"
-        return 0
-    fi
-    if [ -n "$PUBLISHED_DOMAIN" ] && [ "$PUBLISHED_DOMAIN" != "$DOMAIN_PLACEHOLDER" ]; then
-        printf '%s' "$(normalise_host "$PUBLISHED_DOMAIN")"
-        return 0
-    fi
-    candidate="$(module_default_domain)"
-    if [ -n "$candidate" ]; then
-        printf '%s' "$(normalise_host "$candidate")"
-        return 0
-    fi
-    printf '%s' "$DOMAIN_PLACEHOLDER"
-}
-
-# ------------------------------------------------------------------------------
-#  PERSIST THE DOMAIN (what the node reads to build its public links)
-#
-#  core/domain.py resolves the public domain from MESH_PUBLIC_URL in the
-#  environment, then from the domain file, then from its built-in default - and it
-#  never reads the legacy MESH_GATEWAY that agent.env carries. A node installed
-#  with only agent.env therefore dials the right gateway (gateway_host() does
-#  honour MESH_GATEWAY) while minting share links on the built-in default: a real
-#  Termux node published links on the default relay while its tunnel went to the
-#  gateway it was actually registered on.
-#
-#  This script has already resolved the domain, so it writes it down here - the
-#  same thing deploy_gateway.sh does for /etc/antigravity-mesh/domain.env on the
-#  gateway host. The place that decides the domain is then also the place that
-#  records it, and the node's links, its tunnel and the gateway agree by
-#  construction.
-#
-#  Never fatal: an unwritable /etc (no sudo, a locked-down box) still leaves a
-#  working node - the legacy MESH_GATEWAY keeps the tunnel where it was - so a
-#  failure only prints the command the operator can run by hand.
-# ------------------------------------------------------------------------------
-write_domain_file() {
-    local domain existing content module_default parent
-    domain="$(normalise_host "${1:-}")"
-    if [ -z "$domain" ] || [ "$domain" = "$DOMAIN_PLACEHOLDER" ]; then
-        return 0
-    fi
-    # Never record the project's built-in default. It is a fallback, not a decision:
-    # writing it would turn "nothing is configured" into a pinned domain file, and
-    # once that file exists core/domain.py stops consulting the legacy MESH_GATEWAY
-    # at all - the operator's own agent.env knob would silently go inert. Nothing is
-    # lost by skipping it: with no file the resolver's last fallback IS that value,
-    # so the node's links and its tunnel still name the same host.
-    module_default="$(normalise_host "$(module_default_domain)")"
-    if [ -n "$module_default" ] && [ "$domain" = "$module_default" ]; then
-        return 0
-    fi
-    existing="$(normalise_host "$(domain_file_value "$DEFAULT_DOMAIN_FILE")")"
-    if [ "$existing" = "$domain" ]; then
-        return 0
-    fi
-    content="MESH_PUBLIC_URL=https://${domain}"
-    # The parent of the file that is actually used, not of the default path: with
-    # MESH_DOMAIN_FILE pointing into a directory that does not exist yet, the old
-    # code created a directory nobody would read and then failed to write.
-    parent="$(dirname "$DEFAULT_DOMAIN_FILE")"
-
-    if mkdir -p "$parent" 2>/dev/null \
-        && printf '%s\n' "$content" > "$DEFAULT_DOMAIN_FILE" 2>/dev/null; then
-        :
-    elif run_privileged mkdir -p "$parent" >/dev/null 2>&1 \
-        && printf '%s\n' "$content" | run_privileged tee "$DEFAULT_DOMAIN_FILE" >/dev/null 2>&1; then
-        :
-    else
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "${YELLOW}[!] Не удалось записать домен в ${DEFAULT_DOMAIN_FILE}.${RESET}"
-            echo -e "    Ссылки узла будут строиться на встроенном домене по умолчанию."
-            echo -e "    Запишите вручную: ${CYAN}$(domain_file_write_cmd "https://${domain}")${RESET}"
-        else
-            echo -e "${YELLOW}[!] Could not write the domain to ${DEFAULT_DOMAIN_FILE}.${RESET}"
-            echo -e "    The node's links would use the built-in default domain."
-            echo -e "    Write it by hand: ${CYAN}$(domain_file_write_cmd "https://${domain}")${RESET}"
-        fi
-        return 0
-    fi
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        if [ -n "$existing" ]; then
-            echo -e "${GREEN}[OK] Домен узла: ${content} (${DEFAULT_DOMAIN_FILE}, было https://${existing})${RESET}"
-        else
-            echo -e "${GREEN}[OK] Домен узла: ${content} (${DEFAULT_DOMAIN_FILE})${RESET}"
-        fi
-    else
-        if [ -n "$existing" ]; then
-            echo -e "${GREEN}[OK] Node domain: ${content} (${DEFAULT_DOMAIN_FILE}, was https://${existing})${RESET}"
-        else
-            echo -e "${GREEN}[OK] Node domain: ${content} (${DEFAULT_DOMAIN_FILE})${RESET}"
-        fi
-    fi
-    return 0
-}
-
-# Downloading the node code needs the domain, and so does every cloud-gateway
-# mode. A standalone install that already has the code next to it needs neither.
-domain_required() {
-    if [ ! -f "$SCRIPT_DIR/core/agent.py" ]; then
-        return 0
-    fi
-    if [ "$MODE" != "standalone" ]; then
-        return 0
-    fi
-    return 1
-}
-
-CONFIG_DIR="$HOME/.config/antigravity-mesh"
-CONFIG_FILE="$CONFIG_DIR/agent.env"
-
-# Colors
-BOLD="\033[1m"
-GREEN="\033[0;32m"
-CYAN="\033[0;36m"
-YELLOW="\033[1;33m"
-BLUE="\033[0;34m"
-MAGENTA="\033[0;35m"
-RESET="\033[0m"
-
-# ------------------------------------------------------------------------------
-#  PYTHON AND ITS DEPENDENCIES
-#
-#  websockets is the node's ONLY external requirement: core/mcp_tools.py and
-#  core/server.py are standard library only. Everything below exists because a
-#  fresh or minimal system can fail to provide it for a different reason each time:
-#
-#    * no Python at all          -> install it from the system package manager;
-#    * Python but no pip         -> ensurepip, or uv, which needs no pip;
-#    * pip refuses to write      -> PEP 668 "externally managed", or no permission
-#                                   on site-packages: --user, then a venv;
-#    * no usable package manager -> uv, which fetches its own CPython;
-#    * nothing works at all      -> STOP, like the Windows installer does.
-#
-#  The last point is the important one. This script used to continue with
-#  PYTHON_BIN=/usr/bin/python3 whether or not that file existed, wrote a systemd
-#  unit or a launchd plist naming it, and reported success. The node then never
-#  started and the only evidence was one log line - the exact silent failure the
-#  Windows installer already refuses to produce.
-#
-#  PYTHON_BIN is the single interpreter everything afterwards must use, including
-#  the autostart unit. It is NOT necessarily "python3" from PATH: the venv and uv
-#  fallbacks both live outside PATH on purpose.
-# ------------------------------------------------------------------------------
-PYTHON_BIN=""
-UV_BIN=""
-
-# Is this a real, runnable Python 3? A name that answers to "command -v" is not
-# evidence: a broken shim, a half-removed distro package and a stale symlink all
-# pass that test and then fail every call.
-python_works() {
-    [ -n "$1" ] || return 1
-    command -v "$1" >/dev/null 2>&1 || [ -x "$1" ] || return 1
-    "$1" -c 'import sys; raise SystemExit(0 if sys.version_info[0] == 3 else 1)' >/dev/null 2>&1
-}
-
-python_has_websockets() {
-    [ -n "$1" ] || return 1
-    "$1" -c 'import websockets' >/dev/null 2>&1
-}
-
-python_has_pip() {
-    [ -n "$1" ] || return 1
-    "$1" -m pip --version >/dev/null 2>&1
-}
-
-# Every call site after ensure_dependencies uses "$PYTHON_BIN"; this is what finds
-# it. The uv-managed interpreter is searched too, because on a machine where uv is
-# what provided Python there is no python3 on PATH at all.
-resolve_python() {
-    local cand uv_root
-    for cand in python3 python; do
-        if python_works "$cand"; then
-            PYTHON_BIN="$(command -v "$cand")"
-            return 0
-        fi
-    done
-    uv_root="${UV_PYTHON_INSTALL_DIR:-$HOME/.local/share/uv/python}"
-    if [ -d "$uv_root" ]; then
-        for cand in "$uv_root"/cpython-3*/bin/python3; do
-            if [ -x "$cand" ] && python_works "$cand"; then
-                PYTHON_BIN="$cand"
-                return 0
-            fi
-        done
-    fi
-    return 1
-}
-
-# sudo when not already root, and nothing at all when neither is available. The old
-# code spelled this out per branch and forgot it for apk, so `apk add` silently did
-# nothing on a non-root Alpine - the one platform where Python is never preinstalled.
-run_privileged() {
-    if [ "$(id -u)" -eq 0 ]; then
-        "$@"
-    elif command -v sudo >/dev/null 2>&1; then
-        sudo "$@"
-    else
-        return 1
-    fi
-}
-
-# One system-package install per platform, in a subshell with errexit off: a package
-# manager that fails (no network, no sudo, a locked database, a dead mirror) must
-# fall through to the next source instead of aborting the installer. Whether Python
-# actually arrived is decided by resolve_python afterwards, never by these exit codes.
-install_python_packages() {
-    (
-        set +e
-        if [ "$IS_TERMUX" = true ]; then
-            # Termux comes first: it HAS apt-get, but the Debian package names below
-            # (python3-pip, python3-venv) do not exist there, `pkg` is the wrapper
-            # that refreshes the index itself, and run_privileged cannot help -
-            # a phone is never root and has no sudo. pip and the venv wheels are
-            # separate packages, and python3 is a virtual name provided by python.
-            pkg install -y python python-pip python-ensurepip-wheels curl ca-certificates
-        elif command -v apt-get >/dev/null 2>&1; then
-            run_privileged apt-get update -qq
-            run_privileged apt-get install -y -qq python3 python3-pip python3-venv curl ca-certificates
-        elif command -v dnf >/dev/null 2>&1; then
-            run_privileged dnf install -y -q python3 python3-pip curl ca-certificates
-        elif command -v yum >/dev/null 2>&1; then
-            run_privileged yum install -y -q python3 python3-pip curl ca-certificates
-        elif command -v zypper >/dev/null 2>&1; then
-            run_privileged zypper --non-interactive install python3 python3-pip curl ca-certificates
-        elif command -v pacman >/dev/null 2>&1; then
-            run_privileged pacman -Sy --noconfirm python python-pip curl ca-certificates
-        elif command -v apk >/dev/null 2>&1; then
-            run_privileged apk add --no-cache python3 py3-pip curl ca-certificates
-        elif command -v xbps-install >/dev/null 2>&1; then
-            run_privileged xbps-install -Sy python3 python3-pip curl ca-certificates
-        elif [ "$(uname -s 2>/dev/null)" = "Darwin" ] && command -v brew >/dev/null 2>&1; then
-            brew install python3
-        else
-            return 1
-        fi
-        return 0
-    )
-}
-
-# curl is the script's transport, not a Python dependency: the bootstrap download,
-# node registration and the standalone health check all go through it. A machine can
-# have a perfectly good Python 3 and no curl at all (a minimal WSL image, a slim
-# container, a phone where only python was installed), and install_python_packages()
-# never runs in that case - it is called only when Python itself is missing. So the
-# tool is asked for separately, BEFORE the step that needs it.
-install_helper_packages() {
-    (
-        set +e
-        if [ "$IS_TERMUX" = true ]; then
-            pkg install -y curl ca-certificates
-        elif command -v apt-get >/dev/null 2>&1; then
-            run_privileged apt-get update -qq
-            run_privileged apt-get install -y -qq curl ca-certificates
-        elif command -v dnf >/dev/null 2>&1; then
-            run_privileged dnf install -y -q curl ca-certificates
-        elif command -v yum >/dev/null 2>&1; then
-            run_privileged yum install -y -q curl ca-certificates
-        elif command -v zypper >/dev/null 2>&1; then
-            run_privileged zypper --non-interactive install curl ca-certificates
-        elif command -v pacman >/dev/null 2>&1; then
-            run_privileged pacman -Sy --noconfirm curl ca-certificates
-        elif command -v apk >/dev/null 2>&1; then
-            run_privileged apk add --no-cache curl ca-certificates
-        elif command -v xbps-install >/dev/null 2>&1; then
-            run_privileged xbps-install -Sy curl ca-certificates
-        elif [ "$(uname -s 2>/dev/null)" = "Darwin" ] && command -v brew >/dev/null 2>&1; then
-            brew install curl
-        else
-            return 1
-        fi
-        return 0
-    )
-}
-
-# True when curl is usable. Installs it if it is not, and fails closed when it cannot
-# be obtained: without it the node can never be registered, and the alternative - the
-# raw "curl: command not found" at the registration line - names neither the cause nor
-# the fix. Called before the bootstrap download, before registration and before the
-# standalone health check.
-ensure_curl() {
-    command -v curl >/dev/null 2>&1 && return 0
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "\033[1;33m[!] curl не найден. Устанавливаю пакеты...\033[0m"
-    else
-        echo -e "\033[1;33m[!] curl not found. Installing it...\033[0m"
-    fi
-    install_helper_packages || true
-    command -v curl >/dev/null 2>&1 && return 0
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "\033[1;31m[!] Без curl установка невозможна.\033[0m" >&2
-        echo -e "    Через него скачивается код узла, регистрируется узел и проверяется локальный порт." >&2
-        if [ "$IS_TERMUX" = true ]; then
-            echo -e "    Установите вручную и повторите: ${CYAN}pkg install curl${RESET}" >&2
-        else
-            echo -e "    Установите вручную и повторите: ${CYAN}sudo apt install curl${RESET}   # или ваш менеджер пакетов" >&2
-        fi
-        echo -e "    Остановка: без curl ничего не создано." >&2
-    else
-        echo -e "\033[1;31m[!] curl is required and could not be installed.\033[0m" >&2
-        echo -e "    It downloads the node code, registers the node and checks the local port." >&2
-        if [ "$IS_TERMUX" = true ]; then
-            echo -e "    Install it and re-run: ${CYAN}pkg install curl${RESET}" >&2
-        else
-            echo -e "    Install it and re-run: ${CYAN}sudo apt install curl${RESET}   # or your package manager" >&2
-        fi
-        echo -e "    Stopping: nothing was created without it." >&2
-    fi
-    return 1
-}
-
-# uv is the last resort: one static binary that fetches its own CPython and installs
-# packages without pip. The release archive is downloaded and unpacked here rather
-# than piping astral.sh's install script into sh - a script that arrives over the
-# network and is executed unread is a worse default than an archive this unpacks.
-ensure_uv() {
-    if command -v uv >/dev/null 2>&1; then
-        UV_BIN="$(command -v uv)"
-        return 0
-    fi
-    if [ -x "$CONFIG_DIR/bin/uv" ]; then
-        UV_BIN="$CONFIG_DIR/bin/uv"
-        return 0
-    fi
-    # UV_TARGET is empty on an architecture uv publishes no build for, and asking
-    # for the wrong one produces an "Exec format error" that names no cause.
-    [ -n "$UV_TARGET" ] || return 1
-    command -v curl >/dev/null 2>&1 || return 1
-    local tmp
-    tmp="$(mktemp -d 2>/dev/null)" || return 1
-    if curl -fsSL "https://github.com/astral-sh/uv/releases/latest/download/uv-${UV_TARGET}.tar.gz" \
-        -o "$tmp/uv.tar.gz" 2>/dev/null; then
-        if tar -xzf "$tmp/uv.tar.gz" -C "$tmp" 2>/dev/null && [ -f "$tmp/uv-${UV_TARGET}/uv" ]; then
-            mkdir -p "$CONFIG_DIR/bin"
-            cp "$tmp/uv-${UV_TARGET}/uv" "$CONFIG_DIR/bin/uv" 2>/dev/null && chmod +x "$CONFIG_DIR/bin/uv"
-        fi
-    fi
-    rm -rf "$tmp"
-    if [ -x "$CONFIG_DIR/bin/uv" ]; then
-        UV_BIN="$CONFIG_DIR/bin/uv"
-        return 0
-    fi
-    return 1
-}
-
-uv_pip_install() {
-    [ -n "$UV_BIN" ] || return 1
-    "$UV_BIN" pip install --python "$1" websockets >/dev/null 2>&1
-}
-
-# The two packages that make a Termux node behave like a supervised Linux node
-# rather than a bare process: termux-services (runit: Restart=always) and
-# termux-api (every termux-* command the device branch uses; the Termux:API app
-# must be installed as well for these to answer). Both are optional - the install
-# degrades instead of failing - so this never reports an error.
-ensure_termux_extras() {
-    [ "$IS_TERMUX" = true ] || return 0
-    command -v pkg >/dev/null 2>&1 || return 0
-    local missing=""
-    command -v sv >/dev/null 2>&1 || missing="termux-services"
-    # termux-wake-lock is NOT proof that termux-api is installed: on a real phone
-    # (Android 16, OPPO PHY110) that one script existed while termux-battery-status,
-    # termux-wifi-connectioninfo, termux-sensor and every other command were
-    # missing. Checking the wake lock therefore declared the package present and
-    # left the whole device branch dead with nothing to explain it. A command that
-    # only termux-api ships is the honest probe.
-    command -v termux-battery-status >/dev/null 2>&1 || missing="$missing termux-api"
-    # Termux ships pip separately from python, and its interpreter is built
-    # --without-ensurepip: without these two packages neither `pip install` nor the
-    # venv fallback below can work, and the failure would look like a broken node
-    # rather than a missing package.
-    if ! python_has_pip "$PYTHON_BIN"; then
-        missing="$missing python-pip python-ensurepip-wheels"
-    fi
-    [ -n "$missing" ] || return 0
-    # Unquoted on purpose: this is a package list, and pkg install takes them all.
-    # shellcheck disable=SC2086
-    pkg install -y $missing >/dev/null 2>&1 || true
-    return 0
-}
-
-# True when a usable Python 3 is on the machine. Installs one if it is not.
-ensure_python() {
-    resolve_python && return 0
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "\033[1;33m[!] Python 3 не найден. Автоматическая установка системных пакетов...\033[0m"
-    else
-        echo -e "\033[1;33m[!] Python 3 not found. Installing system packages...\033[0m"
-    fi
-    install_python_packages || true
-    resolve_python && return 0
-
-    # No usable package manager: uv can still bring an interpreter of its own.
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "\033[1;33m[!] Пакетный менеджер не дал Python. Пробую uv...\033[0m"
-    else
-        echo -e "\033[1;33m[!] The package manager did not provide Python. Trying uv...\033[0m"
-    fi
-    if ensure_uv && "$UV_BIN" python install 3.12 >/dev/null 2>&1; then
-        resolve_python && return 0
-    fi
-    return 1
-}
-
-ensure_dependencies() {
-    if ! ensure_python; then
-        # Fail closed. An autostart unit naming an interpreter that does not exist
-        # is a node that never connects, and nothing in the output would have said so.
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "\033[1;31m[!] Рабочий Python 3 получить не удалось.\033[0m" >&2
-            if [ "$IS_TERMUX" = true ]; then
-                echo -e "    Проверено: ${CYAN}pkg${RESET} (пакетный менеджер Termux; uv не используется," >&2
-                echo -e "    его сборки линкуются с glibc и на Android/bionic не запускаются)." >&2
-                echo -e "    Установите Python 3 вручную и повторите:" >&2
-                echo -e "      ${CYAN}pkg install python python-pip${RESET}" >&2
-            else
-                echo -e "    Проверены: пакетный менеджер (apt/dnf/yum/zypper/pacman/apk/xbps/brew) и uv." >&2
-                echo -e "    Установите Python 3 вручную и повторите:" >&2
-                echo -e "      ${CYAN}sudo apt install python3 python3-pip python3-venv${RESET}   # или ваш менеджер" >&2
-            fi
-            echo -e "    Остановка: без интерпретатора автозапуск узла работать не будет, ничего не создано." >&2
-        else
-            echo -e "\033[1;31m[!] Could not obtain a working Python 3.\033[0m" >&2
-            if [ "$IS_TERMUX" = true ]; then
-                echo -e "    Tried: ${CYAN}pkg${RESET}, the Termux package manager (uv is skipped there: its" >&2
-                echo -e "    builds link against glibc and cannot run on Android's bionic libc)." >&2
-                echo -e "    Install Python 3 by hand and re-run:" >&2
-                echo -e "      ${CYAN}pkg install python python-pip${RESET}" >&2
-            else
-                echo -e "    Tried: the system package manager (apt/dnf/yum/zypper/pacman/apk/xbps/brew) and uv." >&2
-                echo -e "    Install Python 3 by hand and re-run:" >&2
-                echo -e "      ${CYAN}sudo apt install python3 python3-pip python3-venv${RESET}   # or your package manager" >&2
-            fi
-            echo -e "    Stopping: an autostart entry without an interpreter can never work, nothing was created." >&2
-        fi
-        exit 1
-    fi
-
-    ensure_termux_extras
-
-    if python_has_websockets "$PYTHON_BIN"; then
-        return 0
-    fi
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo "[1/4] Автономная установка зависимостей (websockets)..."
-    else
-        echo "[1/4] Installing dependencies (websockets)..."
-    fi
-
-    # 1. pip, in both spellings. The --break-system-packages retry is the escape
-    #    hatch a PEP 668 distribution documents; without it a Debian 12 or Fedora 38
-    #    refuses the install and the message never mentions the flag.
-    "$PYTHON_BIN" -m pip install --quiet websockets 2>/dev/null || true
-    python_has_websockets "$PYTHON_BIN" && return 0
-    "$PYTHON_BIN" -m pip install --quiet --break-system-packages websockets 2>/dev/null || true
-    python_has_websockets "$PYTHON_BIN" && return 0
-
-    # 2. --user: site-packages is read-only, the home directory is not.
-    "$PYTHON_BIN" -m pip install --quiet --user websockets 2>/dev/null || true
-    python_has_websockets "$PYTHON_BIN" && return 0
-
-    # 3. ensurepip: a distribution can ship python3 without a pip at all.
-    "$PYTHON_BIN" -m ensurepip --default-pip >/dev/null 2>&1 || true
-    "$PYTHON_BIN" -m pip install --quiet websockets 2>/dev/null || true
-    python_has_websockets "$PYTHON_BIN" && return 0
-
-    # 4. uv: installs into a managed environment without the interpreter's own pip.
-    if ensure_uv; then
-        uv_pip_install "$PYTHON_BIN" || true
-        python_has_websockets "$PYTHON_BIN" && return 0
-    fi
-
-    # 5. venv: needs no write access to the system Python, only the interpreter.
-    local venv_dir="$CONFIG_DIR/venv"
-    if [ ! -x "$venv_dir/bin/python3" ]; then
-        "$PYTHON_BIN" -m venv "$venv_dir" >/dev/null 2>&1 || true
-    fi
-    if [ -x "$venv_dir/bin/python3" ]; then
-        "$venv_dir/bin/python3" -m pip install --quiet --upgrade pip >/dev/null 2>&1 || true
-        "$venv_dir/bin/python3" -m pip install --quiet websockets >/dev/null 2>&1 || true
-        if python_has_websockets "$venv_dir/bin/python3"; then
-            PYTHON_BIN="$venv_dir/bin/python3"
-            return 0
-        fi
-        if uv_pip_install "$venv_dir/bin/python3" && python_has_websockets "$venv_dir/bin/python3"; then
-            PYTHON_BIN="$venv_dir/bin/python3"
-            return 0
-        fi
-    fi
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "\033[1;31m[!] Не удалось установить websockets автоматически.\033[0m" >&2
-        echo -e "    Проверены: pip, pip --break-system-packages, pip --user, ensurepip, uv и venv." >&2
-        echo -e "    Выполните вручную: ${CYAN}$PYTHON_BIN -m pip install websockets${RESET}" >&2
-        if [ "$IS_TERMUX" = true ]; then
-            echo -e "    Termux: ${CYAN}pkg install python-pip python-ensurepip-wheels${RESET}, затем повторите." >&2
-        fi
-        echo -e "    Остановка: узел без websockets не сможет подключиться к шлюзу." >&2
-    else
-        echo -e "\033[1;31m[!] Could not install websockets automatically.\033[0m" >&2
-        echo -e "    Tried: pip, pip --break-system-packages, pip --user, ensurepip, uv and a venv." >&2
-        echo -e "    Run manually: ${CYAN}$PYTHON_BIN -m pip install websockets${RESET}" >&2
-        if [ "$IS_TERMUX" = true ]; then
-            echo -e "    Termux: ${CYAN}pkg install python-pip python-ensurepip-wheels${RESET}, then re-run." >&2
-        fi
-        echo -e "    Stopping: a node without websockets can never reach the gateway." >&2
-    fi
-    exit 1
-}
-
-
-# Parse CLI args
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --lang=*)
-            LANG_CHOICE="${1#*=}"
-            EXPLICIT_LANG=true
-            shift
-            ;;
-        -q|--quick)
-            QUICK=true
-            shift
-            ;;
-        --mode=*)
-            MODE="${1#*=}"
-            shift
-            ;;
-        --user=*)
-            USERNAME="${1#*=}"
-            shift
-            ;;
-        --token=*)
-            TOKEN="${1#*=}"
-            shift
-            ;;
-        --gateway=*)
-            # Historical alias of --domain=: both are the explicit override.
-            DOMAIN="${1#*=}"
-            shift
-            ;;
-        --port=*)
-            PORT="${1#*=}"
-            shift
-            ;;
-        --ssh=*)
-            SSH_ARG="${1#*=}"
-            if [[ "$SSH_ARG" =~ ^([^:]+):([0-9]+)$ ]]; then
-                SSH_TARGET="${BASH_REMATCH[1]}"
-                SSH_PORT="${BASH_REMATCH[2]}"
-            else
-                SSH_TARGET="$SSH_ARG"
-            fi
-            shift
-            ;;
-        --tls=*)
-            TLS="${1#*=}"
-            shift
-            ;;
-        --domain=*)
-            # The shared public domain that serves every node. This is NOT a
-            # per-device subdomain: nodes are selected with ?user=<node>.
-            DOMAIN="${1#*=}"
-            GATEWAY="$DOMAIN"
-            shift
-            ;;
-        --dry-run)
-            DRY_RUN=true
-            shift
-            ;;
-        -h|--help)
-            echo "Usage: $0 [--lang=en|ru] [-q|--quick] [--mode=tunnel|standalone|gateway] [--user=<node-name>] [--token=<token>] [--domain=<shared-domain>] [--port=<port>] [--ssh=user@host] [--dry-run]"
-            echo ""
-            echo "All nodes use ONE shared domain; the node is selected by ?user=<node-name>:"
-            echo "  MCP URL: https://<shared-domain>/sse?user=<node-name>&token=<token>"
-            echo ""
-            echo "The shared domain is resolved from the one place that declares it, in this order:"
-            echo "  --domain= / --gateway=, then MESH_PUBLIC_URL, then AGY_PUBLIC_BASE_URL,"
-            echo "  then ${DEFAULT_DOMAIN_FILE}, then the value this copy was published with,"
-            echo "  then core/domain.py's default when the repository is present."
-            echo ""
-            echo "Android/Termux is detected automatically: packages come from pkg, the node is"
-            echo "named after the device model, and autostart is a runit service plus the"
-            echo "Termux:Boot app instead of systemd (see docs/TERMUX.md)."
-            exit 0
-            ;;
-        *)
-            echo -e "${YELLOW}[ERROR] Unknown parameter: $1${RESET}"
-            exit 1
-            ;;
-    esac
-done
-
-# ------------------------------------------------------------------------------
-#  Resolve the shared domain, then fetch the node code from it.
-#
-#  Order matters: the CLI arguments are parsed first (so --domain= counts), the
-#  domain is resolved second, and only then is the bootstrap downloaded - from
-#  the resolved domain, never from a name baked into this file.
-# ------------------------------------------------------------------------------
-GATEWAY="$(resolve_domain "$DOMAIN")"
-
-if [ "$GATEWAY" = "$DOMAIN_PLACEHOLDER" ]; then
-    if domain_required; then
-        echo ""
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "${RED}${BOLD}[ОШИБКА] Домен шлюза не задан.${RESET}"
-            echo -e "  В этой копии установщика остался плейсхолдер ${BOLD}${DOMAIN_PLACEHOLDER}${RESET}: она не была опубликована"
-            echo -e "  скриптом deploy_gateway.sh, а домена нет ни в окружении, ни в файле ${BOLD}${DEFAULT_DOMAIN_FILE}${RESET}."
-            echo -e "  Укажите домен одним из способов:"
-            echo -e "    ${CYAN}./install.sh --domain=<общий-домен>${RESET}"
-            echo -e "    ${CYAN}MESH_PUBLIC_URL=https://<общий-домен> ./install.sh${RESET}"
-            echo -e "    ${CYAN}$(domain_file_write_cmd 'https://<общий-домен>')${RESET}"
-            echo -e "  ${YELLOW}Установка остановлена: регистрация на несуществующем домене не выполняется, ничего не создано.${RESET}"
-        else
-            echo -e "${RED}${BOLD}[ERROR] No gateway domain configured.${RESET}"
-            echo -e "  This copy of the installer still carries the ${BOLD}${DOMAIN_PLACEHOLDER}${RESET} placeholder: it was not"
-            echo -e "  published by deploy_gateway.sh, and no domain was found in the environment or in ${BOLD}${DEFAULT_DOMAIN_FILE}${RESET}."
-            echo -e "  Pass the domain in one of these ways:"
-            echo -e "    ${CYAN}./install.sh --domain=<shared-domain>${RESET}"
-            echo -e "    ${CYAN}MESH_PUBLIC_URL=https://<shared-domain> ./install.sh${RESET}"
-            echo -e "    ${CYAN}$(domain_file_write_cmd 'https://<shared-domain>')${RESET}"
-            echo -e "  ${YELLOW}Stopping: a node is never registered against a domain that does not exist, nothing was created.${RESET}"
-        fi
-        echo ""
-        exit 1
-    fi
-    # Standalone install with the node code already next to this script: no domain
-    # is needed, so this is a warning rather than a stop.
-    GATEWAY=""
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "${YELLOW}[!] Домен не задан - автономному режиму он не нужен, продолжаю.${RESET}"
-    else
-        echo -e "${YELLOW}[!] No domain configured - not needed for standalone mode, continuing.${RESET}"
-    fi
-fi
-
-# ------------------------------------------------------------------------------
-#  GATEWAY REACHABILITY (the one preflight that cannot be deferred)
-#
-#  A node downloads its code from the gateway, registers there, and then dials the
-#  same name for its tunnel. A name this device cannot resolve therefore dooms
-#  every later step - and the failure used to surface much later, as "Failed to
-#  obtain authentication token", which blames the gateway's answer instead of the
-#  missing DNS record. Phones are where this bites: a gateway on a private network
-#  (Tailscale, a VPN, a DNS override on the operator's laptop) resolves on that
-#  laptop and nowhere else, and mobile data resolves nothing private.
-#
-#  Only curl's exit code 6 ("could not resolve host") stops the install: it is the
-#  one answer that cannot become true later in this run. A timeout, a 404 or a 5xx
-#  is not fatal - a gateway without /health still serves the tunnel, and refusing
-#  to install for that would be wrong.
-# ------------------------------------------------------------------------------
-require_gateway_dns() {
-    [ -n "$GATEWAY" ] || return 0
-    command -v curl >/dev/null 2>&1 || return 0
-    local rc=0
-    curl -fsS -m 8 -o /dev/null "https://${GATEWAY}/health" >/dev/null 2>&1 || rc=$?
-    [ "$rc" -eq 6 ] || return 0
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo ""
-        echo -e "${RED}${BOLD}[ОШИБКА] Имя шлюза не разрешается на этом устройстве: ${GATEWAY}${RESET}"
-        echo -e "  DNS не знает такого имени, поэтому ни скачать код узла, ни зарегистрировать его не выйдет."
-        echo -e "  Обычно так бывает, когда шлюз живёт в приватной сети (Tailscale, VPN, локальный DNS):"
-        echo -e "  на рабочем ноутбуке имя резолвится, а на телефоне в мобильной сети - нет."
-        echo -e "  Что делать:"
-        echo -e "    • подключить это устройство к той же сети (на Android - приложение Tailscale);"
-        echo -e "    • или указать домен, который резолвится публично: ${CYAN}--domain=<домен>${RESET};"
-        echo -e "    • проверить вручную: ${CYAN}curl -v https://${GATEWAY}/health${RESET}"
-        echo -e "  ${YELLOW}Остановка: без DNS узел не подключится к шлюзу, ничего не создано.${RESET}"
-        echo ""
-    else
-        echo ""
-        echo -e "${RED}${BOLD}[ERROR] This device cannot resolve the gateway name: ${GATEWAY}${RESET}"
-        echo -e "  DNS does not know the name, so neither the node code nor a registration can arrive."
-        echo -e "  This is the usual state of a gateway on a private network (Tailscale, a VPN, a local"
-        echo -e "  DNS override): it resolves on the operator's laptop and not on a phone on mobile data."
-        echo -e "  What to do:"
-        echo -e "    • put this device on the same network (on Android: the Tailscale app);"
-        echo -e "    • or name a domain that resolves publicly: ${CYAN}--domain=<domain>${RESET};"
-        echo -e "    • check by hand: ${CYAN}curl -v https://${GATEWAY}/health${RESET}"
-        echo -e "  ${YELLOW}Stopping: without DNS the node can never reach the gateway, nothing was created.${RESET}"
-        echo ""
-    fi
-    return 1
-}
-
-# Bootstrap when piped from curl or run outside the project: the node code is
-# fetched from the SAME domain that was just resolved. core/domain.py travels with
-# it, because the node asks that module for the domain as well.
-if [ ! -f "$SCRIPT_DIR/core/agent.py" ]; then
-    # The node code is fetched with curl. Piping this script through curl means curl
-    # exists; arriving through wget, a copy-paste or an embedded runner does not.
-    ensure_curl || exit 1
-    require_gateway_dns || exit 1
-    BOOTSTRAP_DIR="$HOME/.gemini-computer-use"
-    mkdir -p "$BOOTSTRAP_DIR/core" "$BOOTSTRAP_DIR/skills"
-    for f in core/agent.py core/server.py core/mcp_tools.py core/web_share.py core/domain.py core/vitals.py core/updater.py core/version.py core/__init__.py skills/orchestrator.md; do
-        bootstrap_tmp="$BOOTSTRAP_DIR/${f}.part"
-        if curl -fsSL "https://${GATEWAY}/${f}" -o "$bootstrap_tmp" 2>/dev/null \
-            || curl -fsSL "https://raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web/main/${f}" -o "$bootstrap_tmp" 2>/dev/null; then
-            mv "$bootstrap_tmp" "$BOOTSTRAP_DIR/${f}"
-        else
-            rm -f "$bootstrap_tmp"
-        fi
-    done
-    unset bootstrap_tmp
-    # A bootstrap that downloaded nothing (an unreachable gateway and no GitHub)
-    # leaves a directory that names modules which do not exist: every step after it
-    # would write a launcher for code that is not there, and the node would fail
-    # with a Python import error at boot.
-    if [ ! -f "$BOOTSTRAP_DIR/core/agent.py" ]; then
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "${RED}${BOLD}[ОШИБКА] Не удалось скачать код узла.${RESET}" >&2
-            echo -e "  Пробовали: ${CYAN}https://${GATEWAY}/core/agent.py${RESET} и ${CYAN}github.com/LevRa7/Computer-use-for-Gemini-App-Web${RESET}." >&2
-            echo -e "  Проверьте сеть и DNS либо скопируйте репозиторий на устройство и запустите из него:" >&2
-            echo -e "    ${CYAN}git clone https://github.com/LevRa7/Computer-use-for-Gemini-App-Web.git && cd Computer-use-for-Gemini-App-Web && ./install.sh --quick${RESET}" >&2
-            echo -e "  ${YELLOW}Остановка: без кода узла запускать нечего, ничего не создано.${RESET}" >&2
-        else
-            echo -e "${RED}${BOLD}[ERROR] Could not download the node code.${RESET}" >&2
-            echo -e "  Tried: ${CYAN}https://${GATEWAY}/core/agent.py${RESET} and ${CYAN}github.com/LevRa7/Computer-use-for-Gemini-App-Web${RESET}." >&2
-            echo -e "  Check the network and DNS, or put the repository on this device and install from it:" >&2
-            echo -e "    ${CYAN}git clone https://github.com/LevRa7/Computer-use-for-Gemini-App-Web.git && cd Computer-use-for-Gemini-App-Web && ./install.sh --quick${RESET}" >&2
-            echo -e "  ${YELLOW}Stopping: there is no node code to run, nothing was created.${RESET}" >&2
-        fi
-        echo ""
-        exit 1
-    fi
-    SCRIPT_DIR="$BOOTSTRAP_DIR"
-fi
-
-# ------------------------------------------------------------------------------
-#  SHARED-DOMAIN CONTRACT (canonical step)
-#  Every node is reached through ONE public domain ($GATEWAY); the node is
-#  selected by the ?user= query parameter. The installer never mints a
-#  per-device subdomain: each extra hostname would need its own DNS record and
-#  TLS SAN, and a name missing from the certificate fails the handshake with an
-#  opaque "cannot connect to host" error in the Gemini client.
-#     sse    https://<shared-domain>/sse?user=<node-name>&token=<token>
-#     http   https://<shared-domain>/mcp?user=<node-name>&token=<token>
-#     tunnel wss://<shared-domain>/ws/tunnel?user=<node-name>&token=<token>
-#  $GATEWAY is read at call time so the interactive menu can still change it.
-# ------------------------------------------------------------------------------
-node_sse_url() { printf 'https://%s/sse?user=%s&token=%s' "$GATEWAY" "$1" "$2"; }
-
-# Language prompt if interactive and not specified
-if [ -z "$LANG_CHOICE" ]; then
-    if [ "$QUICK" = false ] && [ -z "$MODE" ] && [ -t 0 ]; then
-        echo -e "\n${BOLD}${CYAN}╔════════════════════════════════════════════════════════════════════════╗${RESET}"
-        echo -e "${BOLD}${CYAN}║              🌐 LANGUAGE SELECTION / ВЫБОР ЯЗЫКА                       ║${RESET}"
-        echo -e "${BOLD}${CYAN}╚════════════════════════════════════════════════════════════════════════╝${RESET}"
-        echo -e "  ${GREEN}1)${RESET} English (Default)"
-        echo -e "  ${BLUE}2)${RESET} Русский"
-        read -rp "Select / Выберите [1]: " LANG_INPUT
-        if [ "$LANG_INPUT" = "2" ] || [ "$LANG_INPUT" = "ru" ] || [ "$LANG_INPUT" = "RU" ]; then
-            LANG_CHOICE="ru"
-        else
-            LANG_CHOICE="en"
-        fi
-    else
-        LANG_CHOICE="en"
-    fi
-fi
-
-# Device detection
-# ------------------------------------------------------------------------------
-#  ARCHITECTURE
-#
-#  The system package managers resolve their own architecture, so on Linux this
-#  matters for exactly two things: the uv archive, which is published per CPU and
-#  answers the wrong one with an unhelpful "Exec format error", and the
-#  registration payload, so a gateway operator can see which build a node runs.
-#  macOS reports the same machine names as Linux but needs the -apple-darwin assets.
-# ------------------------------------------------------------------------------
-detect_arch() {
-    DETECTED_ARCH="$(uname -m 2>/dev/null || echo unknown)"
-    case "$DETECTED_ARCH" in
-        x86_64|amd64)        ARCH_LABEL="x86_64 (64-bit)";      UV_TARGET="x86_64-unknown-linux-gnu" ;;
-        aarch64|arm64)       ARCH_LABEL="aarch64 (64-bit ARM)"; UV_TARGET="aarch64-unknown-linux-gnu" ;;
-        armv7l|armv7|armv6l) ARCH_LABEL="armv7 (32-bit ARM)";   UV_TARGET="armv7-unknown-linux-gnueabihf" ;;
-        i386|i486|i586|i686) ARCH_LABEL="x86 (32-bit)";         UV_TARGET="i686-unknown-linux-gnu" ;;
-        *)                   ARCH_LABEL="$DETECTED_ARCH";       UV_TARGET="" ;;
-    esac
-    if [ "$(uname -s 2>/dev/null)" = "Darwin" ]; then
-        case "$DETECTED_ARCH" in
-            x86_64) UV_TARGET="x86_64-apple-darwin" ;;
-            arm64)  UV_TARGET="aarch64-apple-darwin" ;;
-        esac
-    fi
-    if [ "$IS_TERMUX" = true ]; then
-        # uv's archives are glibc/musl builds; neither runs against Android's
-        # bionic libc, and asking for one yields an "Exec format error" that names
-        # no cause. On a phone the package manager is the only source of Python.
-        UV_TARGET=""
-    fi
-}
-
-# Android system properties. getprop lives in /system/bin on every Android build
-# and is readable without root; a missing getprop (or an empty property) simply
-# yields an empty value, never a failed install.
-android_prop() {
-    command -v getprop >/dev/null 2>&1 || return 0
-    getprop "$1" 2>/dev/null | tr -d '\r' | head -n 1
-}
-
-detect_device() {
-    # `|| true` on purpose: a minimal container (and Termux, which has no
-    # hostname(1) of its own) answers neither spelling, and an assignment whose
-    # substitution fails would abort the whole installer under `set -e`.
-    DETECTED_HOSTNAME=$(hostname -s 2>/dev/null || hostname 2>/dev/null || true)
-    detect_arch
-
-    if [ "$IS_TERMUX" = true ]; then
-        ANDROID_MODEL="$(android_prop ro.product.model)"
-        [ -n "$ANDROID_MODEL" ] || ANDROID_MODEL="$(android_prop ro.product.device)"
-        ANDROID_RELEASE="$(android_prop ro.build.version.release)"
-        [ -n "$ANDROID_RELEASE" ] || ANDROID_RELEASE="$(android_prop ro.build.version.sdk)"
-        DETECTED_OS="Android ${ANDROID_RELEASE:-unknown} (Termux)"
-        # The phone itself names the node. Termux has no hostname binary, and
-        # Android's gethostname(2) answers "localhost" - a name every phone would
-        # claim, and the gateway keeps exactly one tunnel per name, so they would
-        # knock each other offline in a loop. The device model is stable, and it is
-        # sanitised below exactly like a hostname.
-        DETECTED_HOSTNAME="${ANDROID_MODEL:-android-node}"
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            DETECTED_TYPE="Смартфон/планшет Android (Termux)"
-        else
-            DETECTED_TYPE="Android phone/tablet (Termux)"
-        fi
-    elif [ "$(uname -s)" = "Darwin" ]; then
-        DETECTED_OS="macOS $(sw_vers -productVersion 2>/dev/null || '')"
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            DETECTED_TYPE="Apple Mac"
-            sysctl -n hw.model 2>/dev/null | grep -qi "book" && DETECTED_TYPE="Apple MacBook (Ноутбук)"
-        else
-            DETECTED_TYPE="Apple Mac"
-            sysctl -n hw.model 2>/dev/null | grep -qi "book" && DETECTED_TYPE="Apple MacBook (Laptop)"
-        fi
-    elif [ -f /etc/os-release ]; then
-        # shellcheck disable=SC1091
-        . /etc/os-release
-        DETECTED_OS="${PRETTY_NAME:-$NAME}"
-    else
-        DETECTED_OS=$(uname -s)
-    fi
-
-    if [ "$(uname -s)" != "Darwin" ] && [ "$IS_TERMUX" != true ]; then
-        # The virtualised environments are asked FIRST, before the battery. WSL2
-        # forwards the host's battery into /sys/class/power_supply, so the battery
-        # test matched inside WSL and reported the user's laptop instead of the
-        # subsystem they were actually installing into - the node registered as
-        # "Laptop" while running under Windows.
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            DETECTED_TYPE="Десктоп / Сервер"
-            if grep -q -i "microsoft" /proc/version 2>/dev/null; then
-                DETECTED_TYPE="WSL (Windows Subsystem for Linux)"
-            elif [ -f /.dockerenv ] || grep -q "docker\|containerd" /proc/1/cgroup 2>/dev/null; then
-                DETECTED_TYPE="Контейнер (Docker/LXC)"
-            elif [ -d /sys/class/power_supply ] && ls /sys/class/power_supply/BAT* 1>/dev/null 2>&1; then
-                DETECTED_TYPE="Ноутбук (Laptop)"
-            elif command -v systemd-detect-virt >/dev/null 2>&1 && systemd-detect-virt -q; then
-                DETECTED_TYPE="Облачный сервер / VPS ($(systemd-detect-virt))"
-            fi
-        else
-            DETECTED_TYPE="Desktop / Server"
-            if grep -q -i "microsoft" /proc/version 2>/dev/null; then
-                DETECTED_TYPE="WSL (Windows Subsystem for Linux)"
-            elif [ -f /.dockerenv ] || grep -q "docker\|containerd" /proc/1/cgroup 2>/dev/null; then
-                DETECTED_TYPE="Container (Docker/LXC)"
-            elif [ -d /sys/class/power_supply ] && ls /sys/class/power_supply/BAT* 1>/dev/null 2>&1; then
-                DETECTED_TYPE="Laptop"
-            elif command -v systemd-detect-virt >/dev/null 2>&1 && systemd-detect-virt -q; then
-                DETECTED_TYPE="Cloud VPS ($(systemd-detect-virt))"
-            fi
-        fi
-    fi
-}
-
-detect_device
-
-print_device_info() {
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "${CYAN}╔════════════════════════════════════════════════════════════════════════╗${RESET}"
-        echo -e "${CYAN}║${RESET} ${BOLD}🔍 Обнаружено устройство:${RESET}"
-        echo -e "${CYAN}║${RESET}   • Имя хоста   : ${GREEN}${DETECTED_HOSTNAME}${RESET}"
-        echo -e "${CYAN}║${RESET}   • Тип         : ${YELLOW}${DETECTED_TYPE}${RESET}"
-        echo -e "${CYAN}║${RESET}   • ОС          : ${DETECTED_OS}"
-        echo -e "${CYAN}║${RESET}   • Архитектура : ${ARCH_LABEL}"
-        echo -e "${CYAN}╚════════════════════════════════════════════════════════════════════════╝${RESET}"
-    else
-        echo -e "${CYAN}╔════════════════════════════════════════════════════════════════════════╗${RESET}"
-        echo -e "${CYAN}║${RESET} ${BOLD}🔍 Detected Device:${RESET}"
-        echo -e "${CYAN}║${RESET}   • Hostname    : ${GREEN}${DETECTED_HOSTNAME}${RESET}"
-        echo -e "${CYAN}║${RESET}   • Type        : ${YELLOW}${DETECTED_TYPE}${RESET}"
-        echo -e "${CYAN}║${RESET}   • OS          : ${DETECTED_OS}"
-        echo -e "${CYAN}║${RESET}   • Architecture: ${ARCH_LABEL}"
-        echo -e "${CYAN}╚════════════════════════════════════════════════════════════════════════╝${RESET}"
-    fi
-}
-
-print_mcp_box() {
-    local title="$1"
-    local url="$2"
-    local copy_msg="$3"
-
-    local max_len=${#title}
-    [ ${#url} -gt $max_len ] && max_len=${#url}
-    [ -n "$copy_msg" ] && [ ${#copy_msg} -gt $max_len ] && max_len=${#copy_msg}
-
-    local width=$(( max_len + 4 ))
-    [ $width -lt 84 ] && width=84
-
-    local dashes=$(printf '%*s' "$width" '' | tr ' ' '-')
-    local border="  +${dashes}+"
-    local empty="  |$(printf '%*s' "$width" '')|"
-
-    echo -e "${GREEN}${border}${RESET}"
-    
-    # Title
-    local pad_title=$(( width - 2 - ${#title} ))
-    printf "  ${GREEN}|${RESET} ${BOLD}%s${RESET}%*s ${GREEN}|${RESET}\n" "$title" "$pad_title" ""
-
-    echo -e "${GREEN}${empty}${RESET}"
-
-    # URL
-    local pad_url=$(( width - 2 - ${#url} ))
-    printf "  ${GREEN}|${RESET} ${BOLD}${YELLOW}%s${RESET}%*s ${GREEN}|${RESET}\n" "$url" "$pad_url" ""
-
-    echo -e "${GREEN}${empty}${RESET}"
-
-    # Copy message
-    if [ -n "$copy_msg" ]; then
-        local pad_copy=$(( width - 2 - ${#copy_msg} ))
-        printf "  ${GREEN}|${RESET} ${BOLD}${GREEN}%s${RESET}%*s ${GREEN}|${RESET}\n" "$copy_msg" "$pad_copy" ""
-    fi
-
-    echo -e "${GREEN}${border}${RESET}"
-}
-
-# ------------------------------------------------------------------------------
-#  TERMUX (ANDROID) AUTOSTART
-#
-#  An unprivileged Android app gets no service manager, so there is no systemd
-#  unit, no launchd agent and no init script to install. Two Termux mechanisms
-#  replace all three, and configure_termux_node sets up both:
-#
-#    1. runit, from the termux-services package: $PREFIX/var/service/<name>/run is
-#       supervised inside the running Termux session, so a node that dies is
-#       restarted - the systemd Restart=always equivalent;
-#    2. ~/.termux/boot/<name>.sh, executed by the Termux:Boot app (F-Droid) after
-#       the device boots: it takes the wake lock and starts the supervisor.
-#
-#  Without termux-services the node still runs and still autostarts at boot, but
-#  nothing restarts it when Android kills the process. The installer says that
-#  plainly instead of implying supervision that is not there.
-#
-#  configure_termux_node <service name> <python module> <extra args> <env file>
-# ------------------------------------------------------------------------------
-configure_termux_node() {
-    local name="$1" module="$2" extra="$3" env_file="$4"
-    local run_script="$CONFIG_DIR/${name}.sh"
-    local boot_script="$HOME/.termux/boot/${name}.sh"
-    local svdir="$TERMUX_PREFIX/var/service"
-    local svlogdir="$TERMUX_PREFIX/var/log"
-    local log_file="$CONFIG_DIR/${name}.log"
-    local env_block=""
-    local module_args="$module"
-    local alive=false
-    local waited=0
-
-    [ -n "$extra" ] && module_args="$module $extra"
-
-    TERMUX_SUPERVISED=false
-    mkdir -p "$CONFIG_DIR" "$HOME/.termux/boot"
-
-    if [ -n "$env_file" ]; then
-        env_block="if [ -f \"$env_file\" ]; then
-    set -a
-    . \"$env_file\"
-    set +a
-fi"
-    fi
-
-    # The launcher is the one thing every mechanism below starts. Absolute paths
-    # only: runit and the boot script run it with a minimal environment in which
-    # $PATH may not even contain $PREFIX/bin.
-    cat << RUNNER_EOF > "$run_script"
-#!$TERMUX_PREFIX/bin/sh
-# Antigravity Mesh - $name launcher (written by install.sh; do not edit).
-# Run this file to start the node by hand; docs/TERMUX.md documents the automatic
-# paths (runit service, Termux:Boot) and where the logs are.
-export PATH="$TERMUX_PREFIX/bin:/system/bin:\$PATH"
-$env_block
-cd "$SCRIPT_DIR" || exit 1
-exec "$PYTHON_BIN" -m $module_args
-RUNNER_EOF
-    chmod 700 "$run_script"
-
-    # 1. runit supervision, when termux-services is installed. install.sh asks the
-    #    package manager for it first; a phone that refused (no network, an old
-    #    mirror) simply keeps the unattended launcher below.
-    if command -v sv >/dev/null 2>&1 && command -v runsvdir >/dev/null 2>&1; then
-        mkdir -p "$svdir/$name/log"
-        cat << SV_EOF > "$svdir/$name/run"
-#!$TERMUX_PREFIX/bin/sh
-exec "$run_script"
-SV_EOF
-        chmod 755 "$svdir/$name/run"
-        # runit refuses to supervise without log/run, and svlogger is a script, not
-        # a program: the documented setup is a symlink to it. A $PREFIX that refuses
-        # symlinks (a FUSE-backed home, an unusual mount) gets an equivalent script
-        # instead, so the node is never left unsupervised for want of a link.
-        if ! ln -sf "$TERMUX_PREFIX/share/termux-services/svlogger" "$svdir/$name/log/run" 2>/dev/null; then
-            printf '#!%s/bin/sh\nexec "%s/share/termux-services/svlogger"\n' \
-                "$TERMUX_PREFIX" "$TERMUX_PREFIX" > "$svdir/$name/log/run"
-            chmod 755 "$svdir/$name/log/run"
-        fi
-        export SVDIR="$svdir"
-        export LOGDIR="$svlogdir"
-        # The supervisor is normally started by the login shell (profile.d), which
-        # has not necessarily run when this installer is piped straight into bash.
-        # Starting it here is what makes the node run *now*; the pgrep guard keeps a
-        # second runsvdir off an SVDIR that already has one.
-        if ! pgrep -f "runsvdir" >/dev/null 2>&1; then
-            command -v service-daemon >/dev/null 2>&1 && service-daemon start >/dev/null 2>&1 || true
-        fi
-        sv up "$name" >/dev/null 2>&1 || true
-        sv-enable "$name" >/dev/null 2>&1 || true
-        TERMUX_SUPERVISED=true
-    fi
-
-    # 2. The boot entry, written even when runit supervises: after a reboot the
-    #    supervisor itself has to be started by something, and on Android that
-    #    something is the Termux:Boot app.
-    cat << BOOT_EOF > "$boot_script"
-#!$TERMUX_PREFIX/bin/sh
-# Antigravity Mesh - starts the $name node after the device boots (Termux:Boot).
-#
-# Requirements, both of them outside this file (docs/TERMUX.md):
-#   * the Termux:Boot app (F-Droid), opened once so Android lets it run;
-#   * battery optimisation OFF for Termux and for Termux:Boot.
-export PATH="$TERMUX_PREFIX/bin:/system/bin:\$PATH"
-export HOME="$HOME"
-export SVDIR="$svdir"
-export LOGDIR="$svlogdir"
-
-# A partial wake lock keeps Android from freezing the node while the screen is
-# off. It needs the termux-api package plus the Termux:API app; without either,
-# this line is a no-op rather than a failure.
-command -v termux-wake-lock >/dev/null 2>&1 && termux-wake-lock >/dev/null 2>&1
-
-if command -v sv >/dev/null 2>&1 && [ -d "$svdir/$name" ]; then
-    if ! pgrep -f "runsvdir" >/dev/null 2>&1; then
-        command -v service-daemon >/dev/null 2>&1 && service-daemon start >/dev/null 2>&1
-    fi
-    sv up "$name" >/dev/null 2>&1
-else
-    # No supervisor on this phone: start the launcher directly and keep its output.
-    "$run_script" >> "$CONFIG_DIR/$name.boot.log" 2>&1 &
-fi
-BOOT_EOF
-    chmod 700 "$boot_script"
-
-    if [ "$TERMUX_SUPERVISED" != true ]; then
-        # The systemd branch's fallback, spelled for a phone: nothing supervises
-        # the process, so it is started detached and its log is the only evidence.
-        pkill -f "$module" 2>/dev/null || true
-        nohup "$run_script" >> "$log_file" 2>&1 &
-    fi
-
-    # Termux has no `systemctl status` to consult, so the installer waits for the
-    # process it just started (runit may take a moment) and reports what it saw.
-    while [ "$waited" -lt 10 ]; do
-        if pgrep -f "$module" >/dev/null 2>&1; then
-            alive=true
-            break
-        fi
-        sleep 1
-        waited=$((waited + 1))
-    done
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        if [ "$TERMUX_SUPERVISED" = true ]; then
-            echo -e "${GREEN}[OK] runit (termux-services) следит за узлом и перезапустит его сам.${RESET}"
-            echo -e "     Статус: ${CYAN}sv status $name${RESET}    Логи: ${CYAN}$svlogdir/sv/$name/current${RESET}"
-        else
-            echo -e "${YELLOW}[!] Узел запущен без супервизора: termux-services не установлен.${RESET}"
-            echo -e "     Автоперезапуск после сбоя: ${CYAN}pkg install termux-services${RESET}, затем повторите установку."
-            echo -e "     Логи: ${CYAN}$log_file${RESET}"
-        fi
-        echo -e "     Автозапуск после перезагрузки: ${CYAN}$boot_script${RESET} (нужно приложение Termux:Boot)."
-        if [ "$alive" != true ]; then
-            echo -e "${YELLOW}[!] Процесс узла пока не виден — смотрите лог: ${CYAN}$log_file${RESET}"
-        fi
-    else
-        if [ "$TERMUX_SUPERVISED" = true ]; then
-            echo -e "${GREEN}[OK] runit (termux-services) supervises the node and restarts it.${RESET}"
-            echo -e "     Status: ${CYAN}sv status $name${RESET}    Logs: ${CYAN}$svlogdir/sv/$name/current${RESET}"
-        else
-            echo -e "${YELLOW}[!] The node runs unsupervised: termux-services is not installed.${RESET}"
-            echo -e "     Restart after a crash: ${CYAN}pkg install termux-services${RESET}, then re-run the installer."
-            echo -e "     Logs: ${CYAN}$log_file${RESET}"
-        fi
-        echo -e "     Autostart after a reboot: ${CYAN}$boot_script${RESET} (the Termux:Boot app is required)."
-        if [ "$alive" != true ]; then
-            echo -e "${YELLOW}[!] The node process is not visible yet - check: ${CYAN}$log_file${RESET}"
-        fi
-    fi
-}
-
-# The Android-side switches no installer can flip for the user: whether the node
-# comes back after a reboot and whether Android keeps it alive with the screen
-# off. Printed after the MCP URL, in the language of the run.
-print_termux_hints() {
-    local name="$1"
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "  ${BOLD}📱 Termux (Android): что проверить на телефоне${RESET} (служба: ${CYAN}$name${RESET})"
-        echo -e "  1. Автозапуск после перезагрузки делает приложение ${CYAN}Termux:Boot${RESET} (F-Droid)."
-        echo -e "     Установите и ${BOLD}запустите его один раз${RESET}, иначе скрипт в ~/.termux/boot не выполнится."
-        echo -e "  2. Отключите оптимизацию батареи для ${CYAN}Termux${RESET} и Termux:Boot: иначе Android"
-        echo -e "     выгружает фоновый процесс вместе с туннелем."
-        echo -e "  3. Скопировать ссылку выше: долгое нажатие в терминале, либо приложение Termux:API и"
-        echo -e "     ${CYAN}termux-clipboard-set '<ссылка>'${RESET}."
-        echo -e "  4. Выдайте приложению ${CYAN}Termux:API${RESET} разрешения для инструментов устройства"
-        echo -e "     (Настройки Android → Приложения → Termux:API → Разрешения): камера, микрофон,"
-        echo -e "     местоположение, SMS, журнал вызовов, контакты. Без них ${CYAN}device_capture${RESET} и"
-        echo -e "     ${CYAN}device_messages${RESET} ответят, какого именно разрешения не хватает."
-        echo -e "  5. Ветка устройства включена по умолчанию (${CYAN}MESH_DEVICE=auto${RESET}). SMS, контакты и"
-        echo -e "     журнал вызовов открывает ${CYAN}MESH_DEVICE_PIM=1${RESET}; ${CYAN}MESH_DEVICE_QUICK=1${RESET} оставляет"
-        echo -e "     system_info мгновенным (без сети, камер, микрофонов и датчиков)."
-        echo -e "  6. Полная инструкция: ${CYAN}docs/TERMUX.md${RESET} (установка, автозапуск, логи, удаление)."
-        echo ""
-    else
-        echo -e "  ${BOLD}📱 Termux (Android): what to check on the phone${RESET} (service: ${CYAN}$name${RESET})"
-        echo -e "  1. Autostart after a reboot is done by the ${CYAN}Termux:Boot${RESET} app (F-Droid)."
-        echo -e "     Install it and ${BOLD}open it once${RESET}, or the script in ~/.termux/boot never runs."
-        echo -e "  2. Turn battery optimisation OFF for ${CYAN}Termux${RESET} and Termux:Boot: otherwise Android"
-        echo -e "     unloads the background process together with the tunnel."
-        echo -e "  3. Copy the URL above: long-press the terminal, or install the Termux:API app and use"
-        echo -e "     ${CYAN}termux-clipboard-set '<url>'${RESET}."
-        echo -e "  4. Grant the ${CYAN}Termux:API${RESET} app the permissions the device tools need"
-        echo -e "     (Android Settings → Apps → Termux:API → Permissions): camera, microphone, location,"
-        echo -e "     SMS, call log, contacts. Without them ${CYAN}device_capture${RESET} / ${CYAN}device_messages${RESET}"
-        echo -e "     answer with the exact permission that is missing."
-        echo -e "  5. The device branch is on by default (${CYAN}MESH_DEVICE=auto${RESET}). ${CYAN}MESH_DEVICE_PIM=1${RESET}"
-        echo -e "     enables SMS, contacts and the call log; ${CYAN}MESH_DEVICE_QUICK=1${RESET} keeps system_info"
-        echo -e "     instant (no network, cameras, microphones or sensors)."
-        echo -e "  6. Full guide: ${CYAN}docs/TERMUX.md${RESET} (install, autostart, logs, uninstall)."
-        echo ""
-    fi
-}
-
-# Dry-run
-if [ "$DRY_RUN" = true ]; then
-    echo "[DRY-RUN] Simulating Antigravity Mesh installation..."
-    echo "[DRY-RUN] Language: $LANG_CHOICE"
-    echo "[DRY-RUN] Detected Host: $DETECTED_HOSTNAME ($DETECTED_TYPE)"
-    echo "[DRY-RUN] Architecture: ${ARCH_LABEL:-$DETECTED_ARCH}"
-    echo "[DRY-RUN] Selected Mode: ${MODE:-standalone}"
-    echo "[DRY-RUN] Port: $PORT"
-    echo "[DRY-RUN] TLS: $TLS"
-    if [ -n "$GATEWAY" ]; then echo "[DRY-RUN] Domain: $GATEWAY"; fi
-    if [ -n "$USERNAME" ]; then
-        echo "[DRY-RUN] User: $USERNAME"
-        if [ -n "$GATEWAY" ]; then
-            echo "[DRY-RUN] Canonical MCP URL: $(node_sse_url "$USERNAME" "${TOKEN:-<token>}")"
-        fi
-    fi
-    if [ -n "$TOKEN" ]; then echo "[DRY-RUN] Token: set (standalone: stored in ${CONFIG_DIR}/standalone.env, chmod 600)"; fi
-    if [ "$IS_TERMUX" = true ]; then
-        echo "[DRY-RUN] Platform: Termux (Android)"
-        echo "[DRY-RUN] Termux prefix: $TERMUX_PREFIX"
-        echo "[DRY-RUN] Package manager: pkg (sudo, systemd and uv do not exist on Android)"
-        echo "[DRY-RUN] Autostart: runit service <name> + ~/.termux/boot/<name>.sh (Termux:Boot)"
-        echo "[DRY-RUN] Domain file: $DEFAULT_DOMAIN_FILE"
-    else
-        echo "[DRY-RUN] Domain file: $DEFAULT_DOMAIN_FILE"
-        echo "[DRY-RUN] Systemd service and dependencies check: OK"
-    fi
-    if [ -z "$GATEWAY" ]; then
-        echo "[DRY-RUN] Domain file value: not written (no domain configured)"
-    elif [ "$GATEWAY" = "$(normalise_host "$(module_default_domain)")" ]; then
-        echo "[DRY-RUN] Domain file value: not written (the built-in default is a fallback, not a configuration)"
-    else
-        echo "[DRY-RUN] Domain file value: MESH_PUBLIC_URL=https://$GATEWAY"
-    fi
-    exit 0
-fi
-
-# SSH Remote install branch
-if [ -n "$SSH_TARGET" ]; then
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "${BOLD}${BLUE}=== Удаленная установка Antigravity Mesh через SSH ===${RESET}"
-        echo -e "Целевой сервер: ${CYAN}${SSH_TARGET}${RESET} (порт: ${SSH_PORT})"
-    else
-        echo -e "${BOLD}${BLUE}=== Remote Antigravity Mesh SSH Installation ===${RESET}"
-        echo -e "Target Server: ${CYAN}${SSH_TARGET}${RESET} (port: ${SSH_PORT})"
-    fi
-
-    SSH_BIN="ssh -o StrictHostKeyChecking=no"
-    SCP_BIN="scp -o StrictHostKeyChecking=no"
-    if [ -n "$SSHPASS" ] && command -v sshpass >/dev/null 2>&1; then
-        SSH_BIN="sshpass -e $SSH_BIN"
-        SCP_BIN="sshpass -e $SCP_BIN"
-    fi
-
-    $SSH_BIN -p "$SSH_PORT" "$SSH_TARGET" "mkdir -p ~/antigravity-mesh/core ~/antigravity-mesh/skills"
-    $SCP_BIN -P "$SSH_PORT" -r "$SCRIPT_DIR/core"/* "$SSH_TARGET:~/antigravity-mesh/core/"
-    $SCP_BIN -P "$SSH_PORT" "$SCRIPT_DIR/install.sh" "$SSH_TARGET:~/antigravity-mesh/"
-    if [ -d "$SCRIPT_DIR/skills" ]; then
-        $SCP_BIN -P "$SSH_PORT" -r "$SCRIPT_DIR/skills"/* "$SSH_TARGET:~/antigravity-mesh/skills/" 2>/dev/null || true
-    fi
-    # The domain was resolved on THIS machine, so it is handed to the target: the
-    # remote copy otherwise re-resolves from its own environment, and a repository
-    # copy whose $PUBLISHED_DOMAIN is still the placeholder falls back to the
-    # built-in default - which the target would now also record as its domain.
-    REMOTE_DOMAIN_ARG=""
-    if [ -n "$GATEWAY" ] && [ "$GATEWAY" != "$DOMAIN_PLACEHOLDER" ]; then
-        REMOTE_DOMAIN_ARG=" --domain=$GATEWAY"
-    fi
-    $SSH_BIN -p "$SSH_PORT" "$SSH_TARGET" "cd ~/antigravity-mesh && bash install.sh --quick --lang=$LANG_CHOICE$REMOTE_DOMAIN_ARG"
-    exit 0
-fi
-
-# Interactive Menu if no mode is specified and not in quick mode
-if [ "$QUICK" = false ] && [ -z "$MODE" ] && [ -t 0 ]; then
-    print_device_info
-    echo ""
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "${BOLD}Выберите режим установки:${RESET}"
-        echo -e "  ${GREEN}1)${RESET} ⚡ ${BOLD}Быстрая настройка${RESET} (Имя узла как имя ПК + Общий домен + Автозапуск) [Рекомендуется]"
-        echo -e "  ${BLUE}2)${RESET} 🖥️  ${BOLD}Локальный Standalone${RESET} (Только localhost:${PORT}, без облачного шлюза)"
-        echo -e "  ${YELLOW}3)${RESET} ⚙️  ${BOLD}Кастомная настройка${RESET} (Ввести имя узла вручную, выбор общего домена)"
-        echo -e "  ${CYAN}4)${RESET} 📡 ${BOLD}Удаленная установка на SSH-сервер${RESET}"
-        echo -e "  ${RESET}0) Выход"
-        echo ""
-        read -rp "Ваш выбор [1]: " MENU_CHOICE
-    else
-        echo -e "${BOLD}Select Installation Mode:${RESET}"
-        echo -e "  ${GREEN}1)${RESET} ⚡ ${BOLD}Quick Setup${RESET} (Node name from PC name + shared domain + Autostart) [Recommended]"
-        echo -e "  ${BLUE}2)${RESET} 🖥️  ${BOLD}Local Standalone${RESET} (localhost:${PORT} only, no cloud gateway)"
-        echo -e "  ${YELLOW}3)${RESET} ⚙️  ${BOLD}Custom Setup${RESET} (Custom node name, custom shared domain)"
-        echo -e "  ${CYAN}4)${RESET} 📡 ${BOLD}Remote SSH Installation${RESET}"
-        echo -e "  ${RESET}0) Exit"
-        echo ""
-        read -rp "Select [1]: " MENU_CHOICE
-    fi
-    MENU_CHOICE=${MENU_CHOICE:-1}
-
-    case "$MENU_CHOICE" in
-        1)
-            MODE="tunnel"
-            QUICK=true
-            ;;
-        2)
-            MODE="standalone"
-            ;;
-        3)
-            MODE="tunnel"
-            echo ""
-            if [ "$LANG_CHOICE" = "ru" ]; then
-                read -rp "Введите имя узла [по умолчанию: ${DETECTED_HOSTNAME}]: " CUSTOM_SUB
-                read -rp "Общий домен шлюза [по умолчанию: ${GATEWAY}]: " CUSTOM_GW
-            else
-                read -rp "Enter node name [default: ${DETECTED_HOSTNAME}]: " CUSTOM_SUB
-                read -rp "Shared gateway domain [default: ${GATEWAY}]: " CUSTOM_GW
-            fi
-            if [ -n "$CUSTOM_SUB" ]; then USERNAME="$CUSTOM_SUB"; fi
-            if [ -n "$CUSTOM_GW" ]; then GATEWAY="$CUSTOM_GW"; fi
-            ;;
-        4)
-            echo ""
-            if [ "$LANG_CHOICE" = "ru" ]; then
-                read -rp "Введите SSH цель (например, user@<host-ip>): " REMOTE_TARGET
-                read -rp "Порт SSH [22]: " REMOTE_PORT
-            else
-                read -rp "Enter SSH target (e.g., user@<host-ip>): " REMOTE_TARGET
-                read -rp "SSH Port [22]: " REMOTE_PORT
-            fi
-            REMOTE_PORT=${REMOTE_PORT:-22}
-            exec "$0" "--ssh=${REMOTE_TARGET}:${REMOTE_PORT}" "--lang=${LANG_CHOICE}"
-            ;;
-        0)
-            echo "Cancelled."
-            exit 0
-            ;;
-        *)
-            MODE="tunnel"
-            QUICK=true
-            ;;
-    esac
-fi
-
-if [ -z "$MODE" ]; then
-    MODE="tunnel"
-fi
-
-print_device_info
-
-# ==============================================================================
-#  BRANCH: STANDALONE MODE
-# ==============================================================================
-if [ "$MODE" = "standalone" ]; then
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "\n${BOLD}${BLUE}=== Настройка локального Standalone FastMCP сервера ===${RESET}"
-        echo "[1/3] Проверка окружения Python..."
-    else
-        echo -e "\n${BOLD}${BLUE}=== Setting up Local Standalone FastMCP Server ===${RESET}"
-        echo "[1/3] Checking Python environment..."
-    fi
-    ensure_dependencies
-    # The endpoint check at the end of this branch runs through curl.
-    ensure_curl || exit 1
-    mkdir -p "$CONFIG_DIR"
-    # A standalone node answers share_file too, so the domain it resolved is written
-    # down here as well - before the server is started, not after.
-    write_domain_file "$GATEWAY"
-
-    # Honour --token in standalone mode without embedding the secret in the
-    # (world-readable) unit/plist: keep it in a 0600 env file for systemd
-    # (EnvironmentFile) and use a 0600 plist environment block on macOS.
-    # core.server reads MESH_TOKEN as the default for --token.
-    STANDALONE_ENV_FILE="$CONFIG_DIR/standalone.env"
-    ENV_FILE_LINE=""
-    PLIST_ENV_BLOCK=""
-    if [ -n "$TOKEN" ]; then
-        printf 'MESH_TOKEN=%s\n' "$TOKEN" > "$STANDALONE_ENV_FILE"
-        chmod 600 "$STANDALONE_ENV_FILE"
-        ENV_FILE_LINE="EnvironmentFile=$STANDALONE_ENV_FILE"
-        PLIST_TOKEN=$(printf '%s' "$TOKEN" | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g')
-        PLIST_ENV_BLOCK="    <key>EnvironmentVariables</key>
-    <dict>
-        <key>MESH_TOKEN</key>
-        <string>${PLIST_TOKEN}</string>
-    </dict>"
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "${GREEN}[✓] Токен авторизации включён (chmod 600).${RESET}"
-        else
-            echo -e "${GREEN}[OK] Authorization token enabled (chmod 600).${RESET}"
-        fi
-    else
-        rm -f "$STANDALONE_ENV_FILE" 2>/dev/null || true
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "${YELLOW}[!] Токен не задан (--token): сервер доступен без авторизации на 127.0.0.1.${RESET}"
-        else
-            echo -e "${YELLOW}[!] No --token given: server is unauthenticated on 127.0.0.1.${RESET}"
-        fi
-    fi
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        if [ "$IS_TERMUX" = true ]; then
-            echo "[2/3] Настройка автозапуска на телефоне (runit + Termux:Boot)..."
-        else
-            echo "[2/3] Настройка systemd автозапуска на ПК..."
-        fi
-    else
-        echo "[2/3] Configuring autostart background service..."
-    fi
-
-    if [ "$(uname -s)" = "Darwin" ]; then
-        LAUNCH_AGENTS="$HOME/Library/LaunchAgents"
-        mkdir -p "$LAUNCH_AGENTS"
-        PLIST_FILE="$LAUNCH_AGENTS/com.antigravity.mesh.standalone.plist"
-        cat << EOF > "$PLIST_FILE"
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>com.antigravity.mesh.standalone</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>$PYTHON_BIN</string>
-        <string>-m</string>
-        <string>core.server</string>
-        <string>--host=127.0.0.1</string>
-        <string>--port=$PORT</string>
-    </array>
-    <key>WorkingDirectory</key>
-    <string>$SCRIPT_DIR</string>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>KeepAlive</key>
-    <true/>
-$PLIST_ENV_BLOCK
-</dict>
-</plist>
-EOF
-        if [ -n "$TOKEN" ]; then
-            chmod 600 "$PLIST_FILE"
-        fi
-        launchctl unload "$PLIST_FILE" 2>/dev/null || true
-        launchctl load -w "$PLIST_FILE" 2>/dev/null || true
-    elif [ "$IS_TERMUX" = true ]; then
-        # Android: neither systemd nor launchd exists - runit inside Termux
-        # supervises the server, and Termux:Boot brings it back after a reboot.
-        configure_termux_node "agy-standalone" "core.server" "--host 127.0.0.1 --port=$PORT" "$STANDALONE_ENV_FILE"
-    else
-        USER_SYSTEMD_DIR="$HOME/.config/systemd/user"
-        mkdir -p "$USER_SYSTEMD_DIR"
-        SERVICE_FILE="$USER_SYSTEMD_DIR/agy-standalone.service"
-        cat << EOF > "$SERVICE_FILE"
-[Unit]
-Description=Antigravity Mesh Local Standalone MCP Server
-After=network.target
-
-[Service]
-Type=simple
-$ENV_FILE_LINE
-WorkingDirectory=$SCRIPT_DIR
-ExecStart=$PYTHON_BIN -m core.server --host 127.0.0.1 --port=$PORT
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=default.target
-EOF
-        systemctl --user daemon-reload 2>/dev/null || true
-        systemctl --user enable --now agy-standalone.service 2>/dev/null || {
-            pkill -f "core.server" 2>/dev/null || true
-            if [ -n "$TOKEN" ]; then
-                nohup env MESH_TOKEN="$TOKEN" $PYTHON_BIN -m core.server --host 127.0.0.1 --port="$PORT" > "$CONFIG_DIR/standalone.log" 2>&1 &
-            else
-                nohup $PYTHON_BIN -m core.server --host 127.0.0.1 --port="$PORT" > "$CONFIG_DIR/standalone.log" 2>&1 &
-            fi
-        }
-        loginctl enable-linger "$USER" 2>/dev/null || true
-    fi
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo "[3/3] Проверка локального эндпоинта..."
-    else
-        echo "[3/3] Verifying local endpoint..."
-    fi
-    HEALTH_URL="http://127.0.0.1:${PORT}/health"
-    HEALTH_OK=false
-    for _attempt in 1 2 3 4 5 6 7 8 9 10; do
-        HTTP_CODE=$(curl -s -o /dev/null -m 2 -w "%{http_code}" "$HEALTH_URL" 2>/dev/null || true)
-        if [ "$HTTP_CODE" = "200" ]; then
-            HEALTH_OK=true
-            break
-        fi
-        sleep 1
-    done
-    if [ "$HEALTH_OK" != true ]; then
-        if [ "$LANG_CHOICE" = "ru" ]; then
-            echo -e "\033[1;31m[ОШИБКА] Standalone MCP-сервер не отвечает (HTTP ${HTTP_CODE:-нет ответа}): $HEALTH_URL\033[0m" >&2
-            if [ "$IS_TERMUX" = true ]; then
-                echo -e "  Статус: ${CYAN}sv status agy-standalone${RESET} (runit, termux-services)" >&2
-                echo -e "  Логи:   ${CYAN}$TERMUX_PREFIX/var/log/sv/agy-standalone/current${RESET}" >&2
-                echo -e "  Локальный сервер на телефоне доступен только внутри Termux (127.0.0.1):" >&2
-                echo -e "  для Gemini с телефона используйте режим туннеля (--mode=tunnel)." >&2
-            else
-                echo -e "  Проверьте статус: ${CYAN}systemctl --user status agy-standalone.service${RESET}" >&2
-                echo -e "  Логи:             ${CYAN}journalctl --user -u agy-standalone.service -n 50 --no-pager${RESET}" >&2
-            fi
-        else
-            echo -e "\033[1;31m[ERROR] Standalone MCP server is not responding (HTTP ${HTTP_CODE:-no response}): $HEALTH_URL\033[0m" >&2
-            if [ "$IS_TERMUX" = true ]; then
-                echo -e "  Status: ${CYAN}sv status agy-standalone${RESET} (runit, termux-services)" >&2
-                echo -e "  Logs:   ${CYAN}$TERMUX_PREFIX/var/log/sv/agy-standalone/current${RESET}" >&2
-                echo -e "  A local server on a phone is reachable inside Termux only (127.0.0.1):" >&2
-                echo -e "  use --mode=tunnel to drive this phone from Gemini." >&2
-            else
-                echo -e "  Check status: ${CYAN}systemctl --user status agy-standalone.service${RESET}" >&2
-                echo -e "  Logs:         ${CYAN}journalctl --user -u agy-standalone.service -n 50 --no-pager${RESET}" >&2
-            fi
-        fi
-        exit 1
-    fi
-
-    MCP_LOCAL_URL="http://localhost:${PORT}/sse"
-    
-    # Quick Copy to Clipboard
-    COPIED=false
-    B64_URL=$(printf "%s" "$MCP_LOCAL_URL" | base64 | tr -d '\r\n')
-    printf "\033]52;c;%s\a" "$B64_URL" 2>/dev/null || true
-    if command -v termux-clipboard-set >/dev/null 2>&1; then
-        # Termux on a phone: termux-api plus the Termux:API app put the URL on
-        # Android's clipboard, where the Gemini app can paste it. Without the app
-        # the command exists but fails, so COPIED stays false and the hint below
-        # tells the user to copy by hand.
-        printf "%s" "$MCP_LOCAL_URL" | termux-clipboard-set 2>/dev/null && COPIED=true
-    elif command -v wl-copy >/dev/null 2>&1; then
-        printf "%s" "$MCP_LOCAL_URL" | wl-copy 2>/dev/null && COPIED=true
-    elif command -v xclip >/dev/null 2>&1; then
-        printf "%s" "$MCP_LOCAL_URL" | xclip -selection clipboard 2>/dev/null && COPIED=true
-    elif command -v xsel >/dev/null 2>&1; then
-        printf "%s" "$MCP_LOCAL_URL" | xsel --clipboard --input 2>/dev/null && COPIED=true
-    elif command -v pbcopy >/dev/null 2>&1; then
-        printf "%s" "$MCP_LOCAL_URL" | pbcopy 2>/dev/null && COPIED=true
-    elif command -v clip.exe >/dev/null 2>&1; then
-        printf "%s" "$MCP_LOCAL_URL" | clip.exe 2>/dev/null && COPIED=true
-    fi
-
-    clear 2>/dev/null || printf "\033[2J\033[H" || true
-
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo ""
-        copy_msg=""
-        if [ "$COPIED" = true ]; then
-            copy_msg="[OK] ССЫЛКА СКОПИРОВАНА В БУФЕР ОБМЕНА! (Вставьте через Ctrl+V)"
-        else
-            copy_msg="Скопируйте ссылку выше"
-        fi
-        print_mcp_box "ССЫЛКА ЛОКАЛЬНОГО MCP-СЕРВЕРА (СКОПИРУЙТЕ):" "$MCP_LOCAL_URL" "$copy_msg"
-        echo ""
-        echo -e "  ${BOLD}Куда вставлять ссылку в Google Gemini:${RESET}"
-        echo -e "  1. Откройте в браузере: ${CYAN}https://gemini.google.com/spark/apps${RESET}"
-        echo -e "  2. Нажмите ${BOLD}'Добавить приложение'${RESET} (Add app / Настройки MCP)"
-        echo -e "  3. Вставьте скопированную ссылку в поле ${BOLD}'URL сервера'${RESET} (${BOLD}Ctrl+V${RESET}) и нажмите ${BOLD}Подключить${RESET}."
-        echo ""
-    else
-        echo ""
-        copy_msg=""
-        if [ "$COPIED" = true ]; then
-            copy_msg="[OK] URL COPIED TO CLIPBOARD! (Press Ctrl+V to paste)"
-        else
-            copy_msg="Copy the URL above"
-        fi
-        print_mcp_box "LOCAL MCP SERVER URL (COPY THIS):" "$MCP_LOCAL_URL" "$copy_msg"
-        echo ""
-        echo -e "  ${BOLD}Where to paste this URL in Google Gemini:${RESET}"
-        echo -e "  1. Open in your browser: ${CYAN}https://gemini.google.com/spark/apps${RESET}"
-        echo -e "  2. Click ${BOLD}'Add app'${RESET} (or navigate to MCP settings)"
-        echo -e "  3. Paste the URL into the ${BOLD}'Server URL'${RESET} field (${BOLD}Ctrl+V${RESET}) and click ${BOLD}Connect${RESET}."
-        echo ""
-    fi
-    if [ "$IS_TERMUX" = true ]; then
-        print_termux_hints "agy-standalone"
-    fi
-    exit 0
-fi
-
-# ==============================================================================
-#  BRANCH: CLOUD GATEWAY + REVERSE TUNNEL
-# ==============================================================================
-if [ "$LANG_CHOICE" = "ru" ]; then
-    echo -e "\n${BOLD}${MAGENTA}=== Настройка облачного туннеля (общий домен) ===${RESET}"
-else
-    echo -e "\n${BOLD}${MAGENTA}=== Configuring Cloud Gateway Tunnel (shared domain) ===${RESET}"
-fi
-
-if [ -z "$USERNAME" ]; then
-    CLEAN_HOST=$(echo "$DETECTED_HOSTNAME" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9_-')
-    USERNAME="$CLEAN_HOST"
-fi
-USERNAME=$(echo "$USERNAME" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9_-')
-[ -z "$USERNAME" ] && USERNAME="mesh-node"
-
-mkdir -p "$CONFIG_DIR"
-
-if [ "$LANG_CHOICE" = "ru" ]; then
-    echo "[1/4] Проверка Python зависимостей (websockets)..."
-else
-    echo "[1/4] Checking Python dependencies (websockets)..."
-fi
-
-ensure_dependencies
-# Registration - the step right after this - is a curl POST. A machine with a usable
-# Python and no curl (a minimal WSL image, a slim container) used to die there with
-# "curl: command not found" and no hint about what to install.
-ensure_curl || exit 1
-# Registration is also the first step that truly needs the gateway: a name that does
-# not resolve here would be reported a moment later as "no authentication token",
-# which blames the gateway's answer instead of this device's DNS.
-require_gateway_dns || exit 1
-
-if [ "$LANG_CHOICE" = "ru" ]; then
-    echo "[2/4] Регистрация узла '${USERNAME}' на общем домене (${GATEWAY})..."
-else
-    echo "[2/4] Registering node '${USERNAME}' on the shared domain (${GATEWAY})..."
-fi
-
-EXISTING_TOKEN=""
-if [ -f "$CONFIG_FILE" ]; then
-    CFG_USER=$(grep "MESH_USER" "$CONFIG_FILE" 2>/dev/null | cut -d '=' -f2 || true)
-    CFG_TOKEN=$(grep "MESH_TOKEN" "$CONFIG_FILE" 2>/dev/null | cut -d '=' -f2 || true)
-    if [ "$CFG_USER" = "$USERNAME" ] && [ -n "$CFG_TOKEN" ]; then
-        EXISTING_TOKEN="$CFG_TOKEN"
-    fi
-fi
-
-if [ -n "$TOKEN" ]; then
-    REQ_TOKEN="$TOKEN"
-elif [ -n "$EXISTING_TOKEN" ]; then
-    REQ_TOKEN="$EXISTING_TOKEN"
-else
-    REQ_TOKEN=""
-fi
-
-DETECTED_MAC=""
-# "$PYTHON_BIN", never a bare python3: after the venv or uv fallback the working
-# interpreter is not on PATH, and the bare name would silently produce no MAC.
-if python_works "$PYTHON_BIN"; then
-    DETECTED_MAC=$("$PYTHON_BIN" -c "import uuid; print(':'.join(['{:02x}'.format((uuid.getnode() >> ele) & 0xff) for ele in range(0,8*6,8)][::-1]))" 2>/dev/null || true)
-fi
-if [ -z "$DETECTED_MAC" ] || [ "$DETECTED_MAC" = "00:00:00:00:00:00" ]; then
-    for iface in /sys/class/net/*; do
-        if [ -f "$iface/address" ] && [ "$(cat "$iface/type" 2>/dev/null)" = "1" ]; then
-            addr=$(cat "$iface/address" 2>/dev/null)
-            if [ -n "$addr" ] && [ "$addr" != "00:00:00:00:00:00" ]; then
-                DETECTED_MAC="$addr"
-                break
-            fi
-        fi
-    done
-fi
-
-# One field out of the registration answer. The JSON arrives on stdin rather than
-# in argv (a token or an error message can contain quotes), and "$PYTHON_BIN" is
-# used because after the venv or uv fallback there is no python3 on PATH - a bare
-# name would return an empty token, which the check below would then blame on the
-# gateway.
-json_field() {
-    # tr strips the CR that a Windows python.exe appends under Git Bash/MSYS.
-    # install.sh explicitly supports MINGW/MSYS/CYGWIN (see DEFAULT_DOMAIN_DIR), and
-    # a trailing CR inside the token would be pasted straight into the wss:// URL.
-    printf '%s' "$1" | "$PYTHON_BIN" -c 'import json, sys; print(json.load(sys.stdin).get(sys.argv[1], ""))' "$2" 2>/dev/null | tr -d '\r\n' || true
-}
-
-REG_BODY="{\"username\": \"${USERNAME}\", \"auto_suffix\": true, \"mac_address\": \"${DETECTED_MAC}\", \"os\": \"${DETECTED_OS}\", \"arch\": \"${DETECTED_ARCH}\""
-if [ -n "$REQ_TOKEN" ]; then
-    REG_BODY="${REG_BODY}, \"token\": \"${REQ_TOKEN}\""
-fi
-REG_BODY="${REG_BODY}}"
-
-REG_RESP=$(curl -s -X POST "https://${GATEWAY}/api/register" \
-    -H "Content-Type: application/json" \
-    -d "$REG_BODY")
-
-ASSIGNED_USER=$(json_field "$REG_RESP" username)
-ASSIGNED_TOKEN=$(json_field "$REG_RESP" token)
-
-if [ -z "$ASSIGNED_TOKEN" ]; then
-    FALLBACK_USER="${USERNAME}-$(date +%s | tail -c 4)"
-    REG_RESP=$(curl -s -X POST "https://${GATEWAY}/api/register" \
-        -H "Content-Type: application/json" \
-        -d "{\"username\": \"${FALLBACK_USER}\", \"auto_suffix\": true, \"mac_address\": \"${DETECTED_MAC}\", \"os\": \"${DETECTED_OS}\", \"arch\": \"${DETECTED_ARCH}\"}")
-    ASSIGNED_USER=$(json_field "$REG_RESP" username)
-    ASSIGNED_TOKEN=$(json_field "$REG_RESP" token)
-fi
-
-if [ -z "$ASSIGNED_TOKEN" ]; then
-    echo -e "${RED}[ERROR] Failed to obtain authentication token from gateway.${RESET}"
-    exit 1
-fi
-
-if [ "$ASSIGNED_USER" != "$USERNAME" ]; then
-    if [ "$LANG_CHOICE" = "ru" ]; then
-        echo -e "${YELLOW}ℹ️  Имя '${USERNAME}' уже было занято. Автоматически назначено имя узла:${RESET} ${BOLD}${GREEN}${ASSIGNED_USER}${RESET}"
-    else
-        echo -e "${YELLOW}ℹ️  Name '${USERNAME}' was already taken. Automatically assigned node name:${RESET} ${BOLD}${GREEN}${ASSIGNED_USER}${RESET}"
-    fi
-fi
-
-if [ "$LANG_CHOICE" = "ru" ]; then
-    echo "[3/4] Сохранение конфигурации в ${CONFIG_FILE}..."
-else
-    echo "[3/4] Saving configuration to ${CONFIG_FILE}..."
-fi
-
-cat << EOF > "$CONFIG_FILE"
-MESH_GATEWAY=${GATEWAY}
-MESH_USER=${ASSIGNED_USER}
-MESH_TOKEN=${ASSIGNED_TOKEN}
-EOF
-chmod 600 "$CONFIG_FILE"
-
-# agent.env carries only the legacy MESH_GATEWAY, which core/domain.py honours for
-# the tunnel but never for the links a node publishes. Writing the domain down is
-# what keeps share links on the gateway this node is registered on.
-write_domain_file "$GATEWAY"
-
-if [ "$LANG_CHOICE" = "ru" ]; then
-    if [ "$IS_TERMUX" = true ]; then
-        echo "[4/4] Настройка и запуск автозапуска на телефоне (runit + Termux:Boot)..."
-    else
-        echo "[4/4] Настройка и запуск службы автозапуска на ПК..."
-    fi
-else
-    echo "[4/4] Configuring and starting background autostart service..."
-fi
-
-if [ "$(uname -s)" = "Darwin" ]; then
-    LAUNCH_AGENTS="$HOME/Library/LaunchAgents"
-    mkdir -p "$LAUNCH_AGENTS"
-    PLIST_FILE="$LAUNCH_AGENTS/com.antigravity.mesh.agent.plist"
-    cat << EOF > "$PLIST_FILE"
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>com.antigravity.mesh.agent</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>$PYTHON_BIN</string>
-        <string>-m</string>
-        <string>core.agent</string>
-    </array>
-    <key>WorkingDirectory</key>
-    <string>$SCRIPT_DIR</string>
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>MESH_GATEWAY</key>
-        <string>$GATEWAY</string>
-        <key>MESH_USER</key>
-        <string>$ASSIGNED_USER</string>
-        <key>MESH_TOKEN</key>
-        <string>$ASSIGNED_TOKEN</string>
-    </dict>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>KeepAlive</key>
-    <true/>
-</dict>
-</plist>
-EOF
-    launchctl unload "$PLIST_FILE" 2>/dev/null || true
-    launchctl load -w "$PLIST_FILE" 2>/dev/null || true
-elif [ "$IS_TERMUX" = true ]; then
-    # Android: the tunnel node is supervised by runit inside Termux, and the
-    # Termux:Boot entry brings it back after a reboot - see configure_termux_node.
-    configure_termux_node "agy-agent" "core.agent" "" "$CONFIG_FILE"
-else
-    USER_SYSTEMD_DIR="$HOME/.config/systemd/user"
-    mkdir -p "$USER_SYSTEMD_DIR"
-    cat << EOF > "$USER_SYSTEMD_DIR/agy-agent.service"
-[Unit]
-Description=Antigravity Mesh Reverse RPC Agent
-After=network.target
-
-[Service]
-Type=simple
-EnvironmentFile=$CONFIG_FILE
-WorkingDirectory=$SCRIPT_DIR
-ExecStart=$PYTHON_BIN -m core.agent
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=default.target
-EOF
-    systemctl --user daemon-reload 2>/dev/null || true
-    systemctl --user enable --now agy-agent.service 2>/dev/null || {
-        pkill -f "core.agent" 2>/dev/null || true
-        nohup $PYTHON_BIN -m core.agent > "$CONFIG_DIR/agent.log" 2>&1 &
-    }
-    loginctl enable-linger "$USER" 2>/dev/null || true
-fi
-
-sleep 1
-
-# Canonical shared-domain MCP URL (one domain for every node; ?user= selects it).
-MCP_URL="$(node_sse_url "$ASSIGNED_USER" "$ASSIGNED_TOKEN")"
-
-# Quick Copy to Clipboard
-COPIED=false
-B64_URL=$(printf "%s" "$MCP_URL" | base64 | tr -d '\r\n')
-printf "\033]52;c;%s\a" "$B64_URL" 2>/dev/null || true
-if command -v termux-clipboard-set >/dev/null 2>&1; then
-    # Termux on a phone: termux-api plus the Termux:API app put the URL on
-    # Android's clipboard, where the Gemini app can paste it. Without the app the
-    # command exists but fails, so COPIED stays false and the hint says so.
-    printf "%s" "$MCP_URL" | termux-clipboard-set 2>/dev/null && COPIED=true
-elif command -v wl-copy >/dev/null 2>&1; then
-    printf "%s" "$MCP_URL" | wl-copy 2>/dev/null && COPIED=true
-elif command -v xclip >/dev/null 2>&1; then
-    printf "%s" "$MCP_URL" | xclip -selection clipboard 2>/dev/null && COPIED=true
-elif command -v xsel >/dev/null 2>&1; then
-    printf "%s" "$MCP_URL" | xsel --clipboard --input 2>/dev/null && COPIED=true
-elif command -v pbcopy >/dev/null 2>&1; then
-    printf "%s" "$MCP_URL" | pbcopy 2>/dev/null && COPIED=true
-elif command -v clip.exe >/dev/null 2>&1; then
-    printf "%s" "$MCP_URL" | clip.exe 2>/dev/null && COPIED=true
-fi
-
-clear 2>/dev/null || printf "\033[2J\033[H" || true
-
-if [ "$LANG_CHOICE" = "ru" ]; then
-    echo ""
-    copy_msg=""
-    if [ "$COPIED" = true ]; then
-        copy_msg="[OK] ССЫЛКА СКОПИРОВАНА В БУФЕР ОБМЕНА! (Вставьте через Ctrl+V)"
-    else
-        copy_msg="Скопируйте ссылку выше"
-    fi
-    print_mcp_box "ССЫЛКА MCP-СЕРВЕРА ДЛЯ ПОДКЛЮЧЕНИЯ (СКОПИРУЙТЕ):" "$MCP_URL" "$copy_msg"
-    echo ""
-    echo -e "  ${BOLD}Куда вставлять ссылку в Google Gemini:${RESET}"
-    echo -e "  1. Откройте в браузере: ${CYAN}https://gemini.google.com/spark/apps${RESET}"
-    echo -e "  2. Нажмите ${BOLD}'Добавить приложение'${RESET} (Add app / Настройки MCP)"
-    echo -e "  3. Вставьте скопированную ссылку в поле ${BOLD}'URL сервера'${RESET} (${BOLD}Ctrl+V${RESET}) и нажмите ${BOLD}Подключить${RESET}."
-    echo ""
-else
-    echo ""
-    copy_msg=""
-    if [ "$COPIED" = true ]; then
-        copy_msg="[OK] URL COPIED TO CLIPBOARD! (Paste with Ctrl+V)"
-    else
-        copy_msg="Copy the URL above"
-    fi
-    print_mcp_box "MCP SERVER CONNECTION URL (COPY THIS):" "$MCP_URL" "$copy_msg"
-    echo ""
-    echo -e "  ${BOLD}Where to paste this URL in Google Gemini:${RESET}"
-    echo -e "  1. Open in your browser: ${CYAN}https://gemini.google.com/spark/apps${RESET}"
-    echo -e "  2. Click ${BOLD}'Add app'${RESET} (or navigate to MCP settings)"
-    echo -e "  3. Paste the URL into the ${BOLD}'Server URL'${RESET} field (${BOLD}Ctrl+V${RESET}) and click ${BOLD}Connect${RESET}."
-    echo ""
-fi
-
-# The phone-specific steps (Termux:Boot, battery optimisation, clipboard) are the
-# same in both modes; on a Linux/macOS/Windows node there is nothing to add.
-if [ "$IS_TERMUX" = true ]; then
-    print_termux_hints "agy-agent"
-fi