gemini-computer-use 0.4.2 → 0.4.4

package/ops/mesh-domain.sh

@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-#  Antigravity Mesh - resolve the public domain, once, for every shell script.
-#
-#  Sourced by deploy_gateway.sh and ops/nginx/render-domain.sh. The order below
-#  is the same order core/domain.py implements for the runtime; keeping the shell
-#  side in one file means "where does the domain come from" has a single answer
-#  for scripts too.
-#
-#    1. MESH_PUBLIC_URL in the environment;
-#    2. MESH_PUBLIC_URL (or the AGY_PUBLIC_BASE_URL alias) in the domain file -
-#       /etc/antigravity-mesh/domain.env by default, MESH_DOMAIN_FILE overrides;
-#    3. core/domain.py's DEFAULT_PUBLIC_BASE_URL, read from the checkout.
-#
-#  On success exports:
-#    MESH_DOMAIN_URL   https://mesh.example.com   (no trailing slash)
-#    MESH_DOMAIN_HOST  mesh.example.com
-#    MESH_DOMAIN_SOURCE  human-readable origin, for logs
-#    MESH_DOMAIN_FILE_RESOLVED  the domain file path that was consulted
-#  and returns 0. Returns 1 when nothing yields a domain.
-# ==============================================================================
-
-mesh_resolve_domain() {
-    local repo_dir="${1:-.}"
-    local value="" candidate_python="" source=""
-
-    MESH_DOMAIN_FILE_RESOLVED="${MESH_DOMAIN_FILE:-/etc/antigravity-mesh/domain.env}"
-
-    if [ -n "${MESH_PUBLIC_URL:-}" ]; then
-        value="$MESH_PUBLIC_URL"
-        source="MESH_PUBLIC_URL environment variable"
-    fi
-
-    local domain_file="$MESH_DOMAIN_FILE_RESOLVED"
-    if [ -z "$value" ] && [ -f "$domain_file" ]; then
-        # Windows PowerShell writes a UTF-8 BOM, and it would sit in front of the
-        # first key, so 'MESH_PUBLIC_URL=' would never match. Strip it first.
-        local domain_text
-        if [ "$(head -c 3 "$domain_file" 2>/dev/null | od -An -tx1 | tr -d ' \n')" = "efbbbf" ]; then
-            domain_text="$(tail -c +4 "$domain_file")"
-        else
-            domain_text="$(cat "$domain_file")"
-        fi
-        value="$(printf '%s\n' "$domain_text" | sed -n 's/^[[:space:]]*MESH_PUBLIC_URL[[:space:]]*=[[:space:]]*//p' | head -n 1)"
-        if [ -z "$value" ]; then
-            value="$(printf '%s\n' "$domain_text" | sed -n 's/^[[:space:]]*AGY_PUBLIC_BASE_URL[[:space:]]*=[[:space:]]*//p' | head -n 1)"
-        fi
-        value="$(printf '%s' "$value" | tr -d '"' | tr -d "'" | tr -d '\r')"
-        [ -n "$value" ] && source="$domain_file"
-    fi
-
-    if [ -z "$value" ]; then
-        # Path candidates, in order. The Microsoft Store "python.exe" (and its
-        # python3.exe twin) is an App Execution Alias: it is on PATH, it prints
-        # nothing usable, and it stops working after a Store repair - the same trap
-        # the Windows installer refuses to pin into an autostart entry. Skipping it
-        # by path is what lets the real interpreter behind it be found, or makes the
-        # resolver refuse honestly instead of trusting a stub.
-        local resolved_python=""
-        for candidate_python in python3 python py; do
-            command -v "$candidate_python" >/dev/null 2>&1 || continue
-            resolved_python="$(command -v "$candidate_python")"
-            case "$resolved_python" in
-                *[Ww]indows[Aa]pps*) continue ;;
-            esac
-            value="$("$resolved_python" -c "import sys; sys.path.insert(0, r'$repo_dir'); from core import domain; print(domain.DEFAULT_PUBLIC_BASE_URL)" 2>/dev/null || true)"
-            [ -n "$value" ] && { source="$repo_dir/core/domain.py default"; break; }
-        done
-    fi
-
-    if [ -z "$value" ]; then
-        MESH_DOMAIN_URL=""; MESH_DOMAIN_HOST=""; MESH_DOMAIN_SOURCE=""
-        export MESH_DOMAIN_URL MESH_DOMAIN_HOST MESH_DOMAIN_SOURCE MESH_DOMAIN_FILE_RESOLVED
-        return 1
-    fi
-
-    case "$value" in
-        http://*|https://*) ;;
-        *) value="https://$value" ;;
-    esac
-    MESH_DOMAIN_URL="${value%/}"
-    MESH_DOMAIN_HOST="$(printf '%s' "$MESH_DOMAIN_URL" | sed -e 's|^[A-Za-z][A-Za-z0-9+.-]*://||' -e 's|/.*$||')"
-    MESH_DOMAIN_SOURCE="$source"
-    export MESH_DOMAIN_URL MESH_DOMAIN_HOST MESH_DOMAIN_SOURCE MESH_DOMAIN_FILE_RESOLVED
-    return 0
-}

package/ops/nginx/README.md

@@ -1,77 +0,0 @@
-# Gateway nginx configuration
-
-Two files, and neither holds a domain literal:
-
-| File | Role |
-| :--- | :--- |
-| `antigravity-mesh-mcp.conf` | the snippet included from the gateway server block: installers, node bootstrap payload, public file shares, MCP endpoints |
-| `mesh-domain.vhost.template` | the HTTPS vhost for the gateway, with `__MESH_DOMAIN__` and `__MESH_CERT_NAME__` placeholders |
-| `render-domain.sh` | renders the template from the one place the domain is declared |
-
-## Where the domain comes from
-
-`render-domain.sh` sources `ops/mesh-domain.sh`, which resolves the domain exactly
-as `core/domain.py` does at runtime:
-
-1. `MESH_PUBLIC_URL` in the environment;
-2. `MESH_PUBLIC_URL` (or the `AGY_PUBLIC_BASE_URL` alias) in the domain file —
-   `/etc/antigravity-mesh/domain.env` by default, `MESH_DOMAIN_FILE` overrides it;
-3. `core/domain.py`'s `DEFAULT_PUBLIC_BASE_URL`, the single declaration of the
-   project default.
-
-`deploy_gateway.sh` uses the same script, so the gateway, the node, the installers
-and nginx all agree on one value.
-
-## Rendering
-
-```bash
-ops/nginx/render-domain.sh                 # render into ./rendered/, change nothing
-ops/nginx/render-domain.sh --out DIR       # render into DIR
-ops/nginx/render-domain.sh --check         # diff the rendered vhost against the live one
-ops/nginx/render-domain.sh --apply         # install into /etc/nginx
-```
-
-`--apply` backs up the current vhost and snippet into
-`/root/backups/antigravity-mesh/nginx-<timestamp>/`, runs `nginx -t`, and only then
-reloads; on a failed test nothing is reloaded and the rollback command is printed.
-
-`--check` is the way to prove the live host still matches the repository: with the
-domain configured correctly it renders byte-identically to
-`/etc/nginx/sites-available/<domain>`.
-
-## Switching the domain
-
-1. Put the new value in the one place — `MESH_PUBLIC_URL` in
-   `/etc/antigravity-mesh/domain.env` (node hosts:
-   `%USERPROFILE%\.config\antigravity-mesh\domain.env`).
-2. Issue the certificate for the new name (certbot, or `tailscale cert` when the
-   name is a Tailscale node name).
-3. `ops/nginx/render-domain.sh --apply`.
-4. `MESH_GATEWAY=… deploy_gateway.sh` to publish installers carrying the new
-   default, if the domain is also served from that host.
-
-## Two lines in the snippet are load-bearing for MCP clients
-
-### `Connection ""` on `/sse`, `/mcp`, `/messages`
-
-These are plain HTTP endpoints. The WebSocket idiom
-`proxy_set_header Connection "upgrade"` was applied to them too, which advertises
-an upgrade on every POST. Only `/ws/tunnel` is a real WebSocket and keeps it.
-
-### `keepalive_timeout 0` on `/sse`, `/mcp`, `/messages`
-
-Google's MCP frontend sends a chunked `DELETE` whose terminator can arrive after
-nginx has already answered. On a kept-alive connection those leftover bytes were
-parsed as a new request line — nginx logged `"0" 400` for it (79 times in 12
-minutes) and closed the connection, losing whatever the client had in flight;
-the client then reported `DEADLINE_EXCEEDED` after its 60 s deadline while the
-tool had already run on the node. Closing the connection after each response
-removes the desync entirely.
-
-### `default_type text/plain`, never `add_header Content-Type`
-
-`add_header Content-Type …` *appends* a header, and `alias` has already set one by
-extension, so the response carried two `Content-Type` values
-(`application/octet-stream` then `text/plain; charset=utf-8`). A client that honours
-the first treats the installer as binary: PowerShell's `Invoke-WebRequest` then
-hands `Invoke-Expression` a byte array, and `irm …/install.ps1 | iex` cannot work.

package/ops/nginx/antigravity-mesh-mcp.conf

@@ -1,172 +0,0 @@
-    # --- Antigravity Mesh FastMCP Gateway Endpoints ---
-    # --- Scanner / secret-hunting noise control ---
-    # Automated probes for .env, secrets, backups and WordPress files always
-    # 404. Answer them here so they never reach the app or its logs.
-    location ~* \.(env|git|svn|bak|old|sql|log|ini|conf|yml|yaml|json)$ {
-        access_log off;
-        return 404;
-    }
-    location ~* /(wp-content|wp-admin|wp-config|vendor|node_modules)/ {
-        access_log off;
-        return 404;
-    }
-
-    # --- Served bootstrap files -------------------------------------------
-    # "default_type text/plain", never "add_header Content-Type ...": add_header
-    # APPENDS a header, and `alias` has already set Content-Type by extension, so
-    # the response carried TWO Content-Type values
-    # ("application/octet-stream" then "text/plain; charset=utf-8"). A client that
-    # honours the first one treats the script as binary: PowerShell's
-    # Invoke-WebRequest then hands Invoke-Expression a byte array instead of text,
-    # and the documented `irm .../install.ps1 | iex` cannot work.
-    location /install.sh {
-        alias /var/www/antigravity-mesh/install.sh;
-        default_type text/plain;
-        charset utf-8;
-        add_header Access-Control-Allow-Origin *;
-    }
-
-    location /install.ps1 {
-        alias /var/www/antigravity-mesh/install.ps1;
-        default_type text/plain;
-        charset utf-8;
-        add_header Access-Control-Allow-Origin *;
-    }
-
-    location = /gateway.py {
-        # Source is published in the GitHub repository; the live gateway does not
-        # need to serve it. Keeps the auth/tunnel logic off the public surface.
-        access_log off;
-        return 404;
-    }
-
-    # --- Only the bootstrap files are public -------------------------------
-    # A curl/npx install needs exactly these; the rest of core/ (hooks, policies,
-    # schemas, subagents, triggers, code_cache, agent_harness) is internal and is
-    # not fetched by any installer, so it is not served.
-    location ~ ^/core/(hooks|policies|schemas|subagents|triggers|code_cache|agent_harness)\.py$ {
-        access_log off;
-        return 404;
-    }
-
-    location /core/ {
-        alias /var/www/antigravity-mesh/core/;
-        default_type text/plain;
-        charset utf-8;
-        add_header Access-Control-Allow-Origin *;
-    }
-
-    location /skills/ {
-        alias /var/www/antigravity-mesh/skills/;
-        default_type text/plain;
-        charset utf-8;
-        add_header Access-Control-Allow-Origin *;
-    }
-
-    # The Windows watchdog and the doctor travel with the node bootstrap: the
-    # served install.ps1 registers the scheduled task that runs the watchdog, and
-    # the README tells the operator to run the doctor, so both must be fetchable
-    # by a node that installed itself from this domain.
-    location /ops/ {
-        alias /var/www/antigravity-mesh/ops/;
-        default_type text/plain;
-        charset utf-8;
-        add_header Access-Control-Allow-Origin *;
-    }
-
-    location /mcp {
-        proxy_pass http://127.0.0.1:8096;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "";
-        keepalive_timeout 0;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Target-User "";
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 86400s;
-        proxy_send_timeout 86400s;
-    }
-
-    location /sse {
-        proxy_pass http://127.0.0.1:8096/sse;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "";
-        keepalive_timeout 0;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Target-User "";
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 86400s;
-        proxy_send_timeout 86400s;
-    }
-
-    location /messages {
-        proxy_pass http://127.0.0.1:8096/messages;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "";
-        keepalive_timeout 0;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Target-User "";
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 86400s;
-        proxy_send_timeout 86400s;
-    }
-
-    location /ws/tunnel {
-        proxy_pass http://127.0.0.1:8096/ws/tunnel;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Target-User "";
-        proxy_buffering off;
-        proxy_cache off;
-        proxy_read_timeout 86400s;
-        proxy_send_timeout 86400s;
-    }
-
-    location /api/register {
-        limit_req zone=mesh_register burst=5 nodelay;
-        proxy_pass http://127.0.0.1:8096/api/register;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Target-User "";
-    }
-
-    location /health-mesh {
-        proxy_pass http://127.0.0.1:8096/health;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Target-User "";
-    }
-
-    location = /.well-known/oauth-protected-resource {
-        proxy_pass http://127.0.0.1:8096;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-    }
-
-    location ^~ /.well-known/oauth-protected-resource/ {
-        proxy_pass http://127.0.0.1:8096;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-    }

package/ops/nginx/mesh-domain.vhost.template

@@ -1,58 +0,0 @@
-# ==============================================================================
-#  Antigravity Mesh - the gateway's HTTPS vhost, as a template
-#
-#  Rendered by ops/nginx/render-domain.sh, which takes the domain from the one
-#  place that declares it (MESH_PUBLIC_URL, the domain file, or core/domain.py).
-#  Do not edit the rendered file on the host: edit this template and re-render,
-#  or the domain ends up in two places again.
-#
-#  Placeholders:
-#    __MESH_DOMAIN__     the public domain, e.g. mesh.example.com
-#    __MESH_CERT_NAME__  the certbot lineage name (usually the same as the domain)
-#
-#  Only the Mesh surface lives here. Other names that may share a host
-#  (api-agy., agy/, /v1/, ...) belong to other services and keep their own files.
-# ==============================================================================
-
-# HTTP -> HTTPS, plus the ACME path so certificate renewal keeps working.
-server {
-    listen 80;
-    listen [::]:80;
-    server_name __MESH_DOMAIN__;
-
-    location ^~ /.well-known/acme-challenge/ {
-        root /var/www/acme;
-        default_type text/plain;
-    }
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-# HTTPS: the Mesh gateway itself.
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name __MESH_DOMAIN__;
-
-    ssl_certificate     /etc/letsencrypt/live/__MESH_CERT_NAME__/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/__MESH_CERT_NAME__/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    # The installers, the node bootstrap payload and the public file shares.
-    include /etc/nginx/snippets/antigravity-mesh-mcp.conf;
-
-    # The MCP surface: SSE and Streamable HTTP stream, so buffering stays off.
-    location / {
-        proxy_pass http://127.0.0.1:8096;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_read_timeout 86400;
-    }
-}

package/ops/nginx/render-domain.sh

@@ -1,123 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-#  Antigravity Mesh - render the nginx configuration for the public domain.
-#
-#  The domain comes from the one place ops/mesh-domain.sh resolves it from:
-#  MESH_PUBLIC_URL, then the domain file, then core/domain.py's single default.
-#  Nothing here holds a domain literal.
-#
-#  Usage:
-#     ops/nginx/render-domain.sh                 # render into ./rendered/
-#     ops/nginx/render-domain.sh --out DIR       # render into DIR
-#     ops/nginx/render-domain.sh --apply         # install into /etc/nginx
-#                                                # (backup + nginx -t + reload)
-#     ops/nginx/render-domain.sh --check         # fail if the rendered vhost
-#                                                # differs from the live one
-#  Env:
-#     MESH_DOMAIN_FILE       path to the domain file
-#     MESH_CERT_NAME         certbot lineage name (default: the domain)
-#     MESH_NGINX_DIR         nginx config root for --apply (default /etc/nginx)
-# ==============================================================================
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
-TEMPLATE="$SCRIPT_DIR/mesh-domain.vhost.template"
-SNIPPET="$SCRIPT_DIR/antigravity-mesh-mcp.conf"
-
-# shellcheck source=../mesh-domain.sh
-. "$REPO_DIR/ops/mesh-domain.sh"
-
-BOLD=""; GREEN=""; YELLOW=""; RED=""; RESET=""
-if [ -t 1 ]; then
-    BOLD="\033[1m"; GREEN="\033[0;32m"; YELLOW="\033[1;33m"; RED="\033[0;31m"; RESET="\033[0m"
-fi
-info() { printf "${BOLD}%s${RESET}\n" "$*"; }
-ok()   { printf "${GREEN}✓ %s${RESET}\n" "$*"; }
-die()  { printf "${RED}✗ %s${RESET}\n" "$*" >&2; exit 1; }
-
-OUT_DIR=""
-APPLY=false
-CHECK=false
-while [ $# -gt 0 ]; do
-    case "$1" in
-        --out)   OUT_DIR="${2:-}"; [ -n "$OUT_DIR" ] || die "--out needs a directory"; shift 2 ;;
-        --apply) APPLY=true; shift ;;
-        --check) CHECK=true; shift ;;
-        -h|--help) sed -n '2,26p' "$0" | sed 's/^#\{1,2\} \{0,1\}//'; exit 0 ;;
-        *) die "Unknown parameter: $1 (try --help)" ;;
-    esac
-done
-
-mesh_resolve_domain "$REPO_DIR" \
-    || die "Cannot determine the public domain: export MESH_PUBLIC_URL, write MESH_PUBLIC_URL into ${MESH_DOMAIN_FILE:-/etc/antigravity-mesh/domain.env}, or run from a checkout that has core/domain.py"
-
-CERT_NAME="${MESH_CERT_NAME:-$MESH_DOMAIN_HOST}"
-NGINX_DIR="${MESH_NGINX_DIR:-/etc/nginx}"
-
-info "Rendering the Mesh nginx configuration"
-echo "  domain      : $MESH_DOMAIN_URL"
-echo "  server_name : $MESH_DOMAIN_HOST"
-echo "  cert name   : $CERT_NAME"
-echo "  source      : $MESH_DOMAIN_SOURCE"
-
-render() {
-    local dst="$1"
-    mkdir -p "$(dirname "$dst")"
-    sed -e "s|__MESH_DOMAIN__|$MESH_DOMAIN_HOST|g" \
-        -e "s|__MESH_CERT_NAME__|$CERT_NAME|g" \
-        "$TEMPLATE" > "$dst"
-    grep -q '__MESH_' "$dst" && die "unsubstituted placeholder left in $dst"
-    return 0
-}
-
-if [ "$CHECK" = true ]; then
-    live_vhost="$NGINX_DIR/sites-available/$MESH_DOMAIN_HOST"
-    [ -f "$live_vhost" ] || die "no live vhost at $live_vhost to compare against"
-    tmp="$(mktemp)"
-    trap 'rm -f "$tmp"' EXIT
-    render "$tmp"
-    if diff -u "$live_vhost" "$tmp" >/dev/null; then
-        ok "the live vhost matches the rendered template"
-        exit 0
-    fi
-    diff -u "$live_vhost" "$tmp" || true
-    die "the live vhost differs from the rendered template (see the diff above)"
-fi
-
-if [ "$APPLY" = true ]; then
-    command -v nginx >/dev/null 2>&1 || die "nginx is not installed here; use --out to render elsewhere"
-    TS="$(date +%Y%m%d-%H%M%S)"
-    backup_dir="/root/backups/antigravity-mesh/nginx-$TS"
-    mkdir -p "$backup_dir"
-    vhost_target="$NGINX_DIR/sites-available/$MESH_DOMAIN_HOST"
-    snippet_target="$NGINX_DIR/snippets/antigravity-mesh-mcp.conf"
-
-    [ -f "$vhost_target" ] && cp -a "$vhost_target" "$backup_dir/" || true
-    [ -f "$snippet_target" ] && cp -a "$snippet_target" "$backup_dir/" || true
-
-    render "$vhost_target"
-    install -m 644 "$SNIPPET" "$snippet_target"
-    ln -sfn "$vhost_target" "$NGINX_DIR/sites-enabled/$MESH_DOMAIN_HOST"
-
-    if ! nginx -t 2>&1; then
-        warn_rollback="cp -a $backup_dir/. $NGINX_DIR/ && nginx -t && systemctl reload nginx"
-        printf "${RED}✗ nginx rejected the rendered configuration${RESET}\n" >&2
-        echo "  the previous files are in $backup_dir" >&2
-        echo "  rollback: $warn_rollback" >&2
-        exit 1
-    fi
-    systemctl reload nginx
-    ok "applied; backup in $backup_dir"
-    echo "  rollback: cp -a $backup_dir/. $NGINX_DIR/ && nginx -t && systemctl reload nginx"
-    exit 0
-fi
-
-# Default: render next to the caller, so nothing on the host changes.
-OUT_DIR="${OUT_DIR:-$PWD/rendered}"
-render "$OUT_DIR/$MESH_DOMAIN_HOST"
-install -m 644 "$SNIPPET" "$OUT_DIR/antigravity-mesh-mcp.conf"
-ok "rendered into $OUT_DIR"
-echo "  vhost   : $OUT_DIR/$MESH_DOMAIN_HOST"
-echo "  snippet : $OUT_DIR/antigravity-mesh-mcp.conf"
-echo "  apply   : $0 --apply"