[LIghtJUNction]

Users can install the MSG client with curl -fsSL https://msg.lmm.best/install | bash without sudo or an existing Python interpreter. The read-only /install endpoint serves a packaged script that verifies pinned uv and published MSG source archives, obtains managed Python 3.15.0rc2, and installs hash-checked client dependencies in a user-owned environment before activating the launcher.

Supports Linux glibc x86_64/ARM64 and macOS Intel/Apple Silicon. Existing unmanaged launchers require explicit --force; identities and shell configuration are retained. The current source pin is published commit 5554f93819478f4559aa226d1d94cfc6202a1cee, so installation does not require unreleased MSG assets. New client revisions need a pin/checksum update before release.

Validation: fresh isolated HOME installed over real HTTPS and msg --help worked; repeated install worked; checksum failure retained the previous launcher and identity. GET/HEAD/method/query endpoint checks and checksum regression: 2 passed. Bash syntax, ShellCheck, Ruff, wheel packaging, and diff checks passed. Linux x86_64 was exercised; other architectures were checked against available upstream artifacts, not hardware-tested. Production endpoint deployment remains separate.

Installer UX inspiration: https://github.com/codr1/termium (MSG-specific implementation; no Chromium dependency).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[LIghtJUNction]

P2: isolate the bootstrap from the caller’s uv configuration

At install.sh:224–226, the three uv commands inherit configuration discovery from the directory where the user runs curl. A project with a different required-version makes the installer reject its own pinned uv binary before creating the environment, so the advertised command can succeed from one directory and fail from another.

I reproduced the configuration behavior offline with the available uv 0.12.19: in a temporary directory containing uv.toml with required-version = "==0.1.0", venv exited 2 and created no environment; adding --no-config made the same local-interpreter command succeed. The pinned 0.12.20 source still enforces the setting before command dispatch, and uv documents discovery from the current/parent directories and user configuration.

Please pass --no-config to all three uv invocations and add a regression that starts from a directory with conflicting uv configuration. This was an isolated, non-network configuration check; I did not run the curl installer or perform a live installation.

[LIghtJUNction]

Integrated directly into main at 97876ec, without a second merge. Released as msgctl 0.2.1 and deployed as msgd 0.2.1-20261001.2. The production /install endpoint returns HTTP 200, matches the packaged source exactly, and passes bash syntax validation. Closing this superseded PR; no additional code changes.