Install the selfhost server on macOS with one script

AGENTS.md

@@ -52,7 +52,7 @@ Each spec's own `Files` / `Code Map` section is the exhaustive file→spec mappi
 - **`docs/specs/webgl-text.md`** — The SDF text-rendering stack for the 3D/WebXR terminal effort: the diffplug/xterm.js fork pipeline (branch strategy, sdf-version lockstep with `@xterm/xterm` pins, GitHub-release tarball distribution), the SDF glyph architecture in the forked webgl addon (color-free atlas with one texture entry per shape, shader tint/smoothstep contract, raster fallbacks for emoji/custom glyphs/decorated cells, the MSDF-compatible texel reservation), and the canopy Storybook lab with its upstream-vs-fork regression harness. Touch points: `canopy/`, the fork's `addons/addon-webgl` (separate repo), any bump of the fork tarball URL or `@xterm/*` pins in `canopy/package.json`.
 - **`docs/specs/remote-security-model.md`** — The trust model for remote control: passkeys prove fresh user presence (user credentials — they sync), non-extractable per-browser device keys prove long-lived Client identity, the Host's local ACL authorizes the *pair* via a local-approval pairing ceremony, and the Host — never the Server — makes the final access decision. Read this first for anything remote; the other three remote specs build on it. Touch points: `server-lib-common/src/security/`, `server/src/handshake.ts`, the security modules in `lib/src/remote/host/` and `lib/src/remote/client/`.
 - **`docs/specs/remote-api.md`** — The protocol a Client speaks after `authorizeConnection`: the shipped terminal-only **protocol-v1** (snapshot directory, attach-is-the-resize, last-attach-wins size authority) and the staged remainder (browser surfaces, in-flight replay, semantic scrollback, tethering display, grants, VR Window, WebRTC). Touch points: `server-lib-common/src/remote/wire.ts` (the fixed wire contract), `lib/src/remote/host/remote-api.ts` + `host-surface-provider.ts`, `lib/src/host/remote/` (the Node-side service both hosts install), `lib/src/remote/client/`.
-- **`docs/specs/server.md`** — The selfhost coordinating server: env config, local JSON-file state, "WebAuthn without a WebAuthn library", the HTTP API, the relay frame flow (one host challenge feeds both signatures → one biometric prompt per connect), the baked relay-origin allowlist for self-host builds (`DORMOUSE_REMOTE_CONNECT_SRC`), Host/Pocket side responsibilities, the testing harness, and instructions for running it end to end. Touch points: `server/src/`, `lib/src/remote/host/enrollment.ts`, `scripts/csp-defaults.mjs`, the `dev:pocket-server` flow.
+- **`docs/specs/server.md`** — The selfhost coordinating server: env config, local JSON-file state, "WebAuthn without a WebAuthn library", the HTTP API, the relay frame flow (one host challenge feeds both signatures → one biometric prompt per connect), the baked relay-origin allowlist for self-host builds (`DORMOUSE_REMOTE_CONNECT_SRC`), Host/Pocket side responsibilities, the testing harness, instructions for running it end to end, and the macOS LaunchAgent install behind Tailscale. Touch points: `server/src/`, `lib/src/remote/host/enrollment.ts`, `scripts/csp-defaults.mjs`, the `dev:pocket-server` flow, `deploy/local/install-macos.sh` (whose operator runbook is `SELF_HOST.md`).
 - **`docs/specs/pocket-app.md`** — Pocket app architecture: the remote session is a `PlatformAdapter` (`RemotePtyAdapter`), so Pocket is auth screens + the mobile-terminal-ui composition; the `lib/src/remote/` module layout and the same-origin deployment rule (WebAuthn origin binding + Chrome PNA). Touch points: `lib/src/remote/client/` + `pocket-app/`, `lib/vite.pocket.config.ts`, the Pocket static serving in `server/src/app.ts`.
 - **`docs/specs/deploy.md`** — Release process: the artifact matrix, release checklist, two-stage pipeline (CI builds unsigned + attests; a local script verifies, signs macOS/Windows, and creates the GitHub Release), Tauri updater manifest, changelog flow, and secrets. Touch points: `.github/workflows/release.yml`, `scripts/sign-and-deploy.sh`, `scripts/bump-version.sh`, the updater config in `tauri.conf.json`.