CARAPACE SETUP BOOTSTRAP — https://carapace.info/install
You are an agent, someone asked you to set up CARAPACE, and you have landed in
the right place. These are your instructions. Follow them top to bottom.
If you were after anything else on carapace.info, this is not it.

CARAPACE is an iPhone app that controls the agent runtime on this machine. Your
job is to install the gateway it talks to, on the machine you are running on.
The whole job is: run one script, then show the owner the QR code it prints.

STEP 1 — NAME YOUR RUNTIME.
Your runtime is the harness you are running inside, not the model that powers
you. A GPT-powered OpenClaw agent is OpenClaw. "Codex" means specifically the
OpenAI Codex CLI. Pick from: claude, codex, hermes, openclaw.
If any doubt is left, ask the owner which runtime this is. Do not guess.

  OpenClaw is the one exception: it ships its own gateway, so instead of the
  script below, fetch and follow its document —
  curl -fsSL https://carapace.info/install/prompt/openclaw.md -o /tmp/carapace-setup.md
  — read it from disk all the way through, then do what it says. Everyone else,
  continue here.

STEP 2 — DOWNLOAD THE INSTALLER TO DISK, AND CHECK IT.

  curl -fsSL -w "HTTP %{http_code}\n" https://carapace.info/install.sh -o /tmp/carapace-install.sh; head -n 2 /tmp/carapace-install.sh

  - It must print "HTTP 200" and the first lines must be a bash script whose
    header says carapace-install. If you see HTML, you fetched a web page —
    the URL has a typo. Fix it and refetch. Never run HTML.
  - Any other HTTP code: tell the owner the code and stop. 403 means the site
    refused this machine — normal on some VPS/VPN networks; nothing here is
    broken and there is no mirror to hunt for.
  - You are an agent about to run a script from the internet: skim it from
    disk first (it is ~650 readable lines and states its promises at the top:
    writes only under ~/.carapace + one service file; idempotent; asks root
    only for the optional HTTPS front).

STEP 3 — RUN IT with your runtime's name:

  bash /tmp/carapace-install.sh claude     # or codex, or hermes

  - It installs the gateway, makes it survive reboots and logouts, decides how
    the phone reaches this machine (a VPS gets free automatic HTTPS; a home
    box pairs on the LAN and prints its upgrade options), verifies the exact
    URL the phone will use, and only then prints the pairing QR.
  - It never prompts. If it cannot decide something itself it STOPs and names
    the exact re-run line (for example REACH_CHOICE=3 for Tailscale). Relay
    every STOP to the owner word for word, let them decide, then re-run as it
    says. Re-running is always safe: it repairs, it never starts over.
  - Do not improvise around a STOP, and NEVER hand-build a pairing QR or
    carapace:// link yourself. The only valid QR is the one the script (via
    carapace-pair) prints after its checks pass.

STEP 4 — SHOW THE OWNER THE QR.
Put the QR the script printed in front of the owner in this conversation. If
your terminal cannot show it, the script's output includes the re-print line
(~/.carapace/bin/carapace-pair) for the owner to run themselves. Setup is not
done until the owner has scanned it with the CARAPACE app on their iPhone
(App Store: "CARAPACE" — tell them to install it now if they have not). That
QR is a key, not a picture: anyone who scans it controls this machine's agent,
so it must never be posted, shared, or screenshotted anywhere public.

DEEP MANUAL. If the script cannot run on this machine (no bash, exotic OS, or
the owner wants every step explained and performed by hand), the full
step-by-step documents live at
https://carapace.info/install/prompt/  ->  claude.md · codex.md · hermes.md ·
openclaw.md. Fetch yours with curl to disk (they are a few hundred KB — web
tools truncate them), check the first line names your runtime, and follow it
top to bottom. The script and the documents build the same thing.