From 0bf0587d5d26f549ba04dfa9096a849f5f50e5fb Mon Sep 17 00:00:00 2001
From: ApiliumDevTeam <it@apilium.com>
Date: Fri, 27 Mar 2026 16:08:36 +0100
Subject: [PATCH 1/3] fix: macOS launcher uses gateway install + start instead
 of start --background

---
 installer/macos/build-dmg.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/installer/macos/build-dmg.sh b/installer/macos/build-dmg.sh
index ec59bc3..17c61e8 100644
--- a/installer/macos/build-dmg.sh
+++ b/installer/macos/build-dmg.sh
@@ -235,7 +235,8 @@ done
 echo " ✓"
 
 if ! pgrep -f "mayros gateway" >/dev/null 2>&1; then
-  "$NODE" "$CLI" gateway start --background 2>/dev/null &
+  "$NODE" "$CLI" gateway install 2>/dev/null || true
+  "$NODE" "$CLI" gateway start 2>/dev/null &
 fi
 echo -n "         Waiting for Gateway."
 for i in \$(seq 1 30); do
@@ -283,7 +284,8 @@ fi
 
 # Start Gateway if not running
 if ! pgrep -f "mayros gateway" >/dev/null 2>&1; then
-  "$NODE" "$CLI" gateway start --background 2>/dev/null &
+  "$NODE" "$CLI" gateway install 2>/dev/null || true
+  "$NODE" "$CLI" gateway start 2>/dev/null &
   for i in $(seq 1 20); do
     curl -s --max-time 2 "http://127.0.0.1:18789/health" >/dev/null 2>&1 && break
     sleep 1

From 21306e777ddb45d4d58c16e357ba0babcc23140d Mon Sep 17 00:00:00 2001
From: ApiliumDevTeam <it@apilium.com>
Date: Fri, 27 Mar 2026 16:27:22 +0100
Subject: [PATCH 2/3] fix: ensure gateway.mode=local is set during installation
 on all platforms

Gateway blocks startup without gateway.mode configured. All installers
now explicitly set gateway.mode=local in mayros.json after onboard,
ensuring the gateway starts successfully on first launch.
---
 installer/linux/build-appimage.sh     |  8 +++++++-
 installer/macos/build-dmg.sh          | 17 ++++++++++++++++-
 installer/windows/build-installer.ps1 |  7 +++++++
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/installer/linux/build-appimage.sh b/installer/linux/build-appimage.sh
index 8d28439..1274a6c 100644
--- a/installer/linux/build-appimage.sh
+++ b/installer/linux/build-appimage.sh
@@ -160,11 +160,17 @@ if [[ ! -f "$CLI" ]]; then
   bash "$HERE/usr/lib/mayros/install-cli.sh"
 fi
 
-# Onboard if needed
+# Onboard if needed + ensure gateway.mode=local
 ONBOARD_MARKER="$HOME/.mayros/.onboarded"
 if [[ ! -f "$ONBOARD_MARKER" ]]; then
   echo "Configuring Mayros for first use..."
   "$NODE" "$CLI" onboard --non-interactive --defaults 2>/dev/null || true
+  CONFIG_FILE="$HOME/.mayros/mayros.json"
+  if [[ -f "$CONFIG_FILE" ]]; then
+    "$NODE" -e "const fs=require('fs');const f='$CONFIG_FILE';const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';fs.writeFileSync(f,JSON.stringify(c,null,2));" 2>/dev/null || true
+  else
+    echo '{"gateway":{"mode":"local"}}' > "$CONFIG_FILE"
+  fi
 fi
 
 # Start Cortex if not running and wait for it
diff --git a/installer/macos/build-dmg.sh b/installer/macos/build-dmg.sh
index 17c61e8..b52a3b5 100644
--- a/installer/macos/build-dmg.sh
+++ b/installer/macos/build-dmg.sh
@@ -214,9 +214,24 @@ fi
 echo "  ✓ CLI wrapper created"
 echo ""
 
-# Step 5: Onboard
+# Step 5: Onboard + configure gateway mode
 echo "  [5/6] Running initial configuration..."
 "$NODE" "$CLI" onboard --non-interactive --defaults 2>/dev/null || true
+# Ensure gateway.mode=local is set (required for gateway to start)
+CONFIG_FILE="$MAYROS_DIR/mayros.json"
+if [[ -f "\$CONFIG_FILE" ]]; then
+  # Merge gateway.mode into existing config
+  "$NODE" -e "
+    const fs = require('fs');
+    const f = '\$CONFIG_FILE';
+    const c = JSON.parse(fs.readFileSync(f, 'utf8'));
+    if (!c.gateway) c.gateway = {};
+    if (!c.gateway.mode) c.gateway.mode = 'local';
+    fs.writeFileSync(f, JSON.stringify(c, null, 2));
+  " 2>/dev/null || true
+else
+  echo '{"gateway":{"mode":"local"}}' > "\$CONFIG_FILE"
+fi
 touch "$MAYROS_DIR/.onboarded"
 echo "  ✓ Configuration complete"
 echo ""
diff --git a/installer/windows/build-installer.ps1 b/installer/windows/build-installer.ps1
index 2897194..1add853 100644
--- a/installer/windows/build-installer.ps1
+++ b/installer/windows/build-installer.ps1
@@ -127,6 +127,13 @@ call "%MAYROS_DIR%\mayros.cmd" onboard --non-interactive --defaults
 if errorlevel 1 (
     echo WARNING: initial configuration had issues, but installation will continue.
 )
+:: Ensure gateway.mode=local is set
+set "CONFIG_FILE=%MAYROS_DIR%\mayros.json"
+if not exist "%CONFIG_FILE%" (
+    echo {"gateway":{"mode":"local"}} > "%CONFIG_FILE%"
+) else (
+    "%MAYROS_DIR%\node\node.exe" -e "const fs=require('fs');const f=process.argv[1];const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';fs.writeFileSync(f,JSON.stringify(c,null,2));" "%CONFIG_FILE%" 2>nul
+)
 echo.
 echo Starting Cortex...
 start "" "%MAYROS_DIR%\bin\aingle-cortex.exe" --port 19090

From ee805ab89124833569d8c43a042a3ba63a4f1c70 Mon Sep 17 00:00:00 2001
From: ApiliumDevTeam <it@apilium.com>
Date: Fri, 27 Mar 2026 16:55:09 +0100
Subject: [PATCH 3/3] fix: skip onboard in installers so portal wizard shows on
 first launch

Replace onboard --non-interactive --defaults with minimal config
(gateway.mode=local + auth.mode=none). The portal wizard handles
provider, API key, and auth setup on first use.
---
 installer/linux/build-appimage.sh     | 17 ++++++-----------
 installer/linux/build-deb.sh          | 20 +++++++++++++++++---
 installer/macos/build-dmg.sh          | 11 +++++------
 installer/windows/build-installer.ps1 | 10 +++-------
 4 files changed, 31 insertions(+), 27 deletions(-)

diff --git a/installer/linux/build-appimage.sh b/installer/linux/build-appimage.sh
index 1274a6c..f2d114c 100644
--- a/installer/linux/build-appimage.sh
+++ b/installer/linux/build-appimage.sh
@@ -160,17 +160,12 @@ if [[ ! -f "$CLI" ]]; then
   bash "$HERE/usr/lib/mayros/install-cli.sh"
 fi
 
-# Onboard if needed + ensure gateway.mode=local
-ONBOARD_MARKER="$HOME/.mayros/.onboarded"
-if [[ ! -f "$ONBOARD_MARKER" ]]; then
-  echo "Configuring Mayros for first use..."
-  "$NODE" "$CLI" onboard --non-interactive --defaults 2>/dev/null || true
-  CONFIG_FILE="$HOME/.mayros/mayros.json"
-  if [[ -f "$CONFIG_FILE" ]]; then
-    "$NODE" -e "const fs=require('fs');const f='$CONFIG_FILE';const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';fs.writeFileSync(f,JSON.stringify(c,null,2));" 2>/dev/null || true
-  else
-    echo '{"gateway":{"mode":"local"}}' > "$CONFIG_FILE"
-  fi
+# Minimal config: gateway.mode=local + auth.mode=none (portal wizard configures auth later)
+CONFIG_FILE="$HOME/.mayros/mayros.json"
+if [[ -f "$CONFIG_FILE" ]]; then
+  "$NODE" -e "const fs=require('fs');const f='$CONFIG_FILE';const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';if(!c.gateway.auth)c.gateway.auth={};if(!c.gateway.auth.mode)c.gateway.auth.mode='none';fs.writeFileSync(f,JSON.stringify(c,null,2));" 2>/dev/null || true
+else
+  echo '{"gateway":{"mode":"local","auth":{"mode":"none"}}}' > "$CONFIG_FILE"
 fi
 
 # Start Cortex if not running and wait for it
diff --git a/installer/linux/build-deb.sh b/installer/linux/build-deb.sh
index 27bc8de..d421e7f 100644
--- a/installer/linux/build-deb.sh
+++ b/installer/linux/build-deb.sh
@@ -153,14 +153,28 @@ exec /opt/mayros/node/bin/node /opt/mayros/lib/node_modules/@apilium/mayros/dist
 EOF
 chmod +x /opt/mayros/bin/mayros
 
-# Run onboarding for the installing user
+# Minimal config: gateway.mode=local + auth.mode=none (portal wizard configures auth later)
 if [ -n "$SUDO_USER" ]; then
-  su - "$SUDO_USER" -c "/opt/mayros/bin/mayros onboard --non-interactive --defaults" || true
+  MAYROS_DIR="/home/$SUDO_USER/.mayros"
+  su - "$SUDO_USER" -c "mkdir -p '$MAYROS_DIR'"
+  CONFIG_FILE="$MAYROS_DIR/mayros.json"
+  if [ -f "$CONFIG_FILE" ]; then
+    su - "$SUDO_USER" -c "/opt/mayros/node/bin/node -e \"const fs=require('fs');const f='$CONFIG_FILE';const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';if(!c.gateway.auth)c.gateway.auth={};if(!c.gateway.auth.mode)c.gateway.auth.mode='none';fs.writeFileSync(f,JSON.stringify(c,null,2));\"" || true
+  else
+    su - "$SUDO_USER" -c "echo '{\"gateway\":{\"mode\":\"local\",\"auth\":{\"mode\":\"none\"}}}' > '$CONFIG_FILE'"
+  fi
   su - "$SUDO_USER" -c "systemctl --user daemon-reload" || true
   su - "$SUDO_USER" -c "systemctl --user enable mayros-gateway.service" || true
   su - "$SUDO_USER" -c "systemctl --user start mayros-gateway.service" || true
 else
-  /opt/mayros/bin/mayros onboard --non-interactive --defaults || true
+  MAYROS_DIR="$HOME/.mayros"
+  mkdir -p "$MAYROS_DIR"
+  CONFIG_FILE="$MAYROS_DIR/mayros.json"
+  if [ -f "$CONFIG_FILE" ]; then
+    /opt/mayros/node/bin/node -e "const fs=require('fs');const f='$CONFIG_FILE';const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';if(!c.gateway.auth)c.gateway.auth={};if(!c.gateway.auth.mode)c.gateway.auth.mode='none';fs.writeFileSync(f,JSON.stringify(c,null,2));" || true
+  else
+    echo '{"gateway":{"mode":"local","auth":{"mode":"none"}}}' > "$CONFIG_FILE"
+  fi
 fi
 
 echo ""
diff --git a/installer/macos/build-dmg.sh b/installer/macos/build-dmg.sh
index b52a3b5..a722020 100644
--- a/installer/macos/build-dmg.sh
+++ b/installer/macos/build-dmg.sh
@@ -214,25 +214,24 @@ fi
 echo "  ✓ CLI wrapper created"
 echo ""
 
-# Step 5: Onboard + configure gateway mode
+# Step 5: Configure gateway (skip onboard so portal wizard shows)
 echo "  [5/6] Running initial configuration..."
-"$NODE" "$CLI" onboard --non-interactive --defaults 2>/dev/null || true
-# Ensure gateway.mode=local is set (required for gateway to start)
+# Minimal config: gateway.mode=local + auth.mode=none (portal wizard configures auth later)
 CONFIG_FILE="$MAYROS_DIR/mayros.json"
 if [[ -f "\$CONFIG_FILE" ]]; then
-  # Merge gateway.mode into existing config
   "$NODE" -e "
     const fs = require('fs');
     const f = '\$CONFIG_FILE';
     const c = JSON.parse(fs.readFileSync(f, 'utf8'));
     if (!c.gateway) c.gateway = {};
     if (!c.gateway.mode) c.gateway.mode = 'local';
+    if (!c.gateway.auth) c.gateway.auth = {};
+    if (!c.gateway.auth.mode) c.gateway.auth.mode = 'none';
     fs.writeFileSync(f, JSON.stringify(c, null, 2));
   " 2>/dev/null || true
 else
-  echo '{"gateway":{"mode":"local"}}' > "\$CONFIG_FILE"
+  echo '{\"gateway\":{\"mode\":\"local\",\"auth\":{\"mode\":\"none\"}}}' > "\$CONFIG_FILE"
 fi
-touch "$MAYROS_DIR/.onboarded"
 echo "  ✓ Configuration complete"
 echo ""
 
diff --git a/installer/windows/build-installer.ps1 b/installer/windows/build-installer.ps1
index 1add853..73f634d 100644
--- a/installer/windows/build-installer.ps1
+++ b/installer/windows/build-installer.ps1
@@ -123,16 +123,12 @@ if errorlevel 1 (
     exit /b 1
 )
 echo Configuring Mayros for first use...
-call "%MAYROS_DIR%\mayros.cmd" onboard --non-interactive --defaults
-if errorlevel 1 (
-    echo WARNING: initial configuration had issues, but installation will continue.
-)
-:: Ensure gateway.mode=local is set
+:: Minimal config: gateway.mode=local + auth.mode=none (portal wizard configures auth later)
 set "CONFIG_FILE=%MAYROS_DIR%\mayros.json"
 if not exist "%CONFIG_FILE%" (
-    echo {"gateway":{"mode":"local"}} > "%CONFIG_FILE%"
+    echo {"gateway":{"mode":"local","auth":{"mode":"none"}}} > "%CONFIG_FILE%"
 ) else (
-    "%MAYROS_DIR%\node\node.exe" -e "const fs=require('fs');const f=process.argv[1];const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';fs.writeFileSync(f,JSON.stringify(c,null,2));" "%CONFIG_FILE%" 2>nul
+    "%MAYROS_DIR%\node\node.exe" -e "const fs=require('fs');const f=process.argv[1];const c=JSON.parse(fs.readFileSync(f,'utf8'));if(!c.gateway)c.gateway={};if(!c.gateway.mode)c.gateway.mode='local';if(!c.gateway.auth)c.gateway.auth={};if(!c.gateway.auth.mode)c.gateway.auth.mode='none';fs.writeFileSync(f,JSON.stringify(c,null,2));" "%CONFIG_FILE%" 2>nul
 )
 echo.
 echo Starting Cortex...