Chrome Control MCP companion — local test installer
Exact companion version, installer revision and source mode are in runtime-lock.json.
Current builds use canonical root source. Historical builds require --audited-0.1.1.

PRE-RELEASE / LOCAL TEST BUILDS. These are ZIP-distributed script installers,
not signed native PKG/MSI/EXE installers. macOS arm64 was tested locally;
Windows and Intel Mac require native acceptance testing before release.
No installer is signed or notarized. Gatekeeper, PowerShell policy or SmartScreen
may block it. Do not disable security settings to run it. An unsigned package
is not a verified public release. Review source or await a signed release if blocked.
The bundled Mac Node executables pass codesign --verify outside the build
sandbox and match their official archives byte-for-byte. This does not sign
or notarize the companion ZIP or installer scripts.

Choose your architecture: macos-arm64 = Apple Silicon, macos-x64 = Intel,
windows-x64 = 64-bit Intel/AMD Windows. Windows ARM is not supported.
Node 24 official minimums: macOS 13.5+, Windows 10 / Server 2016+.
Only the host macOS version is tested; older OS versions need validation.

FULL: program + locked ws dependency + private Node executable/license.
No network or global Node/npm installation is needed during setup.
LIGHT: program + locked ws dependency, without Node. Detects compatible Node
(Node 22 or 24 LTS before their support end dates, matching target architecture)
on PATH; Mac also checks /opt/homebrew/bin
and /usr/local/bin. If missing, asks separately before downloading pinned Node
from https://nodejs.org into this install. Answering anything except yes declines.
The download must match the pinned SHA256 before extraction or execution.
Existing Node is not upgraded, replaced or patched. A private runtime must be
updated by a future reviewed installer; no automatic updater is installed.

1. Verify the archive SHA256 against the separately provided SHA256SUMS.txt.
   Mac: shasum -a 256 <archive.zip>
   Windows PowerShell: Get-FileHash <archive.zip> -Algorithm SHA256
2. Extract the ZIP completely. Do not run from inside a ZIP viewer.
3. Mac: open Terminal and run /bin/bash "/path/to/Install.command".
   Windows: open PowerShell and run & "C:\path\to\Install.ps1".
   Respect your execution policy. No bypass command is supplied or required
   by the installer. If policy blocks unsigned scripts, use a signed release.
4. Review the destination and answer yes to install. In LIGHT mode, separately
   answer yes only if you want the missing private Node runtime downloaded.
   All prompts default to no, including redirected/closed input.
5. Copy the installed mcp-config.example.json entry into your MCP client's
   configuration yourself. It uses an absolute Node path + bin/mcp.js, keeping
   stdout reserved for MCP. The installed Mac launcher is an alternative.
6. Install/enable the browser extension yourself. Start the companion from your
   MCP client, then manually pair using its per-run pairing URL. Setup does not
   start the broker, pair a browser, or grant browser access.

Default destination:
 Mac: ~/Library/Application Support/Chrome Control MCP/<archive name>
 Windows: %LOCALAPPDATA%\Chrome Control MCP\<archive name>
Override the parent folder with --prefix PATH (Mac) or -InstallRoot PATH (Windows).
Paths with spaces are supported. The destination must be new. A repeat install
refuses to overwrite an existing destination; it neither repairs nor upgrades it.
For a reinstall, close clients and manually move/delete that exact install first.
Do not delete ~/.chrome-control-mcp unless you intend to remove runtime state.

The installer creates only its destination, a short-lived staging directory and,
if authorized, a temporary verified download. It installs no services, startup
items, PATH entries, browser extension, security exceptions or client settings.
Running the companion later preserves its existing detached loopback broker
behavior and broad capability defaults; installation is not browser pairing.
Uninstall: close MCP clients and the companion broker, then delete the exact
install directory. No global dependency was installed by this installer.

Node.js redistribution LICENSE and ws LICENSE are included. Runtime archive
hashes were obtained over HTTPS from the official Node distribution manifest
and pinned in runtime-lock.json. SHA256 proves agreement with those pins;
the Node manifest's PGP signature has NOT been independently validated.

This archive: chrome-control-mcp-companion-0.1.8-installer.8-macos-arm64-light
Node.js when bundled/downloaded: 24.21.0
Official runtime: https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz
Runtime archive SHA256: bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057
