Install the extension from the update server during setup

Both installers ended by telling you to load the folder unpacked, which is the
one install that can never update itself. They now offer the policy install as
a last step instead, and only fall back to those instructions when it is
declined or fails.

Windows writes to the user's own policy hive rather than HKLM, so the step
needs no elevation and no separate admin shell; -Scope Machine is still there
for every-account installs. Linux gets the counterpart script — a managed
policy file under /etc, which is root-only because Chrome reads policy from
nowhere else on that platform.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -132,14 +132,21 @@ pick it up from the server.
 select the `extension` folder.
 
 That is the development install. On a machine that just runs trades, install it
-from our own update server instead — one elevated command, and Chrome then keeps
-it updated by itself:
+from our own update server instead, and Chrome keeps it updated by itself — the
+setup scripts offer this as their last step, and it can be run on its own at any
+time:
 
 ```powershell
 powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
 ```
 
-See [deploy/README.md](deploy/README.md). Either way the extension notices when
+```bash
+sudo scripts/install-extension-policy.sh
+```
+
+No administrator rights on Windows, where it goes into the user's own policy
+hive; root on Linux, where Chrome only reads policy from `/etc`. See
+[deploy/README.md](deploy/README.md). Either way the extension notices when
 the dashboard is running newer code than it is: a policy install asks Chrome to
 fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload
 icon on its card still works and is the thing to try when something looks

deploy/README.md

@@ -81,15 +81,27 @@ version than the one it is running.
 
 ## Installing it on a machine
 
-From an elevated PowerShell on the Windows box:
+`setup-windows.bat` and `setup-linux.sh` both offer this as their last step, so
+a fresh instance needs nothing extra. To do it by hand, or on a machine that was
+set up before this existed:
 
 ```powershell
 powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
 ```
 
-Then remove the unpacked copy from `chrome://extensions` — it now has the same
-id, and Chrome will not load both — and restart Chrome. `-Remove` undoes it;
-`-Browser Edge` or `-Browser Brave` writes the same entry for those instead.
+```bash
+sudo scripts/install-extension-policy.sh
+```
+
+The Windows script writes to the current user's policy hive and needs no
+elevation; `-Scope Machine` covers every account on the box and does need an
+elevated shell. Linux has no per-user equivalent — Chrome only reads managed
+policy from `/etc` — so that one is root-only and machine-wide. Both take
+`-Remove` / `--remove`, and the Windows one takes `-Browser Edge` or
+`-Browser Brave`.
+
+Afterwards, remove the unpacked copy from `chrome://extensions` — it now has the
+same id, and Chrome will not load both — and restart the browser.
 
 Development still works the old way: load `extension/` unpacked on a machine
 with no policy entry. It keeps the same id (that is what `key` in the manifest

scripts/install-extension-policy.ps1

@@ -3,29 +3,38 @@
     Install the AutoFirmer extension from our own update server, via policy.
 
 .DESCRIPTION
-    Chrome will not side-load an extension on Windows, and it will not update an
-    unpacked one. The supported way to run an extension you host yourself is an
-    enterprise policy: ExtensionInstallForcelist names the extension id and the
-    update manifest, and from then on Chrome installs it, keeps it updated on its
-    own schedule, and re-installs it if it goes missing.
+    Chrome will not side-load an extension on Windows — dropping a CRX on
+    chrome://extensions is refused — and it will not update an unpacked one. The
+    supported way to run an extension you host yourself is a policy:
+    ExtensionInstallForcelist names the extension id and the update manifest, and
+    from then on Chrome installs it, keeps it updated on its own schedule, and
+    re-installs it if it goes missing.
 
-    Needs an elevated PowerShell — the policy lives under HKLM.
+    Defaults to the current user's policy hive, which needs no elevation.
+    -Scope Machine writes to HKLM instead, for every account on the box; that
+    one does need an elevated shell. Where both exist, HKLM wins.
 
     After this runs:
       * Remove the unpacked copy from chrome://extensions. It has the same id
         now, and Chrome will not load both.
       * Restart Chrome, or open chrome://policy and press "Reload policies".
       * A force-installed extension cannot be disabled or removed from the
-        extensions page. Re-run this with -Remove to take it off.
+        extensions page. Re-run with -Remove to take it off.
 
 .EXAMPLE
     powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
+
+.EXAMPLE
+    powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1 -Scope Machine -Browser Edge
 #>
 [CmdletBinding()]
 param(
     [ValidateSet('Chrome', 'Edge', 'Brave')]
     [string]$Browser = 'Chrome',
 
+    [ValidateSet('User', 'Machine')]
+    [string]$Scope = 'User',
+
     # Derived from the signing key on the droplet. It only changes if the key does.
     [string]$Id = 'lkjbblagjjbldlkeaaffhiopdlhniaan',
 
@@ -36,23 +45,27 @@ param(
 
 $ErrorActionPreference = 'Stop'
 
-$roots = @{
-    Chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
-    Edge   = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
-    Brave  = 'HKLM:\SOFTWARE\Policies\BraveSoftware\Brave'
+$vendors = @{
+    Chrome = 'Google\Chrome'
+    Edge   = 'Microsoft\Edge'
+    Brave  = 'BraveSoftware\Brave'
 }
 
+$hive = if ($Scope -eq 'Machine') { 'HKLM:' } else { 'HKCU:' }
+
+if ($Scope -eq 'Machine') {
     $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
     if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
             [Security.Principal.WindowsBuiltInRole]::Administrator)) {
-    throw 'Run this from an elevated PowerShell — the policy key is under HKLM.'
+        throw 'Run this from an elevated PowerShell for -Scope Machine, or drop the flag to install it for this user only.'
+    }
 }
 
-$key   = Join-Path $roots[$Browser] 'ExtensionInstallForcelist'
+$key   = "$hive\SOFTWARE\Policies\$($vendors[$Browser])\ExtensionInstallForcelist"
 $entry = "$Id;$UpdateUrl"
 
 if ($Remove) {
-    if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no forcelist for $Browser."; exit 0 }
+    if (-not (Test-Path $key)) { Write-Host "Nothing to remove — no $Scope forcelist for $Browser."; exit 0 }
     $props = Get-ItemProperty $key
     $found = $false
     foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notlike 'PS*' })) {
@@ -62,7 +75,7 @@ if ($Remove) {
             $found = $true
         }
     }
-    if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser forcelist." }
+    if (-not $found) { Write-Host "Nothing to remove — $Id was not in the $Browser $Scope forcelist." }
     Write-Host "`nRestart $Browser to let the change take effect."
     exit 0
 }
@@ -78,15 +91,16 @@ $existing = $props.PSObject.Properties |
 
 if ($existing) {
     Set-ItemProperty -Path $key -Name $existing.Name -Value $entry
-    Write-Host "Updated $Browser forcelist entry $($existing.Name):"
+    Write-Host "Updated the $Browser $Scope forcelist entry $($existing.Name):"
 } else {
     $used = $props.PSObject.Properties.Name |
             Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ }
     $slot = if ($used) { (($used | Measure-Object -Maximum).Maximum + 1) } else { 1 }
     New-ItemProperty -Path $key -Name "$slot" -Value $entry -PropertyType String -Force | Out-Null
-    Write-Host "Added $Browser forcelist entry ${slot}:"
+    Write-Host "Added $Browser $Scope forcelist entry ${slot}:"
 }
 
+Write-Host "  $key"
 Write-Host "  $entry"
 Write-Host @"
 

scripts/install-extension-policy.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Install the AutoFirmer extension from our own update server, via policy.
+#
+# The Linux counterpart to install-extension-policy.ps1. Chrome reads managed
+# policy from JSON files under /etc, so unlike Windows there is no per-user
+# option here — it needs root, and it applies to everyone on the machine.
+#
+#   sudo scripts/install-extension-policy.sh            # install
+#   sudo scripts/install-extension-policy.sh --remove   # take it back off
+set -euo pipefail
+
+ID="${EXTENSION_ID:-lkjbblagjjbldlkeaaffhiopdlhniaan}"
+UPDATE_URL="${EXTENSION_UPDATE_URL:-https://ext.juicerroom.com/updates.xml}"
+FILE=autofirmer.json
+
+REMOVE=0
+[ "${1:-}" = "--remove" ] && REMOVE=1
+
+info() { printf '  %s\n' "$1"; }
+fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }
+
+[ "$(id -u)" -eq 0 ] || fail "run this with sudo — Chrome only reads policy from /etc"
+
+# Every Chromium-family browser reads the same policy format from its own
+# directory. Only the ones actually installed are touched: creating the
+# directory for a browser that is not there would do nothing but confuse
+# whoever finds it later.
+CANDIDATES="
+/etc/opt/chrome/policies/managed
+/etc/chromium/policies/managed
+/etc/chromium-browser/policies/managed
+/etc/opt/edge/policies/managed
+/etc/brave/policies/managed
+"
+
+touched=0
+for dir in $CANDIDATES; do
+    parent=$(dirname "$(dirname "$dir")")      # e.g. /etc/opt/chrome
+    [ -d "$parent" ] || [ -d "$dir" ] || continue
+
+    if [ "$REMOVE" -eq 1 ]; then
+        if [ -f "$dir/$FILE" ]; then
+            rm -f "$dir/$FILE"
+            info "removed $dir/$FILE"
+            touched=$((touched + 1))
+        fi
+        continue
+    fi
+
+    mkdir -p "$dir"
+    # Its own file rather than an edit of someone else's: Chrome merges every
+    # JSON in this directory, so a separate file cannot corrupt a policy set by
+    # something else. Two files setting ExtensionInstallForcelist would collide,
+    # which is worth knowing if this machine is centrally managed.
+    cat > "$dir/$FILE" <<JSON
+{
+  "ExtensionInstallForcelist": ["$ID;$UPDATE_URL"]
+}
+JSON
+    chmod 644 "$dir/$FILE"
+    info "wrote $dir/$FILE"
+    touched=$((touched + 1))
+done
+
+if [ "$touched" -eq 0 ]; then
+    if [ "$REMOVE" -eq 1 ]; then
+        info "nothing to remove"
+    else
+        fail "found no Chrome, Chromium, Edge or Brave installation to configure"
+    fi
+    exit 0
+fi
+
+echo
+if [ "$REMOVE" -eq 1 ]; then
+    info "Restart the browser to let the change take effect."
+else
+    info "Next:"
+    info "  1. Remove any unpacked copy from chrome://extensions (same id — both cannot load)."
+    info "  2. Restart the browser, or open chrome://policy and press \"Reload policies\"."
+    info "  3. The card should read \"Installed by enterprise policy\"."
+fi

setup-linux.sh

@@ -86,34 +86,34 @@ echo
 # The branch is named explicitly: a bare clone follows the remote's default
 # branch, which is not necessarily master.
 if [ -d "$TARGET/.git" ]; then
-    info "[1/6] existing checkout - switching to master and pulling..."
+    info "[1/7] existing checkout - switching to master and pulling..."
     git -C "$TARGET" fetch origin
     git -C "$TARGET" checkout master
     git -C "$TARGET" pull --ff-only origin master
 else
-    info "[1/6] cloning $REPO_URL ..."
+    info "[1/7] cloning $REPO_URL ..."
     git clone --branch master "$REPO_URL" "$TARGET"
 fi
 
 cd "$TARGET"
 
 # ── 2. npm ──────────────────────────────────────────────────────────────────
-info "[2/6] installing npm dependencies (a few minutes on a Pi)..."
+info "[2/7] installing npm dependencies (a few minutes on a Pi)..."
 npm install
 
 # ── 3. build ────────────────────────────────────────────────────────────────
-info "[3/6] building..."
+info "[3/7] building..."
 npm run build
 
 # ── 4. settings ─────────────────────────────────────────────────────────────
-info "[4/6] writing instance settings..."
+info "[4/7] writing instance settings..."
 node scripts/seed-settings.js "$MASTER_URL" "$INSTANCE"
 
 # ── 5. python ───────────────────────────────────────────────────────────────
 # A virtualenv rather than a system pip install: Raspberry Pi OS Bookworm
 # enforces PEP 668, so pip into the system interpreter fails outright with
 # "externally-managed-environment".
-info "[5/6] installing clicker dependencies into a virtualenv..."
+info "[5/7] installing clicker dependencies into a virtualenv..."
 VENV="$TARGET/clicker/.venv"
 [ -d "$VENV" ] || python3 -m venv "$VENV"
 "$VENV/bin/python" -m pip install --quiet --upgrade pip
@@ -126,7 +126,7 @@ fi
 
 # ── 6. autostart ────────────────────────────────────────────────────────────
 echo
-info "[6/6] Auto-start and auto-update"
+info "[6/7] Auto-start and auto-update"
 info "      Starts AutoFirmer and the clicker at login, and checks master every"
 info "      5 minutes - rebuilding and restarting when it moves. A failed build"
 info "      is never deployed."
@@ -140,6 +140,25 @@ else
     info "      Skipped. Run scripts/install-autostart.sh later to enable it."
 fi
 
+# ── 7. extension ────────────────────────────────────────────────────────────
+# Chrome refuses to side-load a CRX and will not update an unpacked folder, so
+# the extension goes in the way a self-hosted one has to: a managed-policy file
+# naming our update server. That lives under /etc, hence sudo — there is no
+# per-user equivalent on Linux.
+echo
+info "[7/7] Chrome extension"
+info "      Installs it from the update server and lets Chrome keep it current"
+info "      by itself. Needs sudo - the policy file lives under /etc."
+read -r -p "      Set this up now? [Y/n] " DOEXT
+EXTPOLICY=0
+if [ "${DOEXT,,}" != "n" ]; then
+    if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else
+        warn "extension policy failed - load $TARGET/extension unpacked for now"
+    fi
+else
+    info "      Skipped. Run: sudo scripts/install-extension-policy.sh"
+fi
+
 # ── summary ─────────────────────────────────────────────────────────────────
 echo
 echo " ============================================"
@@ -159,8 +178,13 @@ else
 fi
 echo
 info "Still manual:"
+if [ "$EXTPOLICY" -eq 1 ]; then
+    info "  - Restart Chrome, and remove any unpacked copy of the extension"
+    info "    (it shares the same id now, and Chrome will not load both)"
+else
     info "  - Load the Chrome extension: chrome://extensions -> Developer mode"
     info "    -> Load unpacked -> $TARGET/extension"
+fi
 info "  - Add your firm credentials on the dashboard's Settings page"
 if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then
     echo

setup-windows.bat

@@ -201,7 +201,7 @@ REM The branch is named explicitly throughout. A bare `git clone` follows the
 REM remote's default branch, which is not necessarily master - and an existing
 REM checkout may be sitting on a stale branch from before that was corrected.
 if exist "%TARGET%\.git" goto :repo_update
-echo  [1/6] Cloning %REPO_URL% ...
+echo  [1/7] Cloning %REPO_URL% ...
 git clone --branch master "%REPO_URL%" "%TARGET%"
 if errorlevel 1 goto :clone_failed
 goto :repo_ready
@@ -211,7 +211,7 @@ echo  [X] Clone failed. Check network access to git.juicerroom.com.
 goto :fail
 
 :repo_update
-echo  [1/6] Existing checkout found - switching to master and pulling...
+echo  [1/7] Existing checkout found - switching to master and pulling...
 pushd "%TARGET%"
 git fetch origin
 if errorlevel 1 goto :pull_failed
@@ -235,7 +235,7 @@ pushd "%TARGET%"
 
 REM ------------------------------------------------------------------- install
 echo.
-echo  [2/6] Installing npm dependencies ^(this takes a few minutes^)...
+echo  [2/7] Installing npm dependencies ^(this takes a few minutes^)...
 call npm install
 if errorlevel 1 (
     echo.
@@ -250,7 +250,7 @@ if errorlevel 1 (
 
 REM --------------------------------------------------------------------- build
 echo.
-echo  [3/6] Building...
+echo  [3/7] Building...
 call npm run build
 if errorlevel 1 (
     echo  [X] Build failed.
@@ -260,7 +260,7 @@ if errorlevel 1 (
 
 REM ------------------------------------------------------------------ settings
 echo.
-echo  [4/6] Writing instance settings...
+echo  [4/7] Writing instance settings...
 node scripts\seed-settings.js "%MASTER_URL%" "%INSTANCE%"
 if errorlevel 1 (
     echo  [X] Could not write settings to autotrader.sqlite.
@@ -274,7 +274,7 @@ if defined PYCMD echo %PYCMD%> scripts\.python-cmd
 REM ------------------------------------------------------ python deps (option)
 echo.
 if not defined PYCMD goto :deps_skip
-echo  [5/6] Installing clicker Python dependencies...
+echo  [5/7] Installing clicker Python dependencies...
 REM requirements.txt guards its pyobjc entries with sys_platform == "darwin",
 REM so on Windows this resolves to pyautogui and its wheels only.
 %PYCMD% -m pip install --upgrade --quiet --disable-pip-version-check pip
@@ -292,7 +292,7 @@ echo        %PYCMD% -m pip install -r clicker\requirements.txt
 goto :deps_done
 
 :deps_skip
-echo  [5/6] Skipping Python dependencies ^(python not found^).
+echo  [5/7] Skipping Python dependencies ^(python not found^).
 
 :deps_done
 
@@ -300,7 +300,7 @@ REM ------------------------------------------------------------- autostart
 REM Prompted, not automatic: turning a trading PC into something that rebuilds
 REM and restarts itself on every push to master should be a decision.
 echo.
-echo  [6/6] Auto-start and auto-update
+echo  [6/7] Auto-start and auto-update
 echo        Starts AutoFirmer and the clicker at logon, and checks master every
 echo        5 minutes - rebuilding and restarting when it moves. A failed build
 echo        is never deployed.
@@ -325,6 +325,35 @@ set "AUTOSTART=0"
 
 :autostart_done
 
+REM ------------------------------------------------------- extension policy
+REM Chrome refuses to side-load a CRX and will not update an unpacked folder, so
+REM the extension is installed the way a self-hosted one has to be: a policy
+REM entry naming our update server. Written to this user's hive, which needs no
+REM elevation - install-extension-policy.ps1 -Scope Machine covers every account.
+echo.
+echo  [7/7] Chrome extension
+echo        Installs it from the update server and lets Chrome keep it current
+echo        by itself. No administrator rights needed.
+set "DOEXT="
+set /p "DOEXT=      Set this up now? [Y/n] "
+if /i "%DOEXT%"=="n" goto :ext_skipped
+powershell -NoProfile -ExecutionPolicy Bypass -File "%TARGET%\scripts\install-extension-policy.ps1"
+if errorlevel 1 (
+    echo  [!] Extension policy failed. Load %TARGET%\extension unpacked for now,
+    echo      and re-run scripts\install-extension-policy.ps1 to try again.
+    set "EXTPOLICY=0"
+) else (
+    set "EXTPOLICY=1"
+)
+goto :ext_done
+
+:ext_skipped
+echo        Skipped. Run scripts\install-extension-policy.ps1 later, or load
+echo        %TARGET%\extension unpacked and reload it by hand after updates.
+set "EXTPOLICY=0"
+
+:ext_done
+
 REM ---------------------------------------------------------------- start file
 > "%~dp0start-autofirmer.bat" (
     echo @echo off
@@ -361,10 +390,15 @@ echo   Handy         : pm2 list ^| pm2 logs autofirmer ^| pm2 logs clicker
 :summary_manual
 echo.
 echo   Still manual:
+if "%EXTPOLICY%"=="1" (
+    echo     - Restart Chrome, and remove any unpacked copy of the extension
+    echo       ^(it shares the same id now, and Chrome will not load both^)
+) else (
     echo     - Load the Chrome extension: chrome://extensions, enable Developer
     echo       mode, "Load unpacked", select %TARGET%\extension
-echo       ^(an update cannot reload it for you - the dashboard warns when
-echo        the extension or runner is behind^)
+    echo       ^(loaded that way it reloads itself from disk after a pull;
+    echo        the policy install lets Chrome update it properly^)
+)
 echo     - Add your firm credentials on the dashboard's Settings page
 echo.
 pause