Merge dev → main: native installers + browser MCP off by default (#79)

## Summary
Promotes the installer + safety changes from \`dev\` to \`main\`.

What lands:

- **PR #78** \`feat(install): native installers (.pkg + .exe)\` — proper
macOS \`.pkg\` builder + Windows Inno Setup \`.exe\` with real icons.
Replaces the curl-pipe scripts as the recommended path for non-technical
users.
- **PR #77** \`feat(mcp): disable Playwright MCP by default\` — browser
tools become opt-in. Main agent and browser-pilot crew don't see
\`browser_*\` tools until the user enables Playwright in MCP settings.
- **PR #75** + follow-up fixes \`1cf856f\` and \`f61032a\` — the
original curl-pipe scripts plus the two patches I pushed during testing
(osascript GUI password prompt for non-TTY sudo; Unicode ellipses
replaced with ASCII so \`set -u\` doesn't choke).

After merge, the README's
\`raw.githubusercontent.com/.../main/scripts/install.sh\` URL resolves
and the legacy curl-pipe path keeps working alongside the new native
installers. Future cleanup (deleting the curl-pipe scripts since the
native installers are the recommended path) can be a follow-up commit.

## Test plan
- [ ] After merge, build the macOS \`.pkg\` from
\`installer/macos/build-pkg.sh\`, run on a clean Mac, confirm app
installs and dashboard opens
- [ ] Run \`installer/windows/Output/DaemoraSetup.exe\` on a clean
Windows box, confirm same
- [ ] Confirm browser tools are absent from main agent's tool list on a
fresh install (PR #77 default)
- [ ] Verify
\`https://raw.githubusercontent.com/CodeAndCanvasLabs/Daemora/main/scripts/install.sh\`
resolves

Author: UmarFarooq75

.gitignore

@@ -1,5 +1,6 @@
 # ── Dependencies ─────────────────────────────────────────────────────────────
 node_modules/
+.pnpm-store/
 
 # ── Environment - NEVER commit secrets ───────────────────────────────────────
 .env

README.md

@@ -121,7 +121,22 @@ Then message your bot. That's it.
 
 ## Installation
 
-### npm (recommended)
+### Download the installer (recommended — no terminal needed)
+
+Native installers handle everything: Node.js, the daemora package, app icons, Desktop / Start Menu shortcuts, and the launcher. Click the icon → browser opens to the dashboard. First-run walks through the setup wizard.
+
+| Platform | Download | What you get |
+|---|---|---|
+| **macOS** (12+, Apple Silicon or Intel) | [`Daemora.pkg`](https://github.com/CodeAndCanvasLabs/Daemora/releases/latest) | Standard install wizard. `Daemora.app` and `Stop Daemora.app` land in `/Applications`. Desktop alias. Spotlight + Launchpad indexed. |
+| **Windows** (10+) | [`DaemoraSetup.exe`](https://github.com/CodeAndCanvasLabs/Daemora/releases/latest) | Inno Setup wizard. Start Menu + Desktop shortcuts. |
+
+Double-click the installer → walk through the wizard → enter your password (it writes to `/Applications` on macOS or `Program Files` on Windows). Then double-click the **Daemora** icon. Browser opens at `http://localhost:8081`. The setup wizard inside the app collects your model API key and configures channels.
+
+Closing the browser **does not** stop daemora — the daemon is detached and survives logout. Use the **Stop Daemora** shortcut to actually shut it down.
+
+> Building the installer locally (e.g. for an unreleased commit)? See [`installer/README.md`](./installer/README.md) and the per-platform `BUILD.md` files.
+
+### npm (developers)
 
 ```bash
 npm install -g daemora

…ew/video-editor/template/public/logo.png …o-editor/template/public/DaemoraLogo.pngcrew/video-editor/template/public/logo.png renamed to crew/video-editor/template/public/DaemoraLogo.png crew/video-editor/template/public/logo.png renamed to crew/video-editor/template/public/DaemoraLogo.png

@@ -0,0 +1,100 @@
+# Daemora installers
+
+One-click installers for non-technical users. Two platforms, same UX:
+
+```
+Download installer  →  Run it  →  Click "Daemora" on Desktop  →  Web UI opens
+```
+
+No terminal. No `npm install -g`. No `daemora setup`. The web UI handles
+all configuration on first run.
+
+## Layout
+
+```
+installer/
+├── windows/                Inno Setup project -> DaemoraSetup.exe
+│   ├── daemora.iss
+│   ├── launcher.ps1
+│   ├── assets/             (drop daemora.ico here)
+│   └── BUILD.md
+└── macos/                  pkgbuild project -> Daemora.pkg
+    ├── build-pkg.sh
+    ├── distribution.xml
+    ├── scripts/
+    │   ├── preinstall
+    │   └── postinstall
+    ├── app-template/
+    │   ├── Daemora.app/
+    │   └── Stop Daemora.app/
+    ├── resources/          (welcome.html, license.html, etc.)
+    └── BUILD.md
+```
+
+## What the installer does
+
+1. **Detects Node.js 22+** — installs it if missing.
+   - Windows: `winget install OpenJS.NodeJS.LTS`, fallback to MSI download.
+   - macOS: Homebrew (auto-installs brew if missing) + `brew install node@22`.
+2. **`npm install -g daemora`**.
+3. **Drops a launcher + shortcuts**:
+   - Windows: `launcher.ps1` in install dir, shortcuts on Start Menu + Desktop.
+   - macOS: `Daemora.app` and `Stop Daemora.app` in /Applications, alias on Desktop.
+
+## Lifecycle
+
+- **Start** (1-click): double-click the Daemora icon. If the daemon isn't
+  running, it spawns hidden (no Terminal/PowerShell window), waits for
+  `/health`, then opens the browser. If already running, just opens
+  the browser.
+- **Closing the browser does NOT stop Daemora.** The daemon is detached
+  and survives browser close, launcher exit, and even user logout.
+- **Stop**: separate "Stop Daemora" shortcut/app. Reads the PID file
+  in the data dir and kills the process tree. Falls back to killing
+  whatever's bound to port 8081 if the PID file is stale.
+
+## Data dir
+
+Daemora resolves its data dir to the OS-standard app dir automatically
+(see [src/config/env.ts](../src/config/env.ts)):
+
+- Windows: `%APPDATA%\Daemora\` (= `C:\Users\<user>\AppData\Roaming\Daemora`)
+- macOS:   `~/Library/Application Support/Daemora/`
+
+The launcher writes `daemora.pid` and `daemora.log` to the same dir, so
+all per-user state lives in one place. Uninstalling the app does not
+delete the data dir — user state survives reinstalls.
+
+## Build
+
+See [`windows/BUILD.md`](windows/BUILD.md) and [`macos/BUILD.md`](macos/BUILD.md).
+
+The Windows installer is built with Inno Setup on a Windows machine.
+The macOS installer needs `pkgbuild` / `productbuild`, which are
+macOS-only. CI: GitHub Actions has both `windows-latest` and
+`macos-latest` runners that can produce both artifacts in one workflow.
+
+## Code signing
+
+Both platforms warn loudly on unsigned installers. Strongly recommended
+for non-technical users — tells the OS "this came from us, run it".
+
+| Platform | Cert | Cost | What you get |
+|---|---|---|---|
+| Windows | EV code-signing | $200–400/yr | No SmartScreen warning at all |
+| Windows | Standard OV | $80–200/yr | Warning clears once enough users install it (reputation) |
+| macOS   | Developer ID + notarization | $99/yr | No Gatekeeper warning; "Open" works on first try |
+
+Without signing, expect the user to click through one OS warning on
+their first install. After install, every subsequent launch is silent.
+
+## Release process
+
+1. Bump version in [`package.json`](../package.json).
+2. Bump `AppVersion` in [`windows/daemora.iss`](windows/daemora.iss) and
+   `version` in [`macos/distribution.xml`](macos/distribution.xml).
+3. `npm publish` (so `npm install -g daemora` resolves the new version).
+4. Build both installers (CI or locally on each OS).
+5. Sign + notarize.
+6. Upload `DaemoraSetup.exe` and `Daemora.pkg` to GitHub Releases.
+7. Update README download links.

installer/README.md

@@ -0,0 +1,71 @@
+# Building the macOS installer
+
+Must be built on macOS 12+. Linux/Windows can't produce a notarized
+`.pkg` because `pkgbuild` and `productbuild` are macOS-only tools.
+
+## Prerequisites
+
+1. **Xcode CLI tools**: `xcode-select --install`
+2. (For signing/notarization, optional but strongly recommended for
+   non-technical end users) **Apple Developer ID** ($99/yr).
+3. `daemora.icns` is checked into both `.app` Resources dirs, generated
+   from [`ui/public/favicon.svg`](../../ui/public/favicon.svg). If the
+   SVG changes, regenerate with `pnpm run icons:installer`.
+
+## Build (unsigned, for local testing)
+
+```bash
+chmod +x installer/macos/build-pkg.sh
+installer/macos/build-pkg.sh
+```
+
+Output: `installer/macos/dist/Daemora.pkg`.
+
+To test locally: double-click the `.pkg`. Gatekeeper will block it
+("cannot be opened because it is from an unidentified developer").
+Workaround: System Settings → Privacy & Security → "Open Anyway".
+
+## Build, sign, and notarize (for public release)
+
+```bash
+# 1. Build
+installer/macos/build-pkg.sh
+
+# 2. Sign
+productsign --sign "Developer ID Installer: Your Name (TEAMID)" \
+    installer/macos/dist/Daemora.pkg \
+    installer/macos/dist/Daemora-signed.pkg
+
+# 3. Notarize (one-time setup: store credentials in keychain)
+xcrun notarytool store-credentials NOTARY \
+    --apple-id you@example.com \
+    --team-id TEAMID \
+    --password app-specific-password
+
+xcrun notarytool submit installer/macos/dist/Daemora-signed.pkg \
+    --keychain-profile NOTARY --wait
+
+# 4. Staple the notarization ticket so Gatekeeper passes offline too
+xcrun stapler staple installer/macos/dist/Daemora-signed.pkg
+```
+
+Without notarization: every user has to right-click → Open the first
+time. With notarization: double-click works on any Mac, no warnings.
+
+## What the user sees
+
+1. Download `Daemora.pkg` from GitHub Releases, double-click.
+2. Standard macOS install wizard: Continue → Continue → Install (asks
+   for the user's password — required to write to /Applications).
+3. Two `.app` bundles land in /Applications: **Daemora** and **Stop
+   Daemora**. A **Daemora** alias appears on the Desktop.
+4. Daemora is also dropped into the user's Applications list (Spotlight,
+   Launchpad).
+
+## 1-click launch
+
+Double-click **Daemora** on the Desktop (or in /Applications). No
+Terminal window. Browser opens to http://localhost:8081 once the server
+is ready. The daemon survives browser close, app exit, and user logout.
+
+To stop: double-click **Stop Daemora.app** in /Applications.

installer/macos/.metadata_never_index

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleDevelopmentRegion</key>
+    <string>en</string>
+    <key>CFBundleExecutable</key>
+    <string>Daemora</string>
+    <key>CFBundleIconFile</key>
+    <string>daemora.icns</string>
+    <key>CFBundleIdentifier</key>
+    <string>com.codeandcanvaslabs.daemora</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>Daemora</string>
+    <key>CFBundleDisplayName</key>
+    <string>Daemora</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>1.0.0</string>
+    <key>CFBundleVersion</key>
+    <string>1</string>
+    <key>LSApplicationCategoryType</key>
+    <string>public.app-category.productivity</string>
+    <key>LSMinimumSystemVersion</key>
+    <string>12.0</string>
+    <key>LSUIElement</key>
+    <false/>
+    <key>NSHighResolutionCapable</key>
+    <true/>
+</dict>
+</plist>

installer/macos/BUILD.md

@@ -0,0 +1,73 @@
+#!/bin/bash
+#
+# Daemora.app launcher — what runs when the user double-clicks the icon.
+#
+# 1-click flow:
+#   - if daemon already running -> open browser, exit
+#   - else -> start daemon detached, wait for /health, open browser, exit
+#
+# No Terminal window. No interactive prompts. The daemon survives this
+# script exiting (nohup + disown), browser close, and user logout.
+
+set -u
+
+PORT=8081
+URL="http://localhost:$PORT"
+DATA_DIR="$HOME/Library/Application Support/Daemora"
+PID_FILE="$DATA_DIR/daemora.pid"
+LOG_FILE="$DATA_DIR/daemora.log"
+
+mkdir -p "$DATA_DIR"
+
+# Make sure /opt/homebrew/bin (Apple Silicon) and /usr/local/bin (Intel)
+# are on PATH — Finder-launched apps inherit a sparse PATH that often
+# misses Homebrew, so daemora won't resolve without this.
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+show_error() {
+    osascript <<EOF
+display alert "Daemora failed to start" message "$1" as critical
+EOF
+}
+
+is_health_ok() {
+    curl -sf --max-time 2 "$URL/health" >/dev/null 2>&1
+}
+
+is_daemon_running() {
+    if is_health_ok; then return 0; fi
+    [ -f "$PID_FILE" ] || return 1
+    local pid
+    pid=$(cat "$PID_FILE" 2>/dev/null)
+    [ -n "$pid" ] || return 1
+    kill -0 "$pid" 2>/dev/null
+}
+
+start_daemon() {
+    if ! command -v daemora >/dev/null 2>&1; then
+        show_error "The 'daemora' command is not on PATH. Re-run the Daemora installer to fix this."
+        return 1
+    fi
+    # Suppress daemora's own browser-open so we can poll /health first
+    # and only open the page once the server is actually ready.
+    DAEMORA_NO_OPEN=1 nohup daemora start >>"$LOG_FILE" 2>&1 &
+    echo $! > "$PID_FILE"
+    disown 2>/dev/null || true
+
+    # Poll for up to 60s — first boot loads skills, embeddings, MCP, etc.
+    for _ in $(seq 1 60); do
+        if is_health_ok; then return 0; fi
+        sleep 1
+    done
+    return 1
+}
+
+if ! is_daemon_running; then
+    if ! start_daemon; then
+        show_error "Daemora did not respond within 60 seconds. Check the log at:\n$LOG_FILE"
+        exit 1
+    fi
+fi
+
+open "$URL"
+exit 0

installer/macos/app-template/Daemora.app-template/Contents/Info.plist

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleDevelopmentRegion</key>
+    <string>en</string>
+    <key>CFBundleExecutable</key>
+    <string>Stop Daemora</string>
+    <key>CFBundleIconFile</key>
+    <string>daemora.icns</string>
+    <key>CFBundleIdentifier</key>
+    <string>com.codeandcanvaslabs.daemora.stop</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>Stop Daemora</string>
+    <key>CFBundleDisplayName</key>
+    <string>Stop Daemora</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>1.0.0</string>
+    <key>CFBundleVersion</key>
+    <string>1</string>
+    <key>LSApplicationCategoryType</key>
+    <string>public.app-category.utilities</string>
+    <key>LSMinimumSystemVersion</key>
+    <string>12.0</string>
+    <key>LSUIElement</key>
+    <true/>
+    <key>NSHighResolutionCapable</key>
+    <true/>
+</dict>
+</plist>