IT Mass Deployment (Non-Store)

Audience: IT and endpoint administrators deploying Pyze to all client machines when the extension is not installed from the Chrome Web Store or Edge Add-ons. Pyze supplies a signed package; you host it internally and force-install it by policy.

The native host is a small local helper that reads the signed-in OS username and hands the extension a hashed identifier (see Privacy note).

Two components go to every machine:

If your environment can install from the store, the store guide is simpler.

Step 1: Install the Native Host (Machine-Wide)

Use the package for the target OS: pyze-native-host-<customer>-windows.zip or pyze-native-host-<customer>-macos.zip. Run as Administrator or system (Intune, SCCM, Jamf).

• Windows
• macOS

reg add "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.pyze.host"  /ve /t REG_SZ /d "C:\Program Files\Pyze\com.pyze.host.json" /f
reg add "HKLM\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.pyze.host" /ve /t REG_SZ /d "C:\Program Files\Pyze\com.pyze.host.json" /f

reg add "HKLM\SOFTWARE\Policies\Google\Chrome"  /v NativeHostsExecutablesLaunchDirectly /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v NativeHostsExecutablesLaunchDirectly /t REG_DWORD /d 1 /f

# Create the folders; none of them exist on a fresh Mac
mkdir -p "/Library/Application Support/Pyze" \
         "/Library/Google/Chrome/NativeMessagingHosts" \
         "/Library/Microsoft/Edge/NativeMessagingHosts"

install -m 755 pyze-native-host-macos-arm64 "/Library/Application Support/Pyze/pyze-native-host"
xattr -d com.apple.quarantine "/Library/Application Support/Pyze/pyze-native-host" 2>/dev/null || true

# Register the manifest for both browsers
cp com.pyze.host.json "/Library/Google/Chrome/NativeMessagingHosts/"
cp com.pyze.host.json "/Library/Microsoft/Edge/NativeMessagingHosts/"

Step 2: Host the Extension Package

Pyze ships pyze-<customer>-<version>.crx and update.xml, and gives you the extension ID with the package. The package is signed with a fixed key, so the ID never changes between versions, and the native host from Step 1 already trusts it.

Put both files on an internal HTTPS server that every endpoint can reach (office, VPN, Citrix):

• The certificate must be trusted by the endpoints. Allow anonymous GET with no sign-in redirect. SharePoint, OneDrive, and Teams links do not work.
• Serve .crx as application/x-chrome-extension. Do not use file:// or UNC paths.
• Edit the one URL in update.xml to point at your location:

<updatecheck codebase="https://<host>/pyze/pyze-<customer>-<version>.crx" version="<version>" />

Step 3: Force-Install by Policy

Set the force-install policy with this value (extension ID, semicolon, update.xml URL):

<extension-id>;https://<host>/pyze/update.xml

Verify on a client

1. Open chrome://policy and click Reload policies. The entry should be listed without error.
2. Open chrome://extensions. Pyze <Customer> should appear with the ID above and the label Installed by your organization.
3. If the extension is missing, open the update.xml URL in the browser on that machine. It must load with no redirect or certificate warning.

Verify the Native Host on a Client

Open chrome://extensions (Edge: edge://extensions), turn on Developer mode, click service worker under Pyze <Customer>, and reload the extension. The console should show Pyze: Native config loaded followed by User Hash: <string>.

On managed machines the service worker link is hidden until the DeveloperToolsAvailability policy is 1 under HKLM\SOFTWARE\Policies\Google\Chrome (and ...\Microsoft\Edge for Edge). On Citrix published desktops push that value with Group Policy or a Citrix WEM registry action, as a manual change on a non-persistent host is lost at reboot. Remove it again when you are done.

Any other message means the native host is not working. Native Host Troubleshooting maps each console message (not found, forbidden, Failed to start) to its cause and fix.

Updates and Uninstall

Extension: Pyze sends a new .crx and update.xml. Upload the .crx, edit the codebase URL in the new update.xml to your location exactly as in Step 2, then replace the old update.xml. Browsers update silently within a few hours, with no policy change. Never re-zip or modify the .crx.

Native host: replace the binary at the install path.

Uninstall extension: delete the force-install entry. The browser removes the extension at the next policy refresh.

Uninstall native host (Windows): run the following, then delete C:\Program Files\Pyze\:

reg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.pyze.host"  /f
reg delete "HKLM\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.pyze.host" /f

Uninstall native host (macOS): delete the two com.pyze.host.json files and /Library/Application Support/Pyze/.

Privacy Note

The native host reads the OS username and sends only a SHA-256 hash of it. The username itself is never sent. The hash is a stable pseudonymous identifier, so the same user gets the same ID on every machine.