Mephisto 3.1.214 — it can update itself now

Mephisto can update itself now — if you ask it to. Plus the four-player fixes from 3.1.211–213, which never got a release of their own.

Which download?

Archive	Size	Use it when
mephisto-3.1.214.zip	585 MB	First install — everything, engines included
mephisto-3.1.214-update.zip	5.9 MB	You already have Mephisto — extract over your existing folder

⚠️ Extract the update over your existing install, never into an empty folder — without the engines it cannot run. Extract in place: Chrome derives an unpacked extension's id from its folder path, so a new folder means a new id and re-running the native-host installer.

This one you still install by hand. The updater ships in 3.1.214, so it can't be the thing that installs 3.1.214. Do this one the usual way; from here on it's a button.

Automatic updates — opt-in, off by default

Settings → General → Updates. Chrome never updates an extension you loaded yourself, so Mephisto does it instead: it fetches the 5.9 MB update archive from this repository's latest release and writes it into its own folder, in place.

Three steps, once:

1. Automatic Updates → On — Chrome asks for permission to download from this repository's releases. Refusing leaves it off.
2. Choose Extension Folder — pick the folder you loaded as an unpacked extension. Chrome remembers it.
3. Install Update when one is offered.

After that it's one button, and the extension reloads itself. Reload any game tab you had open.

In place is the whole point. The id is derived from the folder path — measured, not assumed: the same folder loaded into two fresh Chrome profiles gets the same id both times. So the id survives, and the native engine hosts registered against it keep working. That is also why install-tetrarch.ps1 no longer tells you to re-run it after every reload; it never needed to.

What it will not do:

Install anything by itself	It checks and it tells you. Nothing is written until you press Install Update.
Touch the bundled engines	The update archive doesn't contain them, so lib/engine and lib/ort are left alone.
Write into the wrong folder	A folder is rejected unless its manifest.json is this extension's.
Apply a broken download	The archive is unpacked and checked in memory first — every path, the version against the release, the files the extension needs to boot, and a refusal to apply the 585 MB archive by mistake. If anything is off, nothing is written at all.
Anything at all, while off	Every button is disabled and the installer refuses outright.

The permission is scoped to this repository's release downloads, not to github.com. You can revoke it on chrome://extensions, or just switch the toggle off, which hands it back for you.

Being straight about one thing: on Chrome 151 an extension page can already read any cross-origin URL with no host permission at all — measured, including a full read of a real release asset with nothing granted. So the permission is a visible, revocable record of what you agreed to, not the thing standing between the extension and a download. The check that actually gates it is the extension's own.

Four-player chess (from 3.1.211–213, unreleased until now)

• Help Mode draws arrows again. The moving guard sits above the whole message dispatch and its else branch was a bare return for every message shape — so it was also throwing away drawHint, clearHint and drawEvalBar, none of which touch the board. Four-player autoplay moves almost continuously, so the guard was up most of the time, which is why arrows looked broken there while the identical code worked on an 8×8 board. It now blocks only automove and premoves.
• Free-for-all is actually detected. The old scan read .board-layout-sidebar, .game-info, main — on a real game page the first two don't exist and main has no text, so it saw an empty string and fell through to the Teams default. chess.com renders the mode in .game-details-type ("1 | 7 | FFA", "2 | 10 Teams"); that's the signal now, with the whole page's text as a fallback. Also measured: the URL does not carry the mode, so that check can confirm but never decide.
• The search streams like every other engine. The readout was a bare move and a number — a8b7 (2.65). The host had been emitting an info frame per depth all along; this lane just never passed an onInfo, so all of it was discarded. It now reads Red to play, best move is a8b7, with live NPS and a score row that deepens as it searches.
• Fresh screenshots for the panel that actually ships.

Known limits

The zip reading and the in-place write are driven by tests against the real published archives — this release's own 5.9 MB artifact was unpacked by the updater and diffed file-by-file against unzip, then installed over a stand-in existing install, with the manifest key preserved and lib/engine untouched. The options page was loaded into a real Chrome to confirm showDirectoryPicker exists there at all, the section renders, and every button is dead while the toggle is off.

Three steps are not yet confirmed on a real profile: accepting the permission prompt, the folder picker returning a handle, and the reload. All three are single browser calls with no logic of ours around them, but none can be automated, so they are owed rather than done. If the first run misbehaves, say so and include what the status line said — it names the stage it failed at, and nothing is written unless every check passed.