# macOS and Windows differences

The two platforms are not at the same maturity, and it is better to know where before you
roll out.

## macOS

- Signed and notarized; no security warning on first launch.
- **Install by dragging to Applications.** Running from the mounted disk image leaves
  macOS executing it from a translocated read-only path where it cannot keep its device
  key.
- The device key lives in the **Keychain**.
- Environment changes are applied in the way that actually reaches applications launched
  from the Dock, not only terminal sessions.
- The app can compare an installed AI application's code-signing identity against the
  vendor's real one, and flag an imposter. This check is macOS-only.

## Windows

- Installs **per user** via an NSIS installer — no administrator rights needed.
- **Not yet Authenticode-signed**, so SmartScreen warns on first run. This is the main
  outstanding gap on Windows.
- The device key lives in **Credential Manager**.
- Command-line tool detection understands Windows executable extensions, so `claude.cmd`
  is found the same way `claude` is on macOS.
- Automatic updates ship but are unproven; treat them as manual.
- There is no MSI and no Group Policy deployment path yet — the per-user installer is the
  only supported route.

## Linux

The app builds, but Linux is not a supported distribution track and there is no signed
package. If you need it, tell us — it is a matter of demand, not of feasibility.