macOS and Windows differences

The two platforms are not at the same maturity, and it is better to know where before you
roll out.
macOS
Signed and notarized; no security warning on first launch.
Install by dragging to Applications. Running from the mounted disk image leaves
macOS executing it from a translocated read-only path where it cannot keep its device
key.
The device key lives in the Keychain.
Environment changes are applied in the way that actually reaches applications launched
from the Dock, not only terminal sessions.
The app can compare an installed AI application's code-signing identity against the
vendor's real one, and flag an imposter. This check is macOS-only.
Windows
Installs per user via an NSIS installer — no administrator rights needed.
Not yet Authenticode-signed, so SmartScreen warns on first run. This is the main
outstanding gap on Windows.
The device key lives in Credential Manager.
Command-line tool detection understands Windows executable extensions, so 
claude.cmd
is found the same way 
claude is on macOS.
Automatic updates ship but are unproven; treat them as manual.
There is no MSI and no Group Policy deployment path yet — the per-user installer is the
only supported route.
Linux
The app builds, but Linux is not a supported distribution track and there is no signed
package. If you need it, tell us — it is a matter of demand, not of feasibility.