# macOS host install (LaunchAgent)

The DMG / `.app` **only places** CorporateLabs.app. Discover starts after you
open the app, paste an access key in the CorporateLabs window, and start
discover — still the same `clabs` binary, not a new agent. No VPN, system
proxy, MITM CA, or firewall rule is installed.

Published artifacts (after release CI):

| Object | URL |
|---|---|
| **DMG** | `https://install.corporatelabs.ai/clabs/latest/CorporateLabs.dmg` |
| `.app` zip (Mac CI) | `https://install.corporatelabs.ai/clabs/latest/CorporateLabs_darwin_universal.app.zip` |
| This doc | `https://install.corporatelabs.ai/MACOS.md` |

Pin a release with `clabs/vX.Y.Z/` instead of `clabs/latest/`. Dogfood with `clabs/dev/`.

## Prerequisites

1. Console → **Installations** → type **macOS** → mint an access key
2. macOS 12+ (Monterey), Apple Silicon or Intel. The `.app` must be built with **Go 1.22** (`GOTOOLCHAIN=go1.22.12`); newer Go stamps a macOS 13 minimum into the binary.
3. Outbound HTTPS to `api.corporatelabs.ai` (or your on-prem collector)

## Install

1. Download the DMG from the table above (CI builds it on a Mac runner).
2. Open the DMG. Drag **CorporateLabs.app** into **Applications**.
3. Open it from **Applications** (not from the disk image). A CorporateLabs window opens — it does not use Safari. Right-click → Open the first time if Gatekeeper warns (unsigned until notarized). If it still blocks: `xattr -c /Applications/CorporateLabs.app`.
4. Paste the `clt_…` access key in the CorporateLabs window and start discover.

That registers a **user** LaunchAgent (`~/Library/LaunchAgents/ai.corporatelabs.clabs.plist`) which runs `clabs run` (discover). It does **not** run `clabs intercept`.

## What this agent does

- Samples processes that look agentic and may record their TCP peers
- POSTs Events to `https://api.corporatelabs.ai`
- Listens on **no** local port

Confirm nothing is listening:

```bash
lsof -nP -iTCP -sTCP:LISTEN | grep -i clabs || echo "clabs is not listening"
```

## Check Events

Console → **Events**. Rows show `installationId` (stamped from the access key).
Hosts lists the machine hostname.

## Uninstall

Drag **CorporateLabs.app** to the Trash. The LaunchAgent notices the bundle is
gone, unloads itself, and deletes:

- `~/Library/LaunchAgents/ai.corporatelabs.clabs.plist`
- `~/Library/Application Support/clabs` (includes the access key)
- `~/Library/Logs/clabs`

Your VPN, proxy, and trust store are unchanged — this agent never owned them.

To stop without deleting the app: open CorporateLabs.app → **Stop agent**.

## Build a DMG locally

```bash
cd packages/listener
VER=0.0.0-dev bash dist/macos/build-dmg.sh
# dist/out/CorporateLabs.dmg  (macOS)
# dist/out/CorporateLabs_darwin_<arch>.app.zip
# uses GOTOOLCHAIN=go1.22.12 so the app launches on Monterey 12
```