The background agent that keeps each developer's local setup on the approved standard now ships signed installers for macOS and Windows.
baselane team · Jun 24, 2026 · 4 min read
Packs get distributed to repos as pull requests. That part of baselane has been solid since the beginning — a PR lands, someone reviews it, it merges or it doesn't. But a repo-level standard only covers what lives in the repo. Editor settings, global assistant preferences, locally installed tool versions — none of that is a file a PR can touch. That's the gap the laptop agent closes, and as of this release it closes it on the two platforms most engineering teams actually use.
The laptop agent runs quietly in the background on a developer's machine. It holds a subscription to whatever packs their org has approved for their team, polls the portal for changes, and reconciles local state against the current version — the same reconcile logic that underlies repo-level distribution, just running against a laptop instead of a git remote.
Reconciliation is conservative by design. The agent only ever touches the specific configuration surfaces a pack declares — a global Claude Code settings file, a shared snippets directory, an MCP server registration — and it merges into what's already there. If a developer has local customizations layered on top of the standard, those survive. The agent adds and updates a managed region; it does not clobber the rest of the file.
A background process that touches configuration files on a developer's laptop is exactly the kind of thing macOS Gatekeeper and Windows SmartScreen are built to stop, and they should stop it if it isn't signed. That was the real work in this release: getting both installers through notarization and code signing so IT teams can push the agent through Jamf, Intune, or whatever MDM they already run, without asking developers to click through a security warning first.
Concretely, that means:
.pkg for macOS, installable silently via MDM or interactively via the standard installer flow..msi for Windows, with the same silent-install path for managed fleets.Before signed installers, rolling the agent out to a fleet meant asking every developer to run an unsigned binary — fine for an early pilot with volunteers, not something a platform team could put in an onboarding checklist. With signing in place, the agent becomes something IT can provision the same way they provision every other piece of standard developer tooling: silently, at machine setup, with no individual click-through.
That matters more than it sounds. The repos in an org converge on a standard the moment the packs merge. Laptops converge only as fast as developers install and keep the agent running. Removing the friction from installation is what turns "most developers have adopted the standard" into "every developer has."
Linux support is in progress — the reconcile engine itself is already platform-agnostic, so the remaining work is packaging and signing, the same category of problem we just finished for macOS and Windows. If your team runs a mixed fleet, this is the release where the laptop agent stops being an early-access curiosity and starts being infrastructure.