Signed installers

Beam distributes workspace-specific Mac and Windows desktop installers from Enrollment & installers. The packages contain enrollment configuration, so treat their distribution as an administrative operation. They are distinct from the public Agent CLI npm package.

Install the standalone beamd agent

The public beamd installer is separate from Beam CLI and from the workspace-specific Fleet packages described below. It downloads the matching agent binary through Beam's MDM installer endpoint. A token is not required to install the binary; enrollment is a separate step in Device management → Setup.

On macOS or Linux:

curl -fsSL https://agentbeam.com/mdm/install | sudo bash

On Windows, run in PowerShell:

irm https://agentbeam.com/mdm/install.ps1 | iex

To enroll, generate a single-use token in Device management → Setup and use the command shown there. The installer places beamd at /usr/local/bin/beamd on macOS and Linux, or under Program Files\Beam on Windows. The Beam CLI quickstart uses a different installer and executable.

Download a published package

Sign in with an owner or administrator account, open the setup page, and confirm the workspace ID and platform. Download the Mac package or Windows MSI that your operator has published. Verify the expected publisher before installation and test on a representative endpoint.

If an artifact is unavailable, ask the operator to check the installer manifest and read-only release mount. The dashboard does not build installers on demand. It also does not contain signing keys.

Build and publish a release

Operators use the repository's platform-specific scripts:

Build with a reviewed, pinned fleetctl release on a dedicated signing host. Supply enrollment configuration and signing credentials from your secret manager. Enrollment secrets can appear in packaging process arguments; protect builder access and avoid command transcripts containing them.

After signing, the operator publishes the artifact with the manifest tool:

bun apps/mdm-service/scripts/installer-manifest.ts /absolute/signed-package.pkg /absolute/release-output WORKSPACE_ID VERSION

Use an MSI path for Windows. The tool verifies the copied artifact's platform signature, refuses to overwrite an existing version, and updates the manifest atomically. Serialize publication per workspace; merge both platform entries when separate build hosts publish a release.

How download integrity works

The service verifies the artifact size and SHA-256 hash against the manifest before streaming the same open file. A modified or mismatched package is refused. Mount the complete workspace release directory read-only and ensure the service user can read it.

A matching hash establishes consistency with the published manifest. Endpoint signature checks and successful installation remain separate verification steps.

Update an existing rollout

Publish a new version, retain the previous release under your retention policy, and validate the new installer on a test device. Keep manifests with deployment records so the operator can identify exactly what was distributed. Updating package files does not automatically upgrade every enrolled endpoint.