From 879b37e164d0a264a9f129a57adad29232685684 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 12:47:57 +0100
Subject: [PATCH 01/35] Add ultimate installer for Windows

---
 packages/safe-chain/bin/safe-chain.js         |  32 +++---
 .../src/installation/installUltimate.js       | 101 ++++++++++++++++++
 2 files changed, 121 insertions(+), 12 deletions(-)
 create mode 100644 packages/safe-chain/src/installation/installUltimate.js

diff --git a/packages/safe-chain/bin/safe-chain.js b/packages/safe-chain/bin/safe-chain.js
index 841ccee..e33ad9f 100755
--- a/packages/safe-chain/bin/safe-chain.js
+++ b/packages/safe-chain/bin/safe-chain.js
@@ -16,6 +16,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import fs from "fs";
 import { knownAikidoTools } from "../src/shell-integration/helpers.js";
+import { installUltimate } from "../src/installation/installUltimate.js";
 
 /** @type {string} */
 // This checks the current file's dirname in a way that's compatible with:
@@ -62,6 +63,8 @@ if (tool) {
   process.exit(0);
 } else if (command === "setup") {
   setup();
+} else if (command === "--ultimate") {
+  installUltimate();
 } else if (command === "teardown") {
   teardownDirectories();
   teardown();
@@ -82,36 +85,41 @@ if (tool) {
 
 function writeHelp() {
   ui.writeInformation(
-    chalk.bold("Usage: ") + chalk.cyan("safe-chain <command>")
+    chalk.bold("Usage: ") + chalk.cyan("safe-chain <command>"),
   );
   ui.emptyLine();
   ui.writeInformation(
     `Available commands: ${chalk.cyan("setup")}, ${chalk.cyan(
-      "teardown"
+      "teardown",
     )}, ${chalk.cyan("setup-ci")}, ${chalk.cyan("help")}, ${chalk.cyan(
-      "--version"
-    )}`
+      "--version",
+    )}`,
   );
   ui.emptyLine();
   ui.writeInformation(
     `- ${chalk.cyan(
-      "safe-chain setup"
-    )}: This will setup your shell to wrap safe-chain around npm, npx, yarn, pnpm, pnpx, bun, bunx, pip and pip3.`
+      "safe-chain setup",
+    )}: This will setup your shell to wrap safe-chain around npm, npx, yarn, pnpm, pnpx, bun, bunx, pip and pip3.`,
   );
   ui.writeInformation(
     `- ${chalk.cyan(
-      "safe-chain teardown"
-    )}: This will remove safe-chain aliases from your shell configuration.`
+      "safe-chain --ultimate",
+    )}: This installs the ultimate version of safe-chain, enabling protection for more eco-systems (vscode).`,
   );
   ui.writeInformation(
     `- ${chalk.cyan(
-      "safe-chain setup-ci"
-    )}: This will setup safe-chain for CI environments by creating shims and modifying the PATH.`
+      "safe-chain teardown",
+    )}: This will remove safe-chain aliases from your shell configuration.`,
+  );
+  ui.writeInformation(
+    `- ${chalk.cyan(
+      "safe-chain setup-ci",
+    )}: This will setup safe-chain for CI environments by creating shims and modifying the PATH.`,
   );
   ui.writeInformation(
     `- ${chalk.cyan("safe-chain --version")} (or ${chalk.cyan(
-      "-v"
-    )}): Display the current version of safe-chain.`
+      "-v",
+    )}): Display the current version of safe-chain.`,
   );
   ui.emptyLine();
 }
diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
new file mode 100644
index 0000000..e1323db
--- /dev/null
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -0,0 +1,101 @@
+import { platform, arch, tmpdir } from "os";
+import { createWriteStream, unlinkSync } from "fs";
+import { join } from "path";
+import { execSync } from "child_process";
+import { pipeline } from "stream/promises";
+import fetch from "make-fetch-happen";
+import { ui } from "../environment/userInteraction.js";
+
+const ULTIMATE_VERSION = "v0.2.0";
+
+export function installUltimate() {
+  const operatingSystem = platform();
+
+  if (operatingSystem === "win32") {
+    installOnWindows();
+  } else {
+    ui.writeInformation(
+      `${operatingSystem} is not supported yet by safe-chain's ultimate version.`,
+    );
+  }
+}
+
+async function installOnWindows() {
+  if (!isRunningAsAdmin()) {
+    ui.writeError("Administrator privileges required.");
+    ui.writeInformation(
+      "Please run this command in an elevated terminal (Run as Administrator)."
+    );
+    return;
+  }
+
+  const architecture = getWindowsArchitecture();
+  const downloadUrl = buildDownloadUrl(architecture);
+  const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
+
+  ui.writeInformation(`Downloading SafeChain Agent ${ULTIMATE_VERSION} for ${architecture}...`);
+  ui.writeVerbose(`Download URL: ${downloadUrl}`);
+  ui.writeVerbose(`Destination: ${msiPath}`);
+  await downloadFile(downloadUrl, msiPath);
+
+  ui.writeInformation("Installing SafeChain Agent...");
+  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
+  runMsiInstaller(msiPath);
+
+  ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
+  cleanup(msiPath);
+  ui.writeInformation("SafeChain Agent installed successfully!");
+}
+
+function isRunningAsAdmin() {
+  try {
+    execSync("net session", { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function getWindowsArchitecture() {
+  const nodeArch = arch();
+  if (nodeArch === "x64") return "amd64";
+  if (nodeArch === "arm64") return "arm64";
+  throw new Error(`Unsupported architecture: ${nodeArch}`);
+}
+
+/**
+ * @param {string} architecture
+ */
+function buildDownloadUrl(architecture) {
+  return `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-windows-${architecture}.msi`;
+}
+
+/**
+ * @param {string} url
+ * @param {string} destPath
+ */
+async function downloadFile(url, destPath) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Download failed: ${response.statusText}`);
+  }
+  await pipeline(response.body, createWriteStream(destPath));
+}
+
+/**
+ * @param {string} msiPath
+ */
+function runMsiInstaller(msiPath) {
+  execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" });
+}
+
+/**
+ * @param {string} msiPath
+ */
+function cleanup(msiPath) {
+  try {
+    unlinkSync(msiPath);
+  } catch {
+    // Ignore cleanup errors
+  }
+}

From 2c0245b020ecbed7ee4c28212d7653970458e288 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 13:28:16 +0100
Subject: [PATCH 02/35] Start and stop safe-chain agent's Windows service.

---
 .../src/installation/installUltimate.js       | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index e1323db..a638407 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -38,13 +38,18 @@ async function installOnWindows() {
   ui.writeVerbose(`Destination: ${msiPath}`);
   await downloadFile(downloadUrl, msiPath);
 
+  stopServiceIfRunning();
+
   ui.writeInformation("Installing SafeChain Agent...");
   ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
   runMsiInstaller(msiPath);
 
+  ui.writeInformation("Starting SafeChain Agent service...");
+  startService();
+
   ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
   cleanup(msiPath);
-  ui.writeInformation("SafeChain Agent installed successfully!");
+  ui.writeInformation("SafeChain Agent installed and started successfully!");
 }
 
 function isRunningAsAdmin() {
@@ -89,6 +94,22 @@ function runMsiInstaller(msiPath) {
   execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" });
 }
 
+function stopServiceIfRunning() {
+  try {
+    ui.writeInformation("Stopping existing SafeChain Agent service...");
+    ui.writeVerbose('Running: net stop "SafeChainAgent"');
+    execSync('net stop "SafeChainAgent"', { stdio: "inherit" });
+  } catch {
+    // Service is not running or doesn't exist, which is fine
+    ui.writeVerbose("SafeChain Agent service not running or not installed.");
+  }
+}
+
+function startService() {
+  ui.writeVerbose('Running: net start "SafeChainAgent"');
+  execSync('net start "SafeChainAgent"', { stdio: "inherit" });
+}
+
 /**
  * @param {string} msiPath
  */

From 6a3c7b938b9ac12d35924c30cf4c2159c901a7a8 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 13:48:33 +0100
Subject: [PATCH 03/35] Overwrite the agent if it's already installed.

---
 packages/safe-chain/src/installation/installUltimate.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index a638407..5d38eb0 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -41,7 +41,7 @@ async function installOnWindows() {
   stopServiceIfRunning();
 
   ui.writeInformation("Installing SafeChain Agent...");
-  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
+  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn REINSTALL=ALL REINSTALLMODE=vomus`);
   runMsiInstaller(msiPath);
 
   ui.writeInformation("Starting SafeChain Agent service...");
@@ -91,7 +91,10 @@ async function downloadFile(url, destPath) {
  * @param {string} msiPath
  */
 function runMsiInstaller(msiPath) {
-  execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" });
+  // Use /i for install/upgrade with REINSTALL=ALL REINSTALLMODE=vomus
+  // This forces a reinstall of all features if the product is already installed
+  // /qn = quiet mode (no UI)
+  execSync(`msiexec /i "${msiPath}" /qn REINSTALL=ALL REINSTALLMODE=vomus`, { stdio: "inherit" });
 }
 
 function stopServiceIfRunning() {

From 4851e582f69a89ddc6ae24420002105cd5b7f467 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 13:54:32 +0100
Subject: [PATCH 04/35] Improve updating existing agent install

---
 .../src/installation/installUltimate.js       | 30 +++++++++++++++----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 5d38eb0..1860b80 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -24,7 +24,7 @@ async function installOnWindows() {
   if (!isRunningAsAdmin()) {
     ui.writeError("Administrator privileges required.");
     ui.writeInformation(
-      "Please run this command in an elevated terminal (Run as Administrator)."
+      "Please run this command in an elevated terminal (Run as Administrator).",
     );
     return;
   }
@@ -33,15 +33,20 @@ async function installOnWindows() {
   const downloadUrl = buildDownloadUrl(architecture);
   const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
 
-  ui.writeInformation(`Downloading SafeChain Agent ${ULTIMATE_VERSION} for ${architecture}...`);
+  ui.writeInformation(
+    `Downloading SafeChain Agent ${ULTIMATE_VERSION} for ${architecture}...`,
+  );
   ui.writeVerbose(`Download URL: ${downloadUrl}`);
   ui.writeVerbose(`Destination: ${msiPath}`);
   await downloadFile(downloadUrl, msiPath);
 
   stopServiceIfRunning();
 
+  // Wait a moment for the service to fully stop before installing
+  await new Promise((resolve) => setTimeout(resolve, 10000));
+
   ui.writeInformation("Installing SafeChain Agent...");
-  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn REINSTALL=ALL REINSTALLMODE=vomus`);
+  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn /norestart`);
   runMsiInstaller(msiPath);
 
   ui.writeInformation("Starting SafeChain Agent service...");
@@ -91,10 +96,23 @@ async function downloadFile(url, destPath) {
  * @param {string} msiPath
  */
 function runMsiInstaller(msiPath) {
-  // Use /i for install/upgrade with REINSTALL=ALL REINSTALLMODE=vomus
-  // This forces a reinstall of all features if the product is already installed
+  // Try to install/upgrade
+  // /i = install (will upgrade if product code matches)
   // /qn = quiet mode (no UI)
-  execSync(`msiexec /i "${msiPath}" /qn REINSTALL=ALL REINSTALLMODE=vomus`, { stdio: "inherit" });
+  // /norestart = suppress restarts
+  try {
+    execSync(`msiexec /i "${msiPath}" /qn /norestart`, { stdio: "inherit" });
+  } catch (error) {
+    // If installation fails, it might be because it's already installed
+    // Try to force a reinstall
+    ui.writeVerbose(
+      "Initial installation failed, attempting to force reinstall...",
+    );
+    execSync(
+      `msiexec /i "${msiPath}" /qn /norestart REINSTALL=ALL REINSTALLMODE=vomus`,
+      { stdio: "inherit" },
+    );
+  }
 }
 
 function stopServiceIfRunning() {

From c4941e25ed5ca304e684b921a8e20590c81f8486 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 13:55:41 +0100
Subject: [PATCH 05/35] Fix linting

---
 packages/safe-chain/src/installation/installUltimate.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 1860b80..278aab4 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -102,7 +102,7 @@ function runMsiInstaller(msiPath) {
   // /norestart = suppress restarts
   try {
     execSync(`msiexec /i "${msiPath}" /qn /norestart`, { stdio: "inherit" });
-  } catch (error) {
+  } catch {
     // If installation fails, it might be because it's already installed
     // Try to force a reinstall
     ui.writeVerbose(

From 673783ceabffac02ec684e3f661b1e90672669f6 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 14:00:09 +0100
Subject: [PATCH 06/35] Uninstall safe-chain agent if it's there, before
 re-installing

---
 .../src/installation/installUltimate.js       | 33 +++++++++----------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 278aab4..6cb3f46 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -41,9 +41,10 @@ async function installOnWindows() {
   await downloadFile(downloadUrl, msiPath);
 
   stopServiceIfRunning();
+  uninstallIfInstalled();
 
-  // Wait a moment for the service to fully stop before installing
-  await new Promise((resolve) => setTimeout(resolve, 10000));
+  // Wait a moment for uninstall to complete
+  await new Promise((resolve) => setTimeout(resolve, 2000));
 
   ui.writeInformation("Installing SafeChain Agent...");
   ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn /norestart`);
@@ -92,27 +93,25 @@ async function downloadFile(url, destPath) {
   await pipeline(response.body, createWriteStream(destPath));
 }
 
+function uninstallIfInstalled() {
+  try {
+    ui.writeInformation("Uninstalling existing SafeChain Agent...");
+    ui.writeVerbose('Running: wmic product where "name=\'SafeChain Agent\'" call uninstall /nointeractive');
+    execSync('wmic product where "name=\'SafeChain Agent\'" call uninstall /nointeractive', { stdio: "inherit" });
+  } catch {
+    // Not installed or uninstall failed, which is fine for a fresh install
+    ui.writeVerbose("No existing SafeChain Agent installation found.");
+  }
+}
+
 /**
  * @param {string} msiPath
  */
 function runMsiInstaller(msiPath) {
-  // Try to install/upgrade
-  // /i = install (will upgrade if product code matches)
+  // /i = install
   // /qn = quiet mode (no UI)
   // /norestart = suppress restarts
-  try {
-    execSync(`msiexec /i "${msiPath}" /qn /norestart`, { stdio: "inherit" });
-  } catch {
-    // If installation fails, it might be because it's already installed
-    // Try to force a reinstall
-    ui.writeVerbose(
-      "Initial installation failed, attempting to force reinstall...",
-    );
-    execSync(
-      `msiexec /i "${msiPath}" /qn /norestart REINSTALL=ALL REINSTALLMODE=vomus`,
-      { stdio: "inherit" },
-    );
-  }
+  execSync(`msiexec /i "${msiPath}" /qn /norestart`, { stdio: "inherit" });
 }
 
 function stopServiceIfRunning() {

From 3958fcfcefeaca7d9e4a215b54b433da02d4178d Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 14:06:43 +0100
Subject: [PATCH 07/35] Parse cli args in ultimate installation

---
 .../src/installation/installUltimate.js       | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 6cb3f46..fc2b93f 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -5,10 +5,13 @@ import { execSync } from "child_process";
 import { pipeline } from "stream/promises";
 import fetch from "make-fetch-happen";
 import { ui } from "../environment/userInteraction.js";
+import { initializeCliArguments } from "../config/cliArguments.js";
 
 const ULTIMATE_VERSION = "v0.2.0";
 
 export function installUltimate() {
+  initializeCliArguments(process.argv);
+
   const operatingSystem = platform();
 
   if (operatingSystem === "win32") {
@@ -96,8 +99,25 @@ async function downloadFile(url, destPath) {
 function uninstallIfInstalled() {
   try {
     ui.writeInformation("Uninstalling existing SafeChain Agent...");
-    ui.writeVerbose('Running: wmic product where "name=\'SafeChain Agent\'" call uninstall /nointeractive');
-    execSync('wmic product where "name=\'SafeChain Agent\'" call uninstall /nointeractive', { stdio: "inherit" });
+
+    // Use PowerShell to find the product code, then use msiexec to uninstall
+    // This is the modern alternative to wmic which is deprecated
+    const findProductCodeCmd = `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`;
+    ui.writeVerbose(`Finding product code: ${findProductCodeCmd}`);
+
+    const productCode = execSync(findProductCodeCmd, {
+      encoding: "utf8",
+    }).trim();
+
+    if (productCode) {
+      ui.writeVerbose(`Found product code: ${productCode}`);
+      ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
+      execSync(`msiexec /x ${productCode} /qn /norestart`, {
+        stdio: "inherit",
+      });
+    } else {
+      ui.writeVerbose("No existing SafeChain Agent installation found.");
+    }
   } catch {
     // Not installed or uninstall failed, which is fine for a fresh install
     ui.writeVerbose("No existing SafeChain Agent installation found.");

From 2784dfd34e89b87f92eb3ed683a821c299adbfb0 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 14:23:15 +0100
Subject: [PATCH 08/35] Check if the agents service is running before starting
 it

---
 .../safe-chain/src/installation/installUltimate.js  | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index fc2b93f..dd8de84 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -146,6 +146,19 @@ function stopServiceIfRunning() {
 }
 
 function startService() {
+  try {
+    // Check if service is already running
+    ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
+    const status = execSync('sc query "SafeChainAgent"', { encoding: "utf8" });
+
+    if (status.includes("RUNNING")) {
+      ui.writeVerbose("SafeChain Agent service is already running.");
+      return;
+    }
+  } catch {
+    // Service might not exist yet or query failed, proceed with start
+  }
+
   ui.writeVerbose('Running: net start "SafeChainAgent"');
   execSync('net start "SafeChainAgent"', { stdio: "inherit" });
 }

From 0e7cce750d7ddfaaef20f00ea3bbc595573163d3 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 14:30:09 +0100
Subject: [PATCH 09/35] Improve output

---
 .../src/installation/installUltimate.js       | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index dd8de84..d1ccf28 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -36,29 +36,35 @@ async function installOnWindows() {
   const downloadUrl = buildDownloadUrl(architecture);
   const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
 
+  ui.emptyLine();
   ui.writeInformation(
-    `Downloading SafeChain Agent ${ULTIMATE_VERSION} for ${architecture}...`,
+    `📥 Downloading SafeChain Agent ${ULTIMATE_VERSION} (${architecture})...`,
   );
   ui.writeVerbose(`Download URL: ${downloadUrl}`);
   ui.writeVerbose(`Destination: ${msiPath}`);
   await downloadFile(downloadUrl, msiPath);
 
+  ui.emptyLine();
   stopServiceIfRunning();
   uninstallIfInstalled();
 
   // Wait a moment for uninstall to complete
   await new Promise((resolve) => setTimeout(resolve, 2000));
 
-  ui.writeInformation("Installing SafeChain Agent...");
+  ui.writeInformation("⚙️  Installing SafeChain Agent...");
   ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn /norestart`);
   runMsiInstaller(msiPath);
 
-  ui.writeInformation("Starting SafeChain Agent service...");
+  ui.emptyLine();
+  ui.writeInformation("🚀 Starting SafeChain Agent service...");
   startService();
 
   ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
   cleanup(msiPath);
-  ui.writeInformation("SafeChain Agent installed and started successfully!");
+
+  ui.emptyLine();
+  ui.writeInformation("✅ SafeChain Agent installed and started successfully!");
+  ui.emptyLine();
 }
 
 function isRunningAsAdmin() {
@@ -98,8 +104,6 @@ async function downloadFile(url, destPath) {
 
 function uninstallIfInstalled() {
   try {
-    ui.writeInformation("Uninstalling existing SafeChain Agent...");
-
     // Use PowerShell to find the product code, then use msiexec to uninstall
     // This is the modern alternative to wmic which is deprecated
     const findProductCodeCmd = `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`;
@@ -110,17 +114,18 @@ function uninstallIfInstalled() {
     }).trim();
 
     if (productCode) {
+      ui.writeInformation("🗑️  Removing previous installation...");
       ui.writeVerbose(`Found product code: ${productCode}`);
       ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
       execSync(`msiexec /x ${productCode} /qn /norestart`, {
         stdio: "inherit",
       });
     } else {
-      ui.writeVerbose("No existing SafeChain Agent installation found.");
+      ui.writeVerbose("No existing installation found (fresh install).");
     }
   } catch {
     // Not installed or uninstall failed, which is fine for a fresh install
-    ui.writeVerbose("No existing SafeChain Agent installation found.");
+    ui.writeVerbose("No existing installation found (fresh install).");
   }
 }
 
@@ -136,12 +141,12 @@ function runMsiInstaller(msiPath) {
 
 function stopServiceIfRunning() {
   try {
-    ui.writeInformation("Stopping existing SafeChain Agent service...");
+    ui.writeInformation("⏹️  Stopping running service...");
     ui.writeVerbose('Running: net stop "SafeChainAgent"');
     execSync('net stop "SafeChainAgent"', { stdio: "inherit" });
   } catch {
     // Service is not running or doesn't exist, which is fine
-    ui.writeVerbose("SafeChain Agent service not running or not installed.");
+    ui.writeVerbose("Service not running (will start after installation).");
   }
 }
 

From fd559cfc63779037152dc892fdcb34d70d42f4a3 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 14:46:04 +0100
Subject: [PATCH 10/35] Restructure code into separate files

---
 .../src/installation/downloadAgent.js         |  40 +++++
 .../src/installation/installOnWindows.js      | 146 +++++++++++++++
 .../src/installation/installUltimate.js       | 166 +-----------------
 packages/safe-chain/src/main.js               |  10 +-
 4 files changed, 193 insertions(+), 169 deletions(-)
 create mode 100644 packages/safe-chain/src/installation/downloadAgent.js
 create mode 100644 packages/safe-chain/src/installation/installOnWindows.js

diff --git a/packages/safe-chain/src/installation/downloadAgent.js b/packages/safe-chain/src/installation/downloadAgent.js
new file mode 100644
index 0000000..2e45b79
--- /dev/null
+++ b/packages/safe-chain/src/installation/downloadAgent.js
@@ -0,0 +1,40 @@
+import { createWriteStream } from "fs";
+import { pipeline } from "stream/promises";
+import fetch from "make-fetch-happen";
+
+const ULTIMATE_VERSION = "v0.2.0";
+
+/**
+ * @typedef {"windows"} Platform
+ * @typedef {"amd64" | "arm64"} Architecture
+ */
+
+/**
+ * Builds the download URL for the SafeChain Agent installer.
+ * @param {Platform} platform
+ * @param {Architecture} architecture
+ */
+export function getAgentDownloadUrl(platform, architecture) {
+  const extension = platform === "windows" ? "msi" : "pkg";
+  return `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-${platform}-${architecture}.${extension}`;
+}
+
+/**
+ * Downloads a file from a URL to a local path.
+ * @param {string} url
+ * @param {string} destPath
+ */
+export async function downloadFile(url, destPath) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Download failed: ${response.statusText}`);
+  }
+  await pipeline(response.body, createWriteStream(destPath));
+}
+
+/**
+ * Returns the current agent version.
+ */
+export function getAgentVersion() {
+  return ULTIMATE_VERSION;
+}
diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
new file mode 100644
index 0000000..27db104
--- /dev/null
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -0,0 +1,146 @@
+import { arch, tmpdir } from "os";
+import { unlinkSync } from "fs";
+import { join } from "path";
+import { execSync } from "child_process";
+import { ui } from "../environment/userInteraction.js";
+import {
+  getAgentDownloadUrl,
+  getAgentVersion,
+  downloadFile,
+} from "./downloadAgent.js";
+
+export async function installOnWindows() {
+  if (!isRunningAsAdmin()) {
+    ui.writeError("Administrator privileges required.");
+    ui.writeInformation(
+      "Please run this command in an elevated terminal (Run as Administrator).",
+    );
+    return;
+  }
+
+  const architecture = getWindowsArchitecture();
+  const downloadUrl = getAgentDownloadUrl("windows", architecture);
+  const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
+
+  ui.emptyLine();
+  ui.writeInformation(
+    `📥 Downloading SafeChain Agent ${getAgentVersion()} (${architecture})...`,
+  );
+  ui.writeVerbose(`Download URL: ${downloadUrl}`);
+  ui.writeVerbose(`Destination: ${msiPath}`);
+  await downloadFile(downloadUrl, msiPath);
+
+  ui.emptyLine();
+  stopServiceIfRunning();
+  uninstallIfInstalled();
+
+  // Wait a moment for uninstall to complete
+  await new Promise((resolve) => setTimeout(resolve, 2000));
+
+  ui.writeInformation("⚙️  Installing SafeChain Agent...");
+  runMsiInstaller(msiPath);
+
+  ui.emptyLine();
+  ui.writeInformation("🚀 Starting SafeChain Agent service...");
+  startService();
+
+  ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
+  cleanup(msiPath);
+
+  ui.emptyLine();
+  ui.writeInformation("✅ SafeChain Agent installed and started successfully!");
+  ui.emptyLine();
+}
+
+function isRunningAsAdmin() {
+  try {
+    execSync("net session", { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function getWindowsArchitecture() {
+  const nodeArch = arch();
+  if (nodeArch === "x64") return "amd64";
+  if (nodeArch === "arm64") return "arm64";
+  throw new Error(`Unsupported architecture: ${nodeArch}`);
+}
+
+function uninstallIfInstalled() {
+  try {
+    // Use PowerShell to find the product code, then use msiexec to uninstall
+    // This is the modern alternative to wmic which is deprecated
+    const findProductCodeCmd = `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`;
+    ui.writeVerbose(`Finding product code: ${findProductCodeCmd}`);
+
+    const productCode = execSync(findProductCodeCmd, {
+      encoding: "utf8",
+    }).trim();
+
+    if (productCode) {
+      ui.writeInformation("🗑️  Removing previous installation...");
+      ui.writeVerbose(`Found product code: ${productCode}`);
+      ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
+      execSync(`msiexec /x ${productCode} /qn /norestart`, {
+        stdio: "inherit",
+      });
+    } else {
+      ui.writeVerbose("No existing installation found (fresh install).");
+    }
+  } catch {
+    // Not installed or uninstall failed, which is fine for a fresh install
+    ui.writeVerbose("No existing installation found (fresh install).");
+  }
+}
+
+/**
+ * @param {string} msiPath
+ */
+function runMsiInstaller(msiPath) {
+  // /i = install
+  // /qn = quiet mode (no UI)
+  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
+  execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" });
+}
+
+function stopServiceIfRunning() {
+  try {
+    ui.writeInformation("⏹️  Stopping running service...");
+    ui.writeVerbose('Running: net stop "SafeChainAgent"');
+    execSync('net stop "SafeChainAgent"', { stdio: "inherit" });
+  } catch {
+    // Service is not running or doesn't exist, which is fine
+    ui.writeVerbose("Service not running (will start after installation).");
+  }
+}
+
+function startService() {
+  try {
+    // Check if service is already running
+    ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
+    const status = execSync('sc query "SafeChainAgent"', { encoding: "utf8" });
+
+    if (status.includes("RUNNING")) {
+      ui.writeVerbose("SafeChain Agent service is already running.");
+      return;
+    }
+  } catch {
+    // Service might not exist yet or query failed, proceed with start
+  }
+
+  ui.writeVerbose('Running: net start "SafeChainAgent"');
+  execSync('net start "SafeChainAgent"', { stdio: "inherit" });
+}
+
+/**
+ * @param {string} msiPath
+ */
+function cleanup(msiPath) {
+  try {
+    unlinkSync(msiPath);
+  } catch {
+    // Ignore cleanup errors
+  }
+}
diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index d1ccf28..7383d2c 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -1,13 +1,7 @@
-import { platform, arch, tmpdir } from "os";
-import { createWriteStream, unlinkSync } from "fs";
-import { join } from "path";
-import { execSync } from "child_process";
-import { pipeline } from "stream/promises";
-import fetch from "make-fetch-happen";
+import { platform } from "os";
 import { ui } from "../environment/userInteraction.js";
 import { initializeCliArguments } from "../config/cliArguments.js";
-
-const ULTIMATE_VERSION = "v0.2.0";
+import { installOnWindows } from "./installOnWindows.js";
 
 export function installUltimate() {
   initializeCliArguments(process.argv);
@@ -22,159 +16,3 @@ export function installUltimate() {
     );
   }
 }
-
-async function installOnWindows() {
-  if (!isRunningAsAdmin()) {
-    ui.writeError("Administrator privileges required.");
-    ui.writeInformation(
-      "Please run this command in an elevated terminal (Run as Administrator).",
-    );
-    return;
-  }
-
-  const architecture = getWindowsArchitecture();
-  const downloadUrl = buildDownloadUrl(architecture);
-  const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
-
-  ui.emptyLine();
-  ui.writeInformation(
-    `📥 Downloading SafeChain Agent ${ULTIMATE_VERSION} (${architecture})...`,
-  );
-  ui.writeVerbose(`Download URL: ${downloadUrl}`);
-  ui.writeVerbose(`Destination: ${msiPath}`);
-  await downloadFile(downloadUrl, msiPath);
-
-  ui.emptyLine();
-  stopServiceIfRunning();
-  uninstallIfInstalled();
-
-  // Wait a moment for uninstall to complete
-  await new Promise((resolve) => setTimeout(resolve, 2000));
-
-  ui.writeInformation("⚙️  Installing SafeChain Agent...");
-  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn /norestart`);
-  runMsiInstaller(msiPath);
-
-  ui.emptyLine();
-  ui.writeInformation("🚀 Starting SafeChain Agent service...");
-  startService();
-
-  ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
-  cleanup(msiPath);
-
-  ui.emptyLine();
-  ui.writeInformation("✅ SafeChain Agent installed and started successfully!");
-  ui.emptyLine();
-}
-
-function isRunningAsAdmin() {
-  try {
-    execSync("net session", { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function getWindowsArchitecture() {
-  const nodeArch = arch();
-  if (nodeArch === "x64") return "amd64";
-  if (nodeArch === "arm64") return "arm64";
-  throw new Error(`Unsupported architecture: ${nodeArch}`);
-}
-
-/**
- * @param {string} architecture
- */
-function buildDownloadUrl(architecture) {
-  return `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-windows-${architecture}.msi`;
-}
-
-/**
- * @param {string} url
- * @param {string} destPath
- */
-async function downloadFile(url, destPath) {
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new Error(`Download failed: ${response.statusText}`);
-  }
-  await pipeline(response.body, createWriteStream(destPath));
-}
-
-function uninstallIfInstalled() {
-  try {
-    // Use PowerShell to find the product code, then use msiexec to uninstall
-    // This is the modern alternative to wmic which is deprecated
-    const findProductCodeCmd = `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`;
-    ui.writeVerbose(`Finding product code: ${findProductCodeCmd}`);
-
-    const productCode = execSync(findProductCodeCmd, {
-      encoding: "utf8",
-    }).trim();
-
-    if (productCode) {
-      ui.writeInformation("🗑️  Removing previous installation...");
-      ui.writeVerbose(`Found product code: ${productCode}`);
-      ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
-      execSync(`msiexec /x ${productCode} /qn /norestart`, {
-        stdio: "inherit",
-      });
-    } else {
-      ui.writeVerbose("No existing installation found (fresh install).");
-    }
-  } catch {
-    // Not installed or uninstall failed, which is fine for a fresh install
-    ui.writeVerbose("No existing installation found (fresh install).");
-  }
-}
-
-/**
- * @param {string} msiPath
- */
-function runMsiInstaller(msiPath) {
-  // /i = install
-  // /qn = quiet mode (no UI)
-  // /norestart = suppress restarts
-  execSync(`msiexec /i "${msiPath}" /qn /norestart`, { stdio: "inherit" });
-}
-
-function stopServiceIfRunning() {
-  try {
-    ui.writeInformation("⏹️  Stopping running service...");
-    ui.writeVerbose('Running: net stop "SafeChainAgent"');
-    execSync('net stop "SafeChainAgent"', { stdio: "inherit" });
-  } catch {
-    // Service is not running or doesn't exist, which is fine
-    ui.writeVerbose("Service not running (will start after installation).");
-  }
-}
-
-function startService() {
-  try {
-    // Check if service is already running
-    ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
-    const status = execSync('sc query "SafeChainAgent"', { encoding: "utf8" });
-
-    if (status.includes("RUNNING")) {
-      ui.writeVerbose("SafeChain Agent service is already running.");
-      return;
-    }
-  } catch {
-    // Service might not exist yet or query failed, proceed with start
-  }
-
-  ui.writeVerbose('Running: net start "SafeChainAgent"');
-  execSync('net start "SafeChainAgent"', { stdio: "inherit" });
-}
-
-/**
- * @param {string} msiPath
- */
-function cleanup(msiPath) {
-  try {
-    unlinkSync(msiPath);
-  } catch {
-    // Ignore cleanup errors
-  }
-}
diff --git a/packages/safe-chain/src/main.js b/packages/safe-chain/src/main.js
index 9b7ba53..0b37eba 100644
--- a/packages/safe-chain/src/main.js
+++ b/packages/safe-chain/src/main.js
@@ -73,20 +73,20 @@ export async function main(args) {
       ui.writeVerbose(
         `${chalk.green("✔")} Safe-chain: Scanned ${
           auditStats.totalPackages
-        } packages, no malware found.`
+        } packages, no malware found.`,
       );
     }
 
     if (proxy.hasSuppressedVersions()) {
       ui.writeInformation(
         `${chalk.yellow(
-          "ℹ"
-        )} Safe-chain: Some package versions were suppressed due to minimum age requirement.`
+          "ℹ",
+        )} Safe-chain: Some package versions were suppressed due to minimum age requirement.`,
       );
       ui.writeInformation(
         `  To disable this check, use: ${chalk.cyan(
-          "--safe-chain-skip-minimum-package-age"
-        )}`
+          "--safe-chain-skip-minimum-package-age",
+        )}`,
       );
     }
 

From 079e4893b1e55d43f8c772d9246588bb5184f7a2 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 14:53:33 +0100
Subject: [PATCH 11/35] Move download name construction to os installer
 function

---
 .../safe-chain/src/installation/downloadAgent.js    | 13 +++----------
 .../safe-chain/src/installation/installOnWindows.js |  3 ++-
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/packages/safe-chain/src/installation/downloadAgent.js b/packages/safe-chain/src/installation/downloadAgent.js
index 2e45b79..d74cbf7 100644
--- a/packages/safe-chain/src/installation/downloadAgent.js
+++ b/packages/safe-chain/src/installation/downloadAgent.js
@@ -4,19 +4,12 @@ import fetch from "make-fetch-happen";
 
 const ULTIMATE_VERSION = "v0.2.0";
 
-/**
- * @typedef {"windows"} Platform
- * @typedef {"amd64" | "arm64"} Architecture
- */
-
 /**
  * Builds the download URL for the SafeChain Agent installer.
- * @param {Platform} platform
- * @param {Architecture} architecture
+ * @param {string} fileName
  */
-export function getAgentDownloadUrl(platform, architecture) {
-  const extension = platform === "windows" ? "msi" : "pkg";
-  return `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-${platform}-${architecture}.${extension}`;
+export function getAgentDownloadUrl(fileName) {
+  return `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/${fileName}`;
 }
 
 /**
diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 27db104..9f92893 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -19,7 +19,8 @@ export async function installOnWindows() {
   }
 
   const architecture = getWindowsArchitecture();
-  const downloadUrl = getAgentDownloadUrl("windows", architecture);
+  const fileName = `SafeChainAgent-windows-${architecture}.msi`;
+  const downloadUrl = getAgentDownloadUrl(fileName);
   const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
 
   ui.emptyLine();

From 471ef2821015309ecdd82c8400f27a33a7d52793 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:22:24 +0100
Subject: [PATCH 12/35] Handle code quality comments

---
 packages/safe-chain/bin/safe-chain.js                    | 4 +++-
 packages/safe-chain/src/installation/installOnWindows.js | 4 ++--
 packages/safe-chain/src/installation/installUltimate.js  | 4 ++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/packages/safe-chain/bin/safe-chain.js b/packages/safe-chain/bin/safe-chain.js
index e33ad9f..d048ce1 100755
--- a/packages/safe-chain/bin/safe-chain.js
+++ b/packages/safe-chain/bin/safe-chain.js
@@ -64,7 +64,9 @@ if (tool) {
 } else if (command === "setup") {
   setup();
 } else if (command === "--ultimate") {
-  installUltimate();
+  (async () => {
+    await installUltimate();
+  })();
 } else if (command === "teardown") {
   teardownDirectories();
   teardown();
diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 9f92893..094ec58 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -103,7 +103,7 @@ function runMsiInstaller(msiPath) {
   // /i = install
   // /qn = quiet mode (no UI)
   ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
-  execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" });
+  execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" }); // noopengrep this is ok, we control the msiPath
 }
 
 function stopServiceIfRunning() {
@@ -128,7 +128,7 @@ function startService() {
       return;
     }
   } catch {
-    // Service might not exist yet or query failed, proceed with start
+    ui.writeVerbose("Service not found or query failed, attempting to start.");
   }
 
   ui.writeVerbose('Running: net start "SafeChainAgent"');
diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 7383d2c..3b6846a 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -3,13 +3,13 @@ import { ui } from "../environment/userInteraction.js";
 import { initializeCliArguments } from "../config/cliArguments.js";
 import { installOnWindows } from "./installOnWindows.js";
 
-export function installUltimate() {
+export async function installUltimate() {
   initializeCliArguments(process.argv);
 
   const operatingSystem = platform();
 
   if (operatingSystem === "win32") {
-    installOnWindows();
+    await installOnWindows();
   } else {
     ui.writeInformation(
       `${operatingSystem} is not supported yet by safe-chain's ultimate version.`,

From 9b61a325fa1eccb98becd11088ba9763da4c2d1c Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:24:49 +0100
Subject: [PATCH 13/35] Log when installer file cleanup failed

---
 packages/safe-chain/src/installation/installOnWindows.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 094ec58..f3c9ee8 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -142,6 +142,6 @@ function cleanup(msiPath) {
   try {
     unlinkSync(msiPath);
   } catch {
-    // Ignore cleanup errors
+    ui.writeVerbose("Failed to clean up temporary installer file.");
   }
 }

From 8b189443b7e293ad7f4bc88944da577ce2ace311 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:31:41 +0100
Subject: [PATCH 14/35] Use safeSpawn instead of execSync

---
 .../src/installation/installOnWindows.js      | 109 +++++++++---------
 1 file changed, 55 insertions(+), 54 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index f3c9ee8..54893bf 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -1,8 +1,8 @@
 import { arch, tmpdir } from "os";
 import { unlinkSync } from "fs";
 import { join } from "path";
-import { execSync } from "child_process";
 import { ui } from "../environment/userInteraction.js";
+import { safeSpawn } from "../utils/safeSpawn.js";
 import {
   getAgentDownloadUrl,
   getAgentVersion,
@@ -10,7 +10,7 @@ import {
 } from "./downloadAgent.js";
 
 export async function installOnWindows() {
-  if (!isRunningAsAdmin()) {
+  if (!(await isRunningAsAdmin())) {
     ui.writeError("Administrator privileges required.");
     ui.writeInformation(
       "Please run this command in an elevated terminal (Run as Administrator).",
@@ -32,18 +32,18 @@ export async function installOnWindows() {
   await downloadFile(downloadUrl, msiPath);
 
   ui.emptyLine();
-  stopServiceIfRunning();
-  uninstallIfInstalled();
+  await stopServiceIfRunning();
+  await uninstallIfInstalled();
 
   // Wait a moment for uninstall to complete
   await new Promise((resolve) => setTimeout(resolve, 2000));
 
   ui.writeInformation("⚙️  Installing SafeChain Agent...");
-  runMsiInstaller(msiPath);
+  await runMsiInstaller(msiPath);
 
   ui.emptyLine();
   ui.writeInformation("🚀 Starting SafeChain Agent service...");
-  startService();
+  await startService();
 
   ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
   cleanup(msiPath);
@@ -53,13 +53,9 @@ export async function installOnWindows() {
   ui.emptyLine();
 }
 
-function isRunningAsAdmin() {
-  try {
-    execSync("net session", { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
+async function isRunningAsAdmin() {
+  const result = await safeSpawn("net", ["session"], { stdio: "ignore" });
+  return result.status === 0;
 }
 
 function getWindowsArchitecture() {
@@ -69,29 +65,31 @@ function getWindowsArchitecture() {
   throw new Error(`Unsupported architecture: ${nodeArch}`);
 }
 
-function uninstallIfInstalled() {
-  try {
-    // Use PowerShell to find the product code, then use msiexec to uninstall
-    // This is the modern alternative to wmic which is deprecated
-    const findProductCodeCmd = `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`;
-    ui.writeVerbose(`Finding product code: ${findProductCodeCmd}`);
+async function uninstallIfInstalled() {
+  // Use PowerShell to find the product code, then use msiexec to uninstall
+  // This is the modern alternative to wmic which is deprecated
+  const powershellScript = `$app = Get-WmiObject -Class Win32_Product -Filter "Name='SafeChain Agent'"; if ($app) { Write-Output $app.IdentifyingNumber }`;
+  ui.writeVerbose(`Finding product code with PowerShell`);
 
-    const productCode = execSync(findProductCodeCmd, {
-      encoding: "utf8",
-    }).trim();
+  const result = await safeSpawn("powershell", ["-Command", powershellScript], {
+    stdio: "pipe",
+  });
 
-    if (productCode) {
-      ui.writeInformation("🗑️  Removing previous installation...");
-      ui.writeVerbose(`Found product code: ${productCode}`);
-      ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
-      execSync(`msiexec /x ${productCode} /qn /norestart`, {
-        stdio: "inherit",
-      });
-    } else {
-      ui.writeVerbose("No existing installation found (fresh install).");
-    }
-  } catch {
-    // Not installed or uninstall failed, which is fine for a fresh install
+  if (result.status !== 0) {
+    ui.writeVerbose("No existing installation found (fresh install).");
+    return;
+  }
+
+  const productCode = result.stdout.trim();
+
+  if (productCode) {
+    ui.writeInformation("🗑️  Removing previous installation...");
+    ui.writeVerbose(`Found product code: ${productCode}`);
+    ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
+    await safeSpawn("msiexec", ["/x", productCode, "/qn", "/norestart"], {
+      stdio: "inherit",
+    });
+  } else {
     ui.writeVerbose("No existing installation found (fresh install).");
   }
 }
@@ -99,40 +97,43 @@ function uninstallIfInstalled() {
 /**
  * @param {string} msiPath
  */
-function runMsiInstaller(msiPath) {
+async function runMsiInstaller(msiPath) {
   // /i = install
   // /qn = quiet mode (no UI)
   ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
-  execSync(`msiexec /i "${msiPath}" /qn`, { stdio: "inherit" }); // noopengrep this is ok, we control the msiPath
+  await safeSpawn("msiexec", ["/i", msiPath, "/qn"], { stdio: "inherit" });
 }
 
-function stopServiceIfRunning() {
-  try {
-    ui.writeInformation("⏹️  Stopping running service...");
-    ui.writeVerbose('Running: net stop "SafeChainAgent"');
-    execSync('net stop "SafeChainAgent"', { stdio: "inherit" });
-  } catch {
-    // Service is not running or doesn't exist, which is fine
+async function stopServiceIfRunning() {
+  ui.writeInformation("⏹️  Stopping running service...");
+  ui.writeVerbose('Running: net stop "SafeChainAgent"');
+  const result = await safeSpawn("net", ["stop", "SafeChainAgent"], {
+    stdio: "inherit",
+  });
+
+  if (result.status !== 0) {
     ui.writeVerbose("Service not running (will start after installation).");
   }
 }
 
-function startService() {
-  try {
-    // Check if service is already running
-    ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
-    const status = execSync('sc query "SafeChainAgent"', { encoding: "utf8" });
+async function startService() {
+  // Check if service is already running
+  ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
+  const queryResult = await safeSpawn("sc", ["query", "SafeChainAgent"], {
+    stdio: "pipe",
+  });
 
-    if (status.includes("RUNNING")) {
-      ui.writeVerbose("SafeChain Agent service is already running.");
-      return;
-    }
-  } catch {
+  if (queryResult.status === 0 && queryResult.stdout.includes("RUNNING")) {
+    ui.writeVerbose("SafeChain Agent service is already running.");
+    return;
+  }
+
+  if (queryResult.status !== 0) {
     ui.writeVerbose("Service not found or query failed, attempting to start.");
   }
 
   ui.writeVerbose('Running: net start "SafeChainAgent"');
-  execSync('net start "SafeChainAgent"', { stdio: "inherit" });
+  await safeSpawn("net", ["start", "SafeChainAgent"], { stdio: "inherit" });
 }
 
 /**

From 4a90bd262109d307e0767eed654258a3e90801bd Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:34:16 +0100
Subject: [PATCH 15/35] Code quality: use early return

---
 .../src/installation/installOnWindows.js        | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 54893bf..a6e0938 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -82,16 +82,17 @@ async function uninstallIfInstalled() {
 
   const productCode = result.stdout.trim();
 
-  if (productCode) {
-    ui.writeInformation("🗑️  Removing previous installation...");
-    ui.writeVerbose(`Found product code: ${productCode}`);
-    ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
-    await safeSpawn("msiexec", ["/x", productCode, "/qn", "/norestart"], {
-      stdio: "inherit",
-    });
-  } else {
+  if (!productCode) {
     ui.writeVerbose("No existing installation found (fresh install).");
+    return;
   }
+
+  ui.writeInformation("🗑️  Removing previous installation...");
+  ui.writeVerbose(`Found product code: ${productCode}`);
+  ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
+  await safeSpawn("msiexec", ["/x", productCode, "/qn", "/norestart"], {
+    stdio: "inherit",
+  });
 }
 
 /**

From 86e600773370e0b5da5f743ba1840bd008899201 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:45:32 +0100
Subject: [PATCH 16/35] Improve error handling

---
 .../src/installation/installOnWindows.js      | 93 ++++++++++++-------
 1 file changed, 57 insertions(+), 36 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index a6e0938..6db1cb0 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -31,31 +31,43 @@ export async function installOnWindows() {
   ui.writeVerbose(`Destination: ${msiPath}`);
   await downloadFile(downloadUrl, msiPath);
 
-  ui.emptyLine();
-  await stopServiceIfRunning();
-  await uninstallIfInstalled();
+  try {
+    ui.emptyLine();
+    await stopServiceIfRunning();
+    await uninstallIfInstalled();
 
-  // Wait a moment for uninstall to complete
-  await new Promise((resolve) => setTimeout(resolve, 2000));
+    // Wait a moment for uninstall to complete
+    await new Promise((resolve) => setTimeout(resolve, 2000));
 
-  ui.writeInformation("⚙️  Installing SafeChain Agent...");
-  await runMsiInstaller(msiPath);
+    ui.writeInformation("⚙️  Installing SafeChain Agent...");
+    await runMsiInstaller(msiPath);
 
-  ui.emptyLine();
-  ui.writeInformation("🚀 Starting SafeChain Agent service...");
-  await startService();
+    ui.emptyLine();
+    ui.writeInformation("🚀 Starting SafeChain Agent service...");
+    await startService();
 
-  ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
-  cleanup(msiPath);
-
-  ui.emptyLine();
-  ui.writeInformation("✅ SafeChain Agent installed and started successfully!");
-  ui.emptyLine();
+    ui.emptyLine();
+    ui.writeInformation(
+      "✅ SafeChain Agent installed and started successfully!",
+    );
+    ui.emptyLine();
+  } finally {
+    ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
+    cleanup(msiPath);
+  }
 }
 
 async function isRunningAsAdmin() {
-  const result = await safeSpawn("net", ["session"], { stdio: "ignore" });
-  return result.status === 0;
+  const result = await safeSpawn(
+    "powershell",
+    [
+      "-Command",
+      "([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)",
+    ],
+    { stdio: "pipe" },
+  );
+
+  return result.status === 0 && result.stdout.trim() === "True";
 }
 
 function getWindowsArchitecture() {
@@ -66,8 +78,6 @@ function getWindowsArchitecture() {
 }
 
 async function uninstallIfInstalled() {
-  // Use PowerShell to find the product code, then use msiexec to uninstall
-  // This is the modern alternative to wmic which is deprecated
   const powershellScript = `$app = Get-WmiObject -Class Win32_Product -Filter "Name='SafeChain Agent'"; if ($app) { Write-Output $app.IdentifyingNumber }`;
   ui.writeVerbose(`Finding product code with PowerShell`);
 
@@ -81,7 +91,6 @@ async function uninstallIfInstalled() {
   }
 
   const productCode = result.stdout.trim();
-
   if (!productCode) {
     ui.writeVerbose("No existing installation found (fresh install).");
     return;
@@ -89,27 +98,38 @@ async function uninstallIfInstalled() {
 
   ui.writeInformation("🗑️  Removing previous installation...");
   ui.writeVerbose(`Found product code: ${productCode}`);
-  ui.writeVerbose(`Running: msiexec /x ${productCode} /qn /norestart`);
-  await safeSpawn("msiexec", ["/x", productCode, "/qn", "/norestart"], {
-    stdio: "inherit",
-  });
+
+  const uninstallResult = await safeSpawn(
+    "msiexec",
+    ["/x", productCode, "/qn", "/norestart"],
+    { stdio: "inherit" },
+  );
+
+  if (uninstallResult.status !== 0) {
+    throw new Error(`Uninstall failed (exit code: ${uninstallResult.status})`);
+  }
 }
 
 /**
  * @param {string} msiPath
  */
 async function runMsiInstaller(msiPath) {
-  // /i = install
-  // /qn = quiet mode (no UI)
   ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
-  await safeSpawn("msiexec", ["/i", msiPath, "/qn"], { stdio: "inherit" });
+
+  const result = await safeSpawn("msiexec", ["/i", msiPath, "/qn"], {
+    stdio: "inherit",
+  });
+
+  if (result.status !== 0) {
+    throw new Error(`MSI installer failed (exit code: ${result.status})`);
+  }
 }
 
 async function stopServiceIfRunning() {
   ui.writeInformation("⏹️  Stopping running service...");
-  ui.writeVerbose('Running: net stop "SafeChainAgent"');
+
   const result = await safeSpawn("net", ["stop", "SafeChainAgent"], {
-    stdio: "inherit",
+    stdio: "pipe",
   });
 
   if (result.status !== 0) {
@@ -118,7 +138,6 @@ async function stopServiceIfRunning() {
 }
 
 async function startService() {
-  // Check if service is already running
   ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
   const queryResult = await safeSpawn("sc", ["query", "SafeChainAgent"], {
     stdio: "pipe",
@@ -129,12 +148,14 @@ async function startService() {
     return;
   }
 
-  if (queryResult.status !== 0) {
-    ui.writeVerbose("Service not found or query failed, attempting to start.");
-  }
-
   ui.writeVerbose('Running: net start "SafeChainAgent"');
-  await safeSpawn("net", ["start", "SafeChainAgent"], { stdio: "inherit" });
+  const startResult = await safeSpawn("net", ["start", "SafeChainAgent"], {
+    stdio: "pipe",
+  });
+
+  if (startResult.status !== 0) {
+    throw new Error(`Failed to start service (exit code: ${startResult.status})`);
+  }
 }
 
 /**

From eb00fe6f3d8a17ec9e8ecf522db15f05072adc06 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:54:02 +0100
Subject: [PATCH 17/35] Write error output

---
 packages/safe-chain/src/installation/installOnWindows.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 6db1cb0..8610394 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -106,6 +106,8 @@ async function uninstallIfInstalled() {
   );
 
   if (uninstallResult.status !== 0) {
+    ui.writeInformation(uninstallResult.stdout);
+    ui.writeInformation(uninstallResult.stderr);
     throw new Error(`Uninstall failed (exit code: ${uninstallResult.status})`);
   }
 }
@@ -154,7 +156,9 @@ async function startService() {
   });
 
   if (startResult.status !== 0) {
-    throw new Error(`Failed to start service (exit code: ${startResult.status})`);
+    throw new Error(
+      `Failed to start service (exit code: ${startResult.status})`,
+    );
   }
 }
 

From 4ebbbca4326295f1d144e0fd22c08cc03690ffbb Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 15:58:11 +0100
Subject: [PATCH 18/35] Temporarily disable cleanup

---
 .../src/installation/installOnWindows.js      | 39 +++++++++----------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 8610394..0257fd8 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -31,30 +31,29 @@ export async function installOnWindows() {
   ui.writeVerbose(`Destination: ${msiPath}`);
   await downloadFile(downloadUrl, msiPath);
 
-  try {
-    ui.emptyLine();
-    await stopServiceIfRunning();
-    await uninstallIfInstalled();
+  // try {
+  ui.emptyLine();
+  await stopServiceIfRunning();
+  await uninstallIfInstalled();
 
-    // Wait a moment for uninstall to complete
-    await new Promise((resolve) => setTimeout(resolve, 2000));
+  // Wait a moment for uninstall to complete
+  await new Promise((resolve) => setTimeout(resolve, 2000));
 
-    ui.writeInformation("⚙️  Installing SafeChain Agent...");
-    await runMsiInstaller(msiPath);
+  ui.writeInformation("⚙️  Installing SafeChain Agent...");
+  await runMsiInstaller(msiPath);
 
-    ui.emptyLine();
-    ui.writeInformation("🚀 Starting SafeChain Agent service...");
-    await startService();
+  ui.emptyLine();
+  ui.writeInformation("🚀 Starting SafeChain Agent service...");
+  await startService();
 
-    ui.emptyLine();
-    ui.writeInformation(
-      "✅ SafeChain Agent installed and started successfully!",
-    );
-    ui.emptyLine();
-  } finally {
-    ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
-    cleanup(msiPath);
-  }
+  ui.emptyLine();
+  ui.writeInformation("✅ SafeChain Agent installed and started successfully!");
+  ui.emptyLine();
+  // }
+  // finally {
+  //   ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
+  //   cleanup(msiPath);
+  // }
 }
 
 async function isRunningAsAdmin() {

From 211f877384950e40a4c0e814c291b49517e7a066 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 16:03:51 +0100
Subject: [PATCH 19/35] Write stdout stderr

---
 .../src/installation/installOnWindows.js      | 43 ++++++++++---------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 0257fd8..7511eef 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -31,29 +31,30 @@ export async function installOnWindows() {
   ui.writeVerbose(`Destination: ${msiPath}`);
   await downloadFile(downloadUrl, msiPath);
 
-  // try {
-  ui.emptyLine();
-  await stopServiceIfRunning();
-  await uninstallIfInstalled();
+  try {
+    ui.emptyLine();
+    await stopServiceIfRunning();
+    await uninstallIfInstalled();
 
-  // Wait a moment for uninstall to complete
-  await new Promise((resolve) => setTimeout(resolve, 2000));
+    // Wait a moment for uninstall to complete
+    await new Promise((resolve) => setTimeout(resolve, 2000));
 
-  ui.writeInformation("⚙️  Installing SafeChain Agent...");
-  await runMsiInstaller(msiPath);
+    ui.writeInformation("⚙️  Installing SafeChain Agent...");
+    await runMsiInstaller(msiPath);
 
-  ui.emptyLine();
-  ui.writeInformation("🚀 Starting SafeChain Agent service...");
-  await startService();
+    ui.emptyLine();
+    ui.writeInformation("🚀 Starting SafeChain Agent service...");
+    await startService();
 
-  ui.emptyLine();
-  ui.writeInformation("✅ SafeChain Agent installed and started successfully!");
-  ui.emptyLine();
-  // }
-  // finally {
-  //   ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
-  //   cleanup(msiPath);
-  // }
+    ui.emptyLine();
+    ui.writeInformation(
+      "✅ SafeChain Agent installed and started successfully!",
+    );
+    ui.emptyLine();
+  } finally {
+    ui.writeVerbose(`Cleaning up temporary file: ${msiPath}`);
+    cleanup(msiPath);
+  }
 }
 
 async function isRunningAsAdmin() {
@@ -85,7 +86,9 @@ async function uninstallIfInstalled() {
   });
 
   if (result.status !== 0) {
-    ui.writeVerbose("No existing installation found (fresh install).");
+    ui.writeVerbose(
+      `No existing installation found (fresh install). Output: ${result.stdout} ${result.stderr}`,
+    );
     return;
   }
 

From 4a7629a17487217500f2b8054e970eb7ca83e186 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 16:11:51 +0100
Subject: [PATCH 20/35] Use execSync to execute powershell command

---
 .../src/installation/installOnWindows.js       | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 7511eef..84dcd9c 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -1,6 +1,7 @@
 import { arch, tmpdir } from "os";
 import { unlinkSync } from "fs";
 import { join } from "path";
+import { execSync } from "child_process";
 import { ui } from "../environment/userInteraction.js";
 import { safeSpawn } from "../utils/safeSpawn.js";
 import {
@@ -81,18 +82,15 @@ async function uninstallIfInstalled() {
   const powershellScript = `$app = Get-WmiObject -Class Win32_Product -Filter "Name='SafeChain Agent'"; if ($app) { Write-Output $app.IdentifyingNumber }`;
   ui.writeVerbose(`Finding product code with PowerShell`);
 
-  const result = await safeSpawn("powershell", ["-Command", powershellScript], {
-    stdio: "pipe",
-  });
-
-  if (result.status !== 0) {
-    ui.writeVerbose(
-      `No existing installation found (fresh install). Output: ${result.stdout} ${result.stderr}`,
-    );
+  let productCode;
+  try {
+    productCode = execSync(`powershell -Command "${powershellScript}"`, {
+      encoding: "utf8",
+    }).trim();
+  } catch {
+    ui.writeVerbose("No existing installation found (fresh install).");
     return;
   }
-
-  const productCode = result.stdout.trim();
   if (!productCode) {
     ui.writeVerbose("No existing installation found (fresh install).");
     return;

From 20fb949a2351d6dc1940b0294f74036b9cb10a4f Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 16:17:34 +0100
Subject: [PATCH 21/35] Fix uninstall

---
 packages/safe-chain/src/installation/installOnWindows.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 84dcd9c..d6e7207 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -79,14 +79,14 @@ function getWindowsArchitecture() {
 }
 
 async function uninstallIfInstalled() {
-  const powershellScript = `$app = Get-WmiObject -Class Win32_Product -Filter "Name='SafeChain Agent'"; if ($app) { Write-Output $app.IdentifyingNumber }`;
   ui.writeVerbose(`Finding product code with PowerShell`);
 
   let productCode;
   try {
-    productCode = execSync(`powershell -Command "${powershellScript}"`, {
-      encoding: "utf8",
-    }).trim();
+    productCode = execSync(
+      `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`,
+      { encoding: "utf8" },
+    ).trim();
   } catch {
     ui.writeVerbose("No existing installation found (fresh install).");
     return;

From c200ea56cf4aef90290654b2d1b40e1787515ac1 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 16:23:59 +0100
Subject: [PATCH 22/35] Cleanup debug logging

---
 packages/safe-chain/src/installation/installOnWindows.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index d6e7207..60a339b 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -106,8 +106,6 @@ async function uninstallIfInstalled() {
   );
 
   if (uninstallResult.status !== 0) {
-    ui.writeInformation(uninstallResult.stdout);
-    ui.writeInformation(uninstallResult.stderr);
     throw new Error(`Uninstall failed (exit code: ${uninstallResult.status})`);
   }
 }

From da6c022ef49c5fcb6faba43a1c6bb9d685a8cc37 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Mon, 19 Jan 2026 16:25:50 +0100
Subject: [PATCH 23/35] Add explaining comments for powershell scritps

---
 packages/safe-chain/src/installation/installOnWindows.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 60a339b..41bb1ca 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -59,6 +59,8 @@ export async function installOnWindows() {
 }
 
 async function isRunningAsAdmin() {
+  // Uses Windows Security API to check if current process has admin privileges.
+  // Returns "True" or "False" as a string.
   const result = await safeSpawn(
     "powershell",
     [
@@ -79,6 +81,8 @@ function getWindowsArchitecture() {
 }
 
 async function uninstallIfInstalled() {
+  // Query Win32_Product via WMI to find the installed SafeChain Agent.
+  // If found, outputs the product GUID (e.g., "{12345678-1234-...}") needed for msiexec uninstall.
   ui.writeVerbose(`Finding product code with PowerShell`);
 
   let productCode;

From 9651e05f4b04773dcd9029a93ce7aa97b2c49859 Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Mon, 19 Jan 2026 18:59:37 +0100
Subject: [PATCH 24/35] Fix naming of SafeChain Agent

---
 packages/safe-chain/src/installation/installOnWindows.js | 8 ++++----
 packages/safe-chain/src/installation/installUltimate.js  | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 41bb1ca..9837d18 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -40,16 +40,16 @@ export async function installOnWindows() {
     // Wait a moment for uninstall to complete
     await new Promise((resolve) => setTimeout(resolve, 2000));
 
-    ui.writeInformation("⚙️  Installing SafeChain Agent...");
+    ui.writeInformation("⚙️  Installing SafeChain Ultimate...");
     await runMsiInstaller(msiPath);
 
     ui.emptyLine();
-    ui.writeInformation("🚀 Starting SafeChain Agent service...");
+    ui.writeInformation("🚀 Starting SafeChain Ultimate service...");
     await startService();
 
     ui.emptyLine();
     ui.writeInformation(
-      "✅ SafeChain Agent installed and started successfully!",
+      "✅ SafeChain Ultimate installed and started successfully!",
     );
     ui.emptyLine();
   } finally {
@@ -148,7 +148,7 @@ async function startService() {
   });
 
   if (queryResult.status === 0 && queryResult.stdout.includes("RUNNING")) {
-    ui.writeVerbose("SafeChain Agent service is already running.");
+    ui.writeVerbose("SafeChain Ultimate service is already running.");
     return;
   }
 
diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 3b6846a..086b6a4 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -12,7 +12,7 @@ export async function installUltimate() {
     await installOnWindows();
   } else {
     ui.writeInformation(
-      `${operatingSystem} is not supported yet by safe-chain's ultimate version.`,
+      `${operatingSystem} is not supported yet by SafeChain's ultimate version.`,
     );
   }
 }

From 3dad1c2516bdc26141a57eeb0eae24eb37f42ecc Mon Sep 17 00:00:00 2001
From: bitterpanda <bitterpanda@proton.me>
Date: Mon, 19 Jan 2026 19:01:28 +0100
Subject: [PATCH 25/35] Update
 packages/safe-chain/src/installation/installOnWindows.js

---
 packages/safe-chain/src/installation/installOnWindows.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 9837d18..3cd3428 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -26,7 +26,7 @@ export async function installOnWindows() {
 
   ui.emptyLine();
   ui.writeInformation(
-    `📥 Downloading SafeChain Agent ${getAgentVersion()} (${architecture})...`,
+    `📥 Downloading SafeChain Ultimate ${getAgentVersion()} (${architecture})...`,
   );
   ui.writeVerbose(`Download URL: ${downloadUrl}`);
   ui.writeVerbose(`Destination: ${msiPath}`);

From 7d55c5453bc19ac8ab203d6f37922c369627659a Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Tue, 20 Jan 2026 09:12:00 +0100
Subject: [PATCH 26/35] Move os and arch detection to downloader, add checksum
 verification.

---
 .../src/installation/downloadAgent.js         | 82 ++++++++++++++++++-
 .../src/installation/installOnWindows.js      | 49 +++++------
 2 files changed, 102 insertions(+), 29 deletions(-)

diff --git a/packages/safe-chain/src/installation/downloadAgent.js b/packages/safe-chain/src/installation/downloadAgent.js
index d74cbf7..2441f7d 100644
--- a/packages/safe-chain/src/installation/downloadAgent.js
+++ b/packages/safe-chain/src/installation/downloadAgent.js
@@ -1,9 +1,25 @@
-import { createWriteStream } from "fs";
+import { createWriteStream, createReadStream } from "fs";
+import { createHash } from "crypto";
 import { pipeline } from "stream/promises";
 import fetch from "make-fetch-happen";
 
 const ULTIMATE_VERSION = "v0.2.0";
 
+const DOWNLOAD_URLS = {
+  win32: {
+    x64: {
+      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.2.0/SafeChainAgent-windows-amd64.msi",
+      checksum:
+        "sha256:c699f74a3666d85b70b8ede076a2192a6a023f1b395e8e6c7556927ee698a020",
+    },
+    arm64: {
+      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.2.0/SafeChainAgent-windows-arm64.msi",
+      checksum:
+        "sha256:5b08dd4749c8befe5379bc01f7a8a5ac1d6a35b6bee37c6c72a4ba8744c3b052",
+    },
+  },
+};
+
 /**
  * Builds the download URL for the SafeChain Agent installer.
  * @param {string} fileName
@@ -31,3 +47,67 @@ export async function downloadFile(url, destPath) {
 export function getAgentVersion() {
   return ULTIMATE_VERSION;
 }
+
+/**
+ * Returns download info (url, checksum) for the current OS and architecture.
+ * @returns {{ url: string, checksum: string } | null}
+ */
+export function getDownloadInfoForCurrentPlatform() {
+  const platform = process.platform;
+  const arch = process.arch;
+
+  if (!Object.hasOwn(DOWNLOAD_URLS, platform)) {
+    return null;
+  }
+  const platformUrls =
+    DOWNLOAD_URLS[/** @type {keyof typeof DOWNLOAD_URLS} */ (platform)];
+
+  if (!Object.hasOwn(platformUrls, arch)) {
+    return null;
+  }
+
+  return platformUrls[/** @type {keyof typeof platformUrls} */ (arch)];
+}
+
+/**
+ * Verifies the checksum of a file.
+ * @param {string} filePath
+ * @param {string} expectedChecksum - Format: "algorithm:hash" (e.g., "sha256:abc123...")
+ * @returns {Promise<boolean>}
+ */
+async function verifyChecksum(filePath, expectedChecksum) {
+  const [algorithm, expected] = expectedChecksum.split(":");
+
+  const hash = createHash(algorithm);
+
+  if (filePath.includes("..")) throw new Error("Invalid file path");
+  const stream = createReadStream(filePath);
+
+  for await (const chunk of stream) {
+    hash.update(chunk);
+  }
+
+  const actual = hash.digest("hex");
+  return actual === expected;
+}
+
+/**
+ * Downloads the SafeChain agent for the current OS/arch and verifies its checksum.
+ * @param {string} fileName - Destination file path
+ * @returns {Promise<string | null>} The file path if successful, null if no download URL for current platform
+ */
+export async function downloadAgentToFile(fileName) {
+  const info = getDownloadInfoForCurrentPlatform();
+  if (!info) {
+    return null;
+  }
+
+  await downloadFile(info.url, fileName);
+
+  const isValid = await verifyChecksum(fileName, info.checksum);
+  if (!isValid) {
+    throw new Error("Checksum verification failed");
+  }
+
+  return fileName;
+}
diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 3cd3428..33ae293 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -1,14 +1,13 @@
-import { arch, tmpdir } from "os";
+import { tmpdir } from "os";
 import { unlinkSync } from "fs";
 import { join } from "path";
 import { execSync } from "child_process";
 import { ui } from "../environment/userInteraction.js";
 import { safeSpawn } from "../utils/safeSpawn.js";
-import {
-  getAgentDownloadUrl,
-  getAgentVersion,
-  downloadFile,
-} from "./downloadAgent.js";
+import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
+
+const WINDOWS_SERVICE_NAME = "SafeChainAgent";
+const WINDOWS_APP_NAME = "SafeChain Agent";
 
 export async function installOnWindows() {
   if (!(await isRunningAsAdmin())) {
@@ -19,18 +18,17 @@ export async function installOnWindows() {
     return;
   }
 
-  const architecture = getWindowsArchitecture();
-  const fileName = `SafeChainAgent-windows-${architecture}.msi`;
-  const downloadUrl = getAgentDownloadUrl(fileName);
-  const msiPath = join(tmpdir(), `SafeChainAgent-${Date.now()}.msi`);
+  const msiPath = join(tmpdir(), `SafeChainUltimate-${Date.now()}.msi`);
 
   ui.emptyLine();
-  ui.writeInformation(
-    `📥 Downloading SafeChain Ultimate ${getAgentVersion()} (${architecture})...`,
-  );
-  ui.writeVerbose(`Download URL: ${downloadUrl}`);
+  ui.writeInformation(`📥 Downloading SafeChain Ultimate ${getAgentVersion()}`);
   ui.writeVerbose(`Destination: ${msiPath}`);
-  await downloadFile(downloadUrl, msiPath);
+
+  const result = await downloadAgentToFile(msiPath);
+  if (!result) {
+    ui.writeError("No download available for this platform/architecture.");
+    return;
+  }
 
   try {
     ui.emptyLine();
@@ -73,13 +71,6 @@ async function isRunningAsAdmin() {
   return result.status === 0 && result.stdout.trim() === "True";
 }
 
-function getWindowsArchitecture() {
-  const nodeArch = arch();
-  if (nodeArch === "x64") return "amd64";
-  if (nodeArch === "arm64") return "arm64";
-  throw new Error(`Unsupported architecture: ${nodeArch}`);
-}
-
 async function uninstallIfInstalled() {
   // Query Win32_Product via WMI to find the installed SafeChain Agent.
   // If found, outputs the product GUID (e.g., "{12345678-1234-...}") needed for msiexec uninstall.
@@ -88,7 +79,7 @@ async function uninstallIfInstalled() {
   let productCode;
   try {
     productCode = execSync(
-      `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='SafeChain Agent'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`,
+      `powershell -Command "$app = Get-WmiObject -Class Win32_Product -Filter \\"Name='${WINDOWS_APP_NAME}'\\"; if ($app) { Write-Output $app.IdentifyingNumber }"`,
       { encoding: "utf8" },
     ).trim();
   } catch {
@@ -132,7 +123,7 @@ async function runMsiInstaller(msiPath) {
 async function stopServiceIfRunning() {
   ui.writeInformation("⏹️  Stopping running service...");
 
-  const result = await safeSpawn("net", ["stop", "SafeChainAgent"], {
+  const result = await safeSpawn("net", ["stop", WINDOWS_SERVICE_NAME], {
     stdio: "pipe",
   });
 
@@ -142,8 +133,10 @@ async function stopServiceIfRunning() {
 }
 
 async function startService() {
-  ui.writeVerbose('Checking service status: sc query "SafeChainAgent"');
-  const queryResult = await safeSpawn("sc", ["query", "SafeChainAgent"], {
+  ui.writeVerbose(
+    `Checking service status: sc query "${WINDOWS_SERVICE_NAME}"`,
+  );
+  const queryResult = await safeSpawn("sc", ["query", WINDOWS_SERVICE_NAME], {
     stdio: "pipe",
   });
 
@@ -152,8 +145,8 @@ async function startService() {
     return;
   }
 
-  ui.writeVerbose('Running: net start "SafeChainAgent"');
-  const startResult = await safeSpawn("net", ["start", "SafeChainAgent"], {
+  ui.writeVerbose(`Running: net start "${WINDOWS_SERVICE_NAME}"`);
+  const startResult = await safeSpawn("net", ["start", WINDOWS_SERVICE_NAME], {
     stdio: "pipe",
   });
 

From 626bb0d2b9c4262a92472beda086cbb25fe5f715 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Tue, 20 Jan 2026 12:21:45 +0100
Subject: [PATCH 27/35] Don't start the windows service - the msi already does
 this

---
 .../src/installation/installOnWindows.js      | 32 -------------------
 1 file changed, 32 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 33ae293..2380a7f 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -35,16 +35,9 @@ export async function installOnWindows() {
     await stopServiceIfRunning();
     await uninstallIfInstalled();
 
-    // Wait a moment for uninstall to complete
-    await new Promise((resolve) => setTimeout(resolve, 2000));
-
     ui.writeInformation("⚙️  Installing SafeChain Ultimate...");
     await runMsiInstaller(msiPath);
 
-    ui.emptyLine();
-    ui.writeInformation("🚀 Starting SafeChain Ultimate service...");
-    await startService();
-
     ui.emptyLine();
     ui.writeInformation(
       "✅ SafeChain Ultimate installed and started successfully!",
@@ -132,31 +125,6 @@ async function stopServiceIfRunning() {
   }
 }
 
-async function startService() {
-  ui.writeVerbose(
-    `Checking service status: sc query "${WINDOWS_SERVICE_NAME}"`,
-  );
-  const queryResult = await safeSpawn("sc", ["query", WINDOWS_SERVICE_NAME], {
-    stdio: "pipe",
-  });
-
-  if (queryResult.status === 0 && queryResult.stdout.includes("RUNNING")) {
-    ui.writeVerbose("SafeChain Ultimate service is already running.");
-    return;
-  }
-
-  ui.writeVerbose(`Running: net start "${WINDOWS_SERVICE_NAME}"`);
-  const startResult = await safeSpawn("net", ["start", WINDOWS_SERVICE_NAME], {
-    stdio: "pipe",
-  });
-
-  if (startResult.status !== 0) {
-    throw new Error(
-      `Failed to start service (exit code: ${startResult.status})`,
-    );
-  }
-}
-
 /**
  * @param {string} msiPath
  */

From a7e21bbfe272e31b11c7aae7c7b1e825090c2aa2 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Wed, 21 Jan 2026 07:58:06 +0100
Subject: [PATCH 28/35] Update download urls

---
 .../src/installation/downloadAgent.js         | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/packages/safe-chain/src/installation/downloadAgent.js b/packages/safe-chain/src/installation/downloadAgent.js
index 2441f7d..0ee994e 100644
--- a/packages/safe-chain/src/installation/downloadAgent.js
+++ b/packages/safe-chain/src/installation/downloadAgent.js
@@ -8,14 +8,26 @@ const ULTIMATE_VERSION = "v0.2.0";
 const DOWNLOAD_URLS = {
   win32: {
     x64: {
-      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.2.0/SafeChainAgent-windows-amd64.msi",
+      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-windows-amd64.msi",
       checksum:
-        "sha256:c699f74a3666d85b70b8ede076a2192a6a023f1b395e8e6c7556927ee698a020",
+        "sha256:bba5deb250ebc6008f1cb33fa4209d2455a2f47fa99f0a40e3babef64939ac77",
     },
     arm64: {
-      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.2.0/SafeChainAgent-windows-arm64.msi",
+      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-windows-arm64.msi",
       checksum:
-        "sha256:5b08dd4749c8befe5379bc01f7a8a5ac1d6a35b6bee37c6c72a4ba8744c3b052",
+        "sha256:9553ed15d5efed4185b990a1b86af0b11c23f11d96f8ce04e16b6b98aaf0506e",
+    },
+  },
+  darwin: {
+    x64: {
+      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-darwin-amd64.pkg",
+      checksum:
+        "sha256:cbccf32e987a45bc8cc20b620f7b597ff7f9c2f966c2bc21132349612ddb619f",
+    },
+    arm64: {
+      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-darwin-arm64.pkg",
+      checksum:
+        "sha256:4d53a43a47bf7e8133eb61d306a1fb16348b9ec89c1c825e5f746f4fe847796e",
     },
   },
 };

From d4c496d60d625b1ba6886cd8fd312af79bd2afc7 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Wed, 21 Jan 2026 09:14:44 +0100
Subject: [PATCH 29/35] Add mac os installation

---
 .../src/installation/installOnMacOS.js        | 78 +++++++++++++++++++
 .../src/installation/installUltimate.js       |  3 +
 2 files changed, 81 insertions(+)
 create mode 100644 packages/safe-chain/src/installation/installOnMacOS.js

diff --git a/packages/safe-chain/src/installation/installOnMacOS.js b/packages/safe-chain/src/installation/installOnMacOS.js
new file mode 100644
index 0000000..6963291
--- /dev/null
+++ b/packages/safe-chain/src/installation/installOnMacOS.js
@@ -0,0 +1,78 @@
+import { tmpdir } from "os";
+import { unlinkSync } from "fs";
+import { join } from "path";
+import { ui } from "../environment/userInteraction.js";
+import { safeSpawn } from "../utils/safeSpawn.js";
+import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
+
+const MACOS_SERVICE_LABEL = "com.aikido.SafeChainAgent";
+
+export async function installOnMacOS() {
+  if (!isRunningAsRoot()) {
+    ui.writeError("Root privileges required.");
+    ui.writeInformation("Please run this command with sudo:");
+    ui.writeInformation("  sudo safe-chain --ultimate");
+    return;
+  }
+
+  const pkgPath = join(tmpdir(), `SafeChainUltimate-${Date.now()}.pkg`);
+
+  ui.emptyLine();
+  ui.writeInformation(`📥 Downloading SafeChain Ultimate ${getAgentVersion()}`);
+  ui.writeVerbose(`Destination: ${pkgPath}`);
+
+  const result = await downloadAgentToFile(pkgPath);
+  if (!result) {
+    ui.writeError("No download available for this platform/architecture.");
+    return;
+  }
+
+  try {
+    ui.writeInformation("⚙️  Installing SafeChain Ultimate...");
+    await runPkgInstaller(pkgPath);
+
+    ui.emptyLine();
+    ui.writeInformation(
+      "✅ SafeChain Ultimate installed and started successfully!",
+    );
+    ui.emptyLine();
+  } finally {
+    ui.writeVerbose(`Cleaning up temporary file: ${pkgPath}`);
+    cleanup(pkgPath);
+  }
+}
+
+function isRunningAsRoot() {
+  const rootUserUid = 0;
+  return process.getuid?.() === rootUserUid;
+}
+
+/**
+ * @param {string} pkgPath
+ */
+async function runPkgInstaller(pkgPath) {
+  ui.writeVerbose(`Running: installer -pkg "${pkgPath}" -target /`);
+
+  const result = await safeSpawn(
+    "installer",
+    ["-pkg", pkgPath, "-target", "/"],
+    {
+      stdio: "inherit",
+    },
+  );
+
+  if (result.status !== 0) {
+    throw new Error(`PKG installer failed (exit code: ${result.status})`);
+  }
+}
+
+/**
+ * @param {string} pkgPath
+ */
+function cleanup(pkgPath) {
+  try {
+    unlinkSync(pkgPath);
+  } catch {
+    ui.writeVerbose("Failed to clean up temporary installer file.");
+  }
+}
diff --git a/packages/safe-chain/src/installation/installUltimate.js b/packages/safe-chain/src/installation/installUltimate.js
index 086b6a4..a79a2b1 100644
--- a/packages/safe-chain/src/installation/installUltimate.js
+++ b/packages/safe-chain/src/installation/installUltimate.js
@@ -2,6 +2,7 @@ import { platform } from "os";
 import { ui } from "../environment/userInteraction.js";
 import { initializeCliArguments } from "../config/cliArguments.js";
 import { installOnWindows } from "./installOnWindows.js";
+import { installOnMacOS } from "./installOnMacOS.js";
 
 export async function installUltimate() {
   initializeCliArguments(process.argv);
@@ -10,6 +11,8 @@ export async function installUltimate() {
 
   if (operatingSystem === "win32") {
     await installOnWindows();
+  } else if (operatingSystem === "darwin") {
+    await installOnMacOS();
   } else {
     ui.writeInformation(
       `${operatingSystem} is not supported yet by SafeChain's ultimate version.`,

From b9aade2da40082c95c992f02427fc161be95307a Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Wed, 21 Jan 2026 09:18:26 +0100
Subject: [PATCH 30/35] Remove unused variable

---
 packages/safe-chain/src/installation/installOnMacOS.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnMacOS.js b/packages/safe-chain/src/installation/installOnMacOS.js
index 6963291..b2a953a 100644
--- a/packages/safe-chain/src/installation/installOnMacOS.js
+++ b/packages/safe-chain/src/installation/installOnMacOS.js
@@ -5,8 +5,6 @@ import { ui } from "../environment/userInteraction.js";
 import { safeSpawn } from "../utils/safeSpawn.js";
 import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
 
-const MACOS_SERVICE_LABEL = "com.aikido.SafeChainAgent";
-
 export async function installOnMacOS() {
   if (!isRunningAsRoot()) {
     ui.writeError("Root privileges required.");

From 9cde77a408bcfc97f474ec1c213321ec03a4d612 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Thu, 22 Jan 2026 08:20:45 +0100
Subject: [PATCH 31/35] PR comments

---
 .../src/installation/downloadAgent.js         | 18 +++++-----
 .../src/installation/installOnMacOS.js        | 10 ++++--
 .../src/installation/installOnWindows.js      | 34 ++++++++++++++-----
 packages/safe-chain/src/utils/safeSpawn.js    | 16 +++++++++
 4 files changed, 57 insertions(+), 21 deletions(-)

diff --git a/packages/safe-chain/src/installation/downloadAgent.js b/packages/safe-chain/src/installation/downloadAgent.js
index 0ee994e..2f2baac 100644
--- a/packages/safe-chain/src/installation/downloadAgent.js
+++ b/packages/safe-chain/src/installation/downloadAgent.js
@@ -3,31 +3,31 @@ import { createHash } from "crypto";
 import { pipeline } from "stream/promises";
 import fetch from "make-fetch-happen";
 
-const ULTIMATE_VERSION = "v0.2.0";
+const ULTIMATE_VERSION = "v0.2.1";
 
 const DOWNLOAD_URLS = {
   win32: {
     x64: {
-      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-windows-amd64.msi",
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-windows-amd64.msi`,
       checksum:
-        "sha256:bba5deb250ebc6008f1cb33fa4209d2455a2f47fa99f0a40e3babef64939ac77",
+        "sha256:8d86a44d314746099ba50cfae0cc1eae6232522deb348b226da92aae12754eec",
     },
     arm64: {
-      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-windows-arm64.msi",
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-windows-arm64.msi`,
       checksum:
-        "sha256:9553ed15d5efed4185b990a1b86af0b11c23f11d96f8ce04e16b6b98aaf0506e",
+        "sha256:ab5b8335cc257d53424f73d6681920875083cd9b3f53e52d944bf867a415e027",
     },
   },
   darwin: {
     x64: {
-      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-darwin-amd64.pkg",
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-darwin-amd64.pkg`,
       checksum:
-        "sha256:cbccf32e987a45bc8cc20b620f7b597ff7f9c2f966c2bc21132349612ddb619f",
+        "sha256:73f83d9352c4fd25f7693d9e53bbbb2b7ac70d16217d745495c9efb50dc4a3a6",
     },
     arm64: {
-      url: "https://github.com/AikidoSec/safechain-internals/releases/download/v0.0.2-macos-release-artifact/SafeChainAgent-darwin-arm64.pkg",
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-darwin-arm64.pkg`,
       checksum:
-        "sha256:4d53a43a47bf7e8133eb61d306a1fb16348b9ec89c1c825e5f746f4fe847796e",
+        "sha256:bd419e9c82488539b629b04c97aa1d2dc90e54ff045bd7277a6b40d26f8ebc73",
     },
   },
 };
diff --git a/packages/safe-chain/src/installation/installOnMacOS.js b/packages/safe-chain/src/installation/installOnMacOS.js
index b2a953a..0d7081c 100644
--- a/packages/safe-chain/src/installation/installOnMacOS.js
+++ b/packages/safe-chain/src/installation/installOnMacOS.js
@@ -2,7 +2,7 @@ import { tmpdir } from "os";
 import { unlinkSync } from "fs";
 import { join } from "path";
 import { ui } from "../environment/userInteraction.js";
-import { safeSpawn } from "../utils/safeSpawn.js";
+import { printVerboseAndSafeSpawn, safeSpawn } from "../utils/safeSpawn.js";
 import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
 
 export async function installOnMacOS() {
@@ -49,9 +49,13 @@ function isRunningAsRoot() {
  * @param {string} pkgPath
  */
 async function runPkgInstaller(pkgPath) {
-  ui.writeVerbose(`Running: installer -pkg "${pkgPath}" -target /`);
+  // Uses installer to install the package (https://ss64.com/mac/installer.html)
+  // Options:
+  //  -pkg (required):    The package to be installed.
+  //  -target (required): The target volume is specified with the -target parameter.
+  //                       --> "-target /" installs to the current boot volume.
 
-  const result = await safeSpawn(
+  const result = await printVerboseAndSafeSpawn(
     "installer",
     ["-pkg", pkgPath, "-target", "/"],
     {
diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index 2380a7f..c6bc744 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -3,7 +3,7 @@ import { unlinkSync } from "fs";
 import { join } from "path";
 import { execSync } from "child_process";
 import { ui } from "../environment/userInteraction.js";
-import { safeSpawn } from "../utils/safeSpawn.js";
+import { printVerboseAndSafeSpawn, safeSpawn } from "../utils/safeSpawn.js";
 import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
 
 const WINDOWS_SERVICE_NAME = "SafeChainAgent";
@@ -87,7 +87,12 @@ async function uninstallIfInstalled() {
   ui.writeInformation("🗑️  Removing previous installation...");
   ui.writeVerbose(`Found product code: ${productCode}`);
 
-  const uninstallResult = await safeSpawn(
+  // Use msiexec to run the msi installer quitely (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec)
+  // Options:
+  //  - /x:         Uninstalls the package.
+  //  - /qn:        Specifies there's no UI during the installation process.
+  //  - /norestart: Stops the device from restarting after the installation completes.
+  const uninstallResult = await printVerboseAndSafeSpawn(
     "msiexec",
     ["/x", productCode, "/qn", "/norestart"],
     { stdio: "inherit" },
@@ -102,11 +107,18 @@ async function uninstallIfInstalled() {
  * @param {string} msiPath
  */
 async function runMsiInstaller(msiPath) {
-  ui.writeVerbose(`Running: msiexec /i "${msiPath}" /qn`);
+  // Use msiexec to run the msi installer quitely (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec)
+  // Options:
+  //  - /i:  Specifies normal installation
+  //  - /qn: Specifies there's no UI during the installation process.
 
-  const result = await safeSpawn("msiexec", ["/i", msiPath, "/qn"], {
-    stdio: "inherit",
-  });
+  const result = await printVerboseAndSafeSpawn(
+    "msiexec",
+    ["/i", msiPath, "/qn"],
+    {
+      stdio: "inherit",
+    },
+  );
 
   if (result.status !== 0) {
     throw new Error(`MSI installer failed (exit code: ${result.status})`);
@@ -116,9 +128,13 @@ async function runMsiInstaller(msiPath) {
 async function stopServiceIfRunning() {
   ui.writeInformation("⏹️  Stopping running service...");
 
-  const result = await safeSpawn("net", ["stop", WINDOWS_SERVICE_NAME], {
-    stdio: "pipe",
-  });
+  const result = await printVerboseAndSafeSpawn(
+    "net",
+    ["stop", WINDOWS_SERVICE_NAME],
+    {
+      stdio: "pipe",
+    },
+  );
 
   if (result.status !== 0) {
     ui.writeVerbose("Service not running (will start after installation).");
diff --git a/packages/safe-chain/src/utils/safeSpawn.js b/packages/safe-chain/src/utils/safeSpawn.js
index e17bdb5..69c827a 100644
--- a/packages/safe-chain/src/utils/safeSpawn.js
+++ b/packages/safe-chain/src/utils/safeSpawn.js
@@ -1,5 +1,6 @@
 import { spawn, execSync } from "child_process";
 import os from "os";
+import { ui } from "../environment/userInteraction.js";
 
 /**
  * @param {string} arg
@@ -135,3 +136,18 @@ export async function safeSpawn(command, args, options = {}) {
     });
   });
 }
+
+/**
+ * @param {string} command
+ * @param {string[]} args
+ * @param {import("child_process").SpawnOptions} options
+ *
+ * @returns {Promise<{status: number, stdout: string, stderr: string}>}
+ */
+export async function printVerboseAndSafeSpawn(command, args, options = {}) {
+  ui.writeVerbose(`Running: ${command} ${args.join(" ")}`);
+
+  const result = await safeSpawn(command, args, options);
+
+  return result;
+}

From b7a5adf67017b455582eba8688b3fc6aaa8154c7 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Thu, 22 Jan 2026 09:13:43 +0100
Subject: [PATCH 32/35] Fix linting

---
 packages/safe-chain/src/installation/installOnMacOS.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/safe-chain/src/installation/installOnMacOS.js b/packages/safe-chain/src/installation/installOnMacOS.js
index 0d7081c..074bbe6 100644
--- a/packages/safe-chain/src/installation/installOnMacOS.js
+++ b/packages/safe-chain/src/installation/installOnMacOS.js
@@ -2,7 +2,7 @@ import { tmpdir } from "os";
 import { unlinkSync } from "fs";
 import { join } from "path";
 import { ui } from "../environment/userInteraction.js";
-import { printVerboseAndSafeSpawn, safeSpawn } from "../utils/safeSpawn.js";
+import { printVerboseAndSafeSpawn } from "../utils/safeSpawn.js";
 import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
 
 export async function installOnMacOS() {

From b2d94aaa167b720c78759221e5ebae7a7d3beb10 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Thu, 22 Jan 2026 09:18:23 +0100
Subject: [PATCH 33/35] Fix download links

---
 packages/safe-chain/src/installation/downloadAgent.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/safe-chain/src/installation/downloadAgent.js b/packages/safe-chain/src/installation/downloadAgent.js
index 2f2baac..df4a933 100644
--- a/packages/safe-chain/src/installation/downloadAgent.js
+++ b/packages/safe-chain/src/installation/downloadAgent.js
@@ -8,24 +8,24 @@ const ULTIMATE_VERSION = "v0.2.1";
 const DOWNLOAD_URLS = {
   win32: {
     x64: {
-      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-windows-amd64.msi`,
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainUltimate-windows-amd64.msi`,
       checksum:
         "sha256:8d86a44d314746099ba50cfae0cc1eae6232522deb348b226da92aae12754eec",
     },
     arm64: {
-      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-windows-arm64.msi`,
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainUltimate-windows-arm64.msi`,
       checksum:
         "sha256:ab5b8335cc257d53424f73d6681920875083cd9b3f53e52d944bf867a415e027",
     },
   },
   darwin: {
     x64: {
-      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-darwin-amd64.pkg`,
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainUltimate-darwin-amd64.pkg`,
       checksum:
         "sha256:73f83d9352c4fd25f7693d9e53bbbb2b7ac70d16217d745495c9efb50dc4a3a6",
     },
     arm64: {
-      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainAgent-darwin-arm64.pkg`,
+      url: `https://github.com/AikidoSec/safechain-internals/releases/download/${ULTIMATE_VERSION}/SafeChainUltimate-darwin-arm64.pkg`,
       checksum:
         "sha256:bd419e9c82488539b629b04c97aa1d2dc90e54ff045bd7277a6b40d26f8ebc73",
     },

From 09730a07752173ec5d10296b59ee0641f417bb56 Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Thu, 22 Jan 2026 09:23:17 +0100
Subject: [PATCH 34/35] Update application names on Windows

---
 packages/safe-chain/src/installation/installOnWindows.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/safe-chain/src/installation/installOnWindows.js b/packages/safe-chain/src/installation/installOnWindows.js
index c6bc744..0741fb7 100644
--- a/packages/safe-chain/src/installation/installOnWindows.js
+++ b/packages/safe-chain/src/installation/installOnWindows.js
@@ -6,8 +6,8 @@ import { ui } from "../environment/userInteraction.js";
 import { printVerboseAndSafeSpawn, safeSpawn } from "../utils/safeSpawn.js";
 import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
 
-const WINDOWS_SERVICE_NAME = "SafeChainAgent";
-const WINDOWS_APP_NAME = "SafeChain Agent";
+const WINDOWS_SERVICE_NAME = "SafeChainUltimate";
+const WINDOWS_APP_NAME = "SafeChain Ultimate";
 
 export async function installOnWindows() {
   if (!(await isRunningAsAdmin())) {

From f825f84faa88f6e578663674368fc06fe0ccac6e Mon Sep 17 00:00:00 2001
From: Sander Declerck <sander@sdsoftware.be>
Date: Thu, 22 Jan 2026 12:51:25 +0100
Subject: [PATCH 35/35] Add message about the certificate popup

---
 .../safe-chain/src/installation/installOnMacOS.js    | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/packages/safe-chain/src/installation/installOnMacOS.js b/packages/safe-chain/src/installation/installOnMacOS.js
index 074bbe6..0d475b1 100644
--- a/packages/safe-chain/src/installation/installOnMacOS.js
+++ b/packages/safe-chain/src/installation/installOnMacOS.js
@@ -4,6 +4,7 @@ import { join } from "path";
 import { ui } from "../environment/userInteraction.js";
 import { printVerboseAndSafeSpawn } from "../utils/safeSpawn.js";
 import { downloadAgentToFile, getAgentVersion } from "./downloadAgent.js";
+import chalk from "chalk";
 
 export async function installOnMacOS() {
   if (!isRunningAsRoot()) {
@@ -34,6 +35,17 @@ export async function installOnMacOS() {
       "✅ SafeChain Ultimate installed and started successfully!",
     );
     ui.emptyLine();
+    ui.writeInformation(
+      chalk.cyan("🔐 ") +
+        chalk.bold("ACTION REQUIRED: ") +
+        "macOS will show a popup to install our certificate.",
+    );
+    ui.writeInformation(
+      "   " +
+        chalk.bold("Please accept the certificate") +
+        " to complete the installation.",
+    );
+    ui.emptyLine();
   } finally {
     ui.writeVerbose(`Cleaning up temporary file: ${pkgPath}`);
     cleanup(pkgPath);