Skip to main content
The macOS package is a single signed and notarized .pkg. It installs the self-contained bundle to /usr/local/lib/runlayer/runlayer/, symlinks /usr/local/bin/runlayer, and adds two package-owned launchd jobs: an hourly root updater (com.runlayer.cli.update) and an hourly per-user scheduler (com.runlayer.cli.schedule). The updater is enabled by default but silently exits until managed Host and OrgApiKey values are available. Skill sync also defaults on but waits for Host and either SkillSyncOrgApiKey or OrgApiKey. The base deployment needs no Configuration Profiles.

​
Prerequisites

  • An MDM with package deployment — Jamf Pro, Kandji, SimpleMDM, Mosyle, Workspace ONE, Intune, or any MDM that can deploy a .pkg
  • Apple Silicon (arm64) Macs
  • The signed runlayer-<version>-macos-arm64.pkg from your Runlayer downloads access

​
Deployment Steps

1

Upload the .pkg

Upload runlayer-<version>-macos-arm64.pkg as a Custom App (or equivalent package item) in your MDM — Jamf Pro, Kandji, SimpleMDM, Mosyle, Workspace ONE, Intune, or any MDM with package deployment.
2

Scope to your devices

Scope the app to the device groups that should have the CLI. No profiles, PPPC grants, or additional payloads are required for the base install.

​
Skill sync (optional)

Turn on managed skill sync and devices install the skills you select in Runlayer — and keep them current — on an hourly tick.
1

Push the config keys

Add these keys to a Configuration Profile for the dedicated com.runlayer.cli preference domain. The CLI reads this domain first, then fills missing values from com.runlayer.aiwatch. If you already deploy AI Watch, its Host and OrgApiKey work as fallbacks; use the dedicated domain only for CLI-specific values or overrides.AutoUpdate and SyncSkills are opt-out switches: omitting them leaves each feature enabled once its required host and key are present.
2

Push the login-items profile

Upload com.runlayer.cli.loginitems.mobileconfig (published next to the .pkg in the release assets) as-is and scope it with the package. It pre-approves the scheduler agent on macOS 13+, so users never see a “Background Item Added” notification.
To verify on a device — run a sync by hand and check its status:
For an unattended per-user run, --username overrides identity detection and --quiet suppresses non-error output:
runlayer schedule runs all due registered tasks once, using the same entrypoint as the package’s hourly per-user scheduler. Fleet-wide, each device reports its skill-sync status on its device page under Shadow AI.

​
Upgrades and removal

  • Upgrade — once managed Host and OrgApiKey values are present, devices install the backend-selected version themselves within the hour. AutoUpdate defaults to true; set it to false to opt out. For a one-off update, run runlayer update with an organization API key. You can also push a newer .pkg through the same MDM item; installers upgrade in place.
  • Remove — unscope the app in your MDM, or run uninstall-runlayer.sh (ships in the repo under cli/packaging/macos/) as root to remove the bundle, both launchd jobs, and the package receipt.

​
Verification

On a target device, confirm the binary resolves on PATH:
For fleet-level visibility, check the app’s install status in your MDM console.