Install on Windows

The Flowstate Agent on Windows ships as an MSI that installs the flowstate.exe CLI under C:\Program Files\Flowstate\ and registers a Windows service called FlowstateAgent. On Windows the capture path is WinDivert — a kernel driver that diverts outbound TCP/443 connections into the daemon — which is functionally equivalent to the macOS Network Extension and lets us cover apps that bypass the system proxy.

The same flowstate install UX applies on Windows: one command sets up the CA, writes the service config, registers WinDivert, and starts the daemon.

Prerequisites

• Windows 10 21H2 or later, Windows 11, or Windows Server 2019+ (x64). ARM64 is on the roadmap.
• Local administrator (the MSI elevates).
• An organisation key, provisioned at https://app.flowstate.inc/settings/ai/cloud-proxy. The key is a composite of your tenant slug and an API token — base64(tenantSlug:apiKey) — and routes your traffic to the right tenant on the cloud proxy.

Quick install — single machine

Run an elevated PowerShell prompt:

# 1. Download the MSI from the release page.
#    <!-- TODO: switch to https://binaries.flowstate.inc once that site is updated -->
$version = "v1.12.1"   # (v1.12.1, 2026-05-15)
$url = "https://github.com/meetflowstate/flowstate-agent/releases/download/$version/flowstate_windows-amd64.msi"
Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\flowstate.msi"

# 2. Install the MSI (puts flowstate.exe on PATH, lays down the service skeleton).
msiexec /i "$env:TEMP\flowstate.msi" /qn /norestart

# 3. One-shot configure: CA, service config, WinDivert, /etc/flowstate.env equivalent,
#    per-tool config.
& "C:\Program Files\Flowstate\flowstate.exe" install `
    --key="<your-org-key>" `
    --user="<user-email>"

The flowstate install command:

1. Generates a per-machine root certificate authority and installs it under Cert:\LocalMachine\Root (the system trust store).
2. Writes the agent's environment to HKLM\SOFTWARE\Flowstate\Agent — FLOWSTATE_OTLP_KEY, FLOWSTATE_USER, FLOWSTATE_MODE=cloud-proxy, FLOWSTATE_CLOUD_PROXY=https://ai.flowstate.inc.
3. Registers the WinDivert capture driver and starts the FlowstateAgent service.
4. Detects installed AI tools (Claude Code, Cursor, Codex CLI, …) and writes their per-tool OTLP exporter config so they emit native OpenTelemetry to the daemon.

The MSI install + the flowstate install invocation can be combined into a single deployment step via a Win32 wrapper — see the Intune section below.

Optional flags

Flag	When to use it
--host=<url>	Point at a non-default cloud proxy (regional EU endpoint, staging, on-prem mirror). Default: https://ai.flowstate.inc.
--no-app	No-op on Windows — there is no host app on Windows. Pass it freely if you share an install script across platforms.

The previous --transport flag has been removed. Passing it returns an error directing you at --no-app. The flowstate proxy install / flowstate proxy uninstall subcommands have also been removed; use the top-level install / uninstall.

What this does to the machine

Path	Notes
C:\Program Files\Flowstate\flowstate.exe	The CLI + daemon.
C:\Program Files\Flowstate\windivert\	The WinDivert driver payload.
HKLM\SOFTWARE\Flowstate\Agent	Environment values, replaces the macOS/Linux /etc/flowstate.env.
Services → FlowstateAgent	Auto-start on boot, runs as LocalSystem.
C:\ProgramData\Flowstate\logs\agent.log	Daemon log.
Cert:\LocalMachine\Root → Flowstate Agent CA	Trusted root for TLS interception.

Verify the install

# 1. Service running?
Get-Service FlowstateAgent | Format-List Status, StartType

# 2. Registry has the values you expected?
Get-ItemProperty -Path "HKLM:\SOFTWARE\Flowstate\Agent"

# 3. Recent activity?
Get-Content "C:\ProgramData\Flowstate\logs\agent.log" -Tail 100 |
  Select-String "session forwarded"

Then open any AI tool and use it normally — sessions appear under Settings → AI → Cloud Proxy in Flowstate within a few minutes.

Fleet rollout — Microsoft Intune

The cleanest pattern wraps the MSI + the configure step into a single Win32 app.

1. Wrap with the Microsoft Win32 Content Prep Tool.

In a staging directory, place:

• flowstate_windows-amd64.msi
• install.cmd — see below.
• uninstall.cmd — see below.

install.cmd:

@echo off
msiexec /i "%~dp0flowstate_windows-amd64.msi" /qn /norestart
"C:\Program Files\Flowstate\flowstate.exe" install --key=%FLOWSTATE_ORG_KEY% --user=%FLOWSTATE_USER_EMAIL%
exit /b %ERRORLEVEL%

uninstall.cmd:

@echo off
"C:\Program Files\Flowstate\flowstate.exe" uninstall
msiexec /x {<product-code>} /qn /norestart
exit /b %ERRORLEVEL%

Wrap:

.\IntuneWinAppUtil.exe -c "C:\staging" `
  -s "install.cmd" -o "C:\out"

2. Create a Win32 app. Apps → Windows → Add → Win32 app. Upload install.intunewin.

• Name: Flowstate Agent
• Publisher: Flowstate Inc.
• Install command: install.cmd
• Uninstall command: uninstall.cmd
• Install behaviour: System
• Detection rule: file exists C:\Program Files\Flowstate\flowstate.exe with version 1.12.1.0 (v1.12.1, 2026-05-15) or newer.

3. Pass the org key + user email via Settings Catalog. Devices → Configuration → Create policy → Windows 10 and later → Settings catalog. Add Environment Variables (Machine scope):

Variable	Value
FLOWSTATE_ORG_KEY	<the composite org key from app.flowstate.inc/settings/ai/cloud-proxy>
FLOWSTATE_USER_EMAIL	%USERNAME%@<corporate-domain> (or a per-device value from your identity provider)

The Win32 install script reads those at install time and passes them to flowstate install. The agent then persists them under HKLM\SOFTWARE\Flowstate\Agent so the service can read them on every boot.

Assign the Win32 app and the Settings Catalog profile to the same group.

Fleet rollout — Active Directory Group Policy

For domains without Intune:

1. Software installation GPO.

Copy the MSI to a UNC share readable by every domain-joined endpoint (e.g. \\dc01\netlogon\Flowstate\). Group Policy Management → New GPO → Computer Configuration → Policies → Software Settings → Software installation → New → Package. Choose Assigned.

2. Configure GPO preferences for the install args.

Computer Configuration → Preferences → Windows Settings → Registry → New → Registry Item. Add under HKEY_LOCAL_MACHINE\SOFTWARE\Flowstate\Agent:

Value name	Type	Value
FLOWSTATE_OTLP_KEY	REG_SZ	<the composite org key>
FLOWSTATE_USER	REG_SZ	<user email> (or a per-machine value)
FLOWSTATE_MODE	REG_SZ	cloud-proxy
FLOWSTATE_CLOUD_PROXY	REG_SZ	https://ai.flowstate.inc

3. Run the configure step via a scheduled task.

The MSI alone doesn't run flowstate install (that requires the registry values from step 2 to be present). Add a one-shot scheduled task that runs on next boot:

# Pushed via Computer Configuration → Preferences → Scheduled Tasks
& "C:\Program Files\Flowstate\flowstate.exe" install `
    --key="$(Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Flowstate\Agent' -Name FLOWSTATE_OTLP_KEY)" `
    --user="$(Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Flowstate\Agent' -Name FLOWSTATE_USER)"

Set the task to run as SYSTEM, at startup, once. The agent's idempotency means a re-run on subsequent boots is harmless.

Uninstall

# 1. Roll back the configure step.
& "C:\Program Files\Flowstate\flowstate.exe" uninstall

# 2. Remove the MSI payload.
msiexec /x {<product-code>} /qn /norestart

flowstate uninstall reverses everything the configure step did: stops the service, removes the WinDivert registration, removes the Flowstate Agent CA from the local trust store, clears the registry values, and rolls back every per-tool config. msiexec /x then removes the binary itself.

Or, from Intune: change the Win32 app assignment from Required to Uninstall — the wrapper's uninstall.cmd runs both steps in order.

Troubleshooting

See troubleshooting. For Windows specifically:

• WinDivert.sys not loading: usually a Secure Boot signature issue on locked-down corporate images. Confirm the driver is allowed by your endpoint protection (Defender, CrowdStrike, SentinelOne all need to trust the WinDivert signature). The driver SHA256 is published in the release notes for each version.
• Service won't start, log says missing FLOWSTATE_OTLP_KEY: the configure step (flowstate install) didn't run, or the registry values it relies on aren't present. Re-run from an elevated prompt.