diff --git a/website/agent.ps1 b/website/agent.ps1
index b3a2d75..7e3aedc 100644
--- a/website/agent.ps1
+++ b/website/agent.ps1
@@ -28,6 +28,10 @@ Write-Host "    2. Connect to U-Claw relay server" -ForegroundColor DarkGray
 Write-Host "    3. Allow remote command execution for support" -ForegroundColor DarkGray
 Write-Host "    4. Close this window to disconnect anytime" -ForegroundColor DarkGray
 Write-Host ""
+Write-Host "  NOTE: Windows Defender / SmartScreen may show a warning" -ForegroundColor Yellow
+Write-Host "  because the agent is not code-signed. This is normal." -ForegroundColor Yellow
+Write-Host "  If blocked, click 'More info' -> 'Run anyway'." -ForegroundColor Yellow
+Write-Host ""
 $confirm = Read-Host "  Continue? (y/N)"
 if ($confirm -ne "y" -and $confirm -ne "Y") {
     Write-Host "  Cancelled." -ForegroundColor Red
@@ -46,11 +50,21 @@ try {
     if (!(Test-Path $AGENT_DIR)) { New-Item -ItemType Directory -Path $AGENT_DIR -Force | Out-Null }
 
     $ProgressPreference = 'SilentlyContinue'
-    Invoke-WebRequest -Uri $DOWNLOAD_URL -OutFile $AGENT_PATH -UseBasicParsing
+    Invoke-WebRequest -Uri $DOWNLOAD_URL -OutFile $AGENT_PATH -UseBasicParsing -TimeoutSec 120
     $ProgressPreference = 'Continue'
 
-    if (!(Test-Path $AGENT_PATH)) { throw "Download failed" }
-    Write-Host "  [OK] Download complete" -ForegroundColor Green
+    if (!(Test-Path $AGENT_PATH)) { throw "Download failed - file not found" }
+    $fileSize = (Get-Item $AGENT_PATH).Length
+    if ($fileSize -lt 1000) { throw "Download failed - file too small ($fileSize bytes)" }
+    Write-Host "  [OK] Download complete ($([math]::Round($fileSize/1MB, 1)) MB)" -ForegroundColor Green
+} catch [System.Net.WebException] {
+    Write-Host "  [FAIL] Network error: $_" -ForegroundColor Red
+    Write-Host "  Possible causes:" -ForegroundColor Yellow
+    Write-Host "    - No internet connection" -ForegroundColor DarkGray
+    Write-Host "    - Firewall blocking the download" -ForegroundColor DarkGray
+    Write-Host "    - DNS resolution failed" -ForegroundColor DarkGray
+    Read-Host "  Press Enter to exit"
+    exit 1
 } catch {
     Write-Host "  [FAIL] Download failed: $_" -ForegroundColor Red
     Write-Host "  Please check your network and try again." -ForegroundColor Yellow
@@ -58,6 +72,14 @@ try {
     exit 1
 }
 
+# Add Windows Defender exclusion hint
+try {
+    Add-MpPreference -ExclusionPath $AGENT_DIR -ErrorAction SilentlyContinue
+} catch {
+    # Non-admin users can't add exclusions - that's ok
+}
+Write-Host "  [TIP] If Defender blocks it: Settings > Virus protection > Allow" -ForegroundColor DarkGray
+
 # ---- Run Agent ----
 Write-Host "  [2/2] Connecting..." -ForegroundColor White
 Write-Host ""
diff --git a/website/agent.sh b/website/agent.sh
index 861f3f2..a5677e1 100644
--- a/website/agent.sh
+++ b/website/agent.sh
@@ -47,19 +47,35 @@ fi
 echo ""
 
 # Download agent
-echo "  [1/2] Downloading agent..."
+echo "  [1/3] Downloading agent..."
 mkdir -p "$AGENT_DIR"
 if command -v curl &>/dev/null; then
-    curl -fsSL -o "$AGENT_PATH" "$DOWNLOAD_URL"
+    curl -fsSL --connect-timeout 15 --max-time 120 -o "$AGENT_PATH" "$DOWNLOAD_URL"
 elif command -v wget &>/dev/null; then
-    wget -q -O "$AGENT_PATH" "$DOWNLOAD_URL"
+    wget -q --timeout=120 -O "$AGENT_PATH" "$DOWNLOAD_URL"
 else
     echo "  [FAIL] Neither curl nor wget found"
     exit 1
 fi
+
+if [ ! -f "$AGENT_PATH" ] || [ ! -s "$AGENT_PATH" ]; then
+    echo "  [FAIL] Download failed or file is empty"
+    echo "  Please check your network connection and try again."
+    exit 1
+fi
+
 chmod +x "$AGENT_PATH"
 echo "  [OK] Download complete"
 
+# macOS: remove quarantine attribute to bypass Gatekeeper
+if [ "$OS" = "darwin" ]; then
+    echo "  [2/3] Removing macOS Gatekeeper quarantine..."
+    xattr -d com.apple.quarantine "$AGENT_PATH" 2>/dev/null || true
+    echo "  [OK] Gatekeeper bypass applied"
+else
+    echo "  [2/3] Skipping (not macOS)"
+fi
+
 # Cleanup on exit
 cleanup() {
     echo ""
@@ -70,7 +86,7 @@ cleanup() {
 trap cleanup INT TERM EXIT
 
 # Run agent
-echo "  [2/2] Connecting..."
+echo "  [3/3] Connecting..."
 echo ""
 echo "  =========================================="
 echo "    Connected! Send this ID to support:"
@@ -85,8 +101,20 @@ echo "  * Press Ctrl+C or close terminal to disconnect"
 echo "  * Auto-disconnect after ${TIMEOUT_HOURS} hours"
 echo ""
 
-# Run with timeout
-timeout "${TIMEOUT_HOURS}h" "$AGENT_PATH" \
+# Run with timeout (macOS may not have GNU timeout)
+run_with_timeout() {
+    if command -v timeout &>/dev/null; then
+        timeout "${TIMEOUT_HOURS}h" "$@"
+    elif command -v gtimeout &>/dev/null; then
+        gtimeout "${TIMEOUT_HOURS}h" "$@"
+    else
+        # Fallback: use perl alarm for timeout
+        local secs=$((TIMEOUT_HOURS * 3600))
+        perl -e "alarm $secs; exec @ARGV" -- "$@"
+    fi
+}
+
+run_with_timeout "$AGENT_PATH" \
     -server "$RELAY_SERVER" \
     -token "$TOKEN" \
     -id "$DEVICE_ID" 2>/dev/null || true