kodelyth-ecc 2.21.2 → 2.23.0

package/CHANGELOG.md

@@ -2,6 +2,152 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.23.0 — Windows has no manual step left (October 2026)
+
+2.22.0 made the Windows install work but left two components needing a manual
+download: RTK and the codebase graph. That turned out to be a gap in ECC, not a
+limitation upstream — **both projects publish Windows builds** and ECC simply
+never fetched them:
+
+```
+rtk-x86_64-pc-windows-msvc.zip
+codebase-memory-mcp-windows-amd64.zip  /  -arm64.zip
+```
+
+Both now install automatically. Windows is at parity with macOS and Linux.
+
+### How it works
+
+A shared `scripts/lib/win-install.js`, used by both. It pulls from GitHub's
+`releases/latest/download/<asset>` URL, which always redirects to the newest
+release — no API call, so no token and no rate limit.
+
+Download and extraction use `curl.exe` and `tar.exe`. Both ship with Windows 10
+1803 and later, and `tar` there is bsdtar, which handles zip. That avoids
+PowerShell quoting entirely. Both are probed before use, so an older machine
+gets a clear message instead of a spawn error.
+
+Architecture comes from `process.arch`: the codebase graph has a native arm64
+build, while RTK publishes x86_64 only — fine on arm64 Windows, which runs x64
+under emulation.
+
+### PATH is yours, not ours
+
+Binaries land in `%LOCALAPPDATA%\Kodelyth\bin`. ECC does **not** edit your PATH.
+It prints the one command that does:
+
+```powershell
+setx PATH "%PATH%;%LOCALAPPDATA%\Kodelyth\bin"
+```
+
+This mirrors the POSIX path, which reports `~/.local/bin` rather than writing to
+a shell rc. Whether the directory is already persistent is read from
+`HKCU\Environment`, not from `process.env` — the latter would always say yes
+right after the installer prepends it for its own process, and would wrongly
+tell you there is nothing left to do.
+
+### Verified, not asserted
+
+The Windows CI job now installs for real and asserts both binaries exist and
+run:
+
+```
+install dir: C:\Users\runneradmin\AppData\Local\Kodelyth\bin
+  rtk.exe  10,285,056 bytes
+rtk 0.51.0
+codebase-memory-mcp 0.11.0
+```
+
+`doctor`'s Windows hints changed too. They previously said "no Windows installer
+yet" and pointed at a release page; the install command is now correct on every
+platform, and the hint names the PATH step rather than implying the command
+alone finishes the job.
+
+**647 tests passing.**
+
+## v2.22.0 — Windows actually works now (September 2026)
+
+The Windows install was broken in three separate ways. Windows CI had been green
+throughout, because the test suite only ever exercised library functions — it
+never ran the installer, which takes a completely different path there
+(`install.ps1` through PowerShell rather than `install.sh` through bash).
+
+Every finding below was measured on a real `windows-latest` runner, not inferred
+from reading the code.
+
+### The documented command failed outright
+
+`install.sh` matches `claude-home|claude-code` in every case arm, so both
+spellings work on macOS and Linux. `install.ps1` had three separate
+`switch ($Target)` blocks that each matched only `claude-home`, so the other
+spelling hit the default arm:
+
+```
+Unknown target: claude-code
+Valid targets: claude-home, windsurf-project, ...
+```
+
+`claude-code` is what the README, the docs and the website install page all tell
+people to use. **Every Windows user following the documented instructions got a
+hard failure.** Aliases are now normalised once at the top of the file, which
+covers all three switches and keeps the accepted set identical to `install.sh`
+rather than merely similar.
+
+### None of the post-install wiring ever ran
+
+The Windows branch called `process.exit()` immediately after `install.ps1`, while
+the POSIX branch continued into MCP registration, RTK, Terse mode and the
+codebase graph. A Windows user got agents, skills and commands on disk and
+silently none of those, with no message explaining why.
+
+That block is now a shared `runPostInstall()` called by both branches.
+
+### Hooks shipped without their scripts, and were never registered
+
+`install.ps1` copied only `hooks/hooks.json` — the same defect `install.sh` had
+before 2.21.0, where Windows was missed. So the manifest landed with none of the
+scripts it points at, and `settings.json` was never written at all. Claude Code
+reads hooks from `settings.json`, so every hook was inert.
+
+### Before and after, measured
+
+```
+                        before        after
+--target claude-code    hard fail     works
+hook files                      1        12
+settings.json              ABSENT     present, 8 events
+Terse mode                 absent     present
+MCP registration           absent     present
+total files installed           —       502
+```
+
+### Guarded so it cannot regress
+
+A `Windows install` workflow now runs on every push to main: it packs the
+package as npm would, installs it globally on `windows-latest`, runs a real
+install into a scratch HOME, and asserts on what lands — counts per module,
+whether `settings.json` was written and with how many events, whether Terse and
+MCP registration happened, then runs `doctor`. Green CI now means the Windows
+install works, which it never did before.
+
+### Also
+
+`doctor` was telling Windows users to run `kodelythecc rtk install` and
+`kodelythecc codebase install`. Neither has a Windows installer, so both
+commands report that they cannot proceed and the user follows a dead end. Both
+hints now point at the release page on Windows. Remediation that fails on the
+reader's platform is worse than none.
+
+RTK and the codebase graph remain manual on Windows — they are native binaries
+without a Windows installer script. The difference is that ECC now says so
+during install rather than the feature being silently absent.
+
+README gains a Windows section covering what is automatic, what is not, and why
+no execution-policy change is needed. Two stale claims corrected there: 373
+tests became 647, and 22 hooks became 44 hook entries.
+
+**647 tests passing.**
+
 ## v2.21.2 — same content, with a GitHub release attached (September 2026)
 
 Identical to 2.21.1 in every shipped file. It exists because 2.21.1 could not be

package/README.md

@@ -96,7 +96,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 | Quality hooks | ✅ 22+ | Some | ❌ | ❌ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | ❌ none | Varies | ❌ | Varies |
-| Test coverage | ✅ 373 tests | ❌ | ❌ | ❌ |
+| Test coverage | ✅ 647 tests | ❌ | ❌ | ❌ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---
@@ -118,7 +118,7 @@ kodelythecc --target claude-code --codebase-graph
 That's it. This single flow:
 
 1. Installs both binaries (`kodelyth-ecc` and short-form `kodelythecc`) to your PATH
-2. Copies 70 agents + 196 skills + 103 commands + 22 hooks + 15 rules into your AI tool's config dir
+2. Copies 70 agents + 196 skills + 103 commands + 44 hook entries + 15 rules into your AI tool's config dir
 3. Auto-installs **RTK** binary and wires its PreToolUse hook (input compression starts on next AI restart)
 4. Installs **Terse mode** skill + `/terse` and `/terse-compress` slash commands (dormant — user types `/terse` to activate)
 5. Auto-installs **codebase-memory-mcp** and registers its MCP entries in your AI tool (with `--codebase-graph`)
@@ -190,6 +190,48 @@ export KODELYTH_EXTRA_IDE_WATCH="$HOME/my-agent-logs,$HOME/other-tool/state"
 npx kodelyth-ecc dashboard
 ```
 
+### Windows
+
+The same command works. `npx kodelyth-ecc` detects Windows and runs `install.ps1`
+through PowerShell for you — there is nothing separate to download.
+
+```powershell
+npx kodelyth-ecc                              # Claude Code (default)
+npx kodelyth-ecc --target cursor-project      # any target works the same way
+```
+
+**Requirements.** Node.js 18+ and either PowerShell 7 (`pwsh`) or the Windows
+PowerShell 5.1 that ships with the OS. The installer tries `pwsh` first and falls
+back automatically, and it passes `-ExecutionPolicy Bypass` for its own process
+only, so you do not need to change your machine's execution policy.
+
+**Everything installs automatically**, same as macOS and Linux: the 70 agents,
+196 skills, 103 commands, 15 rules, all 44 hook entries registered into
+`settings.json`, the ECC MCP server (16 tools), Terse mode, **RTK**, and the
+**codebase graph**.
+
+The last two are native binaries. ECC downloads the published Windows builds
+straight from GitHub releases and puts them in `%LOCALAPPDATA%\Kodelyth\bin`.
+That directory is not on `PATH` by default, so the installer prints the one
+command that fixes it:
+
+```powershell
+setx PATH "%PATH%;%LOCALAPPDATA%\Kodelyth\bin"
+```
+
+Run it once, reopen your terminal, done. ECC does not edit `PATH` for you —
+that is your environment to change.
+
+**Verify:**
+
+```powershell
+kodelythecc doctor
+```
+
+Every install is exercised on a real `windows-latest` runner on each push — it
+packs the package, installs it globally, runs a real install, and asserts on
+what lands. See the `Windows install` workflow.
+
 ### Option 2 — npx from GitHub (always latest commit)
 
 ```bash
@@ -973,7 +1015,9 @@ npx kodelyth-ecc typescript python golang rust java kotlin php swift cpp dart ru
 | Google Antigravity | Full | `antigravity` | Agents → skills, commands → workflows, rules |
 | OpenCode | Rules only | `opencode` | Rules (agents + skills not yet supported by OpenCode) |
 
-**OS support:** macOS, Linux (`install.sh`), Windows (`install.ps1`), or any OS with Node.js 18+ (`npx`).
+**OS support:** macOS, Linux and Windows. `npx kodelyth-ecc` is the same command on all
+three — it dispatches to `install.sh` on macOS/Linux and `install.ps1` on Windows for you.
+See [Windows](#windows) for the two pieces that still need a manual step there.
 
 ---
 

package/VERSION

@@ -1 +1 @@
-2.21.2
+2.23.0

package/bin/kodelyth-ecc.js

@@ -1806,79 +1806,20 @@ if (args.includes('--version') || args.includes('-v')) {
 }
 
 // ── Run installer ─────────────────────────────────────────────────────────────
-if (isWin) {
-  const ps1 = path.join(ROOT, 'install.ps1');
-  if (!fs.existsSync(ps1)) {
-    console.error('Error: install.ps1 not found. Please clone the repo and run install.ps1 manually.');
-    process.exit(1);
-  }
-
-  // Map CLI args (--target X, --bundle X, --profile X) → PowerShell named params (-Target X, -Bundle X)
-  // Positional language args (e.g. "typescript python") → collected for -Languages
-  const psArgs = [];
-  const languages = [];
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if ((a === '--target' || a === '-target') && args[i + 1]) {
-      psArgs.push('-Target', args[++i]); continue;
-    }
-    if ((a === '--bundle' || a === '-bundle') && args[i + 1]) {
-      psArgs.push('-Bundle', args[++i]); continue;
-    }
-    if ((a === '--profile' || a === '-profile') && args[i + 1]) {
-      // profile maps to languages in ps1
-      languages.push(args[++i]); continue;
-    }
-    if (!a.startsWith('-')) {
-      // positional = language module
-      languages.push(a); continue;
-    }
-    // pass through any other flags unmapped
-    psArgs.push(a);
-  }
-  if (languages.length > 0) {
-    psArgs.push('-Languages', languages.join(','));
-  }
-
-  // Try pwsh (PowerShell 7+) first, then fall back to powershell (5.1)
-  function trySpawn(bin) {
-    return spawnSync(bin, ['-NoLogo', '-ExecutionPolicy', 'Bypass', '-File', ps1, ...psArgs], {
-      stdio: 'inherit',
-      shell: false,
-      env: { ...process.env, KODELYTH_NONINTERACTIVE: '1' },
-    });
-  }
-
-  let result = trySpawn('pwsh');
-  if (result.error && result.error.code === 'ENOENT') {
-    // pwsh not found — try legacy powershell.exe
-    result = trySpawn('powershell');
-  }
-
-  if (result.error) {
-    console.error(
-      '\nError: Could not launch PowerShell to run the installer.\n' +
-      'Make sure PowerShell is installed and accessible in your PATH.\n' +
-      '  • Try:   pwsh --version\n' +
-      '  • Or:    powershell -Version\n' +
-      '\nAlternatively, run the installer manually:\n' +
-      `  powershell -ExecutionPolicy Bypass -File "${ps1}"\n`
-    );
-    process.exit(1);
-  }
-  process.exit(result.status ?? 1);
-} else {
-  try { require(path.join(ROOT, 'scripts', 'migrate-legacy.js')).main(); } catch {}
-  const sh = path.join(ROOT, 'install.sh');
-  if (!fs.existsSync(sh)) {
-    console.error('Error: install.sh not found in package root:', ROOT);
-    process.exit(1);
-  }
-  fs.chmodSync(sh, 0o755);
-  const result = spawnSync('bash', [sh, ...args], { stdio: 'inherit', shell: false });
-
+// Post-install wiring: MCP registration, RTK, Terse mode, codebase graph.
+//
+// This lived inside the POSIX branch, and the Windows branch called
+// process.exit() straight after install.ps1 — so none of it ran on Windows. A
+// Windows user got agents, skills and commands on disk and silently none of:
+// the MCP server (16 tools), RTK token savings, /terse and /terse-compress, or
+// the codebase graph. Five advertised features, absent with no message.
+//
+// Every block below already guards itself and reports a reason when it cannot
+// proceed, which is what makes sharing it safe: on Windows the parts that work
+// now run, and the parts that cannot say so instead of vanishing.
+function runPostInstall(status, args) {
   // Post-install: auto-register ECC's own MCP server in Claude Code + Desktop.
-  if (result.status === 0 && !args.includes('--no-mcp-register')) {
+  if (status === 0 && !args.includes('--no-mcp-register')) {
     try {
       const reg = require(path.join(ROOT, 'scripts', 'mcp', 'register-self.js'));
       process.stdout.write('\n━ ECC MCP server registration ' + '─'.repeat(31) + '\n');
@@ -1894,7 +1835,7 @@ if (isWin) {
   }
 
   // Post-install: auto-install + wire RTK for the target IDE (opt-out via --no-rtk).
-  if (result.status === 0 && !args.includes('--no-rtk')) {
+  if (status === 0 && !args.includes('--no-rtk')) {
     try {
       const rtk = require(path.join(ROOT, 'scripts', 'rtk', 'index.js'));
       const targetIdx = args.indexOf('--target');
@@ -1909,6 +1850,13 @@ if (isWin) {
           const en = rtk.enableFor(target, { log: () => {} });
           if (en.enabled) {
             w(`  ✓ RTK ${(rtk.getVersion() || '').replace(/^rtk /,'')} — wired for ${target}`);
+            // On Windows the binary goes to %LOCALAPPDATA%\Kodelyth\bin. ECC does
+            // not edit PATH for the user, so say plainly what is left to do —
+            // otherwise rtk works during this install and vanishes next shell.
+            if (inst.pathHint) {
+              w(`  ! ${inst.dir} is not on your PATH yet`);
+              w(`    run once, then reopen your terminal:  ${inst.pathHint}`);
+            }
             w(`  ✓ Restart your AI tool to activate. 60-90% token savings on shell commands.`);
           } else {
             w(`  · skipped: ${en.reason}`);
@@ -1972,5 +1920,80 @@ if (isWin) {
     }
   }
 
-  process.exit(result.status ?? 1);
 }
+
+if (isWin) {
+  const ps1 = path.join(ROOT, 'install.ps1');
+  if (!fs.existsSync(ps1)) {
+    console.error('Error: install.ps1 not found. Please clone the repo and run install.ps1 manually.');
+    process.exit(1);
+  }
+
+  // Map CLI args (--target X, --bundle X, --profile X) → PowerShell named params (-Target X, -Bundle X)
+  // Positional language args (e.g. "typescript python") → collected for -Languages
+  const psArgs = [];
+  const languages = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if ((a === '--target' || a === '-target') && args[i + 1]) {
+      psArgs.push('-Target', args[++i]); continue;
+    }
+    if ((a === '--bundle' || a === '-bundle') && args[i + 1]) {
+      psArgs.push('-Bundle', args[++i]); continue;
+    }
+    if ((a === '--profile' || a === '-profile') && args[i + 1]) {
+      // profile maps to languages in ps1
+      languages.push(args[++i]); continue;
+    }
+    if (!a.startsWith('-')) {
+      // positional = language module
+      languages.push(a); continue;
+    }
+    // pass through any other flags unmapped
+    psArgs.push(a);
+  }
+  if (languages.length > 0) {
+    psArgs.push('-Languages', languages.join(','));
+  }
+
+  // Try pwsh (PowerShell 7+) first, then fall back to powershell (5.1)
+  function trySpawn(bin) {
+    return spawnSync(bin, ['-NoLogo', '-ExecutionPolicy', 'Bypass', '-File', ps1, ...psArgs], {
+      stdio: 'inherit',
+      shell: false,
+      env: { ...process.env, KODELYTH_NONINTERACTIVE: '1' },
+    });
+  }
+
+  let result = trySpawn('pwsh');
+  if (result.error && result.error.code === 'ENOENT') {
+    // pwsh not found — try legacy powershell.exe
+    result = trySpawn('powershell');
+  }
+
+  if (result.error) {
+    console.error(
+      '\nError: Could not launch PowerShell to run the installer.\n' +
+      'Make sure PowerShell is installed and accessible in your PATH.\n' +
+      '  • Try:   pwsh --version\n' +
+      '  • Or:    powershell -Version\n' +
+      '\nAlternatively, run the installer manually:\n' +
+      `  powershell -ExecutionPolicy Bypass -File "${ps1}"\n`
+    );
+    process.exit(1);
+  }
+  runPostInstall(result.status, args);
+  process.exit(result.status ?? 1);
+} else {
+  try { require(path.join(ROOT, 'scripts', 'migrate-legacy.js')).main(); } catch {}
+  const sh = path.join(ROOT, 'install.sh');
+  if (!fs.existsSync(sh)) {
+    console.error('Error: install.sh not found in package root:', ROOT);
+    process.exit(1);
+  }
+  fs.chmodSync(sh, 0o755);
+  const result = spawnSync('bash', [sh, ...args], { stdio: 'inherit', shell: false });
+
+  runPostInstall(result.status, args);
+  process.exit(result.status ?? 1);
+}

package/install.ps1

@@ -32,6 +32,33 @@ $ErrorActionPreference = "Stop"
 # Non-interactive mode: set by npx launcher (KODELYTH_NONINTERACTIVE=1) or --yes flag
 $NonInteractive = ($env:KODELYTH_NONINTERACTIVE -eq '1')
 
+# -- Target aliases -----------------------------------------------------------
+# install.sh matches "claude-home|claude-code" in every one of its case arms, so
+# both spellings work on macOS and Linux. This file had three separate
+# switch ($Target) blocks that each matched only "claude-home", so
+# "--target claude-code" fell through to the default arm and exited 1.
+#
+# That is the spelling the README, the docs and the website install page all
+# tell people to use, so the documented primary command failed outright on
+# Windows while working everywhere else. Measured on a windows-latest runner:
+#
+#   Unknown target: claude-code
+#   Valid targets: claude-home, windsurf-project, ...
+#
+# Normalising once here fixes all three switches at the same time, and keeps the
+# accepted set identical to install.sh rather than merely similar. Matching is
+# case-insensitive because PowerShell users reasonably type -Target Claude-Code.
+$TargetAliases = @{
+    'claude-code' = 'claude-home'
+    'claude'      = 'claude-home'
+}
+$targetKey = $Target.ToLower()
+if ($TargetAliases.ContainsKey($targetKey)) {
+    $Target = $TargetAliases[$targetKey]
+} else {
+    $Target = $targetKey
+}
+
 # -- Bundle handling (audience-tailored cheat sheets) -------------------------
 if ($Bundle) {
     switch ($Bundle.ToLower()) {
@@ -233,10 +260,38 @@ switch ($Target) {
         Install-Dir  "$ScriptDir\commands" $CommandsDest "Commands (79)"
 
         # Hooks
+        #
+        # Copy the whole tree, not just the manifest. Every command inside
+        # hooks.json points at ${CLAUDE_PLUGIN_ROOT}/hooks/{memory,safety}/*.js,
+        # so copying hooks.json alone registers hooks whose scripts are absent.
+        #
+        # Then register them into settings.json. Claude Code reads hooks from
+        # settings.json, NOT from hooks.json — a manifest sitting on disk does
+        # nothing. install.sh was fixed for this in 2.21.0; this file was missed,
+        # so Windows installs shipped 1 hook file and no settings.json at all
+        # (measured on a windows-latest runner).
         if ($HooksDest) {
             if (-not (Test-Path $HooksDest)) { New-Item -ItemType Directory -Path $HooksDest -Force | Out-Null }
-            Copy-Item "$ScriptDir\hooks\hooks.json" "$HooksDest\hooks.json" -Force
-            Write-Host "  [OK] Hooks -> $HooksDest" -ForegroundColor Green
+            Copy-Item "$ScriptDir\hooks\*" $HooksDest -Recurse -Force
+            $hookScripts = (Get-ChildItem -Path $HooksDest -Recurse -Filter "*.js" -ErrorAction SilentlyContinue).Count
+            Write-Host "  [OK] Hooks -> $HooksDest ($hookScripts scripts)" -ForegroundColor Green
+
+            $registrar = Join-Path $ScriptDir "scripts\install\register-hooks.js"
+            if (Test-Path $registrar) {
+                $nodeCmd = Get-Command node -ErrorAction SilentlyContinue
+                if ($nodeCmd) {
+                    $summary = & node $registrar $Dest 2>&1
+                    if ($LASTEXITCODE -eq 0) {
+                        Write-Host "  [OK] Hooks registered ($summary)" -ForegroundColor Green
+                    } else {
+                        Write-Host "  [!] Hook registration failed: $summary" -ForegroundColor Yellow
+                        Write-Host "      Retry: node `"$registrar`" `"$Dest`"" -ForegroundColor Gray
+                    }
+                } else {
+                    Write-Host "  [!] Hooks copied but not registered -- node not found" -ForegroundColor Yellow
+                    Write-Host "      Run after installing Node: node `"$registrar`" `"$Dest`"" -ForegroundColor Gray
+                }
+            }
         }
 
         # Rules

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.21.2",
+  "version": "2.23.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/codebase/index.js

@@ -25,7 +25,32 @@ function getVersion() {
 function install({ log = () => {} } = {}) {
   if (isInstalled()) return { installed: false, skipped: true, reason: 'already installed', version: getVersion() };
   if (os.platform() === 'win32') {
-    return { installed: false, skipped: true, reason: 'windows requires manual install: https://github.com/DeusData/codebase-memory-mcp/releases' };
+    // This project publishes Windows builds for both architectures; ECC just
+    // never downloaded them. Pick by process.arch so an arm64 machine gets the
+    // native build rather than running x64 under emulation.
+    const win = require('../lib/win-install.js');
+    const asset = process.arch === 'arm64'
+      ? 'codebase-memory-mcp-windows-arm64.zip'
+      : 'codebase-memory-mcp-windows-amd64.zip';
+    const r = win.installFromRelease({
+      repo: 'DeusData/codebase-memory-mcp',
+      asset,
+      binName: `${BIN}.exe`,
+      log,
+    });
+    if (!r.installed) {
+      return { installed: false, skipped: true, reason: `${r.reason} — or install by hand: https://github.com/DeusData/codebase-memory-mcp/releases` };
+    }
+    if (!isInstalled()) {
+      return { installed: false, skipped: true, reason: `installed to ${r.dir} but not runnable from PATH` };
+    }
+    return {
+      installed: true,
+      method: 'github-release',
+      version: getVersion(),
+      dir: r.dir,
+      pathHint: r.onPath ? null : win.setxHint(r.dir),
+    };
   }
   log('[codebase] installing codebase-memory-mcp via official curl script…');
   const script = 'curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash';

package/scripts/doctor-health.js

@@ -115,8 +115,21 @@ function checkPromptInjectionGuard() {
   return { status: PASS, detail: `prompt-injection guard active (mode=${mode})` };
 }
 
+// Both tools DO publish Windows builds, and since 2.23.0 ECC downloads them, so
+// the install command is now the right advice on every platform. What differs is
+// what happens afterwards: on Windows the binary lands in
+// %LOCALAPPDATA%\Kodelyth\bin, which is not on PATH by default, so the hint
+// mentions that rather than implying the command alone finishes the job.
+const IS_WIN = process.platform === 'win32';
+
 function checkRtk() {
-  if (!onPath('rtk')) return { status: WARN, detail: 'RTK not installed (input savings inactive)', fix: 'kodelythecc rtk install' };
+  if (!onPath('rtk')) return {
+    status: WARN,
+    detail: 'RTK not installed (input savings inactive)',
+    fix: IS_WIN
+      ? 'kodelythecc rtk install  (installs to %LOCALAPPDATA%\\Kodelyth\\bin — add it to PATH)'
+      : 'kodelythecc rtk install',
+  };
   try {
     const v = execFileSync('rtk', ['--version'], { encoding: 'utf8' }).trim();
     return { status: PASS, detail: `${v} installed`, };
@@ -130,7 +143,13 @@ function checkTerse() {
 }
 
 function checkCodebaseGraph() {
-  if (!onPath('codebase-memory-mcp')) return { status: WARN, detail: 'codebase graph not installed (optional)', fix: 'kodelythecc codebase install' };
+  if (!onPath('codebase-memory-mcp')) return {
+    status: WARN,
+    detail: 'codebase graph not installed (optional)',
+    fix: IS_WIN
+      ? 'kodelythecc codebase install  (installs to %LOCALAPPDATA%\\Kodelyth\\bin — add it to PATH)'
+      : 'kodelythecc codebase install',
+  };
   return { status: PASS, detail: 'codebase-memory-mcp installed' };
 }
 

package/scripts/lib/win-install.js

@@ -0,0 +1,157 @@
+'use strict';
+
+/**
+ * Install a released binary on Windows.
+ *
+ * Both RTK and codebase-memory-mcp publish Windows builds, but ECC never
+ * implemented the download path and reported "windows requires manual install"
+ * instead. That was a gap here, not a limitation upstream:
+ *
+ *   rtk-x86_64-pc-windows-msvc.zip
+ *   codebase-memory-mcp-windows-amd64.zip  /  -arm64.zip
+ *
+ * Uses GitHub's `releases/latest/download/<asset>` URL, which always redirects
+ * to the newest release's asset — no API call, so no token and no rate limit.
+ *
+ * curl.exe and tar.exe both ship with Windows 10 1803 and later, and tar there
+ * is bsdtar, which extracts zip. That avoids PowerShell quoting entirely. Both
+ * are probed before use so an older machine gets a clear message rather than a
+ * spawn error.
+ *
+ * PATH is deliberately NOT modified. The POSIX path installs to ~/.local/bin and
+ * tells the user to add it; this mirrors that, reporting the exact setx command
+ * rather than silently editing a user's environment.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+/** Where ECC puts binaries it installs on Windows. User-writable, no admin. */
+function installDir() {
+  const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+  return path.join(base, 'Kodelyth', 'bin');
+}
+
+function have(bin) {
+  try {
+    execFileSync(bin, ['--version'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {object}   opts
+ * @param {string}   opts.repo     "owner/name"
+ * @param {string}   opts.asset    asset filename in the latest release
+ * @param {string}   opts.binName  executable to find after extraction (with .exe)
+ * @param {function} [opts.log]
+ * @returns {{installed:boolean, reason?:string, dir?:string, binPath?:string, onPath?:boolean}}
+ */
+function installFromRelease({ repo, asset, binName, log = () => {} }) {
+  if (process.platform !== 'win32') {
+    return { installed: false, reason: 'installFromRelease is Windows-only' };
+  }
+  if (!have('curl')) {
+    return { installed: false, reason: 'curl.exe not found (needs Windows 10 1803 or later)' };
+  }
+  if (!have('tar')) {
+    return { installed: false, reason: 'tar.exe not found (needs Windows 10 1803 or later)' };
+  }
+
+  const dir = installDir();
+  const url = `https://github.com/${repo}/releases/latest/download/${asset}`;
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-win-'));
+  const zip = path.join(tmp, asset);
+
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+
+    log(`[win] downloading ${asset}…`);
+    // -L to follow the release redirect, -f so a 404 is an error rather than
+    // an HTML error page written to disk and then "extracted".
+    const dl = spawnSync('curl', ['-fsSL', '-o', zip, url], { stdio: 'inherit' });
+    if (dl.status !== 0) {
+      return { installed: false, reason: `download failed (curl exit ${dl.status}) — ${url}` };
+    }
+    if (!fs.existsSync(zip) || fs.statSync(zip).size === 0) {
+      return { installed: false, reason: `downloaded file is empty — ${url}` };
+    }
+
+    log('[win] extracting…');
+    const ex = spawnSync('tar', ['-xf', zip, '-C', dir], { stdio: 'inherit' });
+    if (ex.status !== 0) {
+      return { installed: false, reason: `extract failed (tar exit ${ex.status})` };
+    }
+
+    // Archives vary: some put the binary at the root, some inside a folder.
+    const binPath = findBinary(dir, binName);
+    if (!binPath) {
+      return { installed: false, reason: `${binName} not found in ${asset} after extraction` };
+    }
+    // Flatten so the binary sits directly in dir and one PATH entry covers it.
+    const finalPath = path.join(dir, binName);
+    if (binPath !== finalPath) fs.copyFileSync(binPath, finalPath);
+
+    // Make it usable in THIS process so a follow-up isInstalled() check passes
+    // without the user restarting their shell.
+    const sep = path.delimiter;
+    if (!(process.env.PATH || '').split(sep).includes(dir)) {
+      process.env.PATH = `${dir}${sep}${process.env.PATH || ''}`;
+    }
+
+    return { installed: true, dir, binPath: finalPath, onPath: isOnUserPath(dir) };
+  } finally {
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* temp dir */ }
+  }
+}
+
+/** Depth-limited search — these archives are shallow; this avoids walking a tree. */
+function findBinary(root, binName, depth = 0) {
+  if (depth > 3) return null;
+  let entries;
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  for (const e of entries) {
+    const p = path.join(root, e.name);
+    if (e.isFile() && e.name.toLowerCase() === binName.toLowerCase()) return p;
+  }
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      const found = findBinary(path.join(root, e.name), binName, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
+/**
+ * Whether the directory is on the user's PERSISTENT PATH, not just this
+ * process's. Checking process.env would always say yes right after we prepend
+ * it, which would wrongly tell the user there is nothing left to do.
+ */
+function isOnUserPath(dir) {
+  try {
+    const out = execFileSync(
+      'reg',
+      ['query', 'HKCU\\Environment', '/v', 'Path'],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    );
+    return out.toLowerCase().includes(dir.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
+/** The exact command to persist the directory on PATH, for the user to run. */
+function setxHint(dir) {
+  return `setx PATH "%PATH%;${dir}"`;
+}
+
+module.exports = { installFromRelease, installDir, isOnUserPath, setxHint, findBinary };

package/scripts/rtk/index.js

@@ -80,13 +80,37 @@ function getVersion() {
 // ── Install RTK binary ───────────────────────────────────────────────────────
 // Mac: prefer `brew install rtk` if brew is on PATH (fastest, cached).
 // Otherwise: pipe the official install script through sh (installs to ~/.local/bin).
-// Windows: skipped (needs manual .zip download from releases).
+// Windows: downloads the published .zip from GitHub releases.
 function install({ log = () => {} } = {}) {
   if (isInstalled()) {
     return { installed: false, skipped: true, reason: 'already installed', version: getVersion() };
   }
   if (os.platform() === 'win32') {
-    return { installed: false, skipped: true, reason: 'windows requires manual install: https://github.com/rtk-ai/rtk/releases' };
+    // RTK publishes a Windows build; ECC just never downloaded it and told the
+    // user to do it by hand. Only x86_64 is published, which is fine on arm64
+    // Windows because it runs x64 binaries under emulation.
+    const win = require('../lib/win-install.js');
+    const r = win.installFromRelease({
+      repo: 'rtk-ai/rtk',
+      asset: 'rtk-x86_64-pc-windows-msvc.zip',
+      binName: 'rtk.exe',
+      log,
+    });
+    if (!r.installed) {
+      return { installed: false, skipped: true, reason: `${r.reason} — or install by hand: https://github.com/rtk-ai/rtk/releases` };
+    }
+    if (!isInstalled()) {
+      return { installed: false, skipped: true, reason: `installed to ${r.dir} but not runnable from PATH` };
+    }
+    return {
+      installed: true,
+      method: 'github-release',
+      version: getVersion(),
+      dir: r.dir,
+      // Reported so the caller can tell the user what is still needed. PATH is
+      // not edited for them — that is their environment to change.
+      pathHint: r.onPath ? null : win.setxHint(r.dir),
+    };
   }
 
   // Try Homebrew first on macOS.