kodelyth-ecc 2.22.0 → 2.23.0

package/CHANGELOG.md

@@ -2,6 +2,69 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.23.0 — Windows has no manual step left (October 2026)
+
+2.22.0 made the Windows install work but left two components needing a manual
+download: RTK and the codebase graph. That turned out to be a gap in ECC, not a
+limitation upstream — **both projects publish Windows builds** and ECC simply
+never fetched them:
+
+```
+rtk-x86_64-pc-windows-msvc.zip
+codebase-memory-mcp-windows-amd64.zip  /  -arm64.zip
+```
+
+Both now install automatically. Windows is at parity with macOS and Linux.
+
+### How it works
+
+A shared `scripts/lib/win-install.js`, used by both. It pulls from GitHub's
+`releases/latest/download/<asset>` URL, which always redirects to the newest
+release — no API call, so no token and no rate limit.
+
+Download and extraction use `curl.exe` and `tar.exe`. Both ship with Windows 10
+1803 and later, and `tar` there is bsdtar, which handles zip. That avoids
+PowerShell quoting entirely. Both are probed before use, so an older machine
+gets a clear message instead of a spawn error.
+
+Architecture comes from `process.arch`: the codebase graph has a native arm64
+build, while RTK publishes x86_64 only — fine on arm64 Windows, which runs x64
+under emulation.
+
+### PATH is yours, not ours
+
+Binaries land in `%LOCALAPPDATA%\Kodelyth\bin`. ECC does **not** edit your PATH.
+It prints the one command that does:
+
+```powershell
+setx PATH "%PATH%;%LOCALAPPDATA%\Kodelyth\bin"
+```
+
+This mirrors the POSIX path, which reports `~/.local/bin` rather than writing to
+a shell rc. Whether the directory is already persistent is read from
+`HKCU\Environment`, not from `process.env` — the latter would always say yes
+right after the installer prepends it for its own process, and would wrongly
+tell you there is nothing left to do.
+
+### Verified, not asserted
+
+The Windows CI job now installs for real and asserts both binaries exist and
+run:
+
+```
+install dir: C:\Users\runneradmin\AppData\Local\Kodelyth\bin
+  rtk.exe  10,285,056 bytes
+rtk 0.51.0
+codebase-memory-mcp 0.11.0
+```
+
+`doctor`'s Windows hints changed too. They previously said "no Windows installer
+yet" and pointed at a release page; the install command is now correct on every
+platform, and the hint names the PATH step rather than implying the command
+alone finishes the job.
+
+**647 tests passing.**
+
 ## v2.22.0 — Windows actually works now (September 2026)
 
 The Windows install was broken in three separate ways. Windows CI had been green

package/README.md

@@ -205,18 +205,22 @@ PowerShell 5.1 that ships with the OS. The installer tries `pwsh` first and fall
 back automatically, and it passes `-ExecutionPolicy Bypass` for its own process
 only, so you do not need to change your machine's execution policy.
 
-**What is fully automatic on Windows:** the 70 agents, 196 skills, 103 commands,
-15 rules, all 44 hook entries registered into `settings.json`, the ECC MCP server
-(16 tools), and Terse mode.
+**Everything installs automatically**, same as macOS and Linux: the 70 agents,
+196 skills, 103 commands, 15 rules, all 44 hook entries registered into
+`settings.json`, the ECC MCP server (16 tools), Terse mode, **RTK**, and the
+**codebase graph**.
 
-**What still needs one manual step:** RTK and the codebase graph ship as native
-binaries without a Windows installer script. ECC tells you so during install and
-prints the download link rather than failing or skipping silently:
+The last two are native binaries. ECC downloads the published Windows builds
+straight from GitHub releases and puts them in `%LOCALAPPDATA%\Kodelyth\bin`.
+That directory is not on `PATH` by default, so the installer prints the one
+command that fixes it:
 
-| Component | Windows | Get it |
-|---|---|---|
-| RTK (token savings) | manual | [rtk-ai/rtk releases](https://github.com/rtk-ai/rtk/releases) |
-| Codebase graph | manual | [codebase-memory-mcp releases](https://github.com/DeusData/codebase-memory-mcp/releases) |
+```powershell
+setx PATH "%PATH%;%LOCALAPPDATA%\Kodelyth\bin"
+```
+
+Run it once, reopen your terminal, done. ECC does not edit `PATH` for you —
+that is your environment to change.
 
 **Verify:**
 

package/VERSION

@@ -1 +1 @@
-2.22.0
+2.23.0

package/bin/kodelyth-ecc.js

@@ -1850,6 +1850,13 @@ function runPostInstall(status, args) {
           const en = rtk.enableFor(target, { log: () => {} });
           if (en.enabled) {
             w(`  ✓ RTK ${(rtk.getVersion() || '').replace(/^rtk /,'')} — wired for ${target}`);
+            // On Windows the binary goes to %LOCALAPPDATA%\Kodelyth\bin. ECC does
+            // not edit PATH for the user, so say plainly what is left to do —
+            // otherwise rtk works during this install and vanishes next shell.
+            if (inst.pathHint) {
+              w(`  ! ${inst.dir} is not on your PATH yet`);
+              w(`    run once, then reopen your terminal:  ${inst.pathHint}`);
+            }
             w(`  ✓ Restart your AI tool to activate. 60-90% token savings on shell commands.`);
           } else {
             w(`  · skipped: ${en.reason}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.22.0",
+  "version": "2.23.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/codebase/index.js

@@ -25,7 +25,32 @@ function getVersion() {
 function install({ log = () => {} } = {}) {
   if (isInstalled()) return { installed: false, skipped: true, reason: 'already installed', version: getVersion() };
   if (os.platform() === 'win32') {
-    return { installed: false, skipped: true, reason: 'windows requires manual install: https://github.com/DeusData/codebase-memory-mcp/releases' };
+    // This project publishes Windows builds for both architectures; ECC just
+    // never downloaded them. Pick by process.arch so an arm64 machine gets the
+    // native build rather than running x64 under emulation.
+    const win = require('../lib/win-install.js');
+    const asset = process.arch === 'arm64'
+      ? 'codebase-memory-mcp-windows-arm64.zip'
+      : 'codebase-memory-mcp-windows-amd64.zip';
+    const r = win.installFromRelease({
+      repo: 'DeusData/codebase-memory-mcp',
+      asset,
+      binName: `${BIN}.exe`,
+      log,
+    });
+    if (!r.installed) {
+      return { installed: false, skipped: true, reason: `${r.reason} — or install by hand: https://github.com/DeusData/codebase-memory-mcp/releases` };
+    }
+    if (!isInstalled()) {
+      return { installed: false, skipped: true, reason: `installed to ${r.dir} but not runnable from PATH` };
+    }
+    return {
+      installed: true,
+      method: 'github-release',
+      version: getVersion(),
+      dir: r.dir,
+      pathHint: r.onPath ? null : win.setxHint(r.dir),
+    };
   }
   log('[codebase] installing codebase-memory-mcp via official curl script…');
   const script = 'curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash';

package/scripts/doctor-health.js

@@ -115,10 +115,11 @@ function checkPromptInjectionGuard() {
   return { status: PASS, detail: `prompt-injection guard active (mode=${mode})` };
 }
 
-// Remediation has to be platform-correct or it is worse than none. RTK and the
-// codebase graph ship as native binaries with no Windows installer, so
-// "kodelythecc rtk install" on Windows just reports that it cannot, and the user
-// follows a dead end. Point at the release page there instead.
+// Both tools DO publish Windows builds, and since 2.23.0 ECC downloads them, so
+// the install command is now the right advice on every platform. What differs is
+// what happens afterwards: on Windows the binary lands in
+// %LOCALAPPDATA%\Kodelyth\bin, which is not on PATH by default, so the hint
+// mentions that rather than implying the command alone finishes the job.
 const IS_WIN = process.platform === 'win32';
 
 function checkRtk() {
@@ -126,7 +127,7 @@ function checkRtk() {
     status: WARN,
     detail: 'RTK not installed (input savings inactive)',
     fix: IS_WIN
-      ? 'no Windows installer yet — download: https://github.com/rtk-ai/rtk/releases'
+      ? 'kodelythecc rtk install  (installs to %LOCALAPPDATA%\\Kodelyth\\bin — add it to PATH)'
       : 'kodelythecc rtk install',
   };
   try {
@@ -146,7 +147,7 @@ function checkCodebaseGraph() {
     status: WARN,
     detail: 'codebase graph not installed (optional)',
     fix: IS_WIN
-      ? 'no Windows installer yet — download: https://github.com/DeusData/codebase-memory-mcp/releases'
+      ? 'kodelythecc codebase install  (installs to %LOCALAPPDATA%\\Kodelyth\\bin — add it to PATH)'
       : 'kodelythecc codebase install',
   };
   return { status: PASS, detail: 'codebase-memory-mcp installed' };

package/scripts/lib/win-install.js

@@ -0,0 +1,157 @@
+'use strict';
+
+/**
+ * Install a released binary on Windows.
+ *
+ * Both RTK and codebase-memory-mcp publish Windows builds, but ECC never
+ * implemented the download path and reported "windows requires manual install"
+ * instead. That was a gap here, not a limitation upstream:
+ *
+ *   rtk-x86_64-pc-windows-msvc.zip
+ *   codebase-memory-mcp-windows-amd64.zip  /  -arm64.zip
+ *
+ * Uses GitHub's `releases/latest/download/<asset>` URL, which always redirects
+ * to the newest release's asset — no API call, so no token and no rate limit.
+ *
+ * curl.exe and tar.exe both ship with Windows 10 1803 and later, and tar there
+ * is bsdtar, which extracts zip. That avoids PowerShell quoting entirely. Both
+ * are probed before use so an older machine gets a clear message rather than a
+ * spawn error.
+ *
+ * PATH is deliberately NOT modified. The POSIX path installs to ~/.local/bin and
+ * tells the user to add it; this mirrors that, reporting the exact setx command
+ * rather than silently editing a user's environment.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+/** Where ECC puts binaries it installs on Windows. User-writable, no admin. */
+function installDir() {
+  const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+  return path.join(base, 'Kodelyth', 'bin');
+}
+
+function have(bin) {
+  try {
+    execFileSync(bin, ['--version'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {object}   opts
+ * @param {string}   opts.repo     "owner/name"
+ * @param {string}   opts.asset    asset filename in the latest release
+ * @param {string}   opts.binName  executable to find after extraction (with .exe)
+ * @param {function} [opts.log]
+ * @returns {{installed:boolean, reason?:string, dir?:string, binPath?:string, onPath?:boolean}}
+ */
+function installFromRelease({ repo, asset, binName, log = () => {} }) {
+  if (process.platform !== 'win32') {
+    return { installed: false, reason: 'installFromRelease is Windows-only' };
+  }
+  if (!have('curl')) {
+    return { installed: false, reason: 'curl.exe not found (needs Windows 10 1803 or later)' };
+  }
+  if (!have('tar')) {
+    return { installed: false, reason: 'tar.exe not found (needs Windows 10 1803 or later)' };
+  }
+
+  const dir = installDir();
+  const url = `https://github.com/${repo}/releases/latest/download/${asset}`;
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-win-'));
+  const zip = path.join(tmp, asset);
+
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+
+    log(`[win] downloading ${asset}…`);
+    // -L to follow the release redirect, -f so a 404 is an error rather than
+    // an HTML error page written to disk and then "extracted".
+    const dl = spawnSync('curl', ['-fsSL', '-o', zip, url], { stdio: 'inherit' });
+    if (dl.status !== 0) {
+      return { installed: false, reason: `download failed (curl exit ${dl.status}) — ${url}` };
+    }
+    if (!fs.existsSync(zip) || fs.statSync(zip).size === 0) {
+      return { installed: false, reason: `downloaded file is empty — ${url}` };
+    }
+
+    log('[win] extracting…');
+    const ex = spawnSync('tar', ['-xf', zip, '-C', dir], { stdio: 'inherit' });
+    if (ex.status !== 0) {
+      return { installed: false, reason: `extract failed (tar exit ${ex.status})` };
+    }
+
+    // Archives vary: some put the binary at the root, some inside a folder.
+    const binPath = findBinary(dir, binName);
+    if (!binPath) {
+      return { installed: false, reason: `${binName} not found in ${asset} after extraction` };
+    }
+    // Flatten so the binary sits directly in dir and one PATH entry covers it.
+    const finalPath = path.join(dir, binName);
+    if (binPath !== finalPath) fs.copyFileSync(binPath, finalPath);
+
+    // Make it usable in THIS process so a follow-up isInstalled() check passes
+    // without the user restarting their shell.
+    const sep = path.delimiter;
+    if (!(process.env.PATH || '').split(sep).includes(dir)) {
+      process.env.PATH = `${dir}${sep}${process.env.PATH || ''}`;
+    }
+
+    return { installed: true, dir, binPath: finalPath, onPath: isOnUserPath(dir) };
+  } finally {
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* temp dir */ }
+  }
+}
+
+/** Depth-limited search — these archives are shallow; this avoids walking a tree. */
+function findBinary(root, binName, depth = 0) {
+  if (depth > 3) return null;
+  let entries;
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  for (const e of entries) {
+    const p = path.join(root, e.name);
+    if (e.isFile() && e.name.toLowerCase() === binName.toLowerCase()) return p;
+  }
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      const found = findBinary(path.join(root, e.name), binName, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
+/**
+ * Whether the directory is on the user's PERSISTENT PATH, not just this
+ * process's. Checking process.env would always say yes right after we prepend
+ * it, which would wrongly tell the user there is nothing left to do.
+ */
+function isOnUserPath(dir) {
+  try {
+    const out = execFileSync(
+      'reg',
+      ['query', 'HKCU\\Environment', '/v', 'Path'],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    );
+    return out.toLowerCase().includes(dir.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
+/** The exact command to persist the directory on PATH, for the user to run. */
+function setxHint(dir) {
+  return `setx PATH "%PATH%;${dir}"`;
+}
+
+module.exports = { installFromRelease, installDir, isOnUserPath, setxHint, findBinary };

package/scripts/rtk/index.js

@@ -80,13 +80,37 @@ function getVersion() {
 // ── Install RTK binary ───────────────────────────────────────────────────────
 // Mac: prefer `brew install rtk` if brew is on PATH (fastest, cached).
 // Otherwise: pipe the official install script through sh (installs to ~/.local/bin).
-// Windows: skipped (needs manual .zip download from releases).
+// Windows: downloads the published .zip from GitHub releases.
 function install({ log = () => {} } = {}) {
   if (isInstalled()) {
     return { installed: false, skipped: true, reason: 'already installed', version: getVersion() };
   }
   if (os.platform() === 'win32') {
-    return { installed: false, skipped: true, reason: 'windows requires manual install: https://github.com/rtk-ai/rtk/releases' };
+    // RTK publishes a Windows build; ECC just never downloaded it and told the
+    // user to do it by hand. Only x86_64 is published, which is fine on arm64
+    // Windows because it runs x64 binaries under emulation.
+    const win = require('../lib/win-install.js');
+    const r = win.installFromRelease({
+      repo: 'rtk-ai/rtk',
+      asset: 'rtk-x86_64-pc-windows-msvc.zip',
+      binName: 'rtk.exe',
+      log,
+    });
+    if (!r.installed) {
+      return { installed: false, skipped: true, reason: `${r.reason} — or install by hand: https://github.com/rtk-ai/rtk/releases` };
+    }
+    if (!isInstalled()) {
+      return { installed: false, skipped: true, reason: `installed to ${r.dir} but not runnable from PATH` };
+    }
+    return {
+      installed: true,
+      method: 'github-release',
+      version: getVersion(),
+      dir: r.dir,
+      // Reported so the caller can tell the user what is still needed. PATH is
+      // not edited for them — that is their environment to change.
+      pathHint: r.onPath ? null : win.setxHint(r.dir),
+    };
   }
 
   // Try Homebrew first on macOS.