diff --git a/scripts/crusher-shim.js b/scripts/crusher-shim.js
index e2531f7d..3c07c4e9 100644
--- a/scripts/crusher-shim.js
+++ b/scripts/crusher-shim.js
@@ -10,11 +10,25 @@
 
 const { install, uninstall, status } = require('./lib/crusher/shim-install');
 
+function toPathResultArray(rawPathResult) {
+  if (Array.isArray(rawPathResult)) {
+    return rawPathResult;
+  }
+  if (rawPathResult) {
+    return [{
+      ...rawPathResult,
+      path: rawPathResult.path || 'Windows user PATH (registry)'
+    }];
+  }
+  return [];
+}
+
 function printInstallResult(result) {
   console.log(`Shim directory: ${result.dir}`);
   if (result.installed.length) console.log(`Installed: ${result.installed.join(', ')}`);
   if (result.skipped.length) console.log(`Not found on this machine (skipped): ${result.skipped.join(', ')}`);
-  const changed = result.pathResult.filter(r => r.changed);
+  const pathResultArray = toPathResultArray(result.pathResult);
+  const changed = pathResultArray.filter(r => r && r.changed);
   if (changed.length) {
     console.log(`PATH updated in: ${changed.map(r => r.path).join(', ')}`);
     console.log('Open a new terminal (or `source` the file above) for it to take effect.');
@@ -26,7 +40,8 @@ function printInstallResult(result) {
 function printUninstallResult(result) {
   console.log(`Shim directory: ${result.dir}`);
   console.log(result.removed.length ? `Removed: ${result.removed.join(', ')}` : 'Nothing to remove.');
-  const changed = result.pathResult.filter(r => r.changed);
+  const pathResultArray = toPathResultArray(result.pathResult);
+  const changed = pathResultArray.filter(r => r && r.changed);
   if (changed.length) console.log(`PATH entry removed from: ${changed.map(r => r.path).join(', ')}`);
 }
 
diff --git a/scripts/install.ps1 b/scripts/install.ps1
index 29f833b3..739b9262 100644
--- a/scripts/install.ps1
+++ b/scripts/install.ps1
@@ -218,7 +218,7 @@ if (-not $DryRun) {
     # but only `egc init` configured the filter that keeps that promise --
     # this quick-start script (the README's own documented command) never
     # did (2026-08-01 audit finding). Best-effort: must not fail the install.
-    node -e 'const rootDir = process.argv[1]; const { applyCommitPrivacyFilterCli } = require(rootDir + "/scripts/lib/memory-filters"); applyCommitPrivacyFilterCli({ projectDir: process.cwd(), scriptPath: rootDir + "/scripts/check-state-leak.js", log: m => console.log("  " + m) });' $RootDir
+    node "$RootDir/scripts/lib/apply-commit-privacy.js" $RootDir
     if ($LASTEXITCODE -ne 0) { Write-Host "  note: commit-privacy filter setup failed (non-fatal)" }
 
     # Write harness config
diff --git a/scripts/lib/apply-commit-privacy.js b/scripts/lib/apply-commit-privacy.js
new file mode 100644
index 00000000..882249f3
--- /dev/null
+++ b/scripts/lib/apply-commit-privacy.js
@@ -0,0 +1,12 @@
+const path = require('path');
+const { applyCommitPrivacyFilterCli } = require('./memory-filters');
+
+const scriptPath = process.argv[2]
+  ? path.resolve(process.argv[2], 'scripts', 'check-state-leak.js')
+  : undefined;
+
+applyCommitPrivacyFilterCli({
+  projectDir: process.cwd(),
+  scriptPath: scriptPath,
+  log: (m) => console.log('  ' + m)
+});