install.ps1

<#
.SYNOPSIS
    codex-cli-installer: one command, working Codex CLI, on Windows.

.DESCRIPTION
    Installs the prerequisites you need to actually use Codex CLI (git, Node
    LTS and ripgrep via winget), installs OpenAI's @openai/codex package, refreshes
    PATH for the current session,
    and verifies the result instead of assuming it.

.EXAMPLE
    irm https://raw.githubusercontent.com/jtlgrowth/codex-cli-installer/main/install.ps1 | iex

.EXAMPLE
    # From Command Prompt (cmd.exe), including the Windows Terminal cmd profile,
    # where the PowerShell one-liner above is a syntax error:
    powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://raw.githubusercontent.com/jtlgrowth/codex-cli-installer/main/install.ps1 | iex"

.NOTES
    Piped usage can still pass options via environment variables:
      $env:CXI_SKILLS  = 'hire,setup'
      $env:CXI_MINIMAL = '1'
      $env:CXI_YES     = '1'
      $env:CXI_DRY_RUN = '1'
#>
[CmdletBinding()]
param(
    # Comma-separated agent skills to install, e.g. 'hire,setup'.
    [string]$Skills = $env:CXI_SKILLS,

    [switch]$Minimal,
    [switch]$Yes,
    [switch]$DryRun
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'

$RepoRaw           = 'https://raw.githubusercontent.com/jtlgrowth/codex-cli-installer/main'
$CodexPackage      = '@openai/codex@latest'
$NodeMinMajor      = 20

# The skill allowlist: name -> tarball, the directory inside it, and how many
# leading path components to strip. An allowlist rather than a -Skills <url>
# flag, so an irm|iex installer never becomes an arbitrary-code downloader.
$SkillCatalog = @{
    hire = @{
        Url    = 'https://codeload.github.com/jtlgrowth/hire/tar.gz/refs/heads/main'
        Member = 'hire-main/skills/hire'
        Strip  = 2
    }
    setup = @{
        Url    = 'https://codeload.github.com/jtlgrowth/hire/tar.gz/refs/heads/main'
        Member = 'hire-main/skills/setup'
        Strip  = 2
    }
}

$script:SkillNames = @()
if ($Skills) {
    # @() is load-bearing: a one-element pipeline returns a scalar string, and
    # under Set-StrictMode reading .Count on a string is a terminating error.
    # Without it, --skills with exactly one skill - the common case - throws.
    $script:SkillNames = @($Skills.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ })
    foreach ($name in $script:SkillNames) {
        if (-not $SkillCatalog.ContainsKey($name)) {
            [Console]::Error.WriteLine("error: unknown skill: $name (known skills: $($SkillCatalog.Keys -join ', '))")
            exit 2
        }
    }
}

if ($env:CXI_MINIMAL -eq '1') { $Minimal = $true }
if ($env:CXI_YES     -eq '1') { $Yes     = $true }
if ($env:CXI_DRY_RUN -eq '1') { $DryRun  = $true }

$script:Installed = [System.Collections.Generic.List[string]]::new()
$script:Already   = [System.Collections.Generic.List[string]]::new()
$script:Skipped   = [System.Collections.Generic.List[string]]::new()

# ---------------------------------------------------------------- output ----

function Write-Step  { param([string]$Text) Write-Host ""; Write-Host $Text -ForegroundColor White }
function Write-Info  { param([string]$Text) Write-Host "==> " -ForegroundColor Blue -NoNewline; Write-Host $Text }
function Write-Ok    { param([string]$Text) Write-Host "  ok " -ForegroundColor Green -NoNewline; Write-Host $Text }
function Write-Warn2 { param([string]$Text) Write-Host "  !! " -ForegroundColor Yellow -NoNewline; Write-Host $Text }
function Write-Err   { param([string]$Text) Write-Host "error: " -ForegroundColor Red -NoNewline; Write-Host $Text }

function Test-Command {
    param([string]$Name)
    $null -ne (Get-Command $Name -ErrorAction SilentlyContinue)
}

# Runs $Action, or just prints it under -DryRun. Returns whatever the block
# returns (dry runs report success) so callers can branch on the result.
function Invoke-Step {
    param([string]$Description, [scriptblock]$Action)
    if ($DryRun) {
        Write-Host "  would run: " -ForegroundColor DarkGray -NoNewline
        Write-Host $Description
        return $true
    }
    $result = & $Action
    if ($null -eq $result) { return $true }
    return $result
}

# A piped script has no console input of its own; default to yes there, the way
# every other one-liner installer does.
function Confirm-Action {
    param([string]$Question)
    if ($Yes -or $DryRun) { return $true }
    if ([Console]::IsInputRedirected) { return $true }
    $reply = Read-Host "$Question [Y/n]"
    return ($reply -notmatch '^(n|no)$')
}

# -------------------------------------------------------------- preflight ----

Write-Step "Codex CLI installer"
if ($DryRun) { Write-Warn2 "dry run: nothing will be installed" }

if (-not [Environment]::Is64BitProcess) {
    Write-Err "Codex CLI does not support 32-bit Windows."
    exit 1
}

# WSL and Git Bash are better served by the bash script; say so rather than
# half-working here.
if ($env:WSL_DISTRO_NAME) {
    Write-Warn2 "This looks like WSL. Use the bash installer instead:"
    Write-Host "    curl -fsSL $RepoRaw/install.sh | bash"
    exit 1
}

$policy = Get-ExecutionPolicy -Scope Process
if ($policy -in @('Restricted', 'AllSigned')) {
    Write-Warn2 "Execution policy is '$policy'. If a script fails to run, first do:"
    Write-Host "    Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass"
}

$arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
Write-Info "system: Windows ($arch), PowerShell $($PSVersionTable.PSVersion)"

# ------------------------------------------------------------- prereqs ------

# Rebuild $env:Path from the registry. An installer that just wrote a PATH entry
# did so in the registry, not in this already-running process, so without this
# every check right after an install reports "not found" and lies.
function Sync-PathFromRegistry {
    $machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
    $user    = [Environment]::GetEnvironmentVariable('Path', 'User')
    $rebuilt = (@($machine, $user) | Where-Object { $_ }) -join ';'
    if ($rebuilt) { $env:Path = $rebuilt }
}

function Get-NodeMajor {
    if (-not (Test-Command 'node')) { return 0 }
    try { return [int](((node --version) -replace '^v', '') -split '\.')[0] } catch { return 0 }
}

# Node straight from nodejs.org, no package manager involved. This is the path
# for boxes with no winget - Windows 10 before 1809, LTSC images, and machines
# where the Store is policy-blocked - which is exactly where "install Node
# yourself" leaves someone with a Codex CLI that cannot run a single skill
# script. The version is queried, never hardcoded, so this does not rot.
function Install-NodeViaMsi {
    $msiArch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }

    if ($DryRun) {
        Write-Host "  would run: download the latest Node LTS $msiArch .msi from nodejs.org and msiexec /qn it" -ForegroundColor DarkGray
        return $true
    }

    $version = $null
    try {
        # index.json is newest-first, and an LTS entry carries the codename
        # string while current releases carry the boolean false.
        $index = Invoke-RestMethod -Uri 'https://nodejs.org/dist/index.json' -UseBasicParsing
        foreach ($rel in $index) {
            if ($rel.lts -is [string] -and $rel.lts) {
                $major = [int](($rel.version -replace '^v', '') -split '\.')[0]
                if ($major -ge $NodeMinMajor) { $version = $rel.version }
                break
            }
        }
    } catch {
        Write-Warn2 "could not reach nodejs.org to find the current Node LTS"
        return $false
    }

    if (-not $version) {
        Write-Warn2 "nodejs.org lists no LTS at or above v$NodeMinMajor"
        return $false
    }

    $msiUrl = "https://nodejs.org/dist/$version/node-$version-$msiArch.msi"
    $msiPath = Join-Path $env:TEMP "node-$version-$msiArch.msi"
    Write-Info "downloading Node $version ($msiArch) from nodejs.org"
    try {
        Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath -UseBasicParsing
    } catch {
        Write-Warn2 "download failed: $msiUrl"
        return $false
    }

    # /qn is the only sane mode here: this script is usually running inside an
    # irm|iex pipe with no console to click a wizard in.
    Write-Info "installing Node $version (msiexec, silent)"
    $proc = Start-Process -FilePath 'msiexec.exe' `
        -ArgumentList @('/i', "`"$msiPath`"", '/qn', '/norestart') `
        -Wait -PassThru
    Remove-Item $msiPath -Force -ErrorAction SilentlyContinue

    if ($proc.ExitCode -ne 0) {
        Write-Warn2 "msiexec exited $($proc.ExitCode); Node was not installed"
        return $false
    }

    Sync-PathFromRegistry
    if ((Get-NodeMajor) -lt $NodeMinMajor) {
        # The MSI landed but PATH has not caught up in this process. Not a
        # failure - just something a new window fixes.
        Write-Ok "Node $version installed (open a new terminal to use it)"
    } else {
        Write-Ok "Node $(node --version) installed"
    }
    return $true
}

function Test-WinGetPackage {
    param([string]$Id)
    try {
        $out = winget list --id $Id --exact --accept-source-agreements 2>$null | Out-String
        return $out -match [regex]::Escape($Id)
    } catch {
        return $false
    }
}

function Install-Prerequisite {
    Write-Step "Prerequisites"

    if ($Minimal) {
        $script:Skipped.Add("prerequisites (-Minimal)")
        Write-Info "minimal mode: skipping git/node/ripgrep"
        return
    }

    # winget ships as App Installer on Windows 10 1809+ / 11. Side-loading the
    # MSIX from a script is where Windows installers go to die, so we do not
    # try. Node is the one prerequisite worth installing the hard way anyway:
    # without it every skill that ships a script is dead on arrival, so it gets
    # a direct-from-nodejs.org MSI path while git and ripgrep stay advisory.
    if (-not (Test-Command 'winget')) {
        Write-Warn2 "winget is not available, so git/ripgrep cannot be installed automatically."
        Write-Host "    Install 'App Installer' from the Microsoft Store to get them:"
        Write-Host "    https://apps.microsoft.com/detail/9nblggh4nns1"
        $script:Skipped.Add("git/ripgrep (winget missing)")

        if ((Get-NodeMajor) -ge $NodeMinMajor) {
            Write-Ok "Node $(node --version) already installed"
            $script:Already.Add("node $(node --version)")
        } elseif (-not (Confirm-Action "Install Node LTS from nodejs.org?")) {
            $script:Skipped.Add("Node LTS (declined)")
        } elseif (Install-NodeViaMsi) {
            $script:Installed.Add("Node LTS")
        } else {
            $script:Skipped.Add("Node LTS (install failed)")
            Write-Host "     install it by hand from https://nodejs.org/en/download"
        }

        Write-Host "    Codex CLI itself will still be installed below."
        return
    }

    $packages = @(
        @{ Id = 'Git.Git';                Cmd = 'git'; Label = 'git' },
        @{ Id = 'OpenJS.NodeJS.LTS';      Cmd = 'node'; Label = 'Node LTS' },
        @{ Id = 'BurntSushi.ripgrep.MSVC'; Cmd = 'rg'; Label = 'ripgrep' }
    )

    foreach ($p in $packages) {
        $needsInstall = $true

        if (Test-Command $p.Cmd) {
            if ($p.Cmd -eq 'node') {
                $major = Get-NodeMajor
                if ($major -ge $NodeMinMajor) {
                    $needsInstall = $false
                    $script:Already.Add("node $(node --version)")
                } else {
                    Write-Warn2 "node v$major is older than v$NodeMinMajor; upgrading"
                }
            } else {
                $needsInstall = $false
                $script:Already.Add($p.Label)
            }
        } elseif (Test-WinGetPackage $p.Id) {
            # Installed but not yet on this session's PATH.
            $needsInstall = $false
            $script:Already.Add("$($p.Label) (installed, needs a new terminal)")
        }

        if (-not $needsInstall) {
            Write-Ok "$($p.Label) already installed"
            continue
        }

        if (-not (Confirm-Action "Install $($p.Label)?")) {
            $script:Skipped.Add("$($p.Label) (declined)")
            continue
        }

        Write-Info "installing $($p.Label)"
        $desc = "winget install --id $($p.Id) --exact --silent"
        $pkgId = $p.Id
        $installed = Invoke-Step $desc {
            winget install --id $pkgId --exact --silent `
                --accept-package-agreements --accept-source-agreements | Out-Null
            ($LASTEXITCODE -eq 0)
        }
        if ($installed) {
            $script:Installed.Add($p.Label)
            Write-Ok "$($p.Label) installed"
        } elseif ($p.Cmd -eq 'node' -and (Install-NodeViaMsi)) {
            # winget's Node package fails often enough on locked-down boxes
            # (source agreements, blocked msstore) that giving up here would
            # strand the one prerequisite the skills actually need.
            Write-Warn2 "winget could not install Node; fell back to the nodejs.org MSI"
            $script:Installed.Add($p.Label)
        } else {
            $script:Skipped.Add("$($p.Label) (install failed)")
            Write-Warn2 "could not install $($p.Label); continuing"
        }
    }
}

# -------------------------------------------------------------- codex cli ----

function Install-CodexCli {
    Write-Step "Codex CLI"
    $wasPresent = Test-Command 'codex'
    if ($wasPresent) {
        $script:Already.Add("Codex CLI $(codex --version 2>$null)")
        Write-Ok "Codex CLI already installed; running its updater anyway"
    }
    if (-not (Test-Command 'npm')) {
        throw "npm is required to install Codex CLI. Re-run without -Minimal or install Node LTS first."
    }
    Write-Info "installing OpenAI Codex CLI"
    Invoke-Step "npm install --global $CodexPackage" {
        npm install --global $CodexPackage | Out-Null
        if ($LASTEXITCODE -ne 0) { throw "npm install exited $LASTEXITCODE" }
    } | Out-Null
    if (-not $wasPresent) { $script:Installed.Add("Codex CLI") }
}

# --------------------------------------------------------------- PATH -------

# Node's installer writes PATH to the user registry. Refresh it so verification
# works without opening a new terminal.
function Update-SessionPath {
    Write-Step "PATH"

    if ($DryRun) {
        Write-Host "  would refresh PATH from the Windows registry" -ForegroundColor DarkGray
        return
    }

    Sync-PathFromRegistry
    Write-Ok "refreshed this session's PATH"
}

# --------------------------------------------------------------- skills -----

# Skills live in ~/.agents/skills/<name>. That path makes $<name> resolve in Codex.
function Install-OneSkill {
    param([string]$Name)

    $entry     = $SkillCatalog[$Name]
    $skillsDir = Join-Path (Join-Path $env:USERPROFILE '.agents') 'skills'
    $dest      = Join-Path $skillsDir $Name

    # Already there: leave it alone. People re-run this line when the first run
    # scrolled past, and that must never overwrite a skill they have edited.
    if (Test-Path $dest) {
        Write-Warn2 "skill $Name already installed at $dest; left alone"
        $script:Skipped.Add("skill $Name (already present)")
        return
    }

    if ($DryRun) {
        Write-Host "  would download: " -ForegroundColor DarkGray -NoNewline
        Write-Host $entry.Url
        Write-Host "  would extract:  " -ForegroundColor DarkGray -NoNewline
        Write-Host "$($entry.Member) -> $dest"
        return
    }

    New-Item -ItemType Directory -Force -Path $skillsDir | Out-Null
    $tmp = Join-Path $env:TEMP "cxi-skill-$Name.tgz"

    # Download to a file, then extract. A PowerShell pipeline carries text, not
    # bytes, so piping the gzip stream into tar would corrupt it - this is the
    # whole reason the bash one-liner cannot simply be reused here.
    try {
        Invoke-RestMethod -Uri $entry.Url -OutFile $tmp
    } catch {
        Write-Warn2 "could not download skill ${Name}: $($_.Exception.Message)"
        $script:Skipped.Add("skill $Name (download failed)")
        return
    }

    & tar -xzf $tmp -C $skillsDir --strip-components=$($entry.Strip) $entry.Member 2>$null
    $tarOk = ($LASTEXITCODE -eq 0)
    Remove-Item $tmp -Force -ErrorAction SilentlyContinue

    if (-not $tarOk) {
        Write-Warn2 "could not extract skill $Name"
        $script:Skipped.Add("skill $Name (extract failed)")
        return
    }

    # Prove it, rather than trusting tar exited 0 over the right paths.
    if (-not (Test-Path (Join-Path $dest 'SKILL.md'))) {
        Write-Warn2 "skill $Name extracted but has no SKILL.md; removing"
        Remove-Item $dest -Recurse -Force -ErrorAction SilentlyContinue
        $script:Skipped.Add("skill $Name (no SKILL.md)")
        return
    }

    $script:Installed.Add("skill $Name")
    Write-Ok "installed $dest"
}

function Install-Skill {
    if ($script:SkillNames.Count -eq 0) { return }
    Write-Step "Skills"

    # tar.exe ships with Windows 10 1803 and later. Older boxes get the npx route.
    if (-not (Test-Command 'tar')) {
        Write-Warn2 "tar not found; cannot install skills"
        Write-Host "     install them with: npx skills add https://github.com/jtlgrowth/<skill>"
        $script:Skipped.Add("skills (no tar)")
        return
    }

    foreach ($name in $script:SkillNames) { Install-OneSkill $name }

    # A skill is Markdown plus scripts, and the scripts need a runtime. -Minimal
    # skips the Node install, so say so rather than leaving a skill that cannot run.
    if (-not (Test-Command 'node')) {
        Write-Warn2 "node is not installed. Skills that ship scripts will not run"
        Write-Host "     re-run this installer without -Minimal, or get Node $NodeMinMajor+ from"
        Write-Host "     https://nodejs.org/en/download, then open a new PowerShell window"
    }
}

# --------------------------------------------------------------- verify -----

function Test-Installation {
    Write-Step "Verify"
    if ($DryRun) {
        Write-Host "  would run: codex --version; codex doctor" -ForegroundColor DarkGray
        return $true
    }

    if (-not (Test-Command 'codex')) {
        Write-Err "'codex' is not on PATH after installation."
        Write-Host ""
        Write-Host "Open a NEW PowerShell window and run:  codex --version"
        Write-Host "If it works there, the install is fine. This session just had a stale PATH."
        return $false
    }

    $version = (codex --version 2>&1 | Out-String).Trim()
    if ($LASTEXITCODE -ne 0) {
        Write-Err "'codex --version' failed:"
        Write-Host $version
        return $false
    }
    Write-Ok "codex --version -> $version"

    Write-Host ""
    Write-Info "codex doctor"
    codex doctor 2>&1 | ForEach-Object { Write-Host "    $_" }
    return $true
}

function Write-Summary {
    param([bool]$Success)
    Write-Step "Summary"
    $installedLabel = if ($DryRun) { "  Would install:" } else { "  Installed:" }
    if ($script:Installed.Count) { Write-Host $installedLabel;      $script:Installed | ForEach-Object { Write-Host "    + $_" } }
    if ($script:Already.Count)   { Write-Host "  Already present:"; $script:Already   | ForEach-Object { Write-Host "    = $_" } }
    if ($script:Skipped.Count)   { Write-Host "  Skipped:";         $script:Skipped   | ForEach-Object { Write-Host "    - $_" } }

    Write-Host ""
    if ($DryRun) {
        Write-Host "Dry run complete: nothing was installed." -ForegroundColor Yellow
        Write-Host "Re-run without -DryRun to actually install."
    } elseif ($Success) {
        Write-Host "Codex CLI is installed and working." -ForegroundColor Green
        Write-Host ""
        Write-Host "Next:"
        Write-Host "  1. Open a new PowerShell window (so PATH is loaded)."
        Write-Host "  2. Run:  codex login"
        Write-Host "  3. Run:  codex"
        Write-Host '  4. Type: Use $setup to configure my AI chief of staff.'
    } else {
        Write-Host "Install did not verify. See the error above." -ForegroundColor Red
    }
}

# ----------------------------------------------------------------- main -----

try {
    Install-Prerequisite
    Install-CodexCli
    Update-SessionPath
    Install-Skill
    $ok = Test-Installation
    Write-Summary -Success $ok
    if (-not $ok) { exit 1 }
    exit 0
} catch {
    Write-Err $_.Exception.Message
    Write-Host ""
    Write-Host "What to do:"
    Write-Host "  1. Re-run with `$env:CXI_DRY_RUN='1' to see the commands without executing them."
    Write-Host "  2. Codex CLI itself can always be installed directly:"
    Write-Host "       npm install --global @openai/codex@latest"
    exit 1
}