NexusWindows

By hand, from the release files (no administrator rights):

$r = 'https://github.com/pironjulien/NexusWindows/releases/latest/download'
Invoke-WebRequest "$r/get.ps1" -OutFile get.ps1
Invoke-WebRequest "$r/SHA256SUMS.txt" -OutFile SHA256SUMS.txt
(Get-FileHash get.ps1 -Algorithm SHA256).Hash    # must equal the get.ps1 line of SHA256SUMS.txt
gh attestation verify get.ps1 --repo pironjulien/NexusWindows --signer-repo pironjulien/NexusSystem   # optional: provenance
powershell -NoProfile -ExecutionPolicy Bypass -File .\get.ps1

get.ps1 downloads NexusWindows-win-x64.zip or NexusWindows-win-arm64.zip from the latest release, checks its SHA-256 against SHA256SUMS.txt, installs the engine under %USERPROFILE%\.nexus\nexus-windows and declares it to Claude Code, Claude Desktop, Codex and Antigravity when they are present. Every client starts the same stable path, %USERPROFILE%\.nexus\nexus-windows\NexusWindows.exe --mcp --agent <claude|codex|antigravity>; updates never change it. Release files carry a build provenance attestation (gh attestation verify <file> --repo pironjulien/NexusWindows --signer-repo pironjulien/NexusSystem). The Claude Desktop extension is nexus-windows-claude.mcpb in each release.

For unattended maintenance of an existing installation, NexusSystem calls get.ps1 -UpdateOnly: it updates only the installed engine and stable launcher, without registering or enabling clients. -RefreshExistingProfiles additionally refreshes the shipped files of an already installed, active Antigravity plugin. Disabled or custom declarations and client configuration remain unchanged. Running sessions keep their engine; new connections use the new version. The launcher itself never downloads updates.

Each MCP session writes an atomic runtime receipt under %USERPROFILE%\.nexus\status\runtime, with its actual PID, process birth, loaded executable, assembly SHA-256, version and idle/busy/stopped lifecycle. MCP initialization and discovery expose the same identity. A receipt must be checked against the live process and its AI host before it can establish that a particular AI uses the installed version; an installation manifest alone cannot prove this.

• codex/native/: the common C# (.NET 10) engine, NexusWindows.exe, serving the three profiles as MCP stdio servers (--mcp --agent claude|codex|antigravity) and declaring itself to them (--register).
• commun/: the shared safety policy (garde-fous.json), the stable launcher (launcher/), the workstation installer of the immutable engine (native-runtime.ps1) and the release packaging (package.ps1).
• claude/, agy/, codex/: each profile's guides, plugin and documentation; codex/ also keeps the Node.js adapter of the Codex REPL guide (lib/, npm package nexus-windows-codex).
• tests/: xUnit tests of the engine, the launcher and the installers.