feat(mcp): add Windows PowerShell installer

[mynameistito]

Summary

Closes #364.

Adds install-mcp.ps1, a PowerShell mirror of install-mcp.sh, so Windows users can install the fff-mcp binary with a one-liner. README updated with the Windows command alongside the existing Unix one.

The release workflow already publishes fff-mcp-x86_64-pc-windows-msvc.exe and fff-mcp-aarch64-pc-windows-msvc.exe, so no CI changes needed — the script just consumes existing assets.

What it does

• Detects AMD64 / ARM64 (honoring PROCESSOR_ARCHITEW6432 for WOW64).
• Picks the latest release containing the matching asset (mirrors the bash awk logic via Invoke-RestMethod).
• Downloads + verifies SHA256 (skips with a warning if .sha256 is missing, same as bash).
• Installs to $env:LOCALAPPDATA\fff-mcp\bin (overridable via FFF_MCP_INSTALL_DIR).
• Adds install dir to user PATH if not already present.
• Detects claude / opencode / codex and prints the same wiring snippets as the bash script.
• Update path: re-runs in-place if binary already exists, prints succinct "updated to <tag>" message.

Invocation

irm https://raw.githubusercontent.com/dmtrKovalenko/fff.nvim/main/install-mcp.ps1 | iex

(Eventually you may want to host this on dmtrkovalenko.dev/install-fff-mcp.ps1 for symmetry — README points at the raw GitHub URL for now.)

Checklist

• No changes to Rust / Lua / public APIs
• No CI workflow changes (existing Windows release assets reused)
• PowerShell 5.1+ compatible (ships with Windows 10/11 — no extra deps)
• Honors FFF_MCP_INSTALL_DIR env override (parity with bash)
• SHA256 verification when checksum file present
• Idempotent: re-running upgrades in place
• Adds install dir to user PATH only if missing
• README updated with both Linux/macOS and Windows install snippets
• Script syntax validated via [System.Management.Automation.PSParser]::Tokenize
• End-to-end install tested on a fresh Windows machine (deferred — needs a real release with Windows assets to download)
• ARM64 Windows tested (no hardware available)

Test plan

• On Windows AMD64: run the one-liner, confirm fff-mcp.exe lands in %LOCALAPPDATA%\fff-mcp\bin, confirm it is on PATH in a new shell, confirm fff-mcp --help (or equivalent) runs.
• Re-run installer, confirm "Updating..." path triggers and binary is replaced.
• Set $env:FFF_MCP_INSTALL_DIR to a custom dir, confirm install lands there.
• Delete the .sha256 upstream temporarily (or test against a release missing it) and confirm the script warns instead of failing.
• Confirm Claude Code / OpenCode / Codex detection prints the right snippet when those CLIs are on PATH.

[mynameistito]

All done with Claude Opus 4.7 and worked as intended for me :)

Did not read any of the code, just tested the outcome happy to make itterations should you wish @dmtrKovalenko

[dmtrKovalenko]

I have no idea is this right or not and do not understand anything in powershell but my opus 4.7 told this LMAO

  - TLS 1.2 not forced. install-mcp.ps1:33 calls Invoke-RestMethod against api.github.com without setting      
  [Net.ServicePointManager]::SecurityProtocol. On PS 5.1 (the minimum version required) on older Win10 builds,
  SecurityProtocol can still default to SSL3/TLS1.0, and GitHub rejects those. Common pitfall in PowerShell    
  installers — recommend adding near the top:
  [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor
  [Net.SecurityProtocolType]::Tls12
  - Wrong exception type for missing SHA256. install-mcp.ps1:66 catches [System.Net.WebException], but on
  PowerShell 7+ a 404 from Invoke-WebRequest throws Microsoft.PowerShell.Commands.HttpResponseException, not
  WebException. Since #Requires -Version 5.1 admits PS 7, and $ErrorActionPreference = 'Stop', a missing
  checksum file will abort the install instead of warning — the exact opposite of the bash script's behavior.
  Use a generic catch or catch both types:
  } catch {
      if ($_.Exception -is [System.Net.WebException] -or $_.Exception.GetType().Name -eq
  'HttpResponseException') {
          Write-Warn "Checksum file not available, skipping verification."
      } else { throw }
  }

I think we should get rid of sha256 check at all

[mynameistito]

that was what my opus thought, maybe good to get other eyes on it but it works as intended for me :)

[mynameistito]

Both points valid — pushed db25a30:

• Forced TLS 1.2 at top of script via [Net.ServicePointManager]::SecurityProtocol = ... -bor [Net.SecurityProtocolType]::Tls12.
• Dropped sha256 verification entirely per your call. Kills the WebException vs HttpResponseException mismatch and halves the script's failure surface. Bash version's check was best-effort anyway.

[ccastanedaucf]

lgtm

[mynameistito]

Thanks @ccastanedaucf — pushed 47d6006 with all five:

• Params: added -Version and -InstallDir. Pipe form keeps working via FFF_MCP_VERSION / FFF_MCP_INSTALL_DIR env-var fallbacks, since irm | iex can't bind params.
• Arch detect: switched to HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment, dropped the env-var dance.
• Release scan: kept the asset-aware scan as the default path (the bash script does the same — not every release publishes the MCP exe), but -Version short-circuits it.
• Download: curl.exe primary with iwr fallback; iwr path wraps $ProgressPreference = 'SilentlyContinue' in try/finally to keep PS 5.1 throughput sane.
• PATH: also appends to $env:PATH for the current session so no shell restart is needed.

[PurpleMyst]

For what it's worth, some pwsh users such as myself prefer appending to $profile *nix-style rather than modifying the environment variable globally; there could probably be a script param to control this behavior.

[mynameistito]

thanks for the feedback pushing another commit out now.

[mynameistito]

Thanks @PurpleMyst — pushed 61fc7e8 with a -PathScope param:

• -PathScope User (default) — sets the user env var, current behavior.
• -PathScope Profile — appends $env:PATH += ';...' to $PROFILE.CurrentUserAllHosts, *nix-style.
• -PathScope None — skip persistence entirely.

Env-var fallback FFF_MCP_PATH_SCOPE for the irm | iex case. Current-session $env:PATH is still updated regardless of scope so the binary is usable immediately.

[PurpleMyst]

LGTM