Windows from zero

For a Windows PC that has never had KernelHub. Every step can be copied, and every step says what success looks like: install Node, install KernelHub with one line, log in a Runtime, pair your phone, send a real task, watch it deliver.

1 · Before you start: what this PC is missing

You have a Windows 10 / 11 PC that has never had KernelHub on it, and you want to get to "send work from my phone, have this PC do it". First, what it ships with and what it lacks:

How to open PowerShell

Press Win + R, type powershell, press Enter. A blue (or black) window means you're in. Only two places on this page need "Run as administrator", and they say so.

2 · With internet access: the shortest path (recommended, 13 steps)

One line per step, copy and run. If something is blocked or you're offline, jump to the matching section.

Step 1 · Check whether this PC has Node

Success looks like: two version numbers (for example v24.21.0 and an npm version). Node is already there — skip to step 4.

On a fresh PC you will see: red text containing "is not recognized as the name of a cmdlet" (on a Chinese system: 「无法将“node”项识别为 cmdlet」). Node is missing — do step 2.

Step 2 · Install Node.js (npm comes with it)

Pick one of two ways. The current LTS is Node v24.21.0 (from the official nodejs.org release index).

Way A: one command (needs winget — Windows 11 and recent Windows 10 have it)

If Windows asks "Do you want to allow this app to make changes to your device?", click Yes. The winget catalogue can trail nodejs.org by a few patch versions; that's fine.

Way B: no winget — pinned version, checked against the official SHA-256 before it installs, stops on mismatch

Only when the check passes does the Node setup wizard open; click Next through it (an admin prompt may appear — click Yes). For a silent install, replace the trailing msiexec /i $f with msiexec /i $f /qn.

The bb0eaee1… value is the node-v24.21.0-x64.msi line from the official nodejs.org SHASUMS256.txt, checked character by character when this page was written. If you see red text "SHA-256 mismatch - stopped, nothing installed": the download was broken or swapped. Run it again; if it keeps failing, use Way A or the proxy in section 5.

Step 3 · Close PowerShell and open a new one

After Node is installed, the old window doesn't know about it. Close it, open a new one as in section 1, and run again:

Success: two version numbers. Still red: sign out or restart Windows, then try again.

Step 4 · Install KernelHub with one line

It does these things in order — you don't have to do anything, just watch:

On success these lines appear (verbatim from the install.ps1 source, not a transcript from a real Windows machine; lines starting with v are green):

v SHA-256 verified
v Installed to C:\Users\<you>\AppData\Local\Programs\icloser\icloser.exe
v Aliases: icli (short name), kernelhub-cli / devnexus-cli (legacy, still work)
v Added C:\Users\<you>\AppData\Local\Programs\icloser to your user PATH
v Typing icloser / icli gets you this install (checked against a new terminal's PATH and PATHEXT)
v icloser 1.0.2 (build 202609161352, commit a4099c062543)
Installing runtime claude (npm install -g @anthropic-ai/claude-code) ...
v Installed runtime: claude (@anthropic-ai/claude-code)

If you see these two lines instead, step 2 was skipped or didn't take effect. KernelHub itself is installed, only the Runtime isn't. Go back to steps 2 and 3, install Node, then run this step's command again (verbatim from the install.ps1 source, not a transcript from a real Windows machine):

  ! No npm on this machine, so no runtime was installed (KernelHub itself is installed)
     Install Node.js (it ships npm), then run this installer again.

Step 5 · Check which version you got

Success: one line containing both 1.0.2 and 202609161352 (this line's shape was checked on a real Windows machine):

icloser 1.0.2 (build 202609161352, commit a4099c062543)

"icloser is not recognized as the name of a cmdlet": close the window, open a new one and retry; if it still fails, run step 4 again.

Step 6 · Log the Runtime in once

The first run walks you through logging in (usually by opening a browser). Follow the prompts; once you reach the chat screen, type /exit or press Ctrl + C twice to leave.

Then see which Runtimes this PC recognises and whether they're logged in:

Success: the Claude Code row no longer says not installed, and its state isn't NOT_INSTALLED. If it's still stuck on login, the state reads STARTABLE_NOT_AUTHED or "unknown" (STARTABLE_AUTH_UNKNOWN) — log in again.

Step 7 · Go to your project folder

Change D:\your-project below to your real project folder (where the code you want your AI employees to change lives):

Don't do this in your Downloads folder or in the folder you unpacked an installer into: that whole folder becomes the AI employee's workspace. KernelHub refuses folders that look like an unpacked install bundle.

Step 8 · Pair your phone

It does three things in turn:

1. Creates a workspace in the current folder.
2. Asks how far the agent may go on this machine — just press Enter for tier 3, read + write + execute: it can change files and run builds and tests. Most people pick this.
3. Draws a QR code in the window, with a "paste this if you can't scan" link below it.

Scan the code with the KernelHub app on your phone. At the end it says the next step is to keep icloser run going so what you say on the phone gets picked up.

You can also do it graphically: open KernelHub Desktop, click "Connect phone", and scan with your phone. Either works.

Step 9 · Enter an invitation code in the phone app

The first time a brand-new account runs pair, the window shows this (measured on Mac and Linux; Windows runs the same CLI):

  账户 7a9e5014 还没有使用权 —— 在 iPhone 或 Android 上输入一次邀请码即可，
  这台机器会自动继承（CLI 上没有激活入口）

It says, in Chinese: this account has no access yet — enter an invitation code once on iPhone or Android and this machine inherits it; the CLI has no activation entry. Open the KernelHub app on your phone and enter your invitation code there. Once it is redeemed, this computer inherits it automatically; nothing to type here.

• One code is 30 days.
• Codes add up: measured, redeeming a second code with 29 days left brought it to 59 days.
• The same code cannot be redeemed twice: the second try is refused (invite_exhausted).

How to get a code: Access & activation. An account that is already active says access was inherited during pair, and you skip this step.

Step 10 · Start taking work

Leave this window open. It keeps running and checks for new tasks every few seconds — it is what picks up the tasks you send from your phone. Its first lines say which workspace it joined and which Runtime it chose.

Step 11 · Send a real task and watch it deliver

With the step 10 window still open, pick up your phone:

1. In the KernelHub app, choose the workspace you just paired and type one sentence into the box. Name the file if you know it, for example "Add a line with today's date at the end of README.md. Don't commit."
2. The icloser run window on your computer scrolls a few new lines — the task has been picked up. On the phone the task card turns into a live view: which files it read, which commands it ran, which files it changed.
3. If the task lacks a permission tier, it stops before acting and shows a card; approving applies to this task only.
4. When it finishes, tap the card's changes to read the diff line by line, then read the result: what it did, what it changed, what it couldn't do. Not happy? Ask for changes, and the same task carries on.

Success: the task shows as done, the changes show the new line in README.md, and the file on your computer really has that extra line.

  ⓘ go：KernelHub Base（机器级，与这条任务无关）没装上 —— 不挂卡、不阻塞，这条任务照常往下跑。要补齐：在这台机器上跑 icloser env bootstrap go，或在设备权限里批 exec + web 后它会自动补上。

Nobody picks it up: check that the step 10 window is still open; if it's still stuck, do the health check in the next step.

Step 12 · Health check (in a second PowerShell)

The step 10 window is busy, so open another PowerShell, cd to the same project folder, and run:

It checks the service, gateway, queue, permissions and Runtimes in one go. Whatever is wrong, it tells you what to type next.

Step 13 · Keep working after you close the window: run it in the background

Once the step 10 window is closed, nobody picks up tasks from your phone. To have it start by itself when you sign in to Windows, run this in your project folder (no admin needed; it runs as your own account):

Success (verbatim from the CLI source, in Chinese: "background task installed (scheduled task: iCloser Agent)"). Installed on a real Windows machine on 2026-09-16: icloser daemon status showed it running, icloser doctor reported the background service as installed and running, and a task was picked up and delivered through it:

✓ 常驻已装好（计划任务：iCloser Agent）

Check on it any time:

With the background task installed, you can close the manual icloser run from step 10 — running both is redundant.

3 · Common things after installing

Add another Runtime (no need to rerun the whole install)

Only claude is installed by default. These can be installed with npm: claude, codex, qwen, codebuddy, opencode, kimi, mimo, pi. This line installs codex; swap in any of them:

Or pick it through the installer (again, swap codex for the one you want):

Each one needs its own login (type its name, for example codex). Google's entry is agy (Antigravity); it does not come from npm — install it from Google's official channel.

Local console

The console is a separate program; icloser run doesn't start it. Start it (this window stays busy too):

Then open http://127.0.0.1:18092 in your browser. It listens only on the loopback address, so nothing outside this PC can reach it. To see whether it's running and at what address:

If it's running, this opens it in your default browser:

4 · No network at all: the offline bundle (fallback — skip it if you can reach the internet)

The offline bundle carries Node, 7-Zip, Python, Git, document tools, the Runtime packages and the three KernelHub programs, so installing needs no outside network.

4.1 Verify the bundle first, then unpack

These commands assume the bundle is in your Downloads folder; if not, change the path.

Download the bundle and the .sha256 file next to it into the same folder. The line below reads that file, computes the hash and compares them for you:

Success: it prints OK followed by the hash:

OK  <the hash from the .sha256 file>

If it does not match, do not use it — the transfer was damaged or tampered with; download both files again:

MISMATCH  expected <from the .sha256 file>  got <computed on this machine>

Unpack to D:\kh-apps (every later command assumes this location):

Success: the last line is True:

Unpacked:
True

Each command below starts with $P='D:\kh-apps\kernelhub-from-zero-windows-x64'; so that every line can be copied and run on its own. If you unpacked somewhere else, change that bit at the start of each line.

4.2 Install order (follow it, don't skip)

① Install 7-Zip (every .7z below needs it; a graphical installer opens):

Confirm it's there (it should print a path to 7z):

② Unpack Node.js 26.8.2 (everything offline depends on it: without npm, no Runtime installs):

Find node.exe, add it to this window's PATH and check (two version numbers means success):

Write it into your user PATH so every new window has it:

③ Install the three KernelHub programs (no admin) — this line does what the installer does: copies the CLI and console into %LOCALAPPDATA%\Programs\icloser, creates the three legacy names, writes your user PATH, then checks itself:

Success: the last line is icloser's version line, and its version and build match the bundle's own winx64\stable.json (the bundle was packed on 2026-09-13 and carries the version of that day, not the current release this page describes). The other way (needs admin) is the MSI:

④ Install Runtimes — order matters: the real package first, then the wrapper

First the four real packages:

Then the eight wrappers (top-level tgz):

The ninth, agy (Antigravity), doesn't use npm: run Google's official installer from the bundle, then check it:

⑤ Log each one in: type each name once in PowerShell (claude, codex, qwen, codebuddy, opencode, kimi, mimo, pi, agy) and follow the login prompts, or it can't run tasks.

⑥ Connect your phone and start taking work: go back to section 2 and do step 7 (project folder) through step 13. Do not pick a project folder under D:\kh-apps.

4.3 Basic tools in the bundle (as needed — you don't need all of them)

The D:\tools\… folders are just examples; put them anywhere, and add their bin folder to PATH.

Python 3.12.10 (portable, no registry, no admin):

Python 3.14.7 (also in the bundle; pick per project):

Portable Git (self-extracting; -o / -y are the usual 7z self-extractor switches, marked untested in the source notes):

uv (Python package manager):

ripgrep (rg.exe):

jq (single exe):

pandoc 3.11 (document conversion):

poppler (includes pdftotext.exe):

Python document-processing packages (this one needs internet; use whichever python.exe you installed):

Note: pytesseract also needs Tesseract itself; pdf2image needs the poppler above. imagemagick, also used for documents, is not in the bundle — if you need it, get the Windows build from imagemagick.org and verify its hash yourself.

4.4 Three limits of the offline route (you need to know these)

5 · Blocked network: getting your commands out

First use the table at the start of section 2 to work out which part is blocked. Every command below can be copied on its own.

5.1 Set a proxy (for this window only)

Replace PORT with your own proxy's address and port (your proxy app's settings show it, often called mixed-port or HTTP port). curl.exe reads http_proxy / https_proxy, while PowerShell's irm uses .NET's default proxy — this line sets both, then checks:

Success:

install.ps1 -> HTTP 200

No HTTP 200: the proxy address or the proxy itself is wrong; don't go further yet. Once it works, section 2's commands need no changes — just run them in this same window.

5.2 Use an npm mirror

Switch to a mirror and check (it echoes the mirror address):

Use the mirror for one command only, without changing global settings:

With a proxy, tell npm about it as well:

registry.npmmirror.com is a common public mirror; to use another one, swap the address.

5.3 Use a pip mirror

Save it in pip's config so every install uses the Tsinghua mirror, and check:

Just this once:

5.4 Point KernelHub's own downloads at a mirror

For company networks with an internal mirror (it must mirror the official folder exactly; the manifest's SHA-256 is still checked):

Note: this only changes where the manifest and packages come from — the installer script itself still comes from icloser.xyz.

5.5 Three more installer switches

Install somewhere else (default %LOCALAPPDATA%\Programs\icloser):

Install no Runtime at all (CLI only):

Install a specific one: see the codex line in section 3 and swap codex for the one you want.

6 · Verify the files yourself

"The file is there" is not "it is installed". These checks need no network and use Windows' built-in certutil.

Check the installed icloser.exe (the one installed online in step 4: x64 against the first row of the table below, ARM64 against the second):

For the three programs in the offline bundle, one line each compares against the bundle's manifest (a line starting with OK means it matches):

OK  icloser  <the hash recorded in the bundle's winx64\stable.json>

The first four rows are read from this release's manifest stable.json when this page is built; the files inside the offline bundle get no numbers here — the bundle was packed on 2026-09-13, is not the same batch as this release, and its own stable.json is the reference for their hashes; the Node row comes from nodejs.org's SHASUMS256.txt; the zip row comes from the packaging record.

Check every file in the bundle (optional; close to 1 GB, so it takes a while; prints ok for each good file):

7 · Common errors: symptom → cause → the one line to run

8 · Uninstall / clean up completely

① If you installed the background task, remove it first (from any folder):

② See exactly what would be deleted (list only):

③ Delete the data folders. The three hold configuration and the task ledger, identity credentials, and the protected root; it's only clean once all three are gone. You'll have to pair again afterwards:

④ Delete the programs:

Finally, in Settings → System → About → Advanced system settings → Environment Variables, you can remove the …\Programs\icloser entry from your user Path. Node and the Runtimes are things you installed yourself; remove them with their own uninstallers.