Quote the apiKeyHelper path, and say why the helper failed

apiKeyHelper is a shell command line, not a path, so the raw value written
into settings.json was split at the first space. A Windows profile named
"Mohammed Ahmed" produced an attempt to run C:\Users\Mohammed, surfacing as
"your apiKeyHelper script is failing" with nothing to go on. Quote the value
when it contains anything a shell cares about, and leave it bare otherwise so
no existing settings.json churns on the next switch. The POSIX port had the
same bug against a /Users/First Last home; shlex.quote has exactly the wanted
"leave ordinary paths alone" behaviour.

doctor could not see any of this. It quoted the path itself before running it,
so it exercised a command line Claude Code never uses and passed while the
real one failed. It now reads the string out of settings.json, reports it when
it is not what a switch would write, and runs that string through a shell.

The helper itself exited 1 in silence on four distinct faults - no state, no
preset, no key, undecryptable key - collapsing them into one indistinguishable
message. Each now names itself on stderr, which is what /status displays. The
DPAPI case says what it actually means: a key stored by a different Windows
account than the one Claude Code runs as. Success paths stay silent, so stdout
still carries the key and nothing else.

Also make install.ps1 survive a Restricted execution policy: piped through
iex it is not subject to the policy, but invoking the installed script for the
key prompt is, which is where a fresh install died. Set Process scope for the
install, offer to set CurrentUser to RemoteSigned, and clear the
mark-of-the-web that Expand-Archive can leave on the extracted scripts.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

install.ps1

@@ -18,6 +18,12 @@ param(
 Set-StrictMode -Version 1.0
 $ErrorActionPreference = 'Stop'
 
+# Piped in as `irm ... | iex` the installer itself is never subject to the
+# execution policy - but invoking the installed claude-mode.ps1 below is, and
+# on a stock Restricted machine that fails. Process scope lasts only for this
+# powershell.exe and does not weaken the machine or user policy.
+try { Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force -ErrorAction Stop } catch { }
+
 $repoUrl = 'https://git.nebulm.com/smoido/claude-mode'
 
 # Running from a checkout, the source is the files next to this script. Piped
@@ -144,13 +150,37 @@ if ($current -match [regex]::Escape($startMark)) {
     Write-Host "  ok   appended claude-mode block to $profilePath" -ForegroundColor Green
 }
 
-# --- 7. execution policy check ---------------------------------------------
+# --- 7. execution policy ----------------------------------------------------
+# Without this the profile block above never loads, so `claude-mode` and the
+# `claude` wrapper simply do not exist in PowerShell. Offer to fix it rather
+# than printing a warning the user has to act on later.
 $pol = Get-ExecutionPolicy -Scope CurrentUser
 if ($pol -in @('Restricted', 'Undefined', 'AllSigned')) {
-    Write-Host "  warn CurrentUser execution policy is '$pol'; the profile will not load." -ForegroundColor Yellow
-    Write-Host "       Fix: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" -ForegroundColor Yellow
+    $effective = Get-ExecutionPolicy
+    if ($effective -in @('Restricted', 'AllSigned')) {
+        Write-Host ''
+        Write-Host "  warn execution policy is '$effective'; the profile block will not load," -ForegroundColor Yellow
+        Write-Host "       so 'claude-mode' will not be a command in PowerShell." -ForegroundColor Yellow
+        $ans = Read-Host '       Set CurrentUser policy to RemoteSigned now? [Y/n]'
+        if ($ans -eq '' -or $ans -match '^(y|yes)$') {
+            try {
+                Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force -ErrorAction Stop
+                Write-Host '  ok   CurrentUser execution policy set to RemoteSigned' -ForegroundColor Green
+            } catch {
+                Write-Host "  warn could not set policy: $($_.Exception.Message)" -ForegroundColor Yellow
+                Write-Host '       Run manually: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned' -ForegroundColor Yellow
+            }
+        } else {
+            Write-Host '       Skipped. Run manually: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned' -ForegroundColor Yellow
+        }
+    }
 }
 
+# Expand-Archive can carry the mark-of-the-web onto extracted files, which
+# RemoteSigned then refuses. Clear it on what was just installed.
+Get-ChildItem -LiteralPath $root -Recurse -Filter '*.ps1' -ErrorAction SilentlyContinue |
+    Unblock-File -ErrorAction SilentlyContinue
+
 # --- 8. key ----------------------------------------------------------------
 if (-not $SkipKeyPrompt) {
     $vault = Join-Path $root 'vault\openrouter.cred'