From cb5f7030d613a52235cfff981753ffbf44c7e0ef Mon Sep 17 00:00:00 2001
From: Snider <snider@host.uk.com>
Date: Tue, 3 Feb 2026 06:22:07 +0000
Subject: [PATCH] feat(cli): wire release command and add installer scripts

- Wire up `core build release` subcommand (was orphaned)
- Wire up `core monitor` command (missing import in full variant)
- Add installer scripts for Unix (.sh) and Windows (.bat)
  - setup: Interactive with variant selection
  - ci: Minimal for CI/CD environments
  - dev: Full development variant
  - go/php/agent: Targeted development variants
- All scripts include security hardening:
  - Secure temp directories (mktemp -d)
  - Architecture validation
  - Version validation after GitHub API call
  - Proper cleanup on exit
  - PowerShell PATH updates on Windows (avoids setx truncation)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 internal/variants/full.go         |   2 +
 pkg/build/buildcmd/cmd_build.go   |   1 +
 pkg/build/buildcmd/cmd_release.go | 112 ++++++++++++++++++++++++++++++
 pkg/i18n/locales/en_GB.json       |  16 ++++-
 tools/install/agent.bat           |  72 +++++++++++++++++++
 tools/install/agent.sh            |  50 +++++++++++++
 tools/install/ci.bat              |  57 +++++++++++++++
 tools/install/ci.sh               |  50 +++++++++++++
 tools/install/dev.bat             |  69 ++++++++++++++++++
 tools/install/dev.sh              |  46 ++++++++++++
 tools/install/go.bat              |  72 +++++++++++++++++++
 tools/install/go.sh               |  51 ++++++++++++++
 tools/install/php.bat             |  72 +++++++++++++++++++
 tools/install/php.sh              |  50 +++++++++++++
 tools/install/setup.bat           |  85 +++++++++++++++++++++++
 tools/install/setup.sh            |  80 +++++++++++++++++++++
 16 files changed, 884 insertions(+), 1 deletion(-)
 create mode 100644 pkg/build/buildcmd/cmd_release.go
 create mode 100644 tools/install/agent.bat
 create mode 100644 tools/install/agent.sh
 create mode 100644 tools/install/ci.bat
 create mode 100644 tools/install/ci.sh
 create mode 100644 tools/install/dev.bat
 create mode 100644 tools/install/dev.sh
 create mode 100644 tools/install/go.bat
 create mode 100644 tools/install/go.sh
 create mode 100644 tools/install/php.bat
 create mode 100644 tools/install/php.sh
 create mode 100644 tools/install/setup.bat
 create mode 100644 tools/install/setup.sh

diff --git a/internal/variants/full.go b/internal/variants/full.go
index ebecd16..409f878 100644
--- a/internal/variants/full.go
+++ b/internal/variants/full.go
@@ -19,6 +19,7 @@
 //   - doctor: Environment health checks
 //   - test: Test runner with coverage
 //   - qa: Quality assurance workflows
+//   - monitor: Security monitoring aggregation
 
 package variants
 
@@ -32,6 +33,7 @@ import (
 	_ "github.com/host-uk/core/internal/cmd/gitcmd"
 	_ "github.com/host-uk/core/internal/cmd/go"
 	_ "github.com/host-uk/core/internal/cmd/help"
+	_ "github.com/host-uk/core/internal/cmd/monitor"
 	_ "github.com/host-uk/core/internal/cmd/php"
 	_ "github.com/host-uk/core/internal/cmd/pkgcmd"
 	_ "github.com/host-uk/core/internal/cmd/qa"
diff --git a/pkg/build/buildcmd/cmd_build.go b/pkg/build/buildcmd/cmd_build.go
index e9bb65a..87b268c 100644
--- a/pkg/build/buildcmd/cmd_build.go
+++ b/pkg/build/buildcmd/cmd_build.go
@@ -139,5 +139,6 @@ func initBuildFlags() {
 // AddBuildCommands registers the 'build' command and all subcommands.
 func AddBuildCommands(root *cobra.Command) {
 	initBuildFlags()
+	AddReleaseCommand(buildCmd)
 	root.AddCommand(buildCmd)
 }
diff --git a/pkg/build/buildcmd/cmd_release.go b/pkg/build/buildcmd/cmd_release.go
new file mode 100644
index 0000000..06883d4
--- /dev/null
+++ b/pkg/build/buildcmd/cmd_release.go
@@ -0,0 +1,112 @@
+// cmd_release.go implements the release command: build + archive + publish in one step.
+
+package buildcmd
+
+import (
+	"context"
+	"os"
+
+	"github.com/host-uk/core/pkg/cli"
+	"github.com/host-uk/core/pkg/i18n"
+	"github.com/host-uk/core/pkg/release"
+)
+
+// Flag variables for release command
+var (
+	releaseVersion    string
+	releaseDraft      bool
+	releasePrerelease bool
+	releaseDryRun     bool
+)
+
+var releaseCmd = &cli.Command{
+	Use:   "release",
+	Short: i18n.T("cmd.build.release.short"),
+	Long:  i18n.T("cmd.build.release.long"),
+	RunE: func(cmd *cli.Command, args []string) error {
+		return runRelease(releaseDryRun, releaseVersion, releaseDraft, releasePrerelease)
+	},
+}
+
+func init() {
+	releaseCmd.Flags().BoolVar(&releaseDryRun, "dry-run", false, i18n.T("cmd.build.release.flag.dry_run"))
+	releaseCmd.Flags().StringVar(&releaseVersion, "version", "", i18n.T("cmd.build.release.flag.version"))
+	releaseCmd.Flags().BoolVar(&releaseDraft, "draft", false, i18n.T("cmd.build.release.flag.draft"))
+	releaseCmd.Flags().BoolVar(&releasePrerelease, "prerelease", false, i18n.T("cmd.build.release.flag.prerelease"))
+}
+
+// AddReleaseCommand adds the release subcommand to the build command.
+func AddReleaseCommand(buildCmd *cli.Command) {
+	buildCmd.AddCommand(releaseCmd)
+}
+
+// runRelease executes the full release workflow: build + archive + checksum + publish.
+func runRelease(dryRun bool, version string, draft, prerelease bool) error {
+	ctx := context.Background()
+
+	// Get current directory
+	projectDir, err := os.Getwd()
+	if err != nil {
+		return cli.WrapVerb(err, "get", "working directory")
+	}
+
+	// Check for release config
+	if !release.ConfigExists(projectDir) {
+		cli.Print("%s %s\n",
+			buildErrorStyle.Render(i18n.Label("error")),
+			i18n.T("cmd.build.release.error.no_config"),
+		)
+		cli.Print("  %s\n", buildDimStyle.Render(i18n.T("cmd.build.release.hint.create_config")))
+		return cli.Err("release config not found")
+	}
+
+	// Load configuration
+	cfg, err := release.LoadConfig(projectDir)
+	if err != nil {
+		return cli.WrapVerb(err, "load", "config")
+	}
+
+	// Apply CLI overrides
+	if version != "" {
+		cfg.SetVersion(version)
+	}
+
+	// Apply draft/prerelease overrides to all publishers
+	if draft || prerelease {
+		for i := range cfg.Publishers {
+			if draft {
+				cfg.Publishers[i].Draft = true
+			}
+			if prerelease {
+				cfg.Publishers[i].Prerelease = true
+			}
+		}
+	}
+
+	// Print header
+	cli.Print("%s %s\n", buildHeaderStyle.Render(i18n.T("cmd.build.release.label.release")), i18n.T("cmd.build.release.building_and_publishing"))
+	if dryRun {
+		cli.Print("  %s\n", buildDimStyle.Render(i18n.T("cmd.build.release.dry_run_hint")))
+	}
+	cli.Blank()
+
+	// Run full release (build + archive + checksum + publish)
+	rel, err := release.Run(ctx, cfg, dryRun)
+	if err != nil {
+		return err
+	}
+
+	// Print summary
+	cli.Blank()
+	cli.Print("%s %s\n", buildSuccessStyle.Render(i18n.T("i18n.done.pass")), i18n.T("cmd.build.release.completed"))
+	cli.Print("  %s   %s\n", i18n.Label("version"), buildTargetStyle.Render(rel.Version))
+	cli.Print("  %s %d\n", i18n.T("cmd.build.release.label.artifacts"), len(rel.Artifacts))
+
+	if !dryRun {
+		for _, pub := range cfg.Publishers {
+			cli.Print("  %s %s\n", i18n.T("cmd.build.release.label.published"), buildTargetStyle.Render(pub.Type))
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/i18n/locales/en_GB.json b/pkg/i18n/locales/en_GB.json
index f328acb..d85f452 100644
--- a/pkg/i18n/locales/en_GB.json
+++ b/pkg/i18n/locales/en_GB.json
@@ -226,7 +226,21 @@
 			"sdk.languages_label": "Languages:",
 			"sdk.would_generate": "Would generate SDK",
 			"sdk.generated_label": "Generated:",
-			"sdk.complete": "SDK generation complete"
+			"sdk.complete": "SDK generation complete",
+			"release.short": "Build, archive, and publish a release",
+			"release.long": "Build all targets, create archives, generate checksums, and publish to configured destinations. Requires .core/release.yaml configuration.",
+			"release.flag.dry_run": "Show what would be done without publishing",
+			"release.flag.version": "Version to release (overrides config)",
+			"release.flag.draft": "Create as draft release",
+			"release.flag.prerelease": "Mark as pre-release",
+			"release.label.release": "Release",
+			"release.building_and_publishing": "Building and publishing release",
+			"release.dry_run_hint": "(dry-run) no artifacts will be published",
+			"release.completed": "Release completed",
+			"release.label.artifacts": "Artifacts:",
+			"release.label.published": "Published to:",
+			"release.error.no_config": "No .core/release.yaml found",
+			"release.hint.create_config": "Create .core/release.yaml to configure release settings"
 		},
 		"ci": {
 			"short": "Publish releases (dry-run by default)",
diff --git a/tools/install/agent.bat b/tools/install/agent.bat
new file mode 100644
index 0000000..3302d27
--- /dev/null
+++ b/tools/install/agent.bat
@@ -0,0 +1,72 @@
+@echo off
+REM Core CLI installer - AI agent variant (Windows)
+REM Usage: curl -fsSL https://core.io.in/agent.bat -o agent.bat && agent.bat
+setlocal enabledelayedexpansion
+
+set "VERSION=%~1"
+if "%VERSION%"=="" set "VERSION=latest"
+set "REPO=host-uk/core"
+set "BINARY=core"
+set "VARIANT=agent"
+set "INSTALL_DIR=%LOCALAPPDATA%\Programs\core"
+
+if not exist "%INSTALL_DIR%" mkdir "%INSTALL_DIR%"
+
+if "%VERSION%"=="latest" (
+    for /f "tokens=2 delims=:" %%a in ('curl -fsSL "https://api.github.com/repos/%REPO%/releases/latest" ^| findstr "tag_name"') do (
+        set "VERSION=%%a"
+        set "VERSION=!VERSION:"=!"
+        set "VERSION=!VERSION: =!"
+        set "VERSION=!VERSION:,=!"
+    )
+    if "!VERSION!"=="" (
+        echo ERROR: Failed to fetch latest version
+        exit /b 1
+    )
+    if "!VERSION!"=="latest" (
+        echo ERROR: Failed to resolve version
+        exit /b 1
+    )
+)
+
+echo Installing %BINARY% !VERSION! (%VARIANT% variant)...
+
+set "ARCHIVE=%BINARY%-%VARIANT%-windows-amd64.zip"
+set "URL=https://github.com/%REPO%/releases/download/!VERSION!/%ARCHIVE%"
+
+curl -fsSLI "%URL%" 2>nul | findstr /r "HTTP/.* [23]0[02]" >nul
+if errorlevel 1 (
+    set "ARCHIVE=%BINARY%-windows-amd64.zip"
+    echo Using full variant (%VARIANT% variant not available^)
+)
+
+curl -fsSL "https://github.com/%REPO%/releases/download/!VERSION!/!ARCHIVE!" -o "%TEMP%\!ARCHIVE!"
+if errorlevel 1 (
+    echo ERROR: Failed to download !ARCHIVE!
+    exit /b 1
+)
+
+powershell -Command "try { Expand-Archive -Force '%TEMP%\!ARCHIVE!' '%INSTALL_DIR%' } catch { exit 1 }"
+if errorlevel 1 (
+    echo ERROR: Failed to extract archive
+    del "%TEMP%\!ARCHIVE!" 2>nul
+    exit /b 1
+)
+del "%TEMP%\!ARCHIVE!" 2>nul
+
+REM Add to PATH using PowerShell (avoids setx 1024 char limit)
+echo %PATH% | findstr /i /c:"%INSTALL_DIR%" >nul
+if errorlevel 1 (
+    powershell -Command "[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';%INSTALL_DIR%', 'User')"
+    set "PATH=%PATH%;%INSTALL_DIR%"
+)
+
+if not exist "%INSTALL_DIR%\%BINARY%.exe" (
+    echo ERROR: Installation failed - binary not found
+    exit /b 1
+)
+
+"%INSTALL_DIR%\%BINARY%.exe" --version
+if errorlevel 1 exit /b 1
+
+endlocal
diff --git a/tools/install/agent.sh b/tools/install/agent.sh
new file mode 100644
index 0000000..8d8e539
--- /dev/null
+++ b/tools/install/agent.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Core CLI installer - AI agent variant
+# Usage: curl -fsSL https://core.io.in/agent.sh | bash
+set -eo pipefail
+
+VERSION="${VERSION:-${1:-latest}}"
+REPO="host-uk/core"
+BINARY="core"
+VARIANT="agent"
+
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+if [ "$VERSION" = "latest" ]; then
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -z "$VERSION" ]; then
+    echo "Failed to fetch latest version from GitHub API" >&2
+    exit 1
+  fi
+fi
+
+echo "Installing ${BINARY} ${VERSION} (${VARIANT} variant) for ${OS}/${ARCH}..."
+
+# Download variant-specific archive if available, else fall back to full
+ARCHIVE="${BINARY}-${VARIANT}-${OS}-${ARCH}.tar.gz"
+URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+
+if ! curl -fsSLI "$URL" 2>/dev/null | grep -qE "^HTTP/.* (200|302)"; then
+  ARCHIVE="${BINARY}-${OS}-${ARCH}.tar.gz"
+  URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+  echo "Using full variant (${VARIANT} variant not available for ${VERSION})"
+fi
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+if ! curl -fsSL "$URL" -o "$TMPDIR/$ARCHIVE"; then
+  echo "Failed to download ${ARCHIVE}" >&2
+  exit 1
+fi
+tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR"
+
+[ -w /usr/local/bin ] && mv "$TMPDIR/${BINARY}" /usr/local/bin/ || sudo mv "$TMPDIR/${BINARY}" /usr/local/bin/
+
+${BINARY} --version
diff --git a/tools/install/ci.bat b/tools/install/ci.bat
new file mode 100644
index 0000000..feb14d0
--- /dev/null
+++ b/tools/install/ci.bat
@@ -0,0 +1,57 @@
+@echo off
+REM Core CLI installer for Windows CI environments
+REM Usage: curl -fsSL https://core.io.in/ci.bat -o ci.bat && ci.bat
+setlocal enabledelayedexpansion
+
+set "VERSION=%~1"
+if "%VERSION%"=="" set "VERSION=latest"
+set "REPO=host-uk/core"
+set "BINARY=core"
+
+if "%VERSION%"=="latest" (
+    for /f "tokens=2 delims=:" %%a in ('curl -fsSL "https://api.github.com/repos/%REPO%/releases/latest" ^| findstr "tag_name"') do (
+        set "VERSION=%%a"
+        set "VERSION=!VERSION:"=!"
+        set "VERSION=!VERSION: =!"
+        set "VERSION=!VERSION:,=!"
+    )
+    if "!VERSION!"=="latest" (
+        echo ERROR: Failed to fetch latest version from GitHub API
+        exit /b 1
+    )
+    if "!VERSION!"=="" (
+        echo ERROR: Failed to fetch latest version from GitHub API
+        exit /b 1
+    )
+)
+
+echo Installing %BINARY% !VERSION!...
+
+set "ARCHIVE=%BINARY%-windows-amd64.zip"
+curl -fsSL "https://github.com/%REPO%/releases/download/!VERSION!/%ARCHIVE%" -o "%TEMP%\%ARCHIVE%"
+if errorlevel 1 (
+    echo ERROR: Failed to download %ARCHIVE%
+    exit /b 1
+)
+
+powershell -Command "try { Expand-Archive -Force '%TEMP%\%ARCHIVE%' '%TEMP%\core-extract' } catch { exit 1 }"
+if errorlevel 1 (
+    echo ERROR: Failed to extract archive
+    del "%TEMP%\%ARCHIVE%" 2>nul
+    exit /b 1
+)
+
+REM Try System32 first (CI runners often have admin), else use local programs
+move /y "%TEMP%\core-extract\%BINARY%.exe" "C:\Windows\System32\%BINARY%.exe" >nul 2>&1
+if errorlevel 1 (
+    if not exist "%LOCALAPPDATA%\Programs" mkdir "%LOCALAPPDATA%\Programs"
+    move /y "%TEMP%\core-extract\%BINARY%.exe" "%LOCALAPPDATA%\Programs\%BINARY%.exe"
+    set "PATH=%LOCALAPPDATA%\Programs;%PATH%"
+    echo NOTE: Installed to %LOCALAPPDATA%\Programs
+)
+rmdir /s /q "%TEMP%\core-extract" 2>nul
+del "%TEMP%\%ARCHIVE%" 2>nul
+
+%BINARY% --version || exit /b 1
+
+endlocal
diff --git a/tools/install/ci.sh b/tools/install/ci.sh
new file mode 100644
index 0000000..99d2d89
--- /dev/null
+++ b/tools/install/ci.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Core CLI installer for CI environments
+# Minimal, fast, no interactive prompts
+# Usage: curl -fsSL https://core.io.in/ci.sh | bash
+#        VERSION=v1.0.0 curl -fsSL https://core.io.in/ci.sh | bash
+set -eo pipefail
+
+VERSION="${VERSION:-${1:-latest}}"
+REPO="host-uk/core"
+BINARY="core"
+
+# Detect platform
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+# Resolve latest
+if [ "$VERSION" = "latest" ]; then
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -z "$VERSION" ]; then
+    echo "Failed to fetch latest version from GitHub API" >&2
+    exit 1
+  fi
+fi
+
+echo "Installing ${BINARY} ${VERSION} (${OS}/${ARCH})..."
+
+# Download and extract to secure temp dir
+ARCHIVE="${BINARY}-${OS}-${ARCH}.tar.gz"
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+if ! curl -fsSL "https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}" -o "$TMPDIR/$ARCHIVE"; then
+  echo "Failed to download ${ARCHIVE}" >&2
+  exit 1
+fi
+tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR"
+
+# Install (CI runners typically have write access to /usr/local/bin)
+if [ -w /usr/local/bin ]; then
+  mv "$TMPDIR/${BINARY}" /usr/local/bin/
+else
+  sudo mv "$TMPDIR/${BINARY}" /usr/local/bin/
+fi
+
+${BINARY} --version
diff --git a/tools/install/dev.bat b/tools/install/dev.bat
new file mode 100644
index 0000000..97e8fe0
--- /dev/null
+++ b/tools/install/dev.bat
@@ -0,0 +1,69 @@
+@echo off
+REM Core CLI installer - Multi-repo development variant (Windows)
+REM Usage: curl -fsSL https://core.io.in/dev.bat -o dev.bat && dev.bat
+setlocal enabledelayedexpansion
+
+set "VERSION=%~1"
+if "%VERSION%"=="" set "VERSION=latest"
+set "REPO=host-uk/core"
+set "BINARY=core"
+set "INSTALL_DIR=%LOCALAPPDATA%\Programs\core"
+
+if not exist "%INSTALL_DIR%" mkdir "%INSTALL_DIR%"
+
+if "%VERSION%"=="latest" (
+    for /f "tokens=2 delims=:" %%a in ('curl -fsSL "https://api.github.com/repos/%REPO%/releases/latest" ^| findstr "tag_name"') do (
+        set "VERSION=%%a"
+        set "VERSION=!VERSION:"=!"
+        set "VERSION=!VERSION: =!"
+        set "VERSION=!VERSION:,=!"
+    )
+    if "!VERSION!"=="" (
+        echo ERROR: Failed to fetch latest version
+        exit /b 1
+    )
+    if "!VERSION!"=="latest" (
+        echo ERROR: Failed to resolve version
+        exit /b 1
+    )
+)
+
+echo Installing %BINARY% !VERSION! (full) for Windows...
+
+set "ARCHIVE=%BINARY%-windows-amd64.zip"
+curl -fsSL "https://github.com/%REPO%/releases/download/!VERSION!/%ARCHIVE%" -o "%TEMP%\%ARCHIVE%"
+if errorlevel 1 (
+    echo ERROR: Failed to download %ARCHIVE%
+    exit /b 1
+)
+
+powershell -Command "try { Expand-Archive -Force '%TEMP%\%ARCHIVE%' '%INSTALL_DIR%' } catch { exit 1 }"
+if errorlevel 1 (
+    echo ERROR: Failed to extract archive
+    del "%TEMP%\%ARCHIVE%" 2>nul
+    exit /b 1
+)
+del "%TEMP%\%ARCHIVE%" 2>nul
+
+REM Add to PATH using PowerShell (avoids setx 1024 char limit)
+echo %PATH% | findstr /i /c:"%INSTALL_DIR%" >nul
+if errorlevel 1 (
+    powershell -Command "[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';%INSTALL_DIR%', 'User')"
+    set "PATH=%PATH%;%INSTALL_DIR%"
+)
+
+if not exist "%INSTALL_DIR%\%BINARY%.exe" (
+    echo ERROR: Installation failed - binary not found
+    exit /b 1
+)
+
+"%INSTALL_DIR%\%BINARY%.exe" --version
+if errorlevel 1 exit /b 1
+
+echo.
+echo Full development variant installed. Available commands:
+echo   core dev     - Multi-repo workflows
+echo   core build   - Cross-platform builds
+echo   core release - Build and publish releases
+
+endlocal
diff --git a/tools/install/dev.sh b/tools/install/dev.sh
new file mode 100644
index 0000000..4d01bdc
--- /dev/null
+++ b/tools/install/dev.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+# Core CLI installer - Multi-repo development variant (full)
+# Usage: curl -fsSL https://core.io.in/dev.sh | bash
+set -eo pipefail
+
+VERSION="${VERSION:-${1:-latest}}"
+REPO="host-uk/core"
+BINARY="core"
+
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+if [ "$VERSION" = "latest" ]; then
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -z "$VERSION" ]; then
+    echo "Failed to fetch latest version from GitHub API" >&2
+    exit 1
+  fi
+fi
+
+echo "Installing ${BINARY} ${VERSION} (full) for ${OS}/${ARCH}..."
+
+ARCHIVE="${BINARY}-${OS}-${ARCH}.tar.gz"
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+if ! curl -fsSL "https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}" -o "$TMPDIR/$ARCHIVE"; then
+  echo "Failed to download ${ARCHIVE}" >&2
+  exit 1
+fi
+tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR"
+
+[ -w /usr/local/bin ] && mv "$TMPDIR/${BINARY}" /usr/local/bin/ || sudo mv "$TMPDIR/${BINARY}" /usr/local/bin/
+
+${BINARY} --version
+
+echo ""
+echo "Full development variant installed. Available commands:"
+echo "  core dev     - Multi-repo workflows"
+echo "  core build   - Cross-platform builds"
+echo "  core release - Build and publish releases"
diff --git a/tools/install/go.bat b/tools/install/go.bat
new file mode 100644
index 0000000..c063fd3
--- /dev/null
+++ b/tools/install/go.bat
@@ -0,0 +1,72 @@
+@echo off
+REM Core CLI installer - Go development variant (Windows)
+REM Usage: curl -fsSL https://core.io.in/go.bat -o go.bat && go.bat
+setlocal enabledelayedexpansion
+
+set "VERSION=%~1"
+if "%VERSION%"=="" set "VERSION=latest"
+set "REPO=host-uk/core"
+set "BINARY=core"
+set "VARIANT=go"
+set "INSTALL_DIR=%LOCALAPPDATA%\Programs\core"
+
+if not exist "%INSTALL_DIR%" mkdir "%INSTALL_DIR%"
+
+if "%VERSION%"=="latest" (
+    for /f "tokens=2 delims=:" %%a in ('curl -fsSL "https://api.github.com/repos/%REPO%/releases/latest" ^| findstr "tag_name"') do (
+        set "VERSION=%%a"
+        set "VERSION=!VERSION:"=!"
+        set "VERSION=!VERSION: =!"
+        set "VERSION=!VERSION:,=!"
+    )
+    if "!VERSION!"=="" (
+        echo ERROR: Failed to fetch latest version
+        exit /b 1
+    )
+    if "!VERSION!"=="latest" (
+        echo ERROR: Failed to resolve version
+        exit /b 1
+    )
+)
+
+echo Installing %BINARY% !VERSION! (%VARIANT% variant)...
+
+set "ARCHIVE=%BINARY%-%VARIANT%-windows-amd64.zip"
+set "URL=https://github.com/%REPO%/releases/download/!VERSION!/%ARCHIVE%"
+
+curl -fsSLI "%URL%" 2>nul | findstr /r "HTTP/.* [23]0[02]" >nul
+if errorlevel 1 (
+    set "ARCHIVE=%BINARY%-windows-amd64.zip"
+    echo Using full variant (%VARIANT% variant not available^)
+)
+
+curl -fsSL "https://github.com/%REPO%/releases/download/!VERSION!/!ARCHIVE!" -o "%TEMP%\!ARCHIVE!"
+if errorlevel 1 (
+    echo ERROR: Failed to download !ARCHIVE!
+    exit /b 1
+)
+
+powershell -Command "try { Expand-Archive -Force '%TEMP%\!ARCHIVE!' '%INSTALL_DIR%' } catch { exit 1 }"
+if errorlevel 1 (
+    echo ERROR: Failed to extract archive
+    del "%TEMP%\!ARCHIVE!" 2>nul
+    exit /b 1
+)
+del "%TEMP%\!ARCHIVE!" 2>nul
+
+REM Add to PATH using PowerShell (avoids setx 1024 char limit)
+echo %PATH% | findstr /i /c:"%INSTALL_DIR%" >nul
+if errorlevel 1 (
+    powershell -Command "[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';%INSTALL_DIR%', 'User')"
+    set "PATH=%PATH%;%INSTALL_DIR%"
+)
+
+if not exist "%INSTALL_DIR%\%BINARY%.exe" (
+    echo ERROR: Installation failed - binary not found
+    exit /b 1
+)
+
+"%INSTALL_DIR%\%BINARY%.exe" --version
+if errorlevel 1 exit /b 1
+
+endlocal
diff --git a/tools/install/go.sh b/tools/install/go.sh
new file mode 100644
index 0000000..8bfca7f
--- /dev/null
+++ b/tools/install/go.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Core CLI installer - Go development variant
+# Usage: curl -fsSL https://core.io.in/go.sh | bash
+set -eo pipefail
+
+VERSION="${VERSION:-${1:-latest}}"
+REPO="host-uk/core"
+BINARY="core"
+VARIANT="go"
+
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+if [ "$VERSION" = "latest" ]; then
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -z "$VERSION" ]; then
+    echo "Failed to fetch latest version from GitHub API" >&2
+    exit 1
+  fi
+fi
+
+echo "Installing ${BINARY} ${VERSION} (${VARIANT} variant) for ${OS}/${ARCH}..."
+
+# Download variant-specific archive if available, else fall back to full
+ARCHIVE="${BINARY}-${VARIANT}-${OS}-${ARCH}.tar.gz"
+URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+
+if ! curl -fsSLI "$URL" 2>/dev/null | grep -qE "^HTTP/.* (200|302)"; then
+  # Fall back to full variant
+  ARCHIVE="${BINARY}-${OS}-${ARCH}.tar.gz"
+  URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+  echo "Using full variant (${VARIANT} variant not available for ${VERSION})"
+fi
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+if ! curl -fsSL "$URL" -o "$TMPDIR/$ARCHIVE"; then
+  echo "Failed to download ${ARCHIVE}" >&2
+  exit 1
+fi
+tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR"
+
+[ -w /usr/local/bin ] && mv "$TMPDIR/${BINARY}" /usr/local/bin/ || sudo mv "$TMPDIR/${BINARY}" /usr/local/bin/
+
+${BINARY} --version
diff --git a/tools/install/php.bat b/tools/install/php.bat
new file mode 100644
index 0000000..20a021c
--- /dev/null
+++ b/tools/install/php.bat
@@ -0,0 +1,72 @@
+@echo off
+REM Core CLI installer - PHP/Laravel development variant (Windows)
+REM Usage: curl -fsSL https://core.io.in/php.bat -o php.bat && php.bat
+setlocal enabledelayedexpansion
+
+set "VERSION=%~1"
+if "%VERSION%"=="" set "VERSION=latest"
+set "REPO=host-uk/core"
+set "BINARY=core"
+set "VARIANT=php"
+set "INSTALL_DIR=%LOCALAPPDATA%\Programs\core"
+
+if not exist "%INSTALL_DIR%" mkdir "%INSTALL_DIR%"
+
+if "%VERSION%"=="latest" (
+    for /f "tokens=2 delims=:" %%a in ('curl -fsSL "https://api.github.com/repos/%REPO%/releases/latest" ^| findstr "tag_name"') do (
+        set "VERSION=%%a"
+        set "VERSION=!VERSION:"=!"
+        set "VERSION=!VERSION: =!"
+        set "VERSION=!VERSION:,=!"
+    )
+    if "!VERSION!"=="" (
+        echo ERROR: Failed to fetch latest version
+        exit /b 1
+    )
+    if "!VERSION!"=="latest" (
+        echo ERROR: Failed to resolve version
+        exit /b 1
+    )
+)
+
+echo Installing %BINARY% !VERSION! (%VARIANT% variant)...
+
+set "ARCHIVE=%BINARY%-%VARIANT%-windows-amd64.zip"
+set "URL=https://github.com/%REPO%/releases/download/!VERSION!/%ARCHIVE%"
+
+curl -fsSLI "%URL%" 2>nul | findstr /r "HTTP/.* [23]0[02]" >nul
+if errorlevel 1 (
+    set "ARCHIVE=%BINARY%-windows-amd64.zip"
+    echo Using full variant (%VARIANT% variant not available^)
+)
+
+curl -fsSL "https://github.com/%REPO%/releases/download/!VERSION!/!ARCHIVE!" -o "%TEMP%\!ARCHIVE!"
+if errorlevel 1 (
+    echo ERROR: Failed to download !ARCHIVE!
+    exit /b 1
+)
+
+powershell -Command "try { Expand-Archive -Force '%TEMP%\!ARCHIVE!' '%INSTALL_DIR%' } catch { exit 1 }"
+if errorlevel 1 (
+    echo ERROR: Failed to extract archive
+    del "%TEMP%\!ARCHIVE!" 2>nul
+    exit /b 1
+)
+del "%TEMP%\!ARCHIVE!" 2>nul
+
+REM Add to PATH using PowerShell (avoids setx 1024 char limit)
+echo %PATH% | findstr /i /c:"%INSTALL_DIR%" >nul
+if errorlevel 1 (
+    powershell -Command "[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';%INSTALL_DIR%', 'User')"
+    set "PATH=%PATH%;%INSTALL_DIR%"
+)
+
+if not exist "%INSTALL_DIR%\%BINARY%.exe" (
+    echo ERROR: Installation failed - binary not found
+    exit /b 1
+)
+
+"%INSTALL_DIR%\%BINARY%.exe" --version
+if errorlevel 1 exit /b 1
+
+endlocal
diff --git a/tools/install/php.sh b/tools/install/php.sh
new file mode 100644
index 0000000..46a2f40
--- /dev/null
+++ b/tools/install/php.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Core CLI installer - PHP/Laravel development variant
+# Usage: curl -fsSL https://core.io.in/php.sh | bash
+set -eo pipefail
+
+VERSION="${VERSION:-${1:-latest}}"
+REPO="host-uk/core"
+BINARY="core"
+VARIANT="php"
+
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+if [ "$VERSION" = "latest" ]; then
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -z "$VERSION" ]; then
+    echo "Failed to fetch latest version from GitHub API" >&2
+    exit 1
+  fi
+fi
+
+echo "Installing ${BINARY} ${VERSION} (${VARIANT} variant) for ${OS}/${ARCH}..."
+
+# Download variant-specific archive if available, else fall back to full
+ARCHIVE="${BINARY}-${VARIANT}-${OS}-${ARCH}.tar.gz"
+URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+
+if ! curl -fsSLI "$URL" 2>/dev/null | grep -qE "^HTTP/.* (200|302)"; then
+  ARCHIVE="${BINARY}-${OS}-${ARCH}.tar.gz"
+  URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+  echo "Using full variant (${VARIANT} variant not available for ${VERSION})"
+fi
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+if ! curl -fsSL "$URL" -o "$TMPDIR/$ARCHIVE"; then
+  echo "Failed to download ${ARCHIVE}" >&2
+  exit 1
+fi
+tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR"
+
+[ -w /usr/local/bin ] && mv "$TMPDIR/${BINARY}" /usr/local/bin/ || sudo mv "$TMPDIR/${BINARY}" /usr/local/bin/
+
+${BINARY} --version
diff --git a/tools/install/setup.bat b/tools/install/setup.bat
new file mode 100644
index 0000000..bfb0401
--- /dev/null
+++ b/tools/install/setup.bat
@@ -0,0 +1,85 @@
+@echo off
+REM Core CLI installer for Windows
+REM Usage: curl -fsSL https://core.io.in/setup.bat -o setup.bat && setup.bat
+
+setlocal enabledelayedexpansion
+
+set "VERSION=%~1"
+if "%VERSION%"=="" set "VERSION=latest"
+set "REPO=host-uk/core"
+set "BINARY=core"
+set "INSTALL_DIR=%LOCALAPPDATA%\Programs\core"
+
+echo [94m>>>[0m Installing Core CLI for Windows...
+
+REM Create install directory
+if not exist "%INSTALL_DIR%" mkdir "%INSTALL_DIR%"
+
+REM Resolve latest version if needed
+if "%VERSION%"=="latest" (
+    echo [94m>>>[0m Fetching latest version...
+    for /f "tokens=2 delims=:" %%a in ('curl -fsSL "https://api.github.com/repos/%REPO%/releases/latest" ^| findstr "tag_name"') do (
+        set "VERSION=%%a"
+        set "VERSION=!VERSION:"=!"
+        set "VERSION=!VERSION: =!"
+        set "VERSION=!VERSION:,=!"
+    )
+    if "!VERSION!"=="" (
+        echo [91m>>>[0m Failed to fetch latest version
+        exit /b 1
+    )
+    if "!VERSION!"=="latest" (
+        echo [91m>>>[0m Failed to resolve version
+        exit /b 1
+    )
+)
+
+echo [94m>>>[0m Installing %BINARY% !VERSION!...
+
+REM Download archive
+set "ARCHIVE=%BINARY%-windows-amd64.zip"
+set "DOWNLOAD_URL=https://github.com/%REPO%/releases/download/!VERSION!/%ARCHIVE%"
+set "TMP_FILE=%TEMP%\%ARCHIVE%"
+
+echo [94m>>>[0m Downloading %ARCHIVE%...
+curl -fsSL "%DOWNLOAD_URL%" -o "%TMP_FILE%"
+if errorlevel 1 (
+    echo [91m>>>[0m Failed to download %DOWNLOAD_URL%
+    exit /b 1
+)
+
+REM Extract
+echo [94m>>>[0m Extracting...
+powershell -Command "try { Expand-Archive -Force '%TMP_FILE%' '%INSTALL_DIR%' } catch { exit 1 }"
+if errorlevel 1 (
+    echo [91m>>>[0m Failed to extract archive
+    del "%TMP_FILE%" 2>nul
+    exit /b 1
+)
+del "%TMP_FILE%" 2>nul
+
+REM Add to PATH using PowerShell (avoids setx 1024 char limit)
+echo %PATH% | findstr /i /c:"%INSTALL_DIR%" >nul
+if errorlevel 1 (
+    echo [94m>>>[0m Adding to PATH...
+    powershell -Command "[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';%INSTALL_DIR%', 'User')"
+    set "PATH=%PATH%;%INSTALL_DIR%"
+)
+
+REM Verify
+if not exist "%INSTALL_DIR%\%BINARY%.exe" (
+    echo [91m>>>[0m Installation failed - binary not found
+    exit /b 1
+)
+
+"%INSTALL_DIR%\%BINARY%.exe" --version
+if errorlevel 1 (
+    echo [91m>>>[0m Installation verification failed
+    exit /b 1
+)
+
+echo [92m>>>[0m Installed successfully!
+echo.
+echo [90mRestart your terminal to use '%BINARY%' command[0m
+
+endlocal
diff --git a/tools/install/setup.sh b/tools/install/setup.sh
new file mode 100644
index 0000000..a90b512
--- /dev/null
+++ b/tools/install/setup.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+# Core CLI installer for macOS and Linux
+# Usage: curl -fsSL https://core.io.in/setup.sh | bash
+#        curl -fsSL https://core.io.in/setup.sh | bash -s -- v1.0.0
+set -eo pipefail
+
+VERSION="${1:-latest}"
+REPO="host-uk/core"
+BINARY="core"
+INSTALL_DIR="${CORE_INSTALL_DIR:-/usr/local/bin}"
+
+# Colours
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+DIM='\033[2m'
+NC='\033[0m'
+
+info() { echo -e "${BLUE}>>>${NC} $1"; }
+success() { echo -e "${GREEN}>>>${NC} $1"; }
+error() { echo -e "${RED}>>>${NC} $1" >&2; exit 1; }
+
+# Detect OS and architecture
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *) error "Unsupported architecture: $ARCH" ;;
+esac
+
+case "$OS" in
+  darwin|linux) ;;
+  *) error "Unsupported OS: $OS (use setup.bat for Windows)" ;;
+esac
+
+# Resolve latest version
+if [ "$VERSION" = "latest" ]; then
+  info "Fetching latest version..."
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -z "$VERSION" ]; then
+    error "Failed to fetch latest version"
+  fi
+fi
+
+info "Installing ${BINARY} ${VERSION} for ${OS}/${ARCH}..."
+
+# Download archive
+ARCHIVE="${BINARY}-${OS}-${ARCH}.tar.gz"
+DOWNLOAD_URL="https://github.com/${REPO}/releases/download/${VERSION}/${ARCHIVE}"
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+info "Downloading ${ARCHIVE}..."
+if ! curl -fsSL "$DOWNLOAD_URL" -o "${TMP_DIR}/${ARCHIVE}"; then
+  error "Failed to download ${DOWNLOAD_URL}"
+fi
+
+# Extract
+info "Extracting..."
+tar -xzf "${TMP_DIR}/${ARCHIVE}" -C "$TMP_DIR"
+chmod +x "${TMP_DIR}/${BINARY}"
+
+# Install
+info "Installing to ${INSTALL_DIR}..."
+if [ -w "$INSTALL_DIR" ]; then
+  mv "${TMP_DIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
+else
+  sudo mv "${TMP_DIR}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
+fi
+
+# Verify
+if command -v "$BINARY" &>/dev/null; then
+  success "Installed successfully!"
+  echo -e "${DIM}$($BINARY --version)${NC}"
+else
+  success "Installed to ${INSTALL_DIR}/${BINARY}"
+  echo -e "${DIM}Add ${INSTALL_DIR} to your PATH if not already present${NC}"
+fi