Sync from upstream: ncp is Python now, runs on Windows too

management/ncp.py replaces the bash CLI's logic; nexus-cli.sh and the new
ncp.ps1 are thin wrappers, so Linux keeps its entry point and Windows gains one.
psutil handles process and port work on both platforms.

install-windows.ps1 registers ncp in the PowerShell profile. The panel VPN
switch now resolves its WireGuard connection through NetworkManager instead of
a hardcoded name, and the .ps1 ASCII guard globs rather than naming files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

install-windows.ps1

@@ -12,7 +12,16 @@
         Right-click install-windows.ps1 -> "Run with PowerShell"
 
     Requires Windows 10/11 with winget (App Installer). No WSL, no reboot.
+.PARAMETER InvokerProfile
+    Internal. The PowerShell profile path of the user who launched the
+    installer, captured before self-elevation and passed to the elevated run.
+    If a standard account elevates with a DIFFERENT admin's credentials, the
+    elevated process sees that admin's $PROFILE - so ncp would be registered
+    for the wrong user. Not meant to be passed by hand.
 #>
+param(
+    [string]$InvokerProfile = ""
+)
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
@@ -48,7 +57,11 @@ $IsAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIden
     [Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $IsAdmin) {
     Write-Host "Requesting administrator privileges..." -ForegroundColor Yellow
-    Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
+    # Capture THIS user's profile path before elevating and hand it to the
+    # elevated run: if UAC prompts for another admin's credentials, that process
+    # would otherwise register ncp in the wrong user's profile.
+    $Invoker = $PROFILE.CurrentUserAllHosts
+    Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`" -InvokerProfile `"$Invoker`"" -Verb RunAs
     exit
 }
 
@@ -164,6 +177,44 @@ try {
     Write-Warn "Could not adjust Ollama autostart - you can still Start/Stop AI from the app."
 }
 
+# -- ncp command ---------------------------------------------------------------
+# The Linux side registers ncp in ~/.bashrc from restore-linux.sh; this is the
+# same idea for PowerShell. Guarded by a marker so re-running the installer is a
+# no-op instead of stacking duplicate functions.
+Write-Step "Registering the ncp command"
+try {
+    # CurrentUserAllHosts (profile.ps1), not $PROFILE: $PROFILE is host-specific,
+    # so ncp would exist in the console but not in the VS Code terminal or ISE.
+    # Prefer the invoking user's path when we were elevated - see -InvokerProfile.
+    $ProfilePath = if ($InvokerProfile) { $InvokerProfile } else { $PROFILE.CurrentUserAllHosts }
+    $ProfileDir = Split-Path -Parent $ProfilePath
+    if (-not (Test-Path $ProfileDir)) {
+        New-Item -ItemType Directory -Path $ProfileDir -Force | Out-Null
+    }
+    $Marker = "# NexusOS ncp"
+    $Existing = ""
+    if (Test-Path $ProfilePath) {
+        $Existing = Get-Content -Path $ProfilePath -Raw -ErrorAction SilentlyContinue
+    }
+    if ($Existing -and $Existing.Contains($Marker)) {
+        Write-OK "ncp already registered in $ProfilePath"
+    } else {
+        $NcpPs1 = Join-Path $RepoRoot "management\ncp.ps1"
+        # Without this, a Join-Path that fails writes `function ncp { & "" }` -
+        # a broken profile with no error. Fail into the catch below instead.
+        if (-not (Test-Path $NcpPs1)) { throw "ncp.ps1 not found at '$NcpPs1'" }
+        # ASCII encoding: the content is ASCII anyway, and -Encoding UTF8 on
+        # PowerShell 5.1 can plant a BOM in the middle of an existing profile.
+        Add-Content -Path $ProfilePath -Encoding ASCII -Value ""
+        Add-Content -Path $ProfilePath -Encoding ASCII -Value $Marker
+        Add-Content -Path $ProfilePath -Encoding ASCII -Value "function ncp { & `"$NcpPs1`" @args }"
+        Write-OK "ncp registered in $ProfilePath"
+    }
+} catch {
+    Write-Warn "Could not register ncp - add this line to your PowerShell profile:"
+    Write-Warn "  function ncp { & '$RepoRoot\management\ncp.ps1' @args }"
+}
+
 # -- Desktop shortcut ----------------------------------------------------------
 Write-Step "Creating desktop shortcut"
 try {
@@ -193,6 +244,9 @@ Write-Host "           (or run  powershell -File launch_nexus.ps1)" -ForegroundC
 Write-Host ""
 Write-Host "  The app opens at http://localhost:8000" -ForegroundColor White
 Write-Host "  The AI starts OFF - click 'Start AI' in the sidebar to turn it on." -ForegroundColor White
+Write-Host ""
+Write-Host "  Terminal:  open a NEW PowerShell window, then run  ncp help" -ForegroundColor White
+Write-Host "             (the profile that defines ncp is only read at startup)" -ForegroundColor DarkGray
 Write-Host "  ==========================================================" -ForegroundColor Green
 Write-Host ""
 Read-Host "Press Enter to close"