Great motivation — the blocking setup is a real UX problem. A few correctness issues to address before this is mergeable:
lua/pkgm/downloaders/wget.lua — missing return after error
In the failure branch of vim.system's callback, on_finished(nil, err) is called but there's no return, so execution falls through and on_finished(self.dest, nil) is called too. Caller will be invoked twice with conflicting results. Compare with curl.lua which returns correctly.
Errors thrown from libuv callback thread — manager.lua download_package, powershell.lua
vim.system's callback runs on the libuv thread, not the main loop. err_util.throw / notify.error / any vim.api.* call from there is unsafe and can crash. Wrap the failure branches in vim.schedule(function() … end). extract_package correctly uses vim.schedule; the download error paths need the same.
install_all doesn't handle failures
If one install throws (via err_util.throw) inside a callback, the remaining counter never decrements and the final callback() never runs — setup hangs silently. Consider passing an error to on_finished and propagating it to install_all's caller.
Behavior change — vim.lsp.enable('jdtls') now called by plugin
This is a real breaking change for users who already enable jdtls themselves; they'll get double-enable. The PR description flags the breaking change but the README/docs aren't updated. Please document the new contract (either "don't call vim.lsp.enable('jdtls') yourself" or "we no-op if already enabled") and update README.
Type inconsistency — powershell.lua on_finished
Annotated as fun(file_path: string) with no nil/error, while curl.lua/wget.lua use fun(file_path: string|nil, err: string|nil). The dispatcher in manager.lua download_package expects the latter signature. Unify them.
Notify call from callback — manager.lua install
notify.info('Package installed successfully ' .. name) is in the download callback. Same scheduling concern as above.
Untested on Windows is noted in the PR — given the powershell path is the one with the trickiest scheduling, that's the riskiest spot.