Merge remote-tracking branch 'upstream/main' into feat/claude-plugin

Signed-off-by: Kody <kaidi.shi.1121@gmail.com>

Author: Geek0x0

.github/workflows/_build.yml

@@ -85,18 +85,26 @@ jobs:
       # Archive layout/name live in the ONE canonical script the local
       # artifact-flow smoke lane also runs (venue-parity contract).
       - name: Archive release binary (canonical package-release.sh)
+        env:
+          VERSION: ${{ inputs.version }}
         run: scripts/package-release.sh ${{ matrix.goos }} ${{ matrix.goarch }}
 
       - name: Attest release binary provenance
         if: ${{ inputs.attest }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
-          subject-path: codebase-memory-mcp-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
+          # *.mcpb matches nothing on the glibc-dynamic linux targets — the
+          # canonical packager builds bundles only where static/one-click holds.
+          subject-path: |
+            codebase-memory-mcp-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
+            *.mcpb
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: "*.tar.gz"
+          path: |
+            *.tar.gz
+            *.mcpb
 
   build-windows:
     runs-on: windows-latest
@@ -133,18 +141,24 @@ jobs:
       # artifact-flow smoke lane also runs (venue-parity contract).
       - name: Archive release binary (canonical package-release.sh)
         shell: msys2 {0}
+        env:
+          VERSION: ${{ inputs.version }}
         run: scripts/package-release.sh windows amd64 CC=clang CXX=clang++
 
       - name: Attest release binary provenance
         if: ${{ inputs.attest }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
-          subject-path: codebase-memory-mcp-windows-amd64.zip
+          subject-path: |
+            codebase-memory-mcp-windows-amd64.zip
+            *.mcpb
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-windows-amd64
-          path: "*.zip"
+          path: |
+            *.zip
+            *.mcpb
 
   build-windows-arm64:
     # Native ARM64 Windows binary via the CLANGARM64 toolchain on the
@@ -183,18 +197,24 @@ jobs:
 
       - name: Archive release binary (canonical package-release.sh)
         shell: msys2 {0}
+        env:
+          VERSION: ${{ inputs.version }}
         run: scripts/package-release.sh windows arm64 CC=clang CXX=clang++
 
       - name: Attest release binary provenance
         if: ${{ inputs.attest }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
-          subject-path: codebase-memory-mcp-windows-arm64.zip
+          subject-path: |
+            codebase-memory-mcp-windows-arm64.zip
+            *.mcpb
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-windows-arm64
-          path: "*.zip"
+          path: |
+            *.zip
+            *.mcpb
 
   build-linux-portable:
     # Fully static Linux binaries (gcc -static on Ubuntu).
@@ -235,15 +255,21 @@ jobs:
           ldd build/c/codebase-memory-mcp 2>&1 | grep -q "not a dynamic executable" || ldd build/c/codebase-memory-mcp 2>&1 | grep -q "statically linked"
 
       - name: Archive release binary (canonical package-release.sh)
+        env:
+          VERSION: ${{ inputs.version }}
         run: scripts/package-release.sh linux ${{ matrix.arch }}-portable
 
       - name: Attest release binary provenance
         if: ${{ inputs.attest }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
-          subject-path: codebase-memory-mcp-linux-${{ matrix.arch }}-portable.tar.gz
+          subject-path: |
+            codebase-memory-mcp-linux-${{ matrix.arch }}-portable.tar.gz
+            *.mcpb
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-linux-${{ matrix.arch }}-portable
-          path: "*.tar.gz"
+          path: |
+            *.tar.gz
+            *.mcpb

.github/workflows/release.yml

@@ -144,16 +144,25 @@ jobs:
           merge-multiple: true
 
       - name: List artifacts
-        run: ls -la *.tar.gz *.zip
+        run: ls -la *.tar.gz *.zip *.mcpb
 
       - name: Generate checksums
-        run: sha256sum *.tar.gz *.zip > checksums.txt
+        run: sha256sum *.tar.gz *.zip *.mcpb > checksums.txt
 
       - name: Attest checksum provenance
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: checksums.txt
 
+      # publish-mcp-registry reads the *.mcpb sha256 lines from here — a
+      # same-run workflow artifact, not a draft-release download, so that
+      # job keeps contents: read and no gh dependency.
+      - name: Preserve checksums for the registry job
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-checksums
+          path: checksums.txt
+
       # SBOM content lives in the canonical scripts/ci entry, not inline YAML
       # (venue-parity contract): vendored versions are reviewable there.
       - name: Generate SBOM
@@ -170,7 +179,7 @@ jobs:
 
       - name: Sign artifacts
         run: |
-          for f in *.tar.gz *.zip checksums.txt; do
+          for f in *.tar.gz *.zip *.mcpb checksums.txt; do
             cosign sign-blob --yes --bundle "${f}.bundle" "$f"
           done
 
@@ -202,6 +211,7 @@ jobs:
           files: |
             *.tar.gz
             *.zip
+            *.mcpb
             checksums.txt
             sbom.json
             *.bundle
@@ -229,11 +239,14 @@ jobs:
         run: |
           ARCHIVE_DIR="$RUNNER_TEMP/release-archives"
           mkdir -p "$ARCHIVE_DIR" binaries
-          gh release download "$VERSION" --dir "$ARCHIVE_DIR" --repo "$GITHUB_REPOSITORY" --pattern '*.tar.gz' --pattern '*.zip'
+          gh release download "$VERSION" --dir "$ARCHIVE_DIR" --repo "$GITHUB_REPOSITORY" --pattern '*.tar.gz' --pattern '*.zip' --pattern '*.mcpb'
+          # 14 = 8 archives + 6 MCPB bundles; runtime 42 = 8×3 archive
+          # sidecars + 6×3 bundle members (manifest.json, LICENSE, notices).
+          # The bundle binaries dedupe to the archive objects byte-for-byte.
           scripts/ci/extract-release-archives.sh "$ARCHIVE_DIR" binaries \
-            --expect-archives=8 \
-            --expect-binaries=8 \
-            --expect-runtime-files=24
+            --expect-archives=14 \
+            --expect-binaries=14 \
+            --expect-runtime-files=42
 
       - name: Security audits on all unique extracted release objects
         run: |
@@ -350,8 +363,17 @@ jobs:
         # A prerelease must never become npm `latest` — plain `npm install`
         # would serve the RC to everyone. Publish prereleases under the
         # `next` dist-tag; testers opt in via `npm i codebase-memory-mcp@next`.
+        #
+        # Idempotency: npm versions are immutable, so a re-run of this job
+        # after a partial success (v0.10.1: npm published, then the twine
+        # step died) can never republish — it 403s on its own earlier
+        # success and the release wedges in draft forever. If the exact
+        # version already exists on the registry, publishing is DONE; skip.
         run: |
-          if [[ "$RELEASE_VERSION" == *-* ]]; then
+          V="${RELEASE_VERSION#v}"
+          if npm view "codebase-memory-mcp@$V" version >/dev/null 2>&1; then
+            echo "npm already has codebase-memory-mcp@$V — skipping publish (idempotent re-run)"
+          elif [[ "$RELEASE_VERSION" == *-* ]]; then
             npm publish --access public --provenance --tag next
           else
             npm publish --access public --provenance
@@ -366,18 +388,30 @@ jobs:
       - name: Build PyPI distribution
         working-directory: pkg/pypi
         run: |
-          # Pin to specific versions (typosquatting / supply-chain mitigation).
-          # OSSF scorecard prefers --require-hashes, but that needs full
-          # transitive deps; version pinning is the practical compromise.
-          python -m pip install --upgrade 'build==1.3.0' 'twine==6.2.0'
+          # Every byte of the publish toolchain is bound by hash: version pins
+          # alone still let a compromised index serve different content, and a
+          # bare `pip install` resolves the whole transitive graph at run time
+          # (OSSF Scorecard pinned-dependencies). requirements-publish.txt is
+          # generated on a linux/amd64 python:3.12 image — see its header for
+          # the exact regeneration command.
+          #
+          # twine must stay >= 7 and hatchling is pinned in pyproject.toml:
+          # `python -m build` resolves its backend fresh in an isolated env, and
+          # a hatchling emitting Metadata-Version 2.5 against twine 6.2.0 is
+          # what broke the v0.10.1 publish.
+          python -m pip install --require-hashes -r requirements-publish.txt
           python -m build
+          twine check dist/*
 
       - name: Publish to PyPI
         working-directory: pkg/pypi
         env:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
-        run: twine upload --non-interactive dist/*
+        # --skip-existing: PyPI files are immutable like npm versions; a
+        # re-run after partial success must treat already-uploaded files
+        # as done, not as a fatal collision.
+        run: twine upload --non-interactive --skip-existing dist/*
 
   # ── 8b. Publish server.json to the official MCP Registry ──────
   # Runs after npm + PyPI so the registry can verify package ownership
@@ -412,6 +446,20 @@ jobs:
           jq --arg v "$VERSION" '.version = $v | (.packages[].version) = $v' \
             server.json > server.tmp && mv server.tmp server.json
           echo "server.json pinned to $VERSION"
+
+      # The MCPB entries need each bundle's sha256; checksums.txt comes from
+      # the release-draft job as a same-run artifact (not a draft-release
+      # download — that would need contents beyond read plus gh).
+      - name: Fetch release checksums
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-checksums
+
+      - name: Append MCPB package entries to server.json
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          scripts/ci/gen-mcpb-registry-entries.sh server.json checksums.txt "$RELEASE_VERSION"
           cat server.json
 
       - name: Install mcp-publisher
@@ -435,6 +483,16 @@ jobs:
     permissions:
       contents: write
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Legacy ui-* aliases so 0.9.x updaters stop 404ing (#1538). Runs after
+      # verify: same bytes as archives the VirusTotal gate already cleared, and
+      # publishing earlier would duplicate the scan set and provenance manifest.
+      - name: Publish legacy ui-* archive aliases
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: scripts/ci/publish-legacy-aliases.sh "${{ inputs.version }}" "$GITHUB_REPOSITORY"
+
       - name: Un-draft GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -81,3 +81,9 @@ soak-results-query-leak/
 # scripts/soak-test.sh stay tracked.
 /soak*/
 /memlab-*
+
+# Compiled Go wrapper binary. `go build` in pkg/go drops the executable beside
+# its sources; one was committed by accident (8.8 MB ELF, flagged by OSSF
+# Scorecard as a binary artifact in source). Source only, never the build.
+/pkg/go/codebase-memory-mcp
+/pkg/go/codebase-memory-mcp.exe

SECURITY.md

@@ -288,8 +288,8 @@ for Linux ELF binaries, so it is not a complete answer either.
 
 | Version | Supported |
 |---------|-----------|
-| Latest `0.9.x` | Yes — security fixes land in the newest release |
-| < 0.9   | No — please upgrade to the latest release |
+| Latest `0.10.x` | Yes — security fixes land in the newest release |
+| < 0.10   | No — please upgrade to the latest release |
 
 Only the latest release is supported. Security fixes are shipped in a new
 patched release rather than backported to older versions; upgrading to the

graph-ui/package-lock.json

@@ -41,6 +41,7 @@
   },
   "overrides": {
     "form-data": ">=4.0.6",
-    "@babel/core": ">=7.29.6"
+    "@babel/core": ">=7.29.6",
+    "nanoid": "^3.3.17"
   }
 }

graph-ui/package.json

@@ -220,25 +220,87 @@ if [ "$EXPECTED" != "$ACTUAL" ]; then
 fi
 echo "Checksum verified."
 
+# Validate the complete archive namespace before extraction. Current and legacy
+# release assets use the same four-member root layout; anything outside that
+# closed set is a release-integrity failure, not a sidecar to ignore.
+if [ "$OS" = "windows" ]; then
+    ARCHIVE_BINARY="codebase-memory-mcp.exe"
+    ARCHIVE_INSTALLER="install.ps1"
+else
+    ARCHIVE_BINARY="codebase-memory-mcp"
+    ARCHIVE_INSTALLER="install.sh"
+fi
+ARCHIVE_MEMBERS_FILE="$DLDIR/archive-members.txt"
+if [ "$EXT" = "zip" ]; then
+    if ! unzip -Z1 "$DLDIR/$ARCHIVE" > "$ARCHIVE_MEMBERS_FILE"; then
+        echo "error: could not enumerate release archive" >&2
+        exit 1
+    fi
+else
+    if ! tar -tzf "$DLDIR/$ARCHIVE" > "$ARCHIVE_MEMBERS_FILE"; then
+        echo "error: could not enumerate release archive" >&2
+        exit 1
+    fi
+fi
+
+BINARY_MEMBERS=0
+LICENSE_MEMBERS=0
+INSTALLER_MEMBERS=0
+NOTICE_MEMBERS=0
+ARCHIVE_MEMBER_COUNT=0
+while IFS= read -r member || [ -n "$member" ]; do
+    ARCHIVE_MEMBER_COUNT=$((ARCHIVE_MEMBER_COUNT + 1))
+    case "$member" in
+        "$ARCHIVE_BINARY") BINARY_MEMBERS=$((BINARY_MEMBERS + 1)) ;;
+        LICENSE) LICENSE_MEMBERS=$((LICENSE_MEMBERS + 1)) ;;
+        "$ARCHIVE_INSTALLER") INSTALLER_MEMBERS=$((INSTALLER_MEMBERS + 1)) ;;
+        THIRD_PARTY_NOTICES.md) NOTICE_MEMBERS=$((NOTICE_MEMBERS + 1)) ;;
+        *)
+            echo "error: release archive contains unexpected member: $member" >&2
+            exit 1
+            ;;
+    esac
+done < "$ARCHIVE_MEMBERS_FILE"
+
+if [ "$BINARY_MEMBERS" -ne 1 ] || [ "$LICENSE_MEMBERS" -ne 1 ] ||
+    [ "$INSTALLER_MEMBERS" -ne 1 ] || [ "$NOTICE_MEMBERS" -ne 1 ] ||
+    [ "$ARCHIVE_MEMBER_COUNT" -ne 4 ]; then
+    echo "error: release archive does not match the exact member set" >&2
+    exit 1
+fi
+
 # Extract
 echo "Extracting..."
 if [ "$EXT" = "zip" ]; then
     unzip -q "$DLDIR/$ARCHIVE" -d "$DLDIR"
 else
-    tar -xzf "$DLDIR/$ARCHIVE" -C "$DLDIR"
+    tar --no-same-owner -xzf "$DLDIR/$ARCHIVE" -C "$DLDIR"
 fi
 
-DLBIN="$DLDIR/codebase-memory-mcp"
-if [ ! -f "$DLBIN" ]; then
+for extracted_member in "$ARCHIVE_BINARY" LICENSE "$ARCHIVE_INSTALLER" \
+    THIRD_PARTY_NOTICES.md; do
+    if [ ! -f "$DLDIR/$extracted_member" ] || [ -L "$DLDIR/$extracted_member" ]; then
+        echo "error: release member is not a regular file: $extracted_member" >&2
+        exit 1
+    fi
+done
+
+DLBIN="$DLDIR/$ARCHIVE_BINARY"
+if [ ! -f "$DLBIN" ] || [ -L "$DLBIN" ]; then
     echo "error: binary not found after extraction" >&2
     exit 1
 fi
 
 # macOS: fix signing
 if [ "$OS" = "darwin" ]; then
     echo "Fixing macOS code signing..."
-    xattr -d com.apple.quarantine "$DLBIN" 2>/dev/null || true
-    codesign --sign - --force "$DLBIN" 2>/dev/null || true
+    # A curl-downloaded archive usually carries no quarantine attribute at all,
+    # and xattr then prints "No such xattr: com.apple.quarantine" on stderr.
+    # That harmless line was read as the cause of an unrelated install failure
+    # and became a bug report's title (#1537) — silence it; nothing here is an
+    # error worth showing.
+    xattr -d com.apple.quarantine "$DLBIN" >/dev/null 2>&1 || true
+    codesign --sign - --force "$DLBIN" >/dev/null 2>&1 || true
 fi
 
 # Verify the candidate before it requests account-wide maintenance. The