Merge pull request DeusData#1543 from DeusData/fix/batch1-strictness-and-installers

fix(install,daemon): unbreak npx clients, group-writable homes, and legacy updaters (+3 security alerts)

Author: DeusData

.github/workflows/release.yml

@@ -360,16 +360,18 @@ jobs:
       - name: Build PyPI distribution
         working-directory: pkg/pypi
         run: |
-          # Pin to specific versions (typosquatting / supply-chain mitigation).
-          # OSSF scorecard prefers --require-hashes, but that needs full
-          # transitive deps; version pinning is the practical compromise.
+          # Every byte of the publish toolchain is bound by hash: version pins
+          # alone still let a compromised index serve different content, and a
+          # bare `pip install` resolves the whole transitive graph at run time
+          # (OSSF Scorecard pinned-dependencies). requirements-publish.txt is
+          # generated on a linux/amd64 python:3.12 image — see its header for
+          # the exact regeneration command.
           #
-          # twine >= 7 is required: `python -m build` resolves the UNPINNED
-          # hatchling backend fresh in its isolated env, and current hatchling
-          # emits Metadata-Version 2.5, which twine 6.2.0 rejects as invalid
-          # ("'2.5' is not a valid metadata version" — the v0.10.1 failure).
-          # Verified locally: identical artifacts, 6.2.0 rejects / 7.0.0 passes.
-          python -m pip install --upgrade 'build==1.3.0' 'twine==7.0.0'
+          # twine must stay >= 7 and hatchling is pinned in pyproject.toml:
+          # `python -m build` resolves its backend fresh in an isolated env, and
+          # a hatchling emitting Metadata-Version 2.5 against twine 6.2.0 is
+          # what broke the v0.10.1 publish.
+          python -m pip install --require-hashes -r requirements-publish.txt
           python -m build
           twine check dist/*
 
@@ -439,6 +441,16 @@ jobs:
     permissions:
       contents: write
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Legacy ui-* aliases so 0.9.x updaters stop 404ing (#1538). Runs after
+      # verify: same bytes as archives the VirusTotal gate already cleared, and
+      # publishing earlier would duplicate the scan set and provenance manifest.
+      - name: Publish legacy ui-* archive aliases
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: scripts/ci/publish-legacy-aliases.sh "${{ inputs.version }}" "$GITHUB_REPOSITORY"
+
       - name: Un-draft GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -80,3 +80,9 @@ soak-results-query-leak/
 # scripts/soak-test.sh stay tracked.
 /soak*/
 /memlab-*
+
+# Compiled Go wrapper binary. `go build` in pkg/go drops the executable beside
+# its sources; one was committed by accident (8.8 MB ELF, flagged by OSSF
+# Scorecard as a binary artifact in source). Source only, never the build.
+/pkg/go/codebase-memory-mcp
+/pkg/go/codebase-memory-mcp.exe

SECURITY.md

@@ -288,8 +288,8 @@ for Linux ELF binaries, so it is not a complete answer either.
 
 | Version | Supported |
 |---------|-----------|
-| Latest `0.9.x` | Yes — security fixes land in the newest release |
-| < 0.9   | No — please upgrade to the latest release |
+| Latest `0.10.x` | Yes — security fixes land in the newest release |
+| < 0.10   | No — please upgrade to the latest release |
 
 Only the latest release is supported. Security fixes are shipped in a new
 patched release rather than backported to older versions; upgrading to the

graph-ui/package-lock.json

@@ -41,6 +41,7 @@
   },
   "overrides": {
     "form-data": ">=4.0.6",
-    "@babel/core": ">=7.29.6"
+    "@babel/core": ">=7.29.6",
+    "nanoid": "^3.3.17"
   }
 }

graph-ui/package.json

@@ -237,8 +237,13 @@ fi
 # macOS: fix signing
 if [ "$OS" = "darwin" ]; then
     echo "Fixing macOS code signing..."
-    xattr -d com.apple.quarantine "$DLBIN" 2>/dev/null || true
-    codesign --sign - --force "$DLBIN" 2>/dev/null || true
+    # A curl-downloaded archive usually carries no quarantine attribute at all,
+    # and xattr then prints "No such xattr: com.apple.quarantine" on stderr.
+    # That harmless line was read as the cause of an unrelated install failure
+    # and became a bug report's title (#1537) — silence it; nothing here is an
+    # error worth showing.
+    xattr -d com.apple.quarantine "$DLBIN" >/dev/null 2>&1 || true
+    codesign --sign - --force "$DLBIN" >/dev/null 2>&1 || true
 fi
 
 # Verify the candidate before it requests account-wide maintenance. The

install.sh

@@ -15,11 +15,7 @@ High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-si
 npm install -g codebase-memory-mcp
 ```
 
-The standard runtime set for your platform is downloaded automatically at install time. To select the UI runtime set and its verified frontend pack, set `CBM_VARIANT=ui` while installing and when invoking the wrapper:
-
-```bash
-CBM_VARIANT=ui npm install -g codebase-memory-mcp
-```
+The runtime set for your platform is downloaded automatically at install time. There is one composition per platform and the graph UI is always included — the former `CBM_VARIANT=ui` opt-in is obsolete.
 
 Then configure your coding agents:
 

pkg/go/codebase-memory-mcp

@@ -580,14 +580,13 @@ async function main() {
   // dynamically links glibc 2.38+ and fails on older distros. macOS/Windows
   // have no such variant. Keep in sync with install.sh / pypi _cli.py / cli.c.
   const variant = platform === 'linux' ? '-portable' : '';
-  // Opt into the UI build (embedded graph visualization) with CBM_VARIANT=ui.
-  // Default is the standard (headless) build. Mirrors install.sh --ui.
-  const ui = (process.env.CBM_VARIANT || '').toLowerCase() === 'ui' ? 'ui-' : '';
-  const archive = `codebase-memory-mcp-${ui}${platform}-${arch}${variant}.${ext}`;
+  // No UI/standard split since v0.10.0: one archive per platform, graph UI
+  // always embedded. The old CBM_VARIANT=ui opt-in pointed at ui-* archives
+  // that no longer exist, so honoring it could only 404 (#1538).
+  const archive = `codebase-memory-mcp-${platform}-${arch}${variant}.${ext}`;
   const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${archive}`;
 
-  const uiLabel = ui ? '(ui) ' : '';
-  process.stdout.write(`codebase-memory-mcp: downloading v${VERSION} ${uiLabel}for ${platform}/${arch}...\n`);
+  process.stdout.write(`codebase-memory-mcp: downloading v${VERSION} for ${platform}/${arch}...\n`);
 
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cbm-install-'));
   const tmpArchive = path.join(tmpDir, `cbm.${ext}`);

pkg/npm/README.md

@@ -4,7 +4,7 @@ mcp-name: io.github.DeusData/codebase-memory-mcp
 
 **Fast code intelligence engine for AI coding agents.** Indexes an average repository in milliseconds, the Linux kernel (28M LOC) in 3 minutes. Answers structural queries in under 1ms.
 
-This Python wrapper downloads the selected `codebase-memory-mcp` runtime set from [GitHub Releases](https://github.com/DeusData/codebase-memory-mcp/releases) on first run and verifies it before publishing it in your OS cache directory. The standard set contains the native executable and authenticated integration asset; `CBM_VARIANT=ui` additionally selects the content-addressed UI pack.
+This Python wrapper downloads the selected `codebase-memory-mcp` runtime set from [GitHub Releases](https://github.com/DeusData/codebase-memory-mcp/releases) on first run and verifies it before publishing it in your OS cache directory. The set contains the native executable and authenticated integration asset, with the graph UI always embedded.
 
 ## Installation
 
@@ -14,7 +14,7 @@ pip install codebase-memory-mcp
 pipx install codebase-memory-mcp
 ```
 
-To use the UI variant, set `CBM_VARIANT=ui` when invoking the wrapper (and consistently for any package-managed update or reinstall).
+There is one composition per platform: the graph UI ships in every build, so no variant selection is needed.
 
 ## Usage