Function main

pkg/npm/install.js:95–152

()

}

async function main() {
  const platform = getPlatform();
  const arch = getArch();
  const ext = platform === 'windows' ? 'zip' : 'tar.gz';
  const binName = platform === 'windows' ? 'codebase-memory-mcp.exe' : 'codebase-memory-mcp';
  const binPath = path.join(BIN_DIR, binName);

  if (fs.existsSync(binPath)) {
    return; // already installed, nothing to do
  }

  fs.mkdirSync(BIN_DIR, { recursive: true });

  // Linux ships a fully-static "-portable" build; the standard linux binary
  // dynamically links glibc 2.38+ and fails on older distros. macOS/Windows
  // have no such variant. Keep in sync with install.sh / pypi _cli.py / cli.c.
  const variant = platform === 'linux' ? '-portable' : '';
  const archive = `codebase-memory-mcp-${platform}-${arch}${variant}.${ext}`;
  const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${archive}`;

  process.stdout.write(`codebase-memory-mcp: downloading v${VERSION} for ${platform}/${arch}...\n`);

  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cbm-install-'));
  const tmpArchive = path.join(tmpDir, `cbm.${ext}`);

  try {
    await download(url, tmpArchive);
    await verifyChecksum(tmpArchive, archive);

    // Extract using execFileSync (array args — no shell injection).
    if (ext === 'tar.gz') {
      execFileSync('tar', ['-xzf', tmpArchive, '-C', tmpDir, '--no-same-owner']);
    } else {
      execFileSync('powershell', [
        '-NoProfile', '-Command',
        `Expand-Archive -Path '${tmpArchive}' -DestinationPath '${tmpDir}' -Force`,
      ]);
    }

    // Validate extracted path doesn't escape tmpDir (tar-slip defense).
    const extracted = path.join(tmpDir, binName);
    const resolvedExtracted = path.resolve(extracted);
    const resolvedTmpDir = path.resolve(tmpDir);
    if (!resolvedExtracted.startsWith(resolvedTmpDir + path.sep)) {
      throw new Error(`Path traversal detected in archive: ${binName}`);
    }
    if (!fs.existsSync(extracted)) {
      throw new Error(`Binary not found after extraction at ${extracted}`);
    }

    fs.copyFileSync(extracted, binPath);
    fs.chmodSync(binPath, 0o755);

    process.stdout.write('codebase-memory-mcp: ready.\n');
  } finally {
    fs.rmSync(tmpDir, { recursive: true, force: true });
  }
}