github-featured/deusdata--codebase-memory-mcp
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
1,889 Commits 307 Branches 52 Tags
fix/script-exec-bits
Commit Graph

6 Commits

Author SHA1 Message Date
Martin Vogel 83c137d2a5 feat: complete shared daemon lifecycle 
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
 2026-07-18 01:26:08 +02:00
Martin Vogel 0e00ef5702 feat: coordinate concurrent CBM sessions 
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
 2026-07-16 19:20:46 +02:00
Martin Vogel eb748cb532 Bump the go-install shim to v0.8.1 2026-06-12 09:59:51 +02:00
Martin Vogel c1eb3dd2d1 Comprehensive security hardening across all installers 
install.sh:
- Wrap entire body in main() to prevent partial execution from curl|bash
  (interrupted download would execute truncated script)

install.ps1:
- Enforce TLS 1.2+ (older PowerShell defaults to TLS 1.0)

PyPI (_cli.py):
- Add SHA256 checksum verification against checksums.txt (was the only
  installer without checksums)

npm (install.js):
- Add SHA256 checksum verification against checksums.txt
- Validate HTTPS on every redirect hop (max 5 redirects)
- Replace execSync string interpolation with execFileSync array args
  (eliminates shell injection vector in tar/PowerShell calls)
- Add path traversal check on extracted binary

npm (bin.js):
- Auto-download binary if missing (handles --ignore-scripts / pnpm)

Go wrapper (main.go):
- Custom HTTP client with CheckRedirect that rejects non-HTTPS redirects
  (Go's default http.Get follows redirects without scheme validation)
- Fix variable name bug in error message (url → rawURL)
 2026-04-14 21:00:42 +02:00
Martin Vogel a89bf96382 Harden installers: remove Unblock-File, add HTTPS-only URL validation 
install.ps1:
- Remove both Unblock-File calls (Defender ClickFix.R!ml signal)
- Remove ExecutionPolicy ByPass from usage comment (scanned by Defender)
- Add HTTPS-only URL scheme check on CBM_DOWNLOAD_URL

install.sh:
- Add HTTPS-only URL scheme check on CBM_DOWNLOAD_URL

pkg/go wrapper:
- Add validateURLScheme() to httpGet and fetchChecksums (defense-in-depth,
  matching Python wrapper's _validate_url_scheme from PR #248)

All installers now allow localhost/127.0.0.1 for testing but reject
http://, ftp://, file:// and other schemes.
 2026-04-14 20:44:17 +02:00
DeusData 39901769fd Add pkg/go — Go module wrapper for go install distribution 
Adds a thin Go wrapper at pkg/go/cmd/codebase-memory-mcp that detects
the current platform and architecture, downloads the matching pre-built
binary from GitHub Releases, verifies its SHA-256 checksum, caches it,
and replaces the current process via exec.

Install via:
  go install github.com/DeusData/codebase-memory-mcp/pkg/go/cmd/codebase-memory-mcp@latest

The Go module proxy indexes this automatically once live on main.
 2026-04-12 18:28:29 +01:00