Windows install.ps1 fails: release archive missing codebase-memory-mcp.payload.exe

[georgejieh]

Bug

The Windows installer (install.ps1) fails during archive validation with:

error: unsafe or incomplete release archive: archive must contain exactly one codebase-memory-mcp.payload.exe

Reproduction

• Windows 10 x64, PowerShell 7.5 (pwsh -NoProfile)
• curl -fsSL -o cbm-install.ps1 https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.ps1
• pwsh -NoProfile -ExecutionPolicy Bypass -File cbm-install.ps1
• Download succeeds, SHA256 checksum verified, then the archive validation in cbm-install.ps1 rejects the release archive.

Root cause

install.ps1 declares the expected Windows archive contents at lines 17-23:

$BinName = "codebase-memory-mcp.exe"
$PayloadName = "codebase-memory-mcp.payload.exe"
$WindowsArchiveNames = @($BinName, $PayloadName, "LICENSE", "install.ps1", "THIRD_PARTY_NOTICES.md")

But the published release archive for codebase-memory-mcp-windows-amd64.zip contains only:

File	Size
codebase-memory-mcp.exe	273,333,760
LICENSE	1,128
install.ps1	6,450
THIRD_PARTY_NOTICES.md	381,851

codebase-memory-mcp.payload.exe is not in the archive. The install script's allowlist check at line ~224 (if ($archiveCounts[$archiveName] -ne 1)) trips and aborts.

The same issue likely affects the bash install.sh (it shares the same $WindowsArchiveNames allowlist logic).

Suggested fix

Either:

1. Update install.ps1 (and install.sh): drop codebase-memory-mcp.payload.exe from $WindowsArchiveNames if the payload is no longer part of the Windows release; OR
2. Update the release pipeline: include codebase-memory-mcp.payload.exe in the published Windows archive (rename the binary or include it as a separate file if it serves a different purpose, e.g. a sandbox/exec helper).

Environment

$ pwsh -NoProfile -Command '$PSVersionTable.PSVersion'
Major  Minor  Build  Revision
-----  -----  -----  --------
7      5      4      0

$ curl -sI https://github.com/DeusData/codebase-memory-mcp/releases/latest/download/codebase-memory-mcp-windows-amd64.zip
HTTP/2 302
location: https://github.com/.../codebase-memory-mcp-windows-amd64.zip

The download completes successfully (37,387,929 bytes), SHA256 verification passes, only the archive allowlist check fails.

[anggarasaja]

for workaround, i use install.ps1 from codebase-memory-mcp-windows-arm64.zip. The script automatically detect the architecture and installed successfully on amd64.

[DeusData]

Thanks for reporting this and for validating the architecture-detection workaround.

The archive contract is fixed on current main by a54ea95. Windows releases now contain one codebase-memory-mcp.exe, and install.ps1 validates that exact root entry (install.ps1:188-227); the smoke workflow also asserts that codebase-memory-mcp.payload.exe is absent. This fixes the same release-layout mismatch on both amd64 and arm64.

I am closing this as fixed on main. It will be included in the next release candidate. Thank you also to @anggarasaja for confirming the practical workaround.