fix(install): accept legacy archives without cbm-integrations.json

[michaelxer]

Summary

Fixes #1499.

Published v0.9.0 Windows/Unix release archives still ship the four-file core layout and omit cbm-integrations.json. After runtime assets were externalized on main, install.ps1 / install.sh from raw.githubusercontent.com/.../main require the five-file layout, so installers fail against current latest downloads with:

error: unsafe or incomplete release archive: archive must contain exactly one cbm-integrations.json

I reproduced this against the live v0.9.0 assets:

• codebase-memory-mcp-windows-amd64.zip entries: codebase-memory-mcp.exe, LICENSE, install.ps1, THIRD_PARTY_NOTICES.md (no cbm-integrations.json)
• codebase-memory-mcp-linux-amd64.tar.gz entries: same four-file core layout

Solution

• Accept either the legacy four-file core set or the current five-file set (core + cbm-integrations.json).
• UI releases still add exactly one hash-shaped pack on top of either layout.
• Keep rejecting unexpected root entries, duplicates, path traversal, and incomplete core members.
• scripts/package-release.sh is unchanged and still ships cbm-integrations.json for new builds.

Verification

bash tests/test_install_archive_layout_compat.sh
# test_install_archive_layout_compat: ok

bash tests/test_windows_bundle_contract.sh
# Windows one-executable runtime-set contract passed

bash -n install.sh
# ok

python3 -c 'open("install.ps1","rb").read().decode("ascii")'
# pure ASCII

Also checked the live v0.9.0 member lists against the new acceptance matrix (legacy 4-file and current 5-file both pass; incomplete/extra/duplicate still fail).

Limitations

• I did not run a full end-to-end Windows install of the downloaded binary after extraction (no Windows host here). The change is limited to archive namespace validation / required-member extraction.
• Once a release that actually packages cbm-integrations.json is published, both layouts remain valid; new archives should keep shipping the integration manifest via package-release.sh.

Checklist

• Focused bug fix for one issue
• DCO sign-off on commit
• Local contract/layout tests run
• Full scripts/test.sh / ASan suite (not run — installer-only change)

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.