One-line installer broken: v0.9.0/v0.9.1-rc.1 tar.gz missing cbm-integrations.json while main's install.sh requires it

[MIt9]

Impact

curl -fsSL .../main/install.sh | bash fails user-side with:

Checksum verified.
error: release archive does not match the exact standard member set

because install.sh on main (updated Aug 8, 2026) enforces an exact 5-member archive (codebase-memory-mcp cbm-integrations.json LICENSE install.sh THIRD_PARTY_NOTICES.md), while every published latest archive was built before cbm-integrations.json existed.

Root cause: not a packaging bug — a release gap

Verified against the published assets:

Release	Published	darwin-arm64.tar.gz members
v0.9.0 (latest)	2026-07-08	binary, LICENSE, install.sh, THIRD_PARTY_NOTICES.md — no cbm-integrations.json
v0.9.1-rc.1	2026-07-30	spawn — same missing file

The fix is already merged to main:

• 36584130 — carry cbm-integrations.json wherever the binary goes
• a6f132bc — ship integration templates as a verified JSON asset, not embedded bytes
• 8018561c — externalize runtime assets, harden VT verification (adds installer-side exact-member validation + --verify-runtime-assets gate in scripts/package-release.sh)

Neither v0.9.0 nor v0.9.1-rc.1 contains any of these commits. scripts/package-release.sh on main correctly stages assets/cbm-integrations.json into every archive, so a release cut from current main will be consistent.

Suggested action

Cut v0.9.1 from main (and re-cut the rc) so the published archive matches the installer contract. No source change required.

Workaround for affected users

curl -fsSL -o /tmp/cbm.tar.gz "https://github.com/DeusData/codebase-memory-mcp/releases/latest/download/codebase-memory-mcp-darwin-arm64.tar.gz"
mkdir -p /tmp/cbm && tar -xzf /tmp/cbm.tar.gz -C /tmp/cbm
/tmp/cbm/codebase-memory-mcp install -y --force --dir="$HOME/.local/bin"

(The archive's own install.sh predates the strict member check, so the manual path works.)

[github-actions]

Thanks for raising this! It looks like a duplicate of an existing issue — the canonical one is linked above. Continuing the discussion there keeps everything in one place. We leave this open for visibility; a maintainer will close it once it's fully covered.

[DeusData]

Thank you for reporting the broken one-line installer and identifying the missing archive member. This is the same release-layout mismatch tracked with broader multi-platform reproduction in #1510. I am closing this as a duplicate so confirmation and fix status stay in the canonical thread.