Repository navigation
v0.12.0 npm postinstall always fails: linux-amd64 binary (316 MB) exceeds the installer's own MAX_ARCHIVE_MEMBER_BYTES limit (256 MB) #2657
Description
Summary
The v0.12.0 npm package cannot be installed via its own postinstall script: the shipped linux-amd64 binary expands to ~316 MB, which exceeds the installer's built-in safety limit of 268435456 bytes (256 MiB, MAX_ARCHIVE_MEMBER_BYTES in install.js). The script refuses to unpack the release's own artifact and the install fails.
Steps to reproduce
pnpm add -g codebase-memory-mcp@0.12.0(same with npm)
Observed output
.../node_modules/codebase-memory-mcp postinstall: codebase-memory-mcp: downloading v0.12.0 for linux/amd64...
.../node_modules/codebase-memory-mcp postinstall: codebase-memory-mcp: checksum verified.
.../node_modules/codebase-memory-mcp postinstall: codebase-memory-mcp: install failed — archive member "codebase-memory-mcp" exceeds the 268435456-byte expanded safety limit
.../nodebase-memory-mcp postinstall: You can install manually: https://github.com/DeusData/codebase-memory-mcp#installation
.../node_modules/codebase-memory-mcp postinstall: Failed
pnpm then rolls the install back, so the package ends up unusable (previous version 0.11.0 keeps working).
Root cause
install.jsguardsMAX_ARCHIVE_MEMBER_BYTES = 256 * 1024 * 1024codebase-memory-mcp-linux-amd64.tar.gz(v0.12.0) contains a 316.0 MB membercodebase-memory-mcp- v0.11.0 shipped a much smaller binary, so the limit was never hit before
$ tar -tvzf codebase-memory-mcp-linux-amd64.tar.gz
316.0 MB codebase-memory-mcp
Suggested fixes
- raise
MAX_ARCHIVE_MEMBER_BYTES(and friends) above the actual artifact size, or - strip/shrink the binary before release (0.12.0 nearly doubled the linux-amd64 size vs 0.11.0), or
- remove the hard cap in favor of a configurable limit
Environment: Linux x86_64, npm package codebase-memory-mcp@0.12.0, pnpm 12.11.2 (the failure is in the package's own install.js, not the package manager).
Activity
docs(upstream): triage PR DeusData#2658 and issues DeusData#2655-Deus…
DeusData commentedon Oct 16, 2026
Thank you so much, @hydroplexus, for this report: the exact output, the
tar -tvzflisting and the pointer toMAX_ARCHIVE_MEMBER_BYTESmade it quick to confirm, and it spares a lot of people a confusing failed install.You are right about the cause, and it is wider than npm on Linux: the npm, PyPI and Go wrappers all refuse an archive member above 256 MiB, and every v0.12.0 binary is 331-335 MB, so
npm i,pnpm add,pip installand the Go wrapper fail on every platform. One small correction to the analysis, for the record: the binary did not nearly double. v0.11.0 was already about 300 MB; what changed in v0.12.0 is that the npm and PyPI installers gained the limit (it was carried over from the Go wrapper).The fix removes those size limits from all three wrappers, and adds smoke tests that install through npm, pip and the Go wrapper against the real release archives on every PR and before every release is published, so an installer that cannot install what we ship can no longer reach you. It is in #2664 and ships as v0.12.1. While checking every install path we also fixed Homebrew (stuck at 0.10.3, and its Linux build needed glibc 2.38) and
go install(it never resolved a tagged version).Until then,
install.sh/install.ps1, Scoop and the release downloads are unaffected, andcodebase-memory-mcp@0.11.0on npm/PyPI keeps working. Thanks again!fix(pkg): remove the archive size caps from the npm, PyPI and Go wrap…