@remem-ai/remem 0.5.97 → 0.5.104

package/README.md

@@ -23,5 +23,8 @@ Environment variables:
 - `REMEM_NPM_SKIP_DOWNLOAD=1`: skip binary download during npm install
 - `REMEM_NPM_BINARY=/path/to/remem`: run an explicit existing binary
 
-See the main project README for Claude Code and OpenAI Codex setup details:
-https://github.com/majiayu000/remem
+See the product site and main project README for Claude Code, OpenAI Codex,
+Codex CLI, and MCP setup details:
+
+- https://majiayu000.github.io/remem/
+- https://github.com/majiayu000/remem

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@remem-ai/remem",
-  "version": "0.5.97",
-  "description": "Persistent memory for Claude Code and OpenAI Codex coding agents",
+  "version": "0.5.104",
+  "description": "Local-first coding agent memory for Claude Code and OpenAI Codex",
   "license": "MIT",
   "homepage": "https://majiayu000.github.io/remem/",
   "repository": {
@@ -32,15 +32,20 @@
   ],
   "keywords": [
     "claude-code",
-    "openai-codex",
     "codex",
+    "codex-cli",
+    "claude-code-memory",
+    "codex-memory",
+    "openai-codex",
     "memory",
     "agent-memory",
-    "coding-agents",
+    "coding-agent-memory",
+    "persistent-memory",
     "mcp",
     "mcp-server",
+    "coding-agent",
     "rust-cli",
-    "ai"
+    "developer-tools"
   ],
   "publishConfig": {
     "access": "public"

package/scripts/install.js

@@ -94,12 +94,28 @@ function sha256(file) {
   return hash.digest("hex");
 }
 
+function expectedAssetFile(key) {
+  if (!/^(darwin|linux)-(arm64|x64)$/.test(key)) {
+    throw new Error(`Unsupported release asset platform key: ${key}`);
+  }
+  return `remem-${key}.tar.gz`;
+}
+
+function validateAssetFile(file, key) {
+  const expected = expectedAssetFile(key);
+  if (file !== expected) {
+    throw new Error(`Release manifest asset ${key} has unsafe file name: ${file}`);
+  }
+  return file;
+}
+
 function resolveAsset(manifest, version, key) {
   const release = manifest?.versions?.[version];
   const asset = release?.assets?.[key];
   if (!asset || typeof asset.file !== "string") {
     throw new Error(`Release manifest for remem ${version} is missing asset ${key}`);
   }
+  const file = validateAssetFile(asset.file, key);
   if (!/^[0-9a-f]{64}$/i.test(asset.sha256 || "")) {
     throw new Error(`Release manifest asset ${key} is missing a valid sha256`);
   }
@@ -107,9 +123,9 @@ function resolveAsset(manifest, version, key) {
     ? release.base_url.replace(/\/$/, "")
     : BASE_URL;
   return {
-    file: asset.file,
+    file,
     sha256: asset.sha256.toLowerCase(),
-    url: `${baseUrl}/${asset.file}`,
+    url: `${baseUrl}/${file}`,
   };
 }
 
@@ -135,7 +151,7 @@ async function main() {
     const manifestUrl = `${BASE_URL}/remem-releases.json`;
     const manifest = await fetchJson(manifestUrl);
     const asset = resolveAsset(manifest, VERSION, key);
-    const archive = path.join(tmpDir, asset.file);
+    const archive = path.join(tmpDir, "remem-release.tar.gz");
 
     console.log(`Downloading remem ${VERSION} for ${key}`);
     await download(asset.url, archive);