codebase-memory-mcp 0.11.0__tar.gz → 0.12.0__tar.gz

{codebase_memory_mcp-0.11.0 → codebase_memory_mcp-0.12.0}/.gitignore

@@ -51,6 +51,9 @@ graph-ui/dist/
 # Generated by scripts/embed-frontend.sh into the source tree (the linker needs
 # it beside the other UI sources). Removed by scripts/clean.sh; never committed.
 src/ui/embedded_assets.c
+# Raw coverage profiles. A coverage-instrumented binary (make test-runner-cov,
+# cbm-cov) run without LLVM_PROFILE_FILE drops default.profraw in its cwd.
+*.profraw
 
 # Generated reports
 BENCHMARK_REPORT.md

{codebase_memory_mcp-0.11.0 → codebase_memory_mcp-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebase-memory-mcp
-Version: 0.11.0
+Version: 0.12.0
 Summary: Fast code intelligence for AI coding agents — installs a verified native runtime set
 Project-URL: Homepage, https://github.com/DeusData/codebase-memory-mcp
 Project-URL: Repository, https://github.com/DeusData/codebase-memory-mcp

{codebase_memory_mcp-0.11.0 → codebase_memory_mcp-0.12.0}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "codebase-memory-mcp"
-version = "0.11.0"
+version = "0.12.0"
 description = "Fast code intelligence for AI coding agents — installs a verified native runtime set"
 readme = "README.md"
 license = { text = "MIT" }

{codebase_memory_mcp-0.11.0 → codebase_memory_mcp-0.12.0}/requirements-publish.txt

@@ -354,6 +354,6 @@ secretstorage==3.5.0 \
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \
     --hash=sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7
-urllib3==2.7.0 \
-    --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \
-    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+urllib3==2.8.0 \
+    --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
+    --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63

{codebase_memory_mcp-0.11.0 → codebase_memory_mcp-0.12.0}/src/codebase_memory_mcp/_cli.py

@@ -1,5 +1,6 @@
 """Downloads codebase-memory-mcp on first run, then runs its native entry point."""
 
+import collections
 import errno
 import hashlib
 import json
@@ -42,6 +43,22 @@ _MAX_REDIRECTS = 5
 _NETWORK_TIMEOUT_SECONDS = 120
 _CANDIDATE_TIMEOUT_SECONDS = 15
 _MAX_CHECKSUM_MANIFEST_BYTES = 1024 * 1024
+# Release archive resource limits. Keep in sync with the Go wrapper
+# (pkg/go/cmd/codebase-memory-mcp/main.go) and the npm wrapper (install.js).
+_MAX_RELEASE_ARCHIVE_BYTES = 256 * 1024 * 1024
+_MAX_ARCHIVE_MEMBERS = 64
+_MAX_ARCHIVE_MEMBER_BYTES = 256 * 1024 * 1024
+_MAX_ARCHIVE_EXPANDED_BYTES = 512 * 1024 * 1024
+_ARCHIVE_COPY_CHUNK_BYTES = 64 * 1024
+_ArchiveLimits = collections.namedtuple(
+    "_ArchiveLimits", "compressed_bytes members member_bytes expanded_bytes"
+)
+_DEFAULT_ARCHIVE_LIMITS = _ArchiveLimits(
+    compressed_bytes=_MAX_RELEASE_ARCHIVE_BYTES,
+    members=_MAX_ARCHIVE_MEMBERS,
+    member_bytes=_MAX_ARCHIVE_MEMBER_BYTES,
+    expanded_bytes=_MAX_ARCHIVE_EXPANDED_BYTES,
+)
 _REDIRECT_CODES = frozenset({301, 302, 303, 307, 308})
 _RUNTIME_LOCK_NAME = ".codebase-memory-mcp-runtime.lock"
 _RUNTIME_LOCK_WAIT_SECONDS = 45
@@ -113,27 +130,50 @@ def _download_https(url: str, dest: str, max_bytes: int = 0) -> None:
 
         with response:
             _validate_url_scheme(response.geturl())
+            declared = (response.headers.get("Content-Length") or "").strip()
+            # Only plain ASCII digits are a length (str.isdigit also accepts
+            # characters that int() rejects); anything else is left to the
+            # byte counter below.
+            if max_bytes and re.fullmatch(r"[0-9]+", declared):
+                if int(declared) > max_bytes:
+                    raise RuntimeError(
+                        f"download exceeds the {max_bytes}-byte safety limit"
+                    )
             deadline = time.monotonic() + _NETWORK_TIMEOUT_SECONDS
             total = 0
-            with open(dest, "wb") as out:
-                while True:
-                    if time.monotonic() >= deadline:
-                        raise TimeoutError(
-                            f"download hop timed out: {current_url}"
-                        )
-                    chunk = response.read(65536)
-                    if not chunk:
-                        return
-                    total += len(chunk)
-                    if max_bytes and total > max_bytes:
-                        raise RuntimeError(
-                            f"download exceeds the {max_bytes}-byte safety limit"
-                        )
-                    out.write(chunk)
+            try:
+                with open(dest, "wb") as out:
+                    while True:
+                        if time.monotonic() >= deadline:
+                            raise TimeoutError(
+                                f"download hop timed out: {current_url}"
+                            )
+                        chunk = response.read(65536)
+                        if not chunk:
+                            return
+                        total += len(chunk)
+                        if max_bytes and total > max_bytes:
+                            raise RuntimeError(
+                                f"download exceeds the {max_bytes}-byte "
+                                f"safety limit"
+                            )
+                        out.write(chunk)
+            except BaseException:
+                # Never leave a partial download behind for a later step to
+                # mistake for the complete asset.
+                _remove_quietly(dest)
+                raise
 
     raise RuntimeError("too many redirects")
 
 
+def _remove_quietly(path) -> None:
+    try:
+        os.unlink(path)
+    except OSError:
+        pass
+
+
 def _verify_candidate(path: Path) -> None:
     """Require a staged native candidate to execute successfully."""
     try:
@@ -196,33 +236,157 @@ def _validate_archive_names(names, archive_names, casefold: bool = False):
         )
 
 
+def _validate_archive_limits(limits) -> None:
+    if (
+        limits.compressed_bytes <= 0
+        or limits.members <= 0
+        or limits.member_bytes <= 0
+        or limits.expanded_bytes <= 0
+    ):
+        sys.exit("codebase-memory-mcp: invalid archive resource safety limits")
+
+
+def _require_compressed_archive_within_limit(archive_path: str, limits) -> None:
+    status = os.stat(archive_path)
+    if not stat.S_ISREG(status.st_mode):
+        sys.exit("codebase-memory-mcp: release archive is not a regular file")
+    if status.st_size > limits.compressed_bytes:
+        sys.exit(
+            f"codebase-memory-mcp: release archive exceeds the "
+            f"{limits.compressed_bytes}-byte compressed safety limit"
+        )
+
+
+def _require_member_count_within_limit(count: int, limits) -> None:
+    if count > limits.members:
+        sys.exit(
+            f"codebase-memory-mcp: archive exceeds the {limits.members}-member "
+            f"safety limit"
+        )
+
+
+def _account_declared_archive_member(
+    name: str, size: int, declared_expanded: int, limits
+) -> int:
+    """Check one member's declared size; return the new declared total."""
+    if size < 0:
+        sys.exit(
+            f"codebase-memory-mcp: archive member has a negative declared "
+            f"size: {name!r}"
+        )
+    if size > limits.member_bytes:
+        sys.exit(
+            f"codebase-memory-mcp: archive member {name!r} exceeds the "
+            f"{limits.member_bytes}-byte expanded safety limit"
+        )
+    if declared_expanded > limits.expanded_bytes - size:
+        sys.exit(
+            f"codebase-memory-mcp: archive exceeds the {limits.expanded_bytes}-byte "
+            f"aggregate expanded safety limit"
+        )
+    return declared_expanded + size
+
+
+def _copy_archive_member_within_limits(
+    source, output, name: str, declared_size: int, actual_expanded: int, limits
+) -> int:
+    """Copy a member while counting bytes; return the new actual total.
+
+    Reads stop one byte past the smaller of the member and remaining aggregate
+    limits, so a member that yields more than it declares can never fill the
+    disk. The caller removes the target on failure.
+    """
+    remaining = limits.expanded_bytes - actual_expanded
+    copy_limit = min(limits.member_bytes, remaining)
+    copied = 0
+    while True:
+        wanted = min(_ARCHIVE_COPY_CHUNK_BYTES, copy_limit + 1 - copied)
+        if wanted <= 0:
+            break
+        chunk = source.read(wanted)
+        if not chunk:
+            break
+        copied += len(chunk)
+        if copied > copy_limit:
+            break
+        output.write(chunk)
+    if copied > limits.member_bytes:
+        sys.exit(
+            f"codebase-memory-mcp: archive member {name!r} exceeds the "
+            f"{limits.member_bytes}-byte actual expanded safety limit"
+        )
+    if copied > remaining:
+        sys.exit(
+            f"codebase-memory-mcp: archive exceeds the {limits.expanded_bytes}-byte "
+            f"aggregate actual expanded safety limit"
+        )
+    if copied != declared_size:
+        sys.exit(
+            f"codebase-memory-mcp: archive member {name!r} actual size {copied} "
+            f"does not match declared size {declared_size}"
+        )
+    return actual_expanded + copied
+
+
+def _write_archive_member_within_limits(
+    source, target: str, name: str, declared_size: int, actual_expanded: int, limits
+) -> int:
+    try:
+        with open(target, "xb") as output:
+            return _copy_archive_member_within_limits(
+                source, output, name, declared_size, actual_expanded, limits
+            )
+    except BaseException:
+        _remove_quietly(target)
+        raise
+
+
 def _safe_extract_tar(
-    tf, dest: str, archive_names=(), extract_names=(), ui: bool = False
+    tf,
+    dest: str,
+    archive_names=(),
+    extract_names=(),
+    ui: bool = False,
+    limits=_DEFAULT_ARCHIVE_LIMITS,
 ):
     """Validate a tar namespace, then extract only its authenticated runtime set."""
+    _validate_archive_limits(limits)
     members = tf.getmembers()
+    _require_member_count_within_limit(len(members), limits)
+    declared_expanded = 0
     for member in members:
         if not member.isfile():
             sys.exit(
                 f"codebase-memory-mcp: refusing unsafe tar entry "
                 f"(not a regular root file: {member.name!r})"
             )
+        declared_expanded = _account_declared_archive_member(
+            member.name, member.size, declared_expanded, limits
+        )
     _validate_archive_names([member.name for member in members], archive_names)
     runtime_names = list(extract_names)
     by_name = {member.name: member for member in members}
     dest_abs = os.path.abspath(dest)
+    actual_expanded = 0
     for name in runtime_names:
         source = tf.extractfile(by_name[name])
         if source is None:
             sys.exit(f"codebase-memory-mcp: could not read archive member: {name}")
         target = os.path.join(dest_abs, name)
-        with source, open(target, "xb") as output:
-            shutil.copyfileobj(source, output)
+        with source:
+            actual_expanded = _write_archive_member_within_limits(
+                source, target, name, by_name[name].size, actual_expanded, limits
+            )
     return tuple(runtime_names)
 
 
 def _safe_extract_zip(
-    zf, dest: str, archive_names=(), extract_names=(), ui: bool = False
+    zf,
+    dest: str,
+    archive_names=(),
+    extract_names=(),
+    ui: bool = False,
+    limits=_DEFAULT_ARCHIVE_LIMITS,
 ):
     """Extract a zipfile after validating its Windows-style namespace.
 
@@ -230,9 +394,16 @@ def _safe_extract_zip(
     members before extraction prevents archive order from selecting the binary
     that a portable package-manager shim eventually executes.
     """
+    _validate_archive_limits(limits)
     dest_abs = os.path.abspath(dest)
     names = []
-    for info in zf.infolist():
+    infos = zf.infolist()
+    _require_member_count_within_limit(len(infos), limits)
+    declared_expanded = 0
+    for info in infos:
+        declared_expanded = _account_declared_archive_member(
+            info.filename, info.file_size, declared_expanded, limits
+        )
         raw_name = info.filename
         name = raw_name.replace("\\", "/")
         segments_name = name[:-1] if name.endswith("/") else name
@@ -266,10 +437,18 @@ def _safe_extract_zip(
     # Extract only the validated runtime files. This avoids relying on
     # platform-specific zip path rewriting and always creates regular files.
     runtime_names = list(extract_names)
+    actual_expanded = 0
     for name in runtime_names:
         target = os.path.join(dest_abs, name)
-        with zf.open(name) as source, open(target, "xb") as output:
-            shutil.copyfileobj(source, output)
+        with zf.open(name) as source:
+            actual_expanded = _write_archive_member_within_limits(
+                source,
+                target,
+                name,
+                zf.getinfo(name).file_size,
+                actual_expanded,
+                limits,
+            )
     return tuple(runtime_names)
 
 
@@ -338,7 +517,7 @@ def _version() -> str:
         from importlib.metadata import version
         return version("codebase-memory-mcp")
     except Exception:
-        return "0.10.8"
+        return "0.11.0"
 
 
 def _os_name() -> str:
@@ -1179,7 +1358,7 @@ def _download(version: str) -> Path:
     with tempfile.TemporaryDirectory() as tmp:
         tmp_archive = os.path.join(tmp, f"cbm.{ext}")
         try:
-            _download_https(url, tmp_archive)
+            _download_https(url, tmp_archive, _MAX_RELEASE_ARCHIVE_BYTES)
         except (OSError, RuntimeError, urllib.error.URLError) as e:
             sys.exit(
                 f"codebase-memory-mcp: download failed ({e})\n"
@@ -1188,6 +1367,9 @@ def _download(version: str) -> Path:
             )
 
         _verify_checksum(tmp_archive, archive, version)
+        _require_compressed_archive_within_limit(
+            tmp_archive, _DEFAULT_ARCHIVE_LIMITS
+        )
 
         bin_name = (
             _WINDOWS_BINARY_NAME if os_name == "windows" else "codebase-memory-mcp"

{codebase_memory_mcp-0.11.0 → codebase_memory_mcp-0.12.0}/tests/test_cli.py

@@ -1,5 +1,6 @@
 import errno
 import hashlib
+import io
 import json
 import os
 import stat
@@ -835,3 +836,296 @@ _cli._publish_runtime_set(
                     False,
                 )
 
+
+class _FakeHttpsResponse:
+    """Minimal stand-in for the opener's response: headers, geturl, read."""
+
+    def __init__(self, body: bytes, headers=None):
+        self._body = body
+        self._offset = 0
+        self.headers = dict(headers or {})
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc_info):
+        return False
+
+    def geturl(self):
+        return "https://example.invalid/release.tar.gz"
+
+    def read(self, size=-1):
+        if size is None or size < 0:
+            size = len(self._body) - self._offset
+        chunk = self._body[self._offset : self._offset + size]
+        self._offset += len(chunk)
+        return chunk
+
+
+def _limits_with(**overrides):
+    return _cli._DEFAULT_ARCHIVE_LIMITS._replace(**overrides)
+
+
+def _write_tar_gz(archive, entries):
+    with tarfile.open(archive, "w:gz") as tf:
+        for name, data in entries:
+            info = tarfile.TarInfo(name)
+            info.size = len(data)
+            tf.addfile(info, io.BytesIO(data))
+
+
+def _write_zip(archive, entries):
+    with zipfile.ZipFile(archive, "w") as zf:
+        for name, data in entries:
+            zf.writestr(name, data)
+
+
+def _release_entries(names):
+    return [(name, f"payload of {name}".encode()) for name in names]
+
+
+class ArchiveLimitTests(unittest.TestCase):
+    URL = "https://example.invalid/release.tar.gz"
+
+    def _download(self, response, destination, max_bytes):
+        with mock.patch.object(_cli._HTTPS_OPENER, "open", return_value=response):
+            _cli._download_https(self.URL, destination, max_bytes)
+
+    def test_download_rejects_a_declared_length_over_the_limit(self):
+        with tempfile.TemporaryDirectory() as root:
+            destination = os.path.join(root, "release.tar.gz")
+            response = _FakeHttpsResponse(b"", {"Content-Length": "9"})
+            with self.assertRaises(RuntimeError) as raised:
+                self._download(response, destination, 8)
+            self.assertIn("8-byte safety limit", str(raised.exception))
+            self.assertFalse(os.path.exists(destination))
+
+    def test_download_rejects_a_body_over_the_limit_and_removes_the_partial_file(
+        self,
+    ):
+        with tempfile.TemporaryDirectory() as root:
+            destination = os.path.join(root, "release.tar.gz")
+            response = _FakeHttpsResponse(b"x" * 1024)
+            with self.assertRaises(RuntimeError) as raised:
+                self._download(response, destination, 8)
+            self.assertIn("8-byte safety limit", str(raised.exception))
+            self.assertFalse(os.path.exists(destination))
+
+    def test_download_within_the_limit_stores_the_body(self):
+        with tempfile.TemporaryDirectory() as root:
+            destination = os.path.join(root, "release.tar.gz")
+            response = _FakeHttpsResponse(b"payload", {"Content-Length": "7"})
+            self._download(response, destination, 1024)
+            with open(destination, "rb") as stored:
+                self.assertEqual(stored.read(), b"payload")
+
+    def test_download_counts_bytes_when_the_declared_length_is_not_a_number(self):
+        # A superscript two passes str.isdigit but not int(); such values and
+        # plain junk must fall through to the byte counter, never crash.
+        for declared in ("²", "abc", "", "1e3", "-1"):
+            with self.subTest(declared=declared), tempfile.TemporaryDirectory() as root:
+                destination = os.path.join(root, "release.tar.gz")
+                response = _FakeHttpsResponse(b"x" * 1024, {"Content-Length": declared})
+                with self.assertRaises(RuntimeError) as raised:
+                    self._download(response, destination, 8)
+                self.assertIn("8-byte safety limit", str(raised.exception))
+                self.assertFalse(os.path.exists(destination))
+        with tempfile.TemporaryDirectory() as root:
+            destination = os.path.join(root, "release.tar.gz")
+            response = _FakeHttpsResponse(b"payload", {"Content-Length": "²"})
+            self._download(response, destination, 1024)
+            with open(destination, "rb") as stored:
+                self.assertEqual(stored.read(), b"payload")
+
+    def test_unix_tar_rejects_more_members_than_the_limit(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "members.tar.gz"
+            _write_tar_gz(archive, [("one", b"a"), ("two", b"b"), ("three", b"c")])
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with tarfile.open(archive) as tf, self.assertRaises(SystemExit) as raised:
+                _cli._safe_extract_tar(
+                    tf,
+                    str(destination),
+                    ("one", "two", "three"),
+                    ("one",),
+                    limits=_limits_with(members=2),
+                )
+            self.assertIn("2-member safety limit", str(raised.exception))
+            self.assertFalse((destination / "one").exists())
+
+    def test_unix_tar_rejects_a_member_declared_over_the_limit(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "member.tar.gz"
+            _write_tar_gz(archive, [("codebase-memory-mcp", b"x" * 65)])
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with tarfile.open(archive) as tf, self.assertRaises(SystemExit) as raised:
+                _cli._safe_extract_tar(
+                    tf,
+                    str(destination),
+                    ("codebase-memory-mcp",),
+                    ("codebase-memory-mcp",),
+                    limits=_limits_with(member_bytes=64),
+                )
+            self.assertIn(
+                "'codebase-memory-mcp' exceeds the 64-byte expanded safety limit",
+                str(raised.exception),
+            )
+            self.assertFalse((destination / "codebase-memory-mcp").exists())
+
+    def test_unix_tar_rejects_a_declared_aggregate_over_the_limit(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "aggregate.tar.gz"
+            _write_tar_gz(archive, [("one", b"a" * 40), ("two", b"b" * 40)])
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with tarfile.open(archive) as tf, self.assertRaises(SystemExit) as raised:
+                _cli._safe_extract_tar(
+                    tf,
+                    str(destination),
+                    ("one", "two"),
+                    ("one",),
+                    limits=_limits_with(member_bytes=64, expanded_bytes=64),
+                )
+            self.assertIn(
+                "64-byte aggregate expanded safety limit", str(raised.exception)
+            )
+
+    def test_unix_tar_within_the_limits_extracts_only_the_executable(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "release.tar.gz"
+            _write_tar_gz(archive, _release_entries(_cli._UNIX_ARCHIVE_NAMES))
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with tarfile.open(archive) as tf:
+                extracted = _cli._safe_extract_tar(
+                    tf,
+                    str(destination),
+                    _cli._UNIX_ARCHIVE_NAMES,
+                    ("codebase-memory-mcp",),
+                )
+            self.assertEqual(extracted, ("codebase-memory-mcp",))
+            self.assertEqual(
+                (destination / "codebase-memory-mcp").read_bytes(),
+                b"payload of codebase-memory-mcp",
+            )
+            self.assertEqual(os.listdir(destination), ["codebase-memory-mcp"])
+
+    def test_archive_copy_stops_a_member_that_yields_more_than_the_limit(self):
+        source = io.BytesIO(b"x" * 100)
+        output = io.BytesIO()
+        with self.assertRaises(SystemExit) as raised:
+            _cli._copy_archive_member_within_limits(
+                source,
+                output,
+                "member",
+                100,
+                0,
+                _limits_with(member_bytes=64, expanded_bytes=1024),
+            )
+        self.assertIn(
+            "'member' exceeds the 64-byte actual expanded safety limit",
+            str(raised.exception),
+        )
+        # Reading stopped one byte past the limit; nothing beyond it was kept.
+        self.assertEqual(source.tell(), 65)
+        self.assertLessEqual(len(output.getvalue()), 64)
+
+    def test_archive_copy_rejects_a_member_that_yields_more_than_it_declares(self):
+        source = io.BytesIO(b"x" * 100)
+        with self.assertRaises(SystemExit) as raised:
+            _cli._copy_archive_member_within_limits(
+                source,
+                io.BytesIO(),
+                "member",
+                10,
+                0,
+                _limits_with(member_bytes=1024, expanded_bytes=1024),
+            )
+        self.assertIn(
+            "'member' actual size 100 does not match declared size 10",
+            str(raised.exception),
+        )
+
+    def test_archive_copy_rejects_an_aggregate_over_the_actual_limit(self):
+        with self.assertRaises(SystemExit) as raised:
+            _cli._copy_archive_member_within_limits(
+                io.BytesIO(b"abcd"),
+                io.BytesIO(),
+                "member",
+                4,
+                3,
+                _limits_with(member_bytes=10, expanded_bytes=5),
+            )
+        self.assertIn(
+            "5-byte aggregate actual expanded safety limit", str(raised.exception)
+        )
+
+    def test_archive_member_write_removes_the_partial_file_on_failure(self):
+        with tempfile.TemporaryDirectory() as root:
+            target = os.path.join(root, "codebase-memory-mcp")
+            with self.assertRaises(SystemExit):
+                _cli._write_archive_member_within_limits(
+                    io.BytesIO(b"x" * 100),
+                    target,
+                    "codebase-memory-mcp",
+                    10,
+                    0,
+                    _limits_with(member_bytes=1024, expanded_bytes=1024),
+                )
+            self.assertFalse(os.path.exists(target))
+
+    def test_windows_zip_rejects_more_members_than_the_limit(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "members.zip"
+            _write_zip(archive, [("one", b"a"), ("two", b"b"), ("three", b"c")])
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with zipfile.ZipFile(archive) as zf, self.assertRaises(SystemExit) as raised:
+                _cli._safe_extract_zip(
+                    zf,
+                    str(destination),
+                    ("one", "two", "three"),
+                    ("one",),
+                    limits=_limits_with(members=2),
+                )
+            self.assertIn("2-member safety limit", str(raised.exception))
+
+    def test_windows_zip_rejects_a_member_declared_over_the_limit(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "member.zip"
+            _write_zip(archive, [(_cli._WINDOWS_BINARY_NAME, b"x" * 65)])
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with zipfile.ZipFile(archive) as zf, self.assertRaises(SystemExit) as raised:
+                _cli._safe_extract_zip(
+                    zf,
+                    str(destination),
+                    (_cli._WINDOWS_BINARY_NAME,),
+                    (_cli._WINDOWS_BINARY_NAME,),
+                    limits=_limits_with(member_bytes=64),
+                )
+            self.assertIn("64-byte expanded safety limit", str(raised.exception))
+            self.assertFalse((destination / _cli._WINDOWS_BINARY_NAME).exists())
+
+    def test_windows_zip_within_the_limits_extracts_only_the_executable(self):
+        with tempfile.TemporaryDirectory() as root:
+            archive = Path(root) / "release.zip"
+            _write_zip(archive, _release_entries(_cli._WINDOWS_ARCHIVE_NAMES))
+            destination = Path(root) / "extract"
+            destination.mkdir()
+            with zipfile.ZipFile(archive) as zf:
+                extracted = _cli._safe_extract_zip(
+                    zf,
+                    str(destination),
+                    _cli._WINDOWS_ARCHIVE_NAMES,
+                    (_cli._WINDOWS_BINARY_NAME,),
+                )
+            self.assertEqual(extracted, (_cli._WINDOWS_BINARY_NAME,))
+            self.assertEqual(
+                (destination / _cli._WINDOWS_BINARY_NAME).read_bytes(),
+                b"payload of codebase-memory-mcp.exe",
+            )
+            self.assertEqual(os.listdir(destination), [_cli._WINDOWS_BINARY_NAME])
+