Fix code-memory packaging audit findings

.github/workflows/ci.yml

@@ -83,3 +83,18 @@ jobs:
       - name: Ultracite check
         working-directory: npm
         run: npm run check
+  npm-package-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: cargo build --release
+      - run: |
+          cp target/release/code-memory npm/bin/code-memory-bin
+          chmod +x npm/bin/code-memory-bin
+          cd npm
+          npm pack --dry-run
+          node bin/code-memory --version

Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "code-memory"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 description = "Persistent memory for AI coding - semantic search, git history, and intelligent context preservation"
 license = "MIT"
 repository = "https://github.com/mstuart/code-memory"
-keywords = ["ai-memory", "code-context", "mcp-server", "semantic-search", "git-history"]
+keywords = ["ai-memory", "code-memory", "mcp-server", "semantic-search", "git-history"]
 categories = ["development-tools", "command-line-utilities"]
 
 [dependencies]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mark Stuart
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

npm/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mark Stuart
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

npm/bin/code-memory

@@ -1,24 +1,25 @@
-#!/bin/sh
-# Wrapper script for code-memory binary
-# The actual binary is downloaded during npm postinstall
+#!/usr/bin/env node
+"use strict";
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-BINARY="$SCRIPT_DIR/code-memory-bin"
+const { spawnSync } = require("child_process");
+const path = require("path");
 
-if [ -f "$BINARY" ]; then
-  exec "$BINARY" "$@"
-fi
+const binary = path.join(
+  __dirname,
+  process.platform === "win32" ? "code-memory-bin.exe" : "code-memory-bin"
+);
 
-# Check for binary with platform-specific name
-case "$(uname -s)" in
-  MINGW*|MSYS*|CYGWIN*) BINARY="$SCRIPT_DIR/code-memory.exe" ;;
-esac
+const result = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });
 
-if [ -f "$BINARY" ]; then
-  exec "$BINARY" "$@"
-fi
+if (result.error) {
+  console.error("Error: code-memory native binary not found or not executable.");
+  console.error("Try reinstalling: npm install -g code-memory");
+  console.error("Or build from source: cargo install --git https://github.com/mstuart/code-memory code-memory");
+  process.exit(1);
+}
 
-echo "Error: code-memory binary not found."
-echo "Try reinstalling: npm install -g @mstuart/code-memory"
-echo "Or build from source: cargo install --path ."
-exit 1
+if (result.signal) {
+  process.kill(process.pid, result.signal);
+}
+
+process.exit(result.status ?? 1);