install --clients=<token> accepted but inert in the Windows binary: all detected clients configured, none force-included

[ivbrajkovic]

Version

codebase-memory-mcp 0.10.8

Platform

Windows (x64) — Windows 11 build 26200

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

standard

What happened, and what did you expect?

install --clients=<token> on the shipped Windows binary is accepted but inert: it neither restricts configuration to the named clients nor force-includes them when undetected. Three experiments (all --dry-run, all with the = form):

1. No restriction. On a machine where Cursor, Qoder CLI, and Rovo Dev CLI are detected, install --clients=cursor --dry-run shows full configuration sections (mcp + skill + 3 agents, and for Qoder also hooks) for Qoder CLI and Rovo Dev CLI — not just Cursor.
2. No inclusion. With HOME/USERPROFILE redirected to an empty directory, the same command reports Detected agents: (none) and configures nothing — the flag does not add cursor.
3. Parsing works; scope doesn't. --clients=x correctly errors with unknown client: x and lists valid tokens, so the flag is parsed. Scope is decided purely by detection: an otherwise-empty home containing only a .cursor/mcp.json marker yields Detected agents: Cursor and a complete Cursor-only configuration — with or without the flag.

Expected, per the v0.10.4 release notes: "--clients=claude,codex now restricts it."

Cross-reference #1753: that report says the binary's own installer "honors the flag correctly" and scopes the bug to the install.sh wrapper. On Windows v0.10.8 the binary path is affected too — every experiment above used the binary's install subcommand directly (the = form). If the flag works on macOS/Linux, this may be Windows-specific argument handling in the binary.

Reproduction

Windows, v0.10.8 binary at %LOCALAPPDATA%\Programs\codebase-memory-mcp\codebase-memory-mcp.exe.

Experiment 1 — flag does not restrict (machine with several MCP clients installed):

codebase-memory-mcp install --clients=cursor --dry-run

Output (excerpt):

Detected agents: Cursor Qoder CLI Rovo Dev CLI

Cursor:
  mcp: <user>/.cursor/mcp.json
  skill: <user>/.cursor/skills/codebase-memory/SKILL.md (1 installed)
  agent: x3
Qoder CLI:
  mcp: <user>/.qoder/settings.json
  skill: <user>/.qoder/skills/codebase-memory/SKILL.md (1 installed)
  agent: x3
  hooks: <user>/.qoder/settings.json (SessionStart + SubagentStart + PostToolUse Read)
Rovo Dev CLI:
  mcp: <user>/.rovodev/mcp.json
  instructions: <user>/.rovodev/AGENTS.md
  skill: <user>/.rovodev/skills/codebase-memory/SKILL.md (1 installed)
  agent: x3

Expected: only the Cursor section.

Experiment 2 — flag does not include (empty sandbox home; Git Bash syntax, binary honors both vars):

mkdir <sandbox>
HOME=<sandbox> USERPROFILE='C:\<sandbox>' codebase-memory-mcp install --clients=cursor --dry-run

Output (excerpt): Detected agents: (none) — and no Cursor section, despite --clients=cursor.

Expected: Cursor configured via the flag.

Experiment 3 — detection alone drives scope: sandbox containing only .cursor/mcp.json with {"mcpServers": { }} → Detected agents: Cursor, complete Cursor-only configuration, flag irrelevant.

Logs

stderr is clean; the outputs above are the full signal. One wording nit observed along the way: in --dry-run mode the installer prints Added <dir> to the current-user PATH directly above the footer (dry-run — no files were modified), which reads as a completed action; "Would add" would match the rest of the dry-run phrasing.

Project scale

N/A — installer flag behavior, not indexing.

Confirmations

• I searched existing issues and this is not a duplicate — install.sh silently drops --clients and configures every detected client #1753 covers the install.sh wrapper only and asserts the binary honors the flag, which contradicts what is observed here on Windows.
• My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.

[DeusData]

Fixed on main by 1e25d962 ("fix(cli): apply client selector to registry integrations"), merged as 4d8ac9e1 via #1802. Thanks to @rarepops.

--clients filtered only the legacy client table: cli_clients_apply_selection was applied to the detection probe, while print_detected_registry_agents iterated registry profiles and called cbm_agent_client_detect(profile->id, …) with no reference to the selection at all. Registry-backed clients such as Qoder and Rovo Dev were therefore detected and configured regardless of what --clients asked for.

Registry stable IDs are now part of the selector vocabulary, and the same restriction applies to registry detection output and installation. The guards read !g_client_selection || cli_clients_selects_registry_client(...), so the default path — no selector — is unchanged, and only an explicit --clients restricts. Semantics stay restrictive: selected and detected; an undetected client is never force-enabled.

Related: #1800 (merged as c895513f) adds --clients=<tokens> to the CLI help and points at install --clients to list valid tokens — a listing this change completes, since registry stable IDs are now included in it.