Linux: CBM 0.12.1 exits before MCP initialization when Landlock denies reading / #2916

Version

codebase-memory-mcp 0.12.1

Platform

Linux (x64)

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

standard

What happened, and what did you expect?

CBM 0.12.1 exits with could not load saved runtime settings (exit code 1) before MCP initialization inside an nvidia OpenShell 0.1.6 sandbox. Its startup ancestry validation attempts to open / for reading, which Landlock denies with EACCES, even though the home and cache directories are writable. I expected CBM to start successfully and access its settings within the permitted cache directory.

Reproduction

No source code or repository is needed: the failure occurs during startup, before indexing or any MCP tool call.

1. Use CBM 0.12.1’s standard Linux portable binary inside an OpenShell 0.1.6 sandbox, running as a non-root user with HOME=/sandbox. The Landlock policy permits access to /sandbox but denies read access to / itself. An unrestricted container does not reproduce this condition.
2. Run inside the sandbox:

   mkdir -p "$HOME/.cache/codebase-memory-mcp"
   test -w "$HOME/.cache/codebase-memory-mcp"
   
   codebase-memory-mcp --version
   codebase-memory-mcp config
   printf 'exit=%s\n' "$?"

3. Actual output:

   codebase-memory-mcp 0.12.1
   codebase-memory-mcp: could not load saved runtime settings
   exit=1
   

   Expected: config displays the configuration and exits successfully, using the permitted cache directory.

Starting the MCP server also fails at the same stage:

codebase-memory-mcp </dev/null
printf 'exit=%s\n' "$?"

codebase-memory-mcp: could not load saved runtime settings
exit=1

Logs

sandbox@sandbox:~$ codebase-memory-mcp --version
codebase-memory-mcp 0.12.1
sandbox@sandbox:~$ codebase-memory-mcp config
codebase-memory-mcp: could not load saved runtime settings

Diagnostics trajectory (memory / performance / leak issues)

Project scale (if relevant)

No response

Confirmations

• I searched existing issues and this is not a duplicate.
• My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.