@meridiona/meridian-darwin-arm64 1.12.0 → 1.13.0

package/VERSION

@@ -1 +1 @@
-1.12.0
+1.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/install-from-bundle.sh

@@ -197,7 +197,17 @@ command -v node >/dev/null 2>&1 || { info "Installing Node.js…"; brew install
 PYTHON_BIN=""
 for p in python3.11 python3; do command -v "$p" >/dev/null 2>&1 && { PYTHON_BIN="$(command -v "$p")"; break; }; done
 [[ -n "${PYTHON_BIN}" ]] || { info "Installing Python 3.11…"; brew install python@3.11; PYTHON_BIN="$(command -v python3.11)"; }
-ok "node + python ($(${PYTHON_BIN} --version 2>&1))"
+# uv is the package/venv manager for Python services. Install via Homebrew (already
+# required by this installer) rather than the astral curl|sh installer.
+UV_BIN=""
+if command -v uv >/dev/null 2>&1; then
+    UV_BIN="$(command -v uv)"
+else
+    info "Installing uv (Python package manager)…"
+    brew install uv
+    UV_BIN="$(command -v uv)"
+fi
+ok "node + python ($(${PYTHON_BIN} --version 2>&1)) + uv ($(${UV_BIN} --version 2>&1))"
 
 if ! command -v screenpipe >/dev/null 2>&1; then
     info "Installing screenpipe ${SCREENPIPE_VERSION} via npm…"
@@ -258,56 +268,23 @@ else
 fi
 
 # ── 4. Python venv + MLX deps ────────────────────────────────────────────────
-# meridian-npm-setup.sh preserves an existing venv across updates, so on a normal
-# update the venv is already here. The pip install (mlx-lm/outlines/fastapi) costs
-# minutes, so we skip it when the dependency spec is unchanged: hash the parts of
-# pyproject.toml that define the deps and stamp it in the venv. Re-pip only when a
-# fresh venv was created or the hash differs (a release that bumped Python deps).
+# uv reads services/uv.lock (hashed, cross-platform, committed) and installs the
+# exact pinned set with no PyPI resolution at install time. On subsequent runs
+# `uv sync --frozen` is a no-op when the venv is already up-to-date — faster than
+# the old DEPS_STAMP approach and handles cross-version upgrades correctly.
+# PYTHON_BIN is the brew-installed Python we know runs MLX/Metal; --python pins
+# the interpreter used when uv creates a fresh venv (existing venvs are unchanged).
 VENV="${APP_ROOT}/services/.venv"
-DEPS_STAMP="${VENV}/.meridian-deps-hash"
-# Reproducible runtime: install the exact pinned set from requirements-mlx.lock,
-# not the [mlx] extra resolved fresh from PyPI within version ranges (where a new
-# upstream release could break a fresh install). Hash the lock (its source of
-# truth) so a changed lock re-pips; fall back to pyproject when no lock shipped.
-MLX_LOCK="${APP_ROOT}/services/requirements-mlx.lock"
-deps_hash() {
-    local f="${MLX_LOCK}"; [[ -f "$f" ]] || f="${APP_ROOT}/services/pyproject.toml"
-    shasum -a 256 "$f" 2>/dev/null | cut -d' ' -f1
-}
-want_hash="$(deps_hash)"
-
-fresh_venv=0
-if [[ ! -x "${VENV}/bin/python" ]]; then
-    info "Creating Python venv…"
-    rm -rf "${VENV}"
-    "${PYTHON_BIN}" -m venv "${VENV}"
-    fresh_venv=1
-fi
 
-have_hash=""
-[[ -f "${DEPS_STAMP}" ]] && have_hash="$(cat "${DEPS_STAMP}" 2>/dev/null)"
-
-if [[ "${fresh_venv}" -eq 1 || "${want_hash}" != "${have_hash}" || -z "${want_hash}" ]]; then
-    info "Installing Python + MLX deps (mlx-lm/outlines/fastapi; downloads ~ a few hundred MB on first run)…"
-    "${VENV}/bin/pip" install --quiet --upgrade pip
-    _deps_ok=0
-    if [[ -f "${MLX_LOCK}" ]]; then
-        # Pinned lock + the local package WITHOUT re-resolving its deps.
-        "${VENV}/bin/pip" install --quiet -r "${MLX_LOCK}" \
-            && "${VENV}/bin/pip" install --quiet --no-deps -e "${APP_ROOT}/services" \
-            && _deps_ok=1
-    else
-        warn "no requirements-mlx.lock in bundle — resolving [mlx] from version ranges (not pinned)"
-        "${VENV}/bin/pip" install --quiet -e "${APP_ROOT}/services[mlx]" && _deps_ok=1
-    fi
-    if [[ "${_deps_ok}" -eq 1 ]]; then
-        [[ -n "${want_hash}" ]] && printf '%s\n' "${want_hash}" > "${DEPS_STAMP}"
-        ok "Python services ready"
-    else
-        warn "pip install failed — leaving venv as-is; re-run 'meridian setup' to retry"
-    fi
+info "Installing Python + MLX deps (mlx-lm/outlines/fastapi; first run may download a few hundred MB)…"
+if "${UV_BIN}" sync \
+        --project "${APP_ROOT}/services" \
+        --extra mlx \
+        --frozen \
+        --python "${PYTHON_BIN}"; then
+    ok "Python services ready ($(${VENV}/bin/python --version 2>&1))"
 else
-    ok "Python deps unchanged — reusing existing venv (skipped pip install)"
+    warn "uv sync failed — leaving venv as-is; re-run 'meridian setup' to retry"
 fi
 
 # ── 5. macOS permissions for screenpipe (manual — can't be automated) ────────

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.12.0"
+version = "1.13.0"
 description = "Meridian agents — hermes task linking and Jira progress updates for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]
@@ -51,6 +51,11 @@ pm_worklog_update = [
 [project.scripts]
 meridian-server = "agents.server:main"
 
+[tool.uv]
+# Lock all extras so `uv lock` produces a complete, reproducible uv.lock.
+# install-from-bundle.sh installs the mlx extra via `uv sync --extra mlx --frozen`.
+constraint-dependencies = []
+
 [tool.setuptools.packages.find]
 where = ["."]
 include = ["agents", "agents.*"]