@meridiona/meridian-darwin-arm64 1.12.0 → 1.14.0

package/VERSION

@@ -1 +1 @@
-1.12.0
+1.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/bootstrap.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# meridian — normalises screenpipe activity into structured app sessions
+#
+# Bootstrap installer. Fixes the npm global prefix when it is root-owned (the
+# most common reason `npm install -g` fails with EACCES on a stock macOS Node
+# install), installs @meridiona/meridian, then hands off to `meridian setup`.
+#
+# One-liner usage (download + inspect first if you prefer):
+#   curl -fsSL https://raw.githubusercontent.com/Meridiona/meridian/main/scripts/bootstrap.sh | bash
+#
+# Or run directly from a clone:
+#   bash scripts/bootstrap.sh
+#
+# Re-running is safe — all steps are idempotent.
+
+set -euo pipefail
+
+info() { printf '→ %s\n'   "$*"; }
+ok()   { printf '  ✓ %s\n' "$*"; }
+warn() { printf '  ⚠ %s\n' "$*" >&2; }
+err()  { printf '✗ %s\n'   "$*" >&2; exit 1; }
+
+# ── 0. Platform + safety guards ──────────────────────────────────────────────
+[[ "$(uname -s)" == "Darwin" ]] || err "Meridian requires macOS."
+[[ "$(uname -m)" == "arm64"  ]] || err "Meridian requires Apple Silicon (arm64)."
+[[ "$(id -u)" -ne 0          ]] || err "Do not run as root / with sudo. Re-run as your normal user."
+
+# ── 1. Homebrew ───────────────────────────────────────────────────────────────
+command -v brew >/dev/null 2>&1 \
+    || err "Homebrew is required. Install it from https://brew.sh then re-run."
+ok "Homebrew"
+
+# ── 2. Node.js ────────────────────────────────────────────────────────────────
+if ! command -v node >/dev/null 2>&1; then
+    info "Installing Node.js via Homebrew…"
+    brew install node
+fi
+ok "Node $(node --version)"
+
+# ── 3. npm global prefix — ensure it is user-writable ─────────────────────
+# A system Node install (/usr/local) has a root-owned prefix; npm install -g
+# fails with EACCES. Fix: redirect the prefix to ~/.npm-global (user-owned)
+# and add ~/.npm-global/bin to PATH in the user's shell profile. This is a
+# permanent, one-time change — subsequent `npm install -g` commands (including
+# `meridian update`) just work without sudo.
+npm_global_writable() {
+    local prefix; prefix="$(npm config get prefix 2>/dev/null || true)"
+    [[ -n "$prefix" && -w "${prefix}/lib/node_modules" ]]
+}
+
+NPM_GLOBAL="${HOME}/.npm-global"
+
+if npm_global_writable; then
+    ok "npm prefix already user-writable — no fix needed"
+else
+    _old_prefix="$(npm config get prefix 2>/dev/null || true)"
+    info "npm prefix (${_old_prefix}) is root-owned — redirecting to ${NPM_GLOBAL}…"
+    mkdir -p "${NPM_GLOBAL}"
+    npm config set prefix "${NPM_GLOBAL}"
+
+    # Patch the user's shell profile so the fix survives new terminals.
+    _profile=""
+    case "${SHELL:-}" in
+        */zsh)  _profile="${ZDOTDIR:-${HOME}}/.zshrc" ;;
+        */bash) _profile="${HOME}/.bash_profile" ;;
+    esac
+    _export='export PATH="${HOME}/.npm-global/bin:${PATH}"'
+    if [[ -n "${_profile}" ]] && ! grep -qF '.npm-global/bin' "${_profile}" 2>/dev/null; then
+        {
+            printf '\n# Added by meridian bootstrap — npm global prefix\n'
+            printf '%s\n' "${_export}"
+        } >> "${_profile}"
+        ok "Added ~/.npm-global/bin to PATH in ${_profile}"
+        warn "Open a new terminal (or run: source ${_profile}) after setup to pick up PATH."
+    fi
+
+    # Apply for this session so meridian is immediately on PATH after install.
+    export PATH="${NPM_GLOBAL}/bin:${PATH}"
+    ok "npm prefix → ${NPM_GLOBAL} (user-writable, no sudo needed)"
+fi
+
+# ── 4. Install @meridiona/meridian ───────────────────────────────────────────
+info "Installing @meridiona/meridian@latest…"
+npm install -g @meridiona/meridian@latest
+ok "meridian installed ($(meridian --version 2>/dev/null || echo 'version unknown'))"
+
+# ── 5. Hand off to meridian setup ────────────────────────────────────────────
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  meridian is installed. Running setup now…"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+
+# When run interactively (direct bash invocation), exec meridian setup so it
+# owns the terminal for the permission walkthrough. When piped (curl | bash)
+# there is no TTY for interactive prompts — skip permissions and print a
+# reminder; the user runs `meridian setup` once they have a full terminal.
+if [[ -t 0 && -t 1 ]]; then
+    exec meridian setup
+else
+    meridian setup --skip-permissions
+    echo ""
+    echo "  Next step: open a new terminal and run:"
+    echo ""
+    echo "    meridian setup"
+    echo ""
+    echo "  This grants macOS Screen Recording + Accessibility to screenpipe"
+    echo "  and collects your Jira / GitHub / Linear credentials."
+fi

package/scripts/install-from-bundle.sh

@@ -197,7 +197,17 @@ command -v node >/dev/null 2>&1 || { info "Installing Node.js…"; brew install
 PYTHON_BIN=""
 for p in python3.11 python3; do command -v "$p" >/dev/null 2>&1 && { PYTHON_BIN="$(command -v "$p")"; break; }; done
 [[ -n "${PYTHON_BIN}" ]] || { info "Installing Python 3.11…"; brew install python@3.11; PYTHON_BIN="$(command -v python3.11)"; }
-ok "node + python ($(${PYTHON_BIN} --version 2>&1))"
+# uv is the package/venv manager for Python services. Install via Homebrew (already
+# required by this installer) rather than the astral curl|sh installer.
+UV_BIN=""
+if command -v uv >/dev/null 2>&1; then
+    UV_BIN="$(command -v uv)"
+else
+    info "Installing uv (Python package manager)…"
+    brew install uv
+    UV_BIN="$(command -v uv)"
+fi
+ok "node + python ($(${PYTHON_BIN} --version 2>&1)) + uv ($(${UV_BIN} --version 2>&1))"
 
 if ! command -v screenpipe >/dev/null 2>&1; then
     info "Installing screenpipe ${SCREENPIPE_VERSION} via npm…"
@@ -258,56 +268,23 @@ else
 fi
 
 # ── 4. Python venv + MLX deps ────────────────────────────────────────────────
-# meridian-npm-setup.sh preserves an existing venv across updates, so on a normal
-# update the venv is already here. The pip install (mlx-lm/outlines/fastapi) costs
-# minutes, so we skip it when the dependency spec is unchanged: hash the parts of
-# pyproject.toml that define the deps and stamp it in the venv. Re-pip only when a
-# fresh venv was created or the hash differs (a release that bumped Python deps).
+# uv reads services/uv.lock (hashed, cross-platform, committed) and installs the
+# exact pinned set with no PyPI resolution at install time. On subsequent runs
+# `uv sync --frozen` is a no-op when the venv is already up-to-date — faster than
+# the old DEPS_STAMP approach and handles cross-version upgrades correctly.
+# PYTHON_BIN is the brew-installed Python we know runs MLX/Metal; --python pins
+# the interpreter used when uv creates a fresh venv (existing venvs are unchanged).
 VENV="${APP_ROOT}/services/.venv"
-DEPS_STAMP="${VENV}/.meridian-deps-hash"
-# Reproducible runtime: install the exact pinned set from requirements-mlx.lock,
-# not the [mlx] extra resolved fresh from PyPI within version ranges (where a new
-# upstream release could break a fresh install). Hash the lock (its source of
-# truth) so a changed lock re-pips; fall back to pyproject when no lock shipped.
-MLX_LOCK="${APP_ROOT}/services/requirements-mlx.lock"
-deps_hash() {
-    local f="${MLX_LOCK}"; [[ -f "$f" ]] || f="${APP_ROOT}/services/pyproject.toml"
-    shasum -a 256 "$f" 2>/dev/null | cut -d' ' -f1
-}
-want_hash="$(deps_hash)"
-
-fresh_venv=0
-if [[ ! -x "${VENV}/bin/python" ]]; then
-    info "Creating Python venv…"
-    rm -rf "${VENV}"
-    "${PYTHON_BIN}" -m venv "${VENV}"
-    fresh_venv=1
-fi
 
-have_hash=""
-[[ -f "${DEPS_STAMP}" ]] && have_hash="$(cat "${DEPS_STAMP}" 2>/dev/null)"
-
-if [[ "${fresh_venv}" -eq 1 || "${want_hash}" != "${have_hash}" || -z "${want_hash}" ]]; then
-    info "Installing Python + MLX deps (mlx-lm/outlines/fastapi; downloads ~ a few hundred MB on first run)…"
-    "${VENV}/bin/pip" install --quiet --upgrade pip
-    _deps_ok=0
-    if [[ -f "${MLX_LOCK}" ]]; then
-        # Pinned lock + the local package WITHOUT re-resolving its deps.
-        "${VENV}/bin/pip" install --quiet -r "${MLX_LOCK}" \
-            && "${VENV}/bin/pip" install --quiet --no-deps -e "${APP_ROOT}/services" \
-            && _deps_ok=1
-    else
-        warn "no requirements-mlx.lock in bundle — resolving [mlx] from version ranges (not pinned)"
-        "${VENV}/bin/pip" install --quiet -e "${APP_ROOT}/services[mlx]" && _deps_ok=1
-    fi
-    if [[ "${_deps_ok}" -eq 1 ]]; then
-        [[ -n "${want_hash}" ]] && printf '%s\n' "${want_hash}" > "${DEPS_STAMP}"
-        ok "Python services ready"
-    else
-        warn "pip install failed — leaving venv as-is; re-run 'meridian setup' to retry"
-    fi
+info "Installing Python + MLX deps (mlx-lm/outlines/fastapi; first run may download a few hundred MB)…"
+if "${UV_BIN}" sync \
+        --project "${APP_ROOT}/services" \
+        --extra mlx \
+        --frozen \
+        --python "${PYTHON_BIN}"; then
+    ok "Python services ready ($(${VENV}/bin/python --version 2>&1))"
 else
-    ok "Python deps unchanged — reusing existing venv (skipped pip install)"
+    warn "uv sync failed — leaving venv as-is; re-run 'meridian setup' to retry"
 fi
 
 # ── 5. macOS permissions for screenpipe (manual — can't be automated) ────────

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.12.0"
+version = "1.14.0"
 description = "Meridian agents — hermes task linking and Jira progress updates for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]
@@ -51,6 +51,11 @@ pm_worklog_update = [
 [project.scripts]
 meridian-server = "agents.server:main"
 
+[tool.uv]
+# Lock all extras so `uv lock` produces a complete, reproducible uv.lock.
+# install-from-bundle.sh installs the mlx extra via `uv sync --extra mlx --frozen`.
+constraint-dependencies = []
+
 [tool.setuptools.packages.find]
 where = ["."]
 include = ["agents", "agents.*"]