@meridiona/meridian-darwin-arm64 1.24.6 → 1.25.0

package/VERSION

@@ -1 +1 @@
-1.24.6
+1.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.24.6",
+  "version": "1.25.0",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/com.meridiona.a11y-helper.plist

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    com.meridiona.a11y-helper — runs meridian-a11y-helper as a launchd
+    LaunchAgent. The helper enables macOS accessibility on Electron/Chromium
+    apps (Claude, Codex, Slack, …) by setting AXManualAccessibility on the
+    frontmost app, so screenpipe can capture their a11y tree instead of the
+    app staying invisible (see scripts/a11y-helper/main.swift for the full
+    story).
+
+    Runs as its OWN agent (not a meridian-daemon child) on purpose: macOS
+    attributes a child's TCC permissions to its parent, and the daemon binary
+    changes on every release — the Accessibility grant must key to this
+    stable helper binary instead.
+
+    Install via scripts/install-a11y-helper-daemon.sh which copies the
+    committed helper binary to ~/.meridian/bin/, substitutes the placeholders
+    below, and bootstraps the agent.
+
+    Uninstall:
+        launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.meridiona.a11y-helper.plist
+        rm ~/Library/LaunchAgents/com.meridiona.a11y-helper.plist
+-->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.meridiona.a11y-helper</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>{{HELPER_BIN}}</string>
+    </array>
+
+    <key>StandardOutPath</key>
+    <string>{{HOME}}/.meridian/logs/a11y-helper.log</string>
+    <key>StandardErrorPath</key>
+    <string>{{HOME}}/.meridian/logs/a11y-helper-error.log</string>
+
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>ThrottleInterval</key>
+    <integer>10</integer>
+    <key>ProcessType</key>
+    <string>Background</string>
+</dict>
+</plist>

package/scripts/com.meridiona.screenpipe.plist

@@ -23,7 +23,7 @@
     <array>
         <string>/bin/sh</string>
         <string>-c</string>
-        <string>exec {{SCREENPIPE_BIN}} record --disable-audio</string>
+        <string>exec {{SCREENPIPE_BIN}} record --disable-audio --use-pii-removal</string>
     </array>
 
     <key>EnvironmentVariables</key>

package/scripts/install-a11y-helper-daemon.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# meridian — normalises screenpipe activity into structured app sessions
+# Install meridian-a11y-helper as a launchd LaunchAgent under the current user.
+# The helper enables macOS accessibility on Electron/Chromium apps so
+# screenpipe can capture them — see scripts/a11y-helper/main.swift.
+#
+#   ./scripts/install-a11y-helper-daemon.sh
+#
+# Re-running is safe — it bootouts the existing agent, refreshes the binary
+# and plist, and reloads.
+#
+# The helper binary is copied to ~/.meridian/bin/ ONLY when its bytes differ
+# from the committed artifact. The copy is byte-identical to the committed
+# binary, so macOS's Accessibility grant (keyed to the binary's code hash)
+# survives meridian updates that don't touch the helper.
+
+set -euo pipefail
+
+LABEL="com.meridiona.a11y-helper"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEMPLATE="${SCRIPT_DIR}/com.meridiona.a11y-helper.plist"
+SRC_BIN="${SCRIPT_DIR}/a11y-helper/meridian-a11y-helper"
+
+DEST_DIR="${HOME}/.meridian/bin"
+DEST_BIN="${DEST_DIR}/meridian-a11y-helper"
+
+LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
+PLIST_DEST="${LAUNCH_AGENTS}/${LABEL}.plist"
+GUI_TARGET="gui/$(id -u)"
+
+if [[ ! -f "${TEMPLATE}" ]]; then
+    echo "✗ template not found: ${TEMPLATE}" >&2
+    exit 1
+fi
+if [[ ! -f "${SRC_BIN}" ]]; then
+    echo "✗ helper binary not found: ${SRC_BIN} (build with scripts/a11y-helper/build.sh)" >&2
+    exit 1
+fi
+
+mkdir -p "${DEST_DIR}" "${HOME}/.meridian/logs" "${LAUNCH_AGENTS}"
+
+# Copy only when the bytes changed — an unnecessary rewrite is harmless for
+# TCC (same hash) but skipping it keeps mtimes meaningful for debugging.
+if ! cmp -s "${SRC_BIN}" "${DEST_BIN}" 2>/dev/null; then
+    cp "${SRC_BIN}" "${DEST_BIN}"
+    chmod +x "${DEST_BIN}"
+    echo "→ installed helper binary: ${DEST_BIN}"
+else
+    echo "→ helper binary unchanged: ${DEST_BIN}"
+fi
+
+echo "→ writing ${PLIST_DEST}"
+sed \
+    -e "s|{{HOME}}|${HOME}|g" \
+    -e "s|{{HELPER_BIN}}|${DEST_BIN}|g" \
+    "${TEMPLATE}" > "${PLIST_DEST}"
+
+if ! plutil -lint "${PLIST_DEST}" >/dev/null; then
+    echo "✗ plist failed validation" >&2
+    exit 1
+fi
+
+echo "→ bootout ${LABEL} (if loaded)"
+launchctl bootout "${GUI_TARGET}/${LABEL}" 2>/dev/null || true
+_bootout_wait=0
+while launchctl print "${GUI_TARGET}/${LABEL}" >/dev/null 2>&1; do
+    sleep 1
+    _bootout_wait=$(( _bootout_wait + 1 ))
+    if [[ "${_bootout_wait}" -ge 15 ]]; then
+        echo "⚠ ${LABEL} still in launchd domain after 15s — proceeding anyway" >&2
+        break
+    fi
+done
+
+echo "→ bootstrap ${LABEL}"
+launchctl enable "${GUI_TARGET}/${LABEL}" 2>/dev/null || true
+launchctl bootstrap "${GUI_TARGET}" "${PLIST_DEST}"
+launchctl enable "${GUI_TARGET}/${LABEL}"
+launchctl kickstart -k "${GUI_TARGET}/${LABEL}"
+
+echo
+echo "✓ a11y-helper installed and started"
+echo
+echo "⚠ One-time permission: add ${DEST_BIN}"
+echo "  to System Settings → Privacy & Security → Accessibility and toggle it on."
+echo "  Until granted, Electron apps (Claude, Codex, Slack, …) stay invisible to capture."
+echo
+echo "Useful follow-ups:"
+echo "  launchctl print ${GUI_TARGET}/${LABEL}            # status"
+echo "  tail -f ~/.meridian/logs/a11y-helper.log          # live log (shows trust state + pokes)"

package/scripts/install-from-bundle.sh

@@ -10,7 +10,7 @@
 set -euo pipefail
 
 APP_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-SCREENPIPE_VERSION="0.3.350"
+SCREENPIPE_VERSION="0.4.6"
 MLX_PORT="${MLX_PORT:-7823}"
 UI_PORT="${MERIDIAN_UI_PORT:-3939}"   # dashboard port (override via MERIDIAN_UI_PORT)
 SKIP_PERMISSIONS=0
@@ -217,8 +217,12 @@ PLIST
 configure_editor_accessibility() {
     local support_root="${HOME}/Library/Application Support"
     local editors=("Code" "Cursor" "Antigravity IDE")
-    local any=0 ed dir settings
-    for ed in "${editors[@]}"; do
+    # App bundles, index-matched to `editors`, for running-process detection.
+    local app_bundles=("Visual Studio Code.app" "Cursor.app" "Antigravity IDE.app")
+    local any=0 i ed dir settings
+    local needs_restart=()
+    for i in "${!editors[@]}"; do
+        ed="${editors[$i]}"
         dir="${support_root}/${ed}"
         [[ -d "$dir" ]] || continue           # editor not installed → skip
         any=1
@@ -236,8 +240,21 @@ configure_editor_accessibility() {
             # JSONC-tolerant, so this preserves existing keys/comments/formatting.
             perl -0777 -i -pe 's/\{/\{\n\t"editor.accessibilitySupport": "on",/ unless $done++' "$settings"
         fi
-        ok "${ed}: enabled editor.accessibilitySupport = on (restart the editor)"
+        ok "${ed}: enabled editor.accessibilitySupport = on"
+        # The setting is read ONCE at editor boot. If the editor is running
+        # right now, it booted before this write and will keep capturing
+        # nothing until relaunched — these apps routinely run for days, so
+        # without an explicit restart the setting sits inert on disk and the
+        # editor's activity is silently invisible to screenpipe.
+        if pgrep -qf "/Applications/${app_bundles[$i]}/" 2>/dev/null; then
+            needs_restart+=("${ed}")
+        fi
     done
+    if [[ ${#needs_restart[@]} -gt 0 ]]; then
+        warn "RESTART REQUIRED: ${needs_restart[*]} — running editors only read"
+        warn "editor.accessibilitySupport at launch. Quit and reopen them now, or"
+        warn "their activity will NOT be captured until the next relaunch."
+    fi
     [[ "$any" -eq 0 ]] && info "No VS Code / Cursor / Antigravity install found — skipping editor a11y setup"
     return 0
 }
@@ -482,6 +499,14 @@ if [[ "${_macos_major:-0}" -ge 26 ]]; then
 fi
 
 # ── 5. macOS permissions for screenpipe (manual — can't be automated) ────────
+# Stage the a11y helper binary first so its path exists when the user adds it
+# in the Accessibility pane below (the agent itself is installed in §6).
+if [[ -f "${APP_ROOT}/scripts/a11y-helper/meridian-a11y-helper" ]]; then
+    mkdir -p "${HOME}/.meridian/bin"
+    cmp -s "${APP_ROOT}/scripts/a11y-helper/meridian-a11y-helper" "${HOME}/.meridian/bin/meridian-a11y-helper" 2>/dev/null \
+        || cp "${APP_ROOT}/scripts/a11y-helper/meridian-a11y-helper" "${HOME}/.meridian/bin/meridian-a11y-helper"
+    chmod +x "${HOME}/.meridian/bin/meridian-a11y-helper"
+fi
 if [[ "${SKIP_PERMISSIONS}" -eq 0 ]]; then
     echo "→ screenpipe needs 2 macOS permissions: Screen Recording and Accessibility."
     echo "  (Audio capture is disabled, so no Microphone permission is required.)"
@@ -489,7 +514,10 @@ if [[ "${SKIP_PERMISSIONS}" -eq 0 ]]; then
     open "x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture" 2>/dev/null || true
     read -r -p "  Press Enter to open Accessibility settings… " _ || true
     open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility" 2>/dev/null || true
-    read -r -p "  Press Enter once both are granted… " _ || true
+    echo "  In the SAME Accessibility pane, also add the a11y helper (+ → ⌘⇧G → paste):"
+    echo "      ${HOME}/.meridian/bin/meridian-a11y-helper"
+    echo "  Without it, Electron apps (Claude, Codex, Slack, …) stay invisible to capture."
+    read -r -p "  Press Enter once all are granted… " _ || true
 fi
 
 # Enable a11y mode in installed VS Code-family editors (idempotent). Without
@@ -523,6 +551,11 @@ fi
 info "Installing screenpipe launchd agent…"
 bash "${APP_ROOT}/scripts/install-screenpipe-daemon.sh" || warn "screenpipe agent install failed"
 
+# a11y-helper: enables accessibility on Electron apps so screenpipe can
+# capture them (Claude, Codex, Slack, …) — see scripts/a11y-helper/main.swift.
+info "Installing a11y-helper launchd agent…"
+bash "${APP_ROOT}/scripts/install-a11y-helper-daemon.sh" || warn "a11y-helper agent install failed"
+
 # MLX: skip restart + model-load wait when server was already healthy and
 # neither the venv nor the Python source files changed.
 _PY_SRC_STAMP="${HOME}/.meridian/py-src.sha256"
@@ -571,6 +604,13 @@ _final_ui_hash="${_new_ui_hash:-${_OLD_UI_HASH}}"
 
 ok "all daemons installed"
 
+# Install session-summary Claude Code command so `claude -p /session-summary` resolves.
+_skill_src="${APP_ROOT}/services/skills/coding-agent/session-summary/SKILL.md"
+_skill_dst="${HOME}/.claude/commands/session-summary.md"
+mkdir -p "${HOME}/.claude/commands"
+cp "${_skill_src}" "${_skill_dst}"
+ok "session-summary command → ~/.claude/commands/session-summary.md"
+
 # Pipeline smoke test — verify both LLM stages return valid output (no DB writes).
 echo ""
 info "Running pipeline smoke test (this exercises the model — may take ~30s)…"

package/scripts/meridian-cli.sh

@@ -648,7 +648,7 @@ case "$CMD" in
     uninstall)        cmd_uninstall ;;
     permissions)      cmd_permissions ;;
     version|--version|-v) cat "${REPO_ROOT}/VERSION" 2>/dev/null || echo "unknown" ;;
-    worklog-status|pm-worklog|coding-agent-hook|coding-agent-summarise|coding-agent-classify) cmd_daemon_passthrough "$CMD" "$@" ;;
+    worklog-status|pm-worklog|coding-agent-hook|coding-agent-summarise|coding-agent-classify|coding-agent-install-skill) cmd_daemon_passthrough "$CMD" "$@" ;;
     --help|-h|help|"") cmd_help ;;
     *) err "unknown command: ${CMD}"; echo; cmd_help; exit 1 ;;
 esac

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.24.6"
+version = "1.25.0"
 description = "Meridian agents — hermes task linking and Jira progress updates for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]

package/services/skills/coding-agent/session-summary/SKILL.md

@@ -0,0 +1,7 @@
+---
+description: Summarise a coding-agent session transcript for a Jira work-log.
+---
+
+You summarise ONE work-burst of a developer's coding-agent session for a Jira work-log. The transcript is timestamped as `[<ISO ts>] [role] <message>`. Write a factual prose summary of 10-40 sentences: name the files edited, commands run, errors hit, decisions made, tests/validations performed, and any rework or blockers (an approach abandoned, a failed build/test, something deleted and rebuilt). State ONLY what is in the transcript — never invent files, tickets, commands, or outcomes. No preamble, no markdown headings, no bullet lists — just clear paragraphs. If an 'EARLIER IN THIS SESSION' section is present, do not repeat it; summarise only this burst.
+
+Return JSON with `summary` (the prose) and `blockers` (a list of distinct blockers / failures / rework, possibly empty).