@meridiona/meridian-darwin-arm64 1.27.2 → 1.27.4

package/VERSION

@@ -1 +1 @@
-1.27.2
+1.27.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.27.2",
+  "version": "1.27.4",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/com.meridiona.a11y-helper.plist

@@ -31,6 +31,14 @@
         <string>{{HELPER_BIN}}</string>
     </array>
 
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>{{HOME}}</string>
+        <key>PATH</key>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+    </dict>
+
     <key>StandardOutPath</key>
     <string>{{HOME}}/.meridian/logs/a11y-helper.log</string>
     <key>StandardErrorPath</key>
@@ -41,7 +49,7 @@
     <key>KeepAlive</key>
     <true/>
     <key>ThrottleInterval</key>
-    <integer>10</integer>
+    <integer>30</integer>
     <key>ProcessType</key>
     <string>Background</string>
 </dict>

package/scripts/com.meridiona.daemon.plist

@@ -67,7 +67,7 @@
     <key>KeepAlive</key>
     <true/>
     <key>ThrottleInterval</key>
-    <integer>10</integer>
+    <integer>30</integer>
     <key>ProcessType</key>
     <string>Background</string>
 </dict>

package/scripts/com.meridiona.screenpipe.plist

@@ -21,9 +21,10 @@
 
     <key>ProgramArguments</key>
     <array>
-        <string>/bin/sh</string>
-        <string>-c</string>
-        <string>exec {{SCREENPIPE_BIN}} record --disable-audio --use-pii-removal</string>
+        <string>{{SCREENPIPE_BIN}}</string>
+        <string>record</string>
+        <string>--disable-audio</string>
+        <string>--use-pii-removal</string>
     </array>
 
     <key>EnvironmentVariables</key>
@@ -46,7 +47,7 @@
     <key>KeepAlive</key>
     <true/>
     <key>ThrottleInterval</key>
-    <integer>10</integer>
+    <integer>30</integer>
     <key>ProcessType</key>
     <string>Background</string>
 </dict>

package/scripts/com.meridiona.ui.plist

@@ -33,7 +33,7 @@
     <key>EnvironmentVariables</key>
     <dict>
         <key>PATH</key>
-        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+        <string>{{NODE_BIN_DIR}}/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
         <key>HOME</key>
         <string>{{HOME}}</string>
         <key>MERIDIAN_DB</key>
@@ -55,7 +55,7 @@
     <key>KeepAlive</key>
     <true/>
     <key>ThrottleInterval</key>
-    <integer>10</integer>
+    <integer>30</integer>
     <key>ProcessType</key>
     <string>Background</string>
 </dict>

package/scripts/install-daemon.sh

@@ -52,8 +52,8 @@ ENV_FILE="${REPO_ROOT}/.env"
 MERIDIAN_OO_AUTH=""
 MERIDIAN_OTLP_ENDPOINT=""
 if [[ -f "${ENV_FILE}" ]]; then
-    MERIDIAN_OO_AUTH="$(grep -E '^MERIDIAN_OO_AUTH=' "${ENV_FILE}" | cut -d= -f2- | tr -d '[:space:]')" || true
-    MERIDIAN_OTLP_ENDPOINT="$(grep -E '^MERIDIAN_OTLP_ENDPOINT=' "${ENV_FILE}" | cut -d= -f2- | tr -d '[:space:]')" || true
+    MERIDIAN_OO_AUTH="$(grep -E '^MERIDIAN_OO_AUTH=' "${ENV_FILE}" | cut -d= -f2- | tr -d '[:space:]' | sed "s/^['\"]//;s/['\"]$//")" || true
+    MERIDIAN_OTLP_ENDPOINT="$(grep -E '^MERIDIAN_OTLP_ENDPOINT=' "${ENV_FILE}" | cut -d= -f2- | tr -d '[:space:]' | sed "s/^['\"]//;s/['\"]$//")" || true
 fi
 if [[ -z "${MERIDIAN_OO_AUTH}" ]]; then
     echo "  ⚠ MERIDIAN_OO_AUTH not set in <repo>/.env — OTLP export will be disabled"

package/scripts/install-from-bundle.sh

@@ -131,6 +131,13 @@ resolve_node_runtime() {
     local ver sha
     ver="$(grep '^NODE_RUNTIME_VERSION=' "${meta}" | cut -d= -f2 | tr -d '[:space:]')"
     sha="$(grep '^NODE_RUNTIME_SHA=' "${meta}" | cut -d= -f2 | tr -d '[:space:]')"
+    if [[ -z "${ver}" || -z "${sha}" ]]; then
+        warn "node-runtime.meta is malformed (missing VERSION or SHA) — falling back to system node"
+        for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
+            [[ -x "${_n}" ]] && { echo "${_n}"; return 0; }
+        done
+        return 1
+    fi
     local cache_dir="${HOME}/.meridian/node-runtime/v${ver}"
     local cache_bin="${cache_dir}/bin/node"
     if [[ -x "${cache_bin}" ]]; then echo "${cache_bin}"; return 0; fi
@@ -239,6 +246,13 @@ configure_editor_accessibility() {
             # Insert the key after the first `{`. VS Code-family parsers are
             # JSONC-tolerant, so this preserves existing keys/comments/formatting.
             perl -0777 -i -pe 's/\{/\{\n\t"editor.accessibilitySupport": "on",/ unless $done++' "$settings"
+            # Sanity check: the key must appear in the file; if not, the regex
+            # found no `{` (unusual) or perl silently failed — restore backup.
+            if ! grep -q '"editor.accessibilitySupport"' "$settings" 2>/dev/null; then
+                warn "${ed}: settings.json edit failed — restoring backup"
+                cp "${settings}.meridian-bak" "$settings"
+                continue
+            fi
         fi
         ok "${ed}: enabled editor.accessibilitySupport = on"
         # The setting is read ONCE at editor boot. If the editor is running
@@ -280,7 +294,15 @@ fi
 command -v node >/dev/null 2>&1 || { info "Installing Node.js…"; brew install node; }
 PYTHON_BIN=""
 for p in python3.11 python3; do command -v "$p" >/dev/null 2>&1 && { PYTHON_BIN="$(command -v "$p")"; break; }; done
-[[ -n "${PYTHON_BIN}" ]] || { info "Installing Python 3.11…"; brew install python@3.11; PYTHON_BIN="$(command -v python3.11)"; }
+if [[ -z "${PYTHON_BIN}" ]]; then
+    info "Installing Python 3.11…"
+    brew install python@3.11
+    # `command -v` may return empty in a non-interactive shell immediately after
+    # `brew install` because the formula's bin dir isn't in launchd's PATH yet.
+    # Resolve via `brew --prefix` which is always accurate.
+    PYTHON_BIN="$(brew --prefix python@3.11)/bin/python3.11"
+    [[ -x "${PYTHON_BIN}" ]] || PYTHON_BIN="$(command -v python3.11 2>/dev/null || true)"
+fi
 # uv is the package/venv manager for Python services. Install via Homebrew (already
 # required by this installer) rather than the astral curl|sh installer.
 UV_BIN=""
@@ -289,7 +311,8 @@ if command -v uv >/dev/null 2>&1; then
 else
     info "Installing uv (Python package manager)…"
     brew install uv
-    UV_BIN="$(command -v uv)"
+    UV_BIN="$(brew --prefix uv)/bin/uv"
+    [[ -x "${UV_BIN}" ]] || UV_BIN="$(command -v uv 2>/dev/null || true)"
 fi
 ok "node + python ($(${PYTHON_BIN} --version 2>&1)) + uv ($(${UV_BIN} --version 2>&1))"
 
@@ -405,8 +428,11 @@ _LOCK_HASH="$(shasum -a 256 "${APP_ROOT}/services/uv.lock" 2>/dev/null | cut -d'
 # enforces this); the venv MUST use exactly 3.11 or the cpython-311 .so files fail
 # to import. Prefer system python3.11, then uv-managed 3.11, then install it via uv.
 _extract_venv() {
-    local tgz="$1" stamp_hash="$2" tarball_python="" py_dir=""
-    rm -rf "${VENV}"
+    local tgz="$1" stamp_hash="$2" tarball_python="" py_dir="" venv_tmp=""
+    # Stage the new venv to a temp path; swap atomically only on success so a
+    # failed extraction (disk full, corrupt archive) never destroys the live venv.
+    venv_tmp="${VENV}.tmp.$$"
+    rm -rf "${venv_tmp}"
     if command -v python3.11 >/dev/null 2>&1; then
         tarball_python="$(command -v python3.11)"
     elif "${UV_BIN}" python find 3.11 >/dev/null 2>&1; then
@@ -416,13 +442,16 @@ _extract_venv() {
         "${UV_BIN}" python install 3.11
         tarball_python="$("${UV_BIN}" python find 3.11)"
     fi
-    "${UV_BIN}" venv --python "${tarball_python}" "${VENV}" 2>/dev/null
-    py_dir="$(ls "${VENV}/lib/" | grep '^python' | head -1)"
-    mkdir -p "${VENV}/lib/${py_dir}/site-packages"
-    tar -xzf "${tgz}" -C "${VENV}/lib/${py_dir}/site-packages"
+    "${UV_BIN}" venv --python "${tarball_python}" "${venv_tmp}" 2>/dev/null
+    py_dir="$(ls "${venv_tmp}/lib/" | grep '^python' | head -1)"
+    mkdir -p "${venv_tmp}/lib/${py_dir}/site-packages"
+    tar -xzf "${tgz}" -C "${venv_tmp}/lib/${py_dir}/site-packages"
     # Install the local editable package (meridian-agents) — no deps needed,
     # everything is already in site-packages from the tarball.
-    "${UV_BIN}" pip install --quiet --no-deps --python "${VENV}/bin/python" -e "${APP_ROOT}/services"
+    "${UV_BIN}" pip install --quiet --no-deps --python "${venv_tmp}/bin/python" -e "${APP_ROOT}/services"
+    # All steps succeeded — atomically replace the live venv.
+    rm -rf "${VENV}"
+    mv "${venv_tmp}" "${VENV}"
     printf '%s\n' "${stamp_hash}" > "${VENV_STAMP}"
     ok "Python services ready ($(${VENV}/bin/python --version 2>&1))"
 }
@@ -544,6 +573,9 @@ elif [[ -d "${APP_ROOT}/ui" ]]; then
     # ui/ was preserved by meridian-npm-setup.sh — hash matched, no re-extraction needed
     ok "dashboard unchanged — reusing existing build"
     _ui_changed=0
+else
+    err "Dashboard bundle missing from ${APP_ROOT} — re-run the installer: curl -fsSL https://raw.githubusercontent.com/Meridiona/meridian/main/scripts/bootstrap.sh | bash"
+    exit 1
 fi
 
 # ── 6. Daemons — restart only what changed ───────────────────────────────────
@@ -564,10 +596,10 @@ _py_src_changed=1
 if [[ -f "${_PY_SRC_STAMP}" && "$(cat "${_PY_SRC_STAMP}")" == "${_py_src_hash}" ]]; then
     _py_src_changed=0
 fi
-echo "${_py_src_hash}" > "${_PY_SRC_STAMP}"
-
 if [[ "${_mlx_was_healthy}" -eq 1 && "${_venv_changed}" -eq 0 && "${_py_src_changed}" -eq 0 ]]; then
     ok "Python services unchanged — MLX server kept running"
+    # Stamp only when the server is confirmed healthy (skip case = already healthy).
+    echo "${_py_src_hash}" > "${_PY_SRC_STAMP}"
 else
     info "Installing MLX inference server launchd agent…"
     bash "${APP_ROOT}/services/scripts/install-mlx-server-daemon.sh" --port "${MLX_PORT}" || warn "MLX agent install failed"
@@ -576,7 +608,11 @@ else
     until curl -sf "http://127.0.0.1:${MLX_PORT}/health" >/dev/null 2>&1; do
         sleep 3; _w=$((_w+3)); [[ $_w -ge 300 ]] && { warn "MLX not ready after 300s — check: meridian logs mlx-server"; break; }
     done
-    curl -sf "http://127.0.0.1:${MLX_PORT}/health" >/dev/null 2>&1 && ok "MLX server ready (${_w}s)"
+    # Only stamp after confirmed ready — prevents stale stamp on a failed restart.
+    if curl -sf "http://127.0.0.1:${MLX_PORT}/health" >/dev/null 2>&1; then
+        ok "MLX server ready (${_w}s)"
+        echo "${_py_src_hash}" > "${_PY_SRC_STAMP}"
+    fi
 fi
 
 # Rust daemon: skip restart when binary is identical.
@@ -596,11 +632,13 @@ else
 fi
 
 # Persist component hashes for the next update's differential check.
+# Write to a temp file and rename atomically so a crash mid-write never leaves
+# a half-written or empty hash file (which would force a full reinstall).
 _final_ui_hash="${_new_ui_hash:-${_OLD_UI_HASH}}"
 {
     [[ -n "${_new_daemon_hash}" ]] && printf 'daemon_bin=%s\n' "${_new_daemon_hash}"
     [[ -n "${_final_ui_hash}" ]] && printf 'ui_tarball=%s\n' "${_final_ui_hash}"
-} > "${_HASH_FILE}"
+} > "${_HASH_FILE}.tmp" && mv "${_HASH_FILE}.tmp" "${_HASH_FILE}"
 
 ok "all daemons installed"
 
@@ -608,8 +646,12 @@ ok "all daemons installed"
 _skill_src="${APP_ROOT}/services/skills/coding-agent/session-summary/SKILL.md"
 _skill_dst="${HOME}/.claude/commands/session-summary.md"
 mkdir -p "${HOME}/.claude/commands"
-cp "${_skill_src}" "${_skill_dst}"
-ok "session-summary command → ~/.claude/commands/session-summary.md"
+if [[ -f "${_skill_src}" ]]; then
+    cp "${_skill_src}" "${_skill_dst}"
+    ok "session-summary command → ~/.claude/commands/session-summary.md"
+else
+    warn "session-summary skill not found in bundle — skipping (${_skill_src})"
+fi
 
 # Pipeline smoke test — verify both LLM stages return valid output (no DB writes).
 echo ""

package/scripts/install-ui-daemon.sh

@@ -34,6 +34,15 @@ if [[ -z "${NPM_BIN}" ]]; then
     echo "✗ npm not found in PATH — install Node.js 18+ and re-run" >&2
     exit 1
 fi
+# Capture the node binary directory so launchd's restricted PATH includes it.
+# `npm run start` invokes `next start` whose shebang resolves `node` via PATH;
+# NVM / fnm / asdf install node outside /opt/homebrew and /usr/local, so the
+# standard launchd PATH misses it. Injecting NODE_BIN_DIR fixes this.
+NODE_BIN="$(command -v node 2>/dev/null || true)"
+NODE_BIN_DIR_PREFIX=""
+if [[ -n "${NODE_BIN}" ]]; then
+    NODE_BIN_DIR_PREFIX="$(dirname "${NODE_BIN}"):"
+fi
 
 if [[ ! -d "${REPO_ROOT}/ui/.next" ]]; then
     echo "✗ ui/.next not found — run \`cd ui && npm ci && npm run build\` first" >&2
@@ -49,6 +58,7 @@ sed \
     -e "s|{{REPO_ROOT}}|${REPO_ROOT}|g" \
     -e "s|{{HOME}}|${HOME}|g" \
     -e "s|{{NPM_BIN}}|${NPM_BIN}|g" \
+    -e "s|{{NODE_BIN_DIR}}|${NODE_BIN_DIR_PREFIX}|g" \
     "${TEMPLATE}" > "${PLIST_DEST}"
 
 if ! plutil -lint "${PLIST_DEST}" >/dev/null; then

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.27.2"
+version = "1.27.4"
 description = "Meridian agents — hermes task linking and Jira progress updates for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]