@meridiona/meridian-darwin-arm64 1.34.3 → 1.34.4

package/VERSION

@@ -1 +1 @@
-1.34.3
+1.34.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.34.3",
+  "version": "1.34.4",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/install-screenpipe-daemon.sh

@@ -42,12 +42,32 @@ fi
 # found when screenpipe is a native binary (Homebrew) rather than the npm shim.
 STAGED_BIN="${HOME}/.meridian/bin/screenpipe"
 
-# Prefer the already-staged stable binary (written by install-from-bundle.sh).
-# On a standalone re-run of this script (e.g. `meridian repair`) resolve the
-# real Mach-O from the npm tree and stage it so the launchd plist is immune to
-# nvm version changes — the npm shim path under ~/.nvm is version-specific and
-# breaks silently when the user runs `nvm use` or upgrades Node.
-if [[ -x "${STAGED_BIN}" ]] && file "${STAGED_BIN}" 2>/dev/null | grep -q "Mach-O"; then
+# Determine the binary path to write into the plist.
+#
+# Priority order — chosen to avoid invalidating existing TCC grants:
+#
+# 1. Existing plist path is still a valid Mach-O → keep it.
+#    macOS TCC grants are per absolute path. Changing the path silently
+#    revokes the grant and breaks screenpipe on the next start. Preserve
+#    the old path on updates so working installs stay working.
+#
+# 2. Already-staged stable binary exists → use it.
+#    Covers fresh installs and repairs where no old plist exists.
+#
+# 3. Resolve the real Mach-O from the npm tree → stage it → use it.
+#    Handles new installs where neither a plist nor a staged binary exists.
+#    nvm users get a version-specific path under ~/.nvm that breaks on
+#    `nvm use` or Node upgrades, so we always copy to the stable
+#    ~/.meridian/bin/screenpipe location.
+_old_plist_bin=""
+if [[ -f "${PLIST_DEST}" ]]; then
+    _old_plist_bin="$(plutil -extract ProgramArguments.0 raw "${PLIST_DEST}" 2>/dev/null || true)"
+fi
+
+if [[ -n "${_old_plist_bin}" ]] && [[ -x "${_old_plist_bin}" ]] && file "${_old_plist_bin}" 2>/dev/null | grep -q "Mach-O"; then
+    SCREENPIPE_BIN="${_old_plist_bin}"
+    echo "→ keeping existing screenpipe binary (preserves TCC grant): ${SCREENPIPE_BIN}"
+elif [[ -x "${STAGED_BIN}" ]] && file "${STAGED_BIN}" 2>/dev/null | grep -q "Mach-O"; then
     SCREENPIPE_BIN="${STAGED_BIN}"
     echo "→ using staged screenpipe binary: ${SCREENPIPE_BIN}"
 else

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.34.3"
+version = "1.34.4"
 description = "Meridian agents — MLX classifier server and Jira worklog synthesis for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]

package/services/scripts/com.meridiona.mlx-server.plist

@@ -23,13 +23,18 @@
     <key>WorkingDirectory</key>
     <string>{{REPO_ROOT}}/services</string>
 
-    <!-- Use the base Python binary directly (not the venv wrapper script) so
-         Python never reads pyvenv.cfg — which triggers EPERM from launchd on
-         macOS 15 even at Standard ProcessType.  PYTHONPATH gives the venv's
-         site-packages without triggering venv-detection. -->
+    <!-- uv resolves the managed Python and activates the venv before exec.
+         UV_PROJECT_ENVIRONMENT points to services/.venv (prepared by
+         setup-services.sh for dev, or install-from-bundle.sh for npm installs).
+         --no-sync skips lockfile resolution at daemon startup. -->
     <key>ProgramArguments</key>
     <array>
-        <string>{{BASE_PYTHON}}</string>
+        <string>{{UV_BIN}}</string>
+        <string>run</string>
+        <string>--no-sync</string>
+        <string>--project</string>
+        <string>{{REPO_ROOT}}/services</string>
+        <string>python</string>
         <string>-m</string>
         <string>agents.server</string>
         <string>--backend</string>
@@ -40,12 +45,14 @@
 
     <key>EnvironmentVariables</key>
     <dict>
+        <key>HOME</key>
+        <string>{{HOME}}</string>
+        <key>UV_PROJECT_ENVIRONMENT</key>
+        <string>{{SERVICES_VENV}}</string>
         <key>MERIDIAN_DB</key>
         <string>{{HOME}}/.meridian/meridian.db</string>
         <key>PYTHONUNBUFFERED</key>
         <string>1</string>
-        <key>PYTHONPATH</key>
-        <string>{{SITE_PACKAGES}}</string>
         <key>MLX_SERVER_PORT</key>
         <string>{{MLX_SERVER_PORT}}</string>
         <key>MERIDIAN_OO_AUTH</key>

package/services/scripts/install-mlx-server-daemon.sh

@@ -40,42 +40,29 @@ if [[ ! -f "${TEMPLATE}" ]]; then
     exit 1
 fi
 
-VENV="${SERVICES_DIR}/.venv"
-VENV_CFG="${VENV}/pyvenv.cfg"
-if [[ ! -f "${VENV_CFG}" ]]; then
-    echo "✗ venv not found at ${VENV}" >&2
-    echo "  Run:  bash scripts/setup-services.sh --mlx" >&2
+# Find the uv binary.
+UV_BIN=""
+for _uv_candidate in "${HOME}/.local/bin/uv" /opt/homebrew/bin/uv /usr/local/bin/uv; do
+    if [[ -x "${_uv_candidate}" ]]; then UV_BIN="${_uv_candidate}"; break; fi
+done
+[[ -z "${UV_BIN}" ]] && UV_BIN="$(command -v uv 2>/dev/null || true)"
+if [[ -z "${UV_BIN}" ]]; then
+    echo "✗ uv not found. Run:  bash scripts/setup-services.sh --mlx" >&2
     exit 1
 fi
 
-# Resolve the base Python from pyvenv.cfg so we invoke it directly rather
-# than through the venv wrapper. The wrapper shebang causes Python to read
-# pyvenv.cfg at startup, which EPERM-fails when launchd launches the process
-# on macOS 15 (launchd inherits no TCC Documents permission).
-#
-# pyvenv.cfg format differs by creator:
-#   python -m venv  → "executable = /path/to/python3.11"
-#   uv sync         → "home = /path/to/bin"  (no `executable` key)
-# Try `executable` first, fall back to `home` + python3.11/python3/python.
-# `|| true` prevents set -e from exiting when grep finds no match (exit 1).
-BASE_PYTHON=$(grep '^executable' "${VENV_CFG}" 2>/dev/null | awk '{print $3}' || true)
-if [[ -z "${BASE_PYTHON}" || ! -x "${BASE_PYTHON}" ]]; then
-    _home=$(grep '^home ' "${VENV_CFG}" 2>/dev/null | awk '{print $3}' || true)
-    if [[ -n "${_home}" ]]; then
-        for _py in python3.11 python3 python; do
-            if [[ -x "${_home}/${_py}" ]]; then BASE_PYTHON="${_home}/${_py}"; break; fi
-        done
-    fi
-fi
-if [[ ! -x "${BASE_PYTHON}" ]]; then
-    echo "✗ base Python not found (checked pyvenv.cfg executable + home keys in ${VENV_CFG})" >&2
-    exit 1
-fi
+# The venv always lives at services/.venv — inside the repo for dev installs,
+# inside ~/.meridian/app/services/ for npm installs (managed by install-from-bundle.sh).
+SERVICES_VENV="${SERVICES_DIR}/.venv"
 
-# venv site-packages directory (PYTHONPATH replaces venv activation).
-SITE_PACKAGES=$(ls -d "${VENV}/lib/python"*/site-packages 2>/dev/null | head -1)
-if [[ -z "${SITE_PACKAGES}" ]]; then
-    echo "✗ site-packages not found under ${VENV}/lib/" >&2
+if [[ ! -d "${SERVICES_VENV}" ]]; then
+    if [[ "${SERVICES_DIR}" == "${HOME}/.meridian/"* ]]; then
+        echo "✗ venv not found at ${SERVICES_VENV}" >&2
+        echo "  npm install appears incomplete — reinstall via: meridian update" >&2
+        exit 1
+    fi
+    echo "✗ venv not found at ${SERVICES_VENV}" >&2
+    echo "  Run:  bash scripts/setup-services.sh --mlx" >&2
     exit 1
 fi
 
@@ -99,8 +86,8 @@ sed \
     -e "s|{{REPO_ROOT}}|${REPO_ROOT}|g" \
     -e "s|{{HOME}}|${HOME}|g" \
     -e "s|{{MLX_SERVER_PORT}}|${MLX_SERVER_PORT}|g" \
-    -e "s|{{BASE_PYTHON}}|${BASE_PYTHON}|g" \
-    -e "s|{{SITE_PACKAGES}}|${SITE_PACKAGES}|g" \
+    -e "s|{{UV_BIN}}|${UV_BIN}|g" \
+    -e "s|{{SERVICES_VENV}}|${SERVICES_VENV}|g" \
     -e "s|{{MERIDIAN_OO_AUTH}}|${MERIDIAN_OO_AUTH}|g" \
     -e "s|{{MERIDIAN_OTLP_ENDPOINT}}|${MERIDIAN_OTLP_ENDPOINT}|g" \
     "${TEMPLATE}" > "${PLIST_DEST}"