@meridiona/meridian-darwin-arm64 1.51.0 → 1.52.1

package/.env.example

@@ -188,8 +188,9 @@
 # structured log ingestion into a local OpenObserve instance)
 # ---------------------------------------------------------------------------
 
-# base64(email:password) for your local OpenObserve instance.
-# When unset, OTLP export is silently skipped — logs still go to .jsonl files.
+# DEPRECATED — the Rust daemon ignores this; set OpenObserve credentials in
+# the dashboard Settings instead (stored in settings.json). Still read by the
+# Python services' exporter and as an installer fallback for old setups.
 # Generate: echo -n "you@your-org.com:yourpassword" | base64
 # MERIDIAN_OO_AUTH=base64encodedcredentials
 

package/VERSION

@@ -1 +1 @@
-1.51.0
+1.52.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.51.0",
+  "version": "1.52.1",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/com.meridiona.daemon.plist

@@ -43,14 +43,14 @@
         <string>{{HOME}}/.meridian/meridian.db</string>
         <key>POLL_INTERVAL_SECS</key>
         <string>60</string>
-        <key>RUST_LOG</key>
-        <string>meridian=info</string>
-        <!-- OTLP auth for OpenObserve — must be set here (not just .env)
-             because the Rust binary reads env vars before dotenv is loaded.
-             The install script reads MERIDIAN_OO_AUTH from the repo-root .env and
-             substitutes the {{MERIDIAN_OO_AUTH}} placeholder below. -->
-        <key>MERIDIAN_OO_AUTH</key>
-        <string>{{MERIDIAN_OO_AUTH}}</string>
+        <!-- RUST_LOG is intentionally NOT set here. The daemon derives its log
+             filter from settings.log_level (dashboard Settings → Log Level) and
+             hot-reloads it on the next poll tick; pinning RUST_LOG would make
+             reload_log_level() a no-op and silently defeat the UI control. A
+             power user can still export RUST_LOG to override. -->
+        <!-- MERIDIAN_OO_AUTH is deprecated and ignored by the daemon — OpenObserve
+             credentials come from settings.json (dashboard Settings). The key is
+             left out of this plist on purpose. -->
         <key>MERIDIAN_OTLP_ENDPOINT</key>
         <string>{{MERIDIAN_OTLP_ENDPOINT}}</string>
     </dict>

package/scripts/com.meridiona.openobserve.plist

@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    com.meridiona.openobserve — runs OpenObserve as a local OTLP backend for
+    traces + logs from the Meridian stack. Serves on http://localhost:5080.
+
+    Install via scripts/install-openobserve-daemon.sh which copies this file
+    into ~/Library/LaunchAgents/ with absolute paths and credentials
+    substituted, then bootstraps it under launchd. The plist below uses
+    {{HOME}}, {{OO_BIN}}, {{OO_EMAIL}}, and {{OO_PASSWORD}} placeholders that
+    the install script decodes from MERIDIAN_OO_AUTH and substitutes.
+
+    Uninstall:
+        scripts/uninstall-openobserve-daemon.sh
+    Or manually:
+        launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.meridiona.openobserve.plist
+        rm ~/Library/LaunchAgents/com.meridiona.openobserve.plist
+-->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.meridiona.openobserve</string>
+
+    <!-- run.sh reads ~/.openobserve/.log_level for RUST_LOG (default: warn)
+         and sets memory caps before exec-ing the binary. -->
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>{{HOME}}/.openobserve/run.sh</string>
+    </array>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>{{HOME}}</string>
+        <!-- Admin credentials used by OO to bootstrap its first-run account.
+             Decoded from MERIDIAN_OO_AUTH = base64(email:password) by the
+             install script. -->
+        <key>ZO_ROOT_USER_EMAIL</key>
+        <string>{{OO_EMAIL}}</string>
+        <key>ZO_ROOT_USER_PASSWORD</key>
+        <string>{{OO_PASSWORD}}</string>
+        <key>ZO_DATA_DIR</key>
+        <string>{{HOME}}/.openobserve/data</string>
+        <key>ZO_HTTP_PORT</key>
+        <string>5080</string>
+        <key>ZO_GRPC_PORT</key>
+        <string>5081</string>
+        <key>ZO_TELEMETRY</key>
+        <string>false</string>
+    </dict>
+
+    <key>StandardOutPath</key>
+    <string>{{HOME}}/.meridian/logs/openobserve.log</string>
+    <key>StandardErrorPath</key>
+    <string>{{HOME}}/.meridian/logs/openobserve-error.log</string>
+
+    <!-- RunAtLoad true: OO must be up before the Rust daemon and Python agents
+         send traces, so it starts immediately on login. -->
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>ThrottleInterval</key>
+    <integer>30</integer>
+    <key>ProcessType</key>
+    <string>Background</string>
+</dict>
+</plist>

package/scripts/install-openobserve-daemon.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+# Install OpenObserve as a launchd LaunchAgent under the current user.
+# Serves on http://localhost:5080 and auto-starts on login.
+#
+#   ./scripts/install-openobserve-daemon.sh
+#
+# Re-running is safe — it bootouts the existing agent first, rewrites the
+# plist with current credentials, and reloads it.
+#
+# Credentials come from settings.json (oo_email/oo_password, set in the
+# dashboard Settings). MERIDIAN_OO_AUTH in <repo>/.env is DEPRECATED and used
+# only as a fallback; with no credentials anywhere the agent is installed
+# stopped and the dashboard toggle starts it once credentials are set.
+#
+# Uninstall:
+#   ./scripts/uninstall-openobserve-daemon.sh
+
+set -euo pipefail
+
+LABEL="com.meridiona.openobserve"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEMPLATE="${SCRIPT_DIR}/${LABEL}.plist"
+
+LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
+PLIST_DEST="${LAUNCH_AGENTS}/${LABEL}.plist"
+
+GUI_TARGET="gui/$(id -u)"
+
+if [[ ! -f "${TEMPLATE}" ]]; then
+    echo "✗ template not found: ${TEMPLATE}" >&2
+    exit 1
+fi
+
+# Locate the OpenObserve binary.
+OO_BIN=""
+if [[ -x "${HOME}/.openobserve/openobserve" ]]; then
+    OO_BIN="${HOME}/.openobserve/openobserve"
+elif command -v openobserve >/dev/null 2>&1; then
+    OO_BIN="$(command -v openobserve)"
+fi
+
+if [[ -z "${OO_BIN}" ]]; then
+    echo "→ OpenObserve binary not found — downloading v0.11.0 (last release with arm64 binary)..."
+    _oo_arch="$(uname -m)"
+    case "$_oo_arch" in
+        arm64)  _oo_arch="arm64" ;;
+        x86_64) _oo_arch="amd64" ;;
+        *) echo "✗ Unsupported arch: $_oo_arch" >&2; exit 1 ;;
+    esac
+    _oo_ver="v0.11.0"
+    _oo_url="https://github.com/openobserve/openobserve/releases/download/${_oo_ver}/openobserve-${_oo_ver}-darwin-${_oo_arch}.tar.gz"
+    mkdir -p "${HOME}/.openobserve"
+    if curl -fsSL -o "${HOME}/.openobserve/openobserve.tar.gz" "$_oo_url" \
+        && tar -xzf "${HOME}/.openobserve/openobserve.tar.gz" -C "${HOME}/.openobserve" \
+        && [[ -x "${HOME}/.openobserve/openobserve" ]]; then
+        rm -f "${HOME}/.openobserve/openobserve.tar.gz"
+        OO_BIN="${HOME}/.openobserve/openobserve"
+        echo "✓ OpenObserve ${_oo_ver} downloaded"
+    else
+        rm -f "${HOME}/.openobserve/openobserve.tar.gz"
+        echo "✗ Download failed from ${_oo_url}" >&2
+        echo "  Install manually: https://openobserve.ai/docs/install/" >&2
+        exit 1
+    fi
+fi
+
+# Resolve OpenObserve root credentials. settings.json (written by the dashboard
+# Settings page) is the canonical source; MERIDIAN_OO_AUTH in <repo>/.env is
+# DEPRECATED and honoured only as a fallback for not-yet-migrated installs.
+# With no credentials anywhere, the plist is written with placeholders and the
+# service is left stopped — enabling OpenObserve Export in the dashboard
+# patches real credentials into the plist (POST /api/openobserve) before the
+# service's first start, which is when OpenObserve creates its root account.
+_get_setting() {
+    python3 -c "import json,sys;print(json.load(open(sys.argv[1])).get(sys.argv[2]) or '')" "$1" "$2" 2>/dev/null || true
+}
+
+OO_EMAIL=""
+OO_PASSWORD=""
+for _settings in "${HOME}/.meridian/settings.json" "$(cd "${SCRIPT_DIR}/.." && pwd)/settings.json"; do
+    [[ -f "${_settings}" ]] || continue
+    OO_EMAIL="$(_get_setting "${_settings}" oo_email)"
+    OO_PASSWORD="$(_get_setting "${_settings}" oo_password)"
+    if [[ -n "${OO_EMAIL}" && -n "${OO_PASSWORD}" ]]; then
+        echo "→ using OpenObserve credentials from ${_settings}"
+        break
+    fi
+    OO_EMAIL=""; OO_PASSWORD=""
+done
+
+if [[ -z "${OO_EMAIL}" ]]; then
+    ENV_FILE="$(cd "${SCRIPT_DIR}/.." && pwd)/.env"
+    OO_AUTH=""
+    if [[ -f "${ENV_FILE}" ]]; then
+        OO_AUTH="$(grep -E '^MERIDIAN_OO_AUTH=' "${ENV_FILE}" | cut -d= -f2- | tr -d '[:space:]')" || true
+    fi
+    if [[ -n "${OO_AUTH}" ]]; then
+        echo "  ⚠ MERIDIAN_OO_AUTH is DEPRECATED — set OpenObserve credentials in the dashboard Settings instead" >&2
+        OO_CREDENTIALS="$(printf '%s' "${OO_AUTH}" | base64 --decode 2>/dev/null)" || OO_CREDENTIALS=""
+        OO_EMAIL="${OO_CREDENTIALS%%:*}"
+        OO_PASSWORD="${OO_CREDENTIALS#*:}"
+        if [[ -z "${OO_EMAIL}" || -z "${OO_PASSWORD}" || "${OO_EMAIL}" == "${OO_CREDENTIALS}" ]]; then
+            OO_EMAIL=""; OO_PASSWORD=""
+        fi
+    fi
+fi
+
+_no_creds=0
+if [[ -z "${OO_EMAIL}" || -z "${OO_PASSWORD}" ]]; then
+    _no_creds=1
+    OO_EMAIL="setup-pending@meridian.local"
+    OO_PASSWORD="setup-pending"
+    echo "→ no OpenObserve credentials yet — installing the agent stopped; enable"
+    echo "  OpenObserve Export in the dashboard Settings to set them and start it"
+fi
+
+mkdir -p "${HOME}/.meridian/logs"
+mkdir -p "${HOME}/.openobserve/data"
+mkdir -p "${LAUNCH_AGENTS}"
+
+# Remove legacy ai.openobserve agent — it conflicts with com.meridiona.openobserve
+# (both try to bind port 5080, causing a crash-loop on the Meridian plist).
+_legacy_plist="${LAUNCH_AGENTS}/ai.openobserve.plist"
+if [[ -f "${_legacy_plist}" ]]; then
+    echo "→ removing legacy ai.openobserve agent"
+    launchctl bootout "gui/$(id -u)/ai.openobserve" 2>/dev/null || true
+    rm -f "${_legacy_plist}"
+    echo "✓ legacy agent removed"
+fi
+
+# Write the launcher script. run.sh reads ~/.openobserve/.log_level for
+# RUST_LOG (default: warn) and sets memory caps before exec-ing the binary.
+echo "→ writing ${HOME}/.openobserve/run.sh"
+cat > "${HOME}/.openobserve/run.sh" <<'RUNEOF'
+#!/usr/bin/env bash
+# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+# OpenObserve launcher. Called by launchd (com.meridiona.openobserve).
+#
+# Log level override (dev):
+#   echo info   > ~/.openobserve/.log_level   # verbose
+#   echo warn   > ~/.openobserve/.log_level   # default (quiet)
+#   echo debug  > ~/.openobserve/.log_level   # very verbose
+#   rm ~/.openobserve/.log_level              # back to default
+#   launchctl kickstart -k gui/$(id -u)/com.meridiona.openobserve
+
+set -euo pipefail
+
+_level_file="${HOME}/.openobserve/.log_level"
+if [[ -f "${_level_file}" ]]; then
+    RUST_LOG="$(tr -d '[:space:]' < "${_level_file}")"
+else
+    RUST_LOG="warn"
+fi
+export RUST_LOG
+
+export ZO_MEMORY_CACHE_MAX_SIZE=2147483648   # 2 GB (cache layer)
+export ZO_DATAFUSION_POOL_SIZE=4294967296    # 4 GB (query engine)
+
+exec "${HOME}/.openobserve/openobserve"
+RUNEOF
+chmod +x "${HOME}/.openobserve/run.sh"
+echo "✓ run.sh written"
+
+# Write the plist via Python so email/password values with special characters
+# are substituted safely without sed delimiter collisions.
+echo "→ writing ${PLIST_DEST}"
+python3 - "${TEMPLATE}" "${PLIST_DEST}" "${HOME}" "${OO_BIN}" "${OO_EMAIL}" "${OO_PASSWORD}" <<'PYEOF'
+import sys
+template_path, dest_path, home, oo_bin, oo_email, oo_password = sys.argv[1:]
+with open(template_path) as f:
+    content = f.read()
+for placeholder, value in [
+    ("{{HOME}}",         home),
+    ("{{OO_BIN}}",       oo_bin),
+    ("{{OO_EMAIL}}",     oo_email),
+    ("{{OO_PASSWORD}}", oo_password),
+]:
+    content = content.replace(placeholder, value)
+with open(dest_path, "w") as f:
+    f.write(content)
+PYEOF
+
+if ! plutil -lint "${PLIST_DEST}" >/dev/null; then
+    echo "✗ plist failed plutil validation" >&2
+    exit 1
+fi
+
+echo "→ bootout ${LABEL} (if loaded)"
+launchctl bootout "${GUI_TARGET}/${LABEL}" 2>/dev/null || true
+# Wait until launchd confirms the service is gone before re-bootstrapping.
+# A fixed sleep is unreliable — on slower machines or when the prior process
+# takes time to exit, bootstrap can fail with EIO (errno 5) if the domain
+# entry hasn't been fully removed yet.
+_bootout_wait=0
+while launchctl print "${GUI_TARGET}/${LABEL}" >/dev/null 2>&1; do
+    sleep 1
+    _bootout_wait=$(( _bootout_wait + 1 ))
+    if [[ "${_bootout_wait}" -ge 15 ]]; then
+        echo "⚠ ${LABEL} still in launchd domain after 15s — proceeding anyway" >&2
+        break
+    fi
+done
+
+# Respect the runtime toggle: the service runs only when "OpenObserve Export"
+# is enabled in Settings. The plist is always installed so the UI's toggle
+# (POST /api/openobserve) can start/stop the service on demand; here we only
+# decide the INITIAL state. No settings.json anywhere → off (matches
+# RuntimeSettings::default and the UI default).
+_otlp_enabled() {
+    local f
+    for f in "${HOME}/.meridian/settings.json" "$(cd "${SCRIPT_DIR}/.." && pwd)/settings.json"; do
+        [[ -f "$f" ]] || continue
+        grep -q '"otlp_enabled"[[:space:]]*:[[:space:]]*true' "$f" && return 0
+        return 1
+    done
+    return 1
+}
+
+if [[ "${_no_creds}" -eq 0 ]] && _otlp_enabled; then
+    echo "→ bootstrap ${LABEL} (OpenObserve Export is enabled in settings)"
+    launchctl bootstrap "${GUI_TARGET}" "${PLIST_DEST}"
+    launchctl enable "${GUI_TARGET}/${LABEL}"
+    launchctl kickstart -k "${GUI_TARGET}/${LABEL}"
+    echo
+    echo "✓ OpenObserve installed and started"
+else
+    launchctl disable "${GUI_TARGET}/${LABEL}" 2>/dev/null || true
+    echo
+    echo "✓ OpenObserve installed (service left stopped — OpenObserve Export is"
+    echo "  disabled in Settings; enable the toggle in the dashboard to start it)"
+fi
+echo
+echo "  open  http://localhost:5080                           # the UI"
+echo "  tail -f ~/.meridian/logs/openobserve.log              # live stdout"
+echo "  tail -f ~/.meridian/logs/openobserve-error.log        # live stderr"
+echo "  ${SCRIPT_DIR}/uninstall-openobserve-daemon.sh         # remove"

package/scripts/uninstall-openobserve-daemon.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
+# Stop and remove the OpenObserve launchd agent.
+# Data at ~/.openobserve/data/ is left intact.
+
+set -euo pipefail
+
+LABEL="com.meridiona.openobserve"
+PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"
+GUI_TARGET="gui/$(id -u)"
+
+# Remove legacy agent if still present.
+_legacy="${HOME}/Library/LaunchAgents/ai.openobserve.plist"
+if [[ -f "${_legacy}" ]]; then
+    launchctl bootout "${GUI_TARGET}/ai.openobserve" 2>/dev/null || true
+    rm -f "${_legacy}"
+    echo "✓ legacy ai.openobserve agent removed"
+fi
+
+if [[ ! -f "${PLIST}" ]]; then
+    echo "(${LABEL} not installed)"
+    exit 0
+fi
+
+if launchctl print "${GUI_TARGET}/${LABEL}" >/dev/null 2>&1; then
+    echo "→ bootout ${LABEL}"
+    launchctl bootout "${GUI_TARGET}" "${PLIST}" || true
+fi
+
+rm -f "${PLIST}"
+echo "✓ ${LABEL} uninstalled"
+echo "  (trace data at ~/.openobserve/data/ is preserved)"

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.51.0"
+version = "1.52.1"
 description = "Meridian agents — MLX classifier server and Jira worklog synthesis for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]