@meridiona/meridian-darwin-arm64 1.62.0 → 1.64.0

package/VERSION

@@ -1 +1 @@
-1.62.0
+1.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.62.0",
+  "version": "1.64.0",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/install-from-bundle.sh

@@ -10,9 +10,14 @@
 set -euo pipefail
 
 APP_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# ⚠️ LICENSE PIN — DO NOT BUMP past 0.4.6 without legal review.
+# screenpipe relicensed MIT → Commercial on 2026-06-10. 0.4.6 (published
+# 2026-06-05) is the LAST MIT npm release; >= 0.4.17 (2026-06-11+) is Commercial,
+# whose "competing product" clause would then bind our users. Meridian ships zero
+# screenpipe code, so MIT 0.4.6 keeps the install license-clean. Bumping this is a
+# deliberate legal decision. CI enforces it — .github/workflows/ci.yml `screenpipe-license-pin`.
 SCREENPIPE_VERSION="0.4.6"
 MLX_PORT="${MLX_PORT:-7823}"
-UI_PORT="${MERIDIAN_UI_PORT:-3939}"   # dashboard port (override via MERIDIAN_UI_PORT)
 SKIP_PERMISSIONS=0
 [[ "${1:-}" == "--skip-permissions" ]] && SKIP_PERMISSIONS=1
 
@@ -22,7 +27,6 @@ SKIP_PERMISSIONS=0
 _HASH_FILE="${HOME}/.meridian/.component-hashes"
 _load_old_hash() { grep "^$1=" "${_HASH_FILE}" 2>/dev/null | cut -d= -f2 || true; }
 _OLD_DAEMON_HASH="$(_load_old_hash daemon_bin)"
-_OLD_UI_HASH="$(_load_old_hash ui_tarball)"
 _OLD_TRAY_HASH="$(_load_old_hash tray_bin)"
 
 info() { echo "→ $*" >&2; }
@@ -125,111 +129,28 @@ source "${APP_ROOT}/scripts/lib-trello-setup.sh"
 GUI_TARGET="gui/$(id -u)"
 LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
 
-# Resolve the Node runtime the dashboard must run on. The better-sqlite3 addon in
-# ui.tar.gz is built against one exact Node version (recorded in
-# bin/node-runtime.meta by package-release.sh); running any other Node major
-# triggers a NODE_MODULE_VERSION (ABI) mismatch and the dashboard crash-loops.
-# The 113 MB Node binary is NOT shipped through npm (it would blow the registry
-# payload limit), so we download that exact official build from nodejs.org once,
-# verify the pinned SHA-256, and cache it under ~/.meridian (survives the APP_ROOT
-# rm-rf on `meridian update`). Echoes the node path on stdout. Failure fallbacks
-# to system node are LOUD because they may not match the addon's ABI.
-resolve_node_runtime() {
-    local meta="${APP_ROOT}/bin/node-runtime.meta"
-    # Dev/source install (no meta file): use system/Homebrew node as-is. Such a
-    # build compiles its own better-sqlite3 against that node, so ABI matches.
-    if [[ ! -f "${meta}" ]]; then
-        local _n
-        for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-            [[ -x "${_n}" ]] && { echo "${_n}"; return 0; }
-        done
-        return 1
-    fi
-    local ver sha
-    ver="$(grep '^NODE_RUNTIME_VERSION=' "${meta}" | cut -d= -f2 | tr -d '[:space:]')"
-    sha="$(grep '^NODE_RUNTIME_SHA=' "${meta}" | cut -d= -f2 | tr -d '[:space:]')"
-    if [[ -z "${ver}" || -z "${sha}" ]]; then
-        warn "node-runtime.meta is malformed (missing VERSION or SHA) — falling back to system node"
-        for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-            [[ -x "${_n}" ]] && { echo "${_n}"; return 0; }
-        done
-        return 1
-    fi
-    local cache_dir="${HOME}/.meridian/node-runtime/v${ver}"
-    local cache_bin="${cache_dir}/bin/node"
-    if [[ -x "${cache_bin}" ]]; then echo "${cache_bin}"; return 0; fi
-    local tmp tgz url got
-    tmp="$(mktemp -d)"; tgz="${tmp}/node.tar.gz"
-    url="https://nodejs.org/dist/v${ver}/node-v${ver}-darwin-arm64.tar.gz"
-    info "Downloading Node ${ver} runtime for the dashboard (one-time, ~40 MB)…"
-    if curl -fsSL --retry 3 "${url}" -o "${tgz}"; then
-        got="$(shasum -a 256 "${tgz}" | cut -d' ' -f1)"
-        if [[ "${got}" == "${sha}" ]]; then
-            tar -xzf "${tgz}" -C "${tmp}"
-            rm -rf "${cache_dir}"; mkdir -p "$(dirname "${cache_dir}")"
-            mv "${tmp}/node-v${ver}-darwin-arm64" "${cache_dir}"
-            rm -rf "${tmp}"
-            ok "Node ${ver} runtime cached (ABI-matched to the dashboard)"
-            echo "${cache_bin}"; return 0
-        fi
-        warn "Node ${ver} SHA-256 mismatch (expected ${sha}, got ${got}) — not using it"
-    else
-        warn "Node ${ver} download failed (offline?) — the dashboard needs it to match better-sqlite3's ABI"
-    fi
-    rm -rf "${tmp}"
-    local _n
-    for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-        if [[ -x "${_n}" ]]; then
-            warn "Falling back to ${_n} — if the dashboard fails to load, re-run 'meridian update' with a connection"
-            echo "${_n}"; return 0
-        fi
-    done
-    return 1
-}
-
-# Register the dashboard as a launchd agent that runs the prebuilt Next.js
-# standalone server (`node ui/server.js`) — no `npm start`, no node_modules
-# install. Mirrors the EIO-safe bootout/bootstrap pattern of the other agents.
-install_ui_standalone() {
+# Retire the legacy standalone dashboard Node server. The dashboard now ships
+# embedded INSIDE the tray binary (static export, no Node server), so any
+# `com.meridiona.ui` launchd agent from a pre-fold install is a zombie — a
+# KeepAlive=true Node server holding the old dashboard port. Boot it out + remove
+# its plist, and drop the now-orphaned ABI-matched Node runtime cache. Idempotent
+# (no-op when absent) and non-fatal (a launchctl hiccup must not abort the
+# update) — but logged, never silent.
+retire_legacy_ui_server() {
     local label="com.meridiona.ui"
     local plist="${LAUNCH_AGENTS}/${label}.plist"
-    # Resolve the ABI-matched Node runtime (downloads + caches it on first use).
-    local node_bin
-    node_bin="$(resolve_node_runtime)" || { err "node not found — install Node.js: brew install node"; return 1; }
-    local start_script="${APP_ROOT}/scripts/ui-start.sh"
-    chmod +x "${start_script}" 2>/dev/null || true
-    mkdir -p "${HOME}/.meridian/logs" "${LAUNCH_AGENTS}"
-    cat > "${plist}" <<PLIST
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-  <key>Label</key><string>${label}</string>
-  <key>ProgramArguments</key>
-  <array><string>${start_script}</string></array>
-  <key>WorkingDirectory</key><string>${APP_ROOT}/ui</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PORT</key><string>${UI_PORT}</string>
-    <key>HOSTNAME</key><string>127.0.0.1</string>
-    <key>MERIDIAN_DB_PATH</key><string>${HOME}/.meridian/meridian.db</string>
-    <key>MERIDIAN_NODE_BIN</key><string>${node_bin}</string>
-  </dict>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${HOME}/.meridian/logs/ui.log</string>
-  <key>StandardErrorPath</key><string>${HOME}/.meridian/logs/ui-error.log</string>
-  <key>ProcessType</key><string>Background</string>
-</dict></plist>
-PLIST
-    plutil -lint "${plist}" >/dev/null 2>&1 || { warn "ui plist failed lint"; return 1; }
-    launchctl bootout "${GUI_TARGET}/${label}" 2>/dev/null || true
-    local w=0
-    while launchctl print "${GUI_TARGET}/${label}" >/dev/null 2>&1; do
-        sleep 1; w=$((w+1)); [[ $w -ge 15 ]] && break
-    done
-    launchctl enable "${GUI_TARGET}/${label}" 2>/dev/null || true
-    launchctl bootstrap "${GUI_TARGET}" "${plist}"
-    launchctl kickstart -k "${GUI_TARGET}/${label}" 2>/dev/null || true
+    if launchctl print "${GUI_TARGET}/${label}" >/dev/null 2>&1; then
+        info "Retiring the legacy dashboard server (now bundled in the tray app)…"
+        launchctl bootout "${GUI_TARGET}/${label}" 2>/dev/null \
+            || warn "could not bootout ${label} (continuing)"
+    fi
+    if [[ -f "${plist}" ]]; then
+        rm -f "${plist}" && ok "removed legacy ${label} launchd agent" \
+            || warn "could not remove ${plist} (continuing)"
+    fi
+    # The pinned Node runtime existed only to ABI-match better-sqlite3 in the old
+    # server; nothing uses it now.
+    rm -rf "${HOME}/.meridian/node-runtime" 2>/dev/null || true
 }
 
 # Enable accessibility mode in VS Code / Cursor / Antigravity so screenpipe
@@ -339,10 +260,10 @@ ok "node + python ($(${PYTHON_BIN} --version 2>&1)) + uv ($(${UV_BIN} --version
 if ! command -v screenpipe >/dev/null 2>&1; then
     info "Installing screenpipe ${SCREENPIPE_VERSION} via npm…"
     if npm_global_writable; then
-        npm install -g "screenpipe@${SCREENPIPE_VERSION}"
+        npm install -g --ignore-scripts "screenpipe@${SCREENPIPE_VERSION}"
     else
         warn "global npm prefix needs root — elevating just this install (you may be prompted)…"
-        sudo npm install -g "screenpipe@${SCREENPIPE_VERSION}"
+        sudo npm install -g --ignore-scripts "screenpipe@${SCREENPIPE_VERSION}"
     fi
 fi
 ok "screenpipe"
@@ -367,22 +288,18 @@ fi
 if ! command -v ffmpeg >/dev/null 2>&1; then info "Installing ffmpeg…"; brew install ffmpeg; fi
 ok "ffmpeg"
 
-# ── 2. Config: single repo-local .env ────────────────────────────────────────
-ENV_FILE="${APP_ROOT}/.env"
+# ── 2. Config: user credential file ──────────────────────────────────────────
+# Canonical location is ~/.meridian/.env — install-independent, next to
+# meridian.db and settings.json, never inside app/ (the binary tree).
+ENV_FILE="${HOME}/.meridian/.env"
 if [[ ! -f "${ENV_FILE}" ]]; then
     cp "${APP_ROOT}/.env.example" "${ENV_FILE}"
-    info "created ${ENV_FILE} from template — add your Jira creds later: meridian config edit"
+    info "created ${ENV_FILE} from template — add your credentials: meridian config edit"
 fi
 # MLX is the default backend.
 grep -q '^CLASSIFIER_BACKEND=' "${ENV_FILE}" || echo "CLASSIFIER_BACKEND=mlx" >> "${ENV_FILE}"
 grep -q '^MLX_SERVER_PORT='    "${ENV_FILE}" || echo "MLX_SERVER_PORT=${MLX_PORT}" >> "${ENV_FILE}"
-# Dashboard port — honour an existing .env value, otherwise record the default.
-if grep -q '^MERIDIAN_UI_PORT=' "${ENV_FILE}"; then
-    UI_PORT="$(grep '^MERIDIAN_UI_PORT=' "${ENV_FILE}" | tail -n1 | cut -d= -f2 | tr -d '[:space:]')"
-else
-    echo "MERIDIAN_UI_PORT=${UI_PORT}" >> "${ENV_FILE}"
-fi
-ok "config at ${ENV_FILE} (dashboard port ${UI_PORT})"
+ok "config at ${ENV_FILE}"
 
 # Interactive tracker-credential walkthrough — parity with install.sh. A fresh
 # `meridian setup` collects Jira/GitHub/Linear keys here; `meridian update`
@@ -552,7 +469,7 @@ if [[ "${SKIP_PERMISSIONS}" -eq 0 ]]; then
     open "x-apple.systempreferences:com.apple.Notifications-Settings.extension" 2>/dev/null || true
     echo "  → Scroll to the bottom and turn ON"
     echo "    'Allow notifications when mirroring or sharing the display'."
-    echo "  → When 'Meridian Tray' appears, ensure its notifications are allowed"
+    echo "  → When 'Meridian' appears, ensure its notifications are allowed"
     echo "    (style Banners or Alerts, not None)."
     read -r -p "  Press Enter when done… " _ || true
 fi
@@ -561,30 +478,10 @@ fi
 # this, screenpipe falls back to OCR for those editors instead of their a11y tree.
 configure_editor_accessibility
 
-# ── 5b. Unpack the dashboard (Turbopack standalone, shipped as a tarball) ─────
-# The UI ships as ui.tar.gz rather than an expanded ui/ dir so that Turbopack's
-# relative symlinks under .next/node_modules (serverExternalPackages: better-
-# sqlite3, pino, @opentelemetry/*) survive `npm publish`, which strips symlinks.
-# When meridian-npm-setup.sh detected the tarball hash was unchanged it preserved
-# the existing ui/ dir and deleted ui.tar.gz — in that case skip extraction too.
-_ui_changed=1
-_new_ui_hash=""
-if [[ -f "${APP_ROOT}/ui.tar.gz" ]]; then
-    _new_ui_hash="$(shasum -a 256 "${APP_ROOT}/ui.tar.gz" | cut -d' ' -f1)"
-    info "Unpacking dashboard…"
-    rm -rf "${APP_ROOT}/ui"
-    mkdir -p "${APP_ROOT}/ui"
-    tar -xzf "${APP_ROOT}/ui.tar.gz" -C "${APP_ROOT}/ui"
-    rm -f "${APP_ROOT}/ui.tar.gz"
-    ok "dashboard unpacked ($(find "${APP_ROOT}/ui/.next/node_modules" -type l 2>/dev/null | wc -l | tr -d ' ') external symlink(s) restored)"
-elif [[ -d "${APP_ROOT}/ui" ]]; then
-    # ui/ was preserved by meridian-npm-setup.sh — hash matched, no re-extraction needed
-    ok "dashboard unchanged — reusing existing build"
-    _ui_changed=0
-else
-    err "Dashboard bundle missing from ${APP_ROOT} — re-run the installer: curl -fsSL https://raw.githubusercontent.com/Meridiona/meridian/main/scripts/bootstrap.sh | bash"
-    exit 1
-fi
+# ── 5b. Retire the legacy dashboard Node server (one-time, for pre-fold installs) ─
+# The dashboard is now embedded in the tray binary, so an old standalone UI agent
+# is a zombie. This runs on every (re)install/update — idempotent + non-fatal.
+retire_legacy_ui_server
 
 # ── 6. Daemons — restart only what changed ───────────────────────────────────
 # screenpipe: external npm binary, plist may have changed → always refresh.
@@ -679,7 +576,7 @@ if [[ -x "${APP_ROOT}/bin/meridian-tray" ]]; then
     if [[ "${_tray_changed}" -eq 0 ]]; then
         ok "Tray app unchanged — skipping restart"
     else
-        info "Installing Meridian Tray launchd agent…"
+        info "Installing Meridian tray agent…"
         bash "${APP_ROOT}/scripts/install-tray-daemon.sh" || warn "tray agent install failed"
     fi
 else
@@ -716,31 +613,16 @@ if command -v cursor >/dev/null 2>&1 || [[ -d "${HOME}/Library/Application Suppo
     else
         info "  Cursor detected but the cursor-agent CLI is missing — Cursor summaries will use the local model (MLX)."
         info "  To summarise with Cursor's own CLI:  curl https://cursor.com/install -fsS | bash  then: cursor-agent login"
-        info "  Or let the daemon install it on demand: add CURSOR_AGENT_AUTO_INSTALL=1 to ${HOME}/.meridian/app/.env"
+        info "  Or let the daemon install it on demand: add CURSOR_AGENT_AUTO_INSTALL=1 to ${HOME}/.meridian/.env"
     fi
 fi
 
-# UI: even when the build is unchanged we ALWAYS re-pin the Node runtime and
-# reload the launchd job. The better-sqlite3 addon is ABI-locked to one Node
-# version; skipping this reload is how a stale UI job survives `update` and ends
-# up running a mismatched system Node (NODE_MODULE_VERSION crash-loop). The
-# expensive re-extraction is already skipped above when unchanged, so this is
-# cheap — resolve_node_runtime hits the cache, then bootout/bootstrap reloads.
-if [[ "${_ui_changed}" -eq 0 ]]; then
-    info "Dashboard build unchanged — re-pinning Node runtime and reloading UI agent…"
-else
-    info "Installing the dashboard (UI) launchd agent…"
-fi
-install_ui_standalone
-
 # Persist component hashes for the next update's differential check.
 # Write to a temp file and rename atomically so a crash mid-write never leaves
 # a half-written or empty hash file (which would force a full reinstall).
-_final_ui_hash="${_new_ui_hash:-${_OLD_UI_HASH}}"
 _final_tray_hash="${_new_tray_hash:-${_OLD_TRAY_HASH}}"
 {
     [[ -n "${_new_daemon_hash}" ]] && printf 'daemon_bin=%s\n' "${_new_daemon_hash}"
-    [[ -n "${_final_ui_hash}" ]] && printf 'ui_tarball=%s\n' "${_final_ui_hash}"
     [[ -n "${_final_tray_hash}" ]] && printf 'tray_bin=%s\n' "${_final_tray_hash}"
 } > "${_HASH_FILE}.tmp" && mv "${_HASH_FILE}.tmp" "${_HASH_FILE}"
 
@@ -771,7 +653,7 @@ echo "✓ Meridian installed at ${APP_ROOT}"
 echo "  meridian status            # check the daemons"
 echo "  meridian logs -f           # watch the pipeline"
 echo "  meridian config edit       # add Jira creds"
-echo "  open http://localhost:${UI_PORT} # the dashboard"
+echo "  open the Meridian tray icon in the menu bar → Open Dashboard"
 echo ""
 echo "Jira worklogs are DRAFTED only — approve them in the dashboard (Worklogs"
 echo "view) and the daemon posts approved worklogs within ~60s."

package/scripts/meridian-cli.sh

@@ -11,11 +11,12 @@ REPO_ROOT="$(cd "$(dirname "$SELF")/.." && pwd)"
 # --- constants ---
 LABEL_SCREENPIPE="com.meridiona.screenpipe"
 LABEL_DAEMON="com.meridiona.daemon"
-LABEL_UI="com.meridiona.ui"
+LABEL_UI="com.meridiona.ui"   # retired (dashboard now embedded in the tray) — kept only to boot out a leftover legacy agent
 LABEL_MLX="com.meridiona.mlx-server"
-# Jira worklogs and coding-agent ingest run inside the Rust daemon — no
-# separate launchd agents. Only these four are managed.
-readonly LABELS=("${LABEL_SCREENPIPE}" "${LABEL_DAEMON}" "${LABEL_UI}" "${LABEL_MLX}")
+# Jira worklogs and coding-agent ingest run inside the Rust daemon, and the
+# dashboard is embedded in the tray binary — no separate UI launchd agent. Only
+# these three production services are managed.
+readonly LABELS=("${LABEL_SCREENPIPE}" "${LABEL_DAEMON}" "${LABEL_MLX}")
 GUI_TARGET="gui/$(id -u)"
 LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
 LOG_DIR="${HOME}/.meridian/logs"
@@ -268,12 +269,11 @@ _doctor_fallback() {
     printf "  ════════════════════════════════════════════════════════\n"
     _group "system"
     _row "$([[ "$(uname -s)" == "Darwin" ]] && echo ok || echo fail)" "macOS" ""
-    _row "$([[ -f "${REPO_ROOT}/.env" ]] && echo ok || echo fail)" "config (.env)" ""
+    _row "$([[ -f "${HOME}/.meridian/.env" || -f "${REPO_ROOT}/.env" ]] && echo ok || echo fail)" "config (.env)" ""
     _group "services (plists)"
     _plist_row "$LABEL_DAEMON" "daemon plist"
     _plist_row "$LABEL_SCREENPIPE" "screenpipe plist"
     _plist_row "$LABEL_MLX" "mlx plist"
-    _plist_row "$LABEL_UI" "ui plist"
     _group "builds"
     _row "$([[ -f "${REPO_ROOT}/packages/meridian-mcp/dist/index.js" ]] && echo ok || echo fail)" "mcp built" ""
     _row "$([[ -d "${REPO_ROOT}/ui/.next" ]] && echo ok || echo fail)" "ui built" ""
@@ -288,7 +288,9 @@ _doctor_fallback() {
 #   (no flag)        full run: classification + worklog synthesis
 
 _smoke_read_env() {
-    local key="$1" env_file="${REPO_ROOT}/.env"
+    local key="$1"
+    local env_file="${HOME}/.meridian/.env"
+    [[ -f "$env_file" ]] || env_file="${REPO_ROOT}/.env"
     [[ -f "$env_file" ]] || return 0
     grep -E "^${key}=" "$env_file" 2>/dev/null | tail -1 | cut -d= -f2- || true
 }
@@ -452,9 +454,10 @@ cmd_config() {
         err "usage: meridian config edit"
         exit 1
     fi
-    local env_file="${REPO_ROOT}/.env"
+    local env_file="${HOME}/.meridian/.env"
+    [[ -f "$env_file" ]] || env_file="${REPO_ROOT}/.env"
     if [[ ! -f "$env_file" ]]; then
-        err "${env_file} not found — run ./install.sh first"
+        err "~/.meridian/.env not found — run the installer first"
         exit 1
     fi
     "${EDITOR:-nano}" "$env_file"
@@ -494,7 +497,9 @@ cmd_uninstall() {
     set +e
 
     # 1. Stop and remove all launchd agents
-    bash "${REPO_ROOT}/scripts/uninstall-ui-daemon.sh" 2>/dev/null
+    # Legacy UI server (retired — dashboard is now in the tray): boot out + remove inline.
+    launchctl bootout "${GUI_TARGET}/${LABEL_UI}" 2>/dev/null || true
+    rm -f "${HOME}/Library/LaunchAgents/${LABEL_UI}.plist" 2>/dev/null || true
     bash "${REPO_ROOT}/services/scripts/uninstall-mlx-server-daemon.sh" 2>/dev/null
     bash "${REPO_ROOT}/scripts/uninstall-daemon.sh" 2>/dev/null
     bash "${REPO_ROOT}/scripts/uninstall-screenpipe-daemon.sh" 2>/dev/null

package/scripts/meridian-npm-setup.sh

@@ -43,13 +43,22 @@ clone_dir() { # <src> <dst>
 }
 
 mkdir -p "${STAGE}"
-# Copy the prebuilt payload (bin/ ui.tar.gz services/ scripts/ .env.example VERSION).
+# Copy the prebuilt payload (bin/ services/ scripts/ .env.example VERSION).
 cp -R "${BUNDLE}/." "${STAGE}/"
 # Drop npm-package metadata that isn't part of the app.
 rm -f "${STAGE}/package.json" "${STAGE}/README.md" "${STAGE}/.gitignore" "${STAGE}/.npmignore"
 
-# Preserve an existing .env across re-installs/updates.
-[[ -f "${APP}/.env" ]] && cp "${APP}/.env" "${STAGE}/.env"
+# One-time migration: move credentials from the old app/.env location to the
+# canonical ~/.meridian/.env (outside the swap area — untouched by updates).
+# If both exist, the canonical wins and the old copy is removed.
+if [[ -f "${APP}/.env" ]]; then
+    if [[ ! -f "${HOME}/.meridian/.env" ]]; then
+        mv "${APP}/.env" "${HOME}/.meridian/.env"
+        echo "migrated credentials: ~/.meridian/app/.env → ~/.meridian/.env"
+    else
+        rm -f "${APP}/.env"
+    fi
+fi
 
 # Preserve the Python venv across updates. The venv is built from PyPI via
 # uv sync at install time; preserving it means install-from-bundle.sh only
@@ -60,35 +69,9 @@ if [[ -d "${APP}/services/.venv" ]]; then
     clone_dir "${APP}/services/.venv" "${STAGE}/services/.venv"
 fi
 
-# UI. Two cases, mirroring install-from-bundle.sh's contract:
-#   * unchanged (tarball hash matches the recorded one, or no tarball shipped):
-#     clone the existing ui/ and drop the tarball — the installer reads
-#     "no tarball + ui/ present" as unchanged and skips re-extraction.
-#   * changed: pre-extract the tarball into staging AND keep the tarball. The
-#     stage is then complete BEFORE the swap, so an installer crash after the
-#     swap still leaves a runnable dashboard; the installer's own extraction
-#     (which records the new hash) re-does only a few seconds of work.
-_hash_file="${HOME}/.meridian/.component-hashes"
-_ui_preserved=0
-if [[ -d "${APP}/ui" ]]; then
-    if [[ -f "${STAGE}/ui.tar.gz" ]] && [[ -f "${_hash_file}" ]]; then
-        _old_ui_hash="$(grep '^ui_tarball=' "${_hash_file}" 2>/dev/null | cut -d= -f2 || true)"
-        _new_ui_hash="$(shasum -a 256 "${STAGE}/ui.tar.gz" | cut -d' ' -f1)"
-        if [[ -n "${_old_ui_hash}" && "${_new_ui_hash}" == "${_old_ui_hash}" ]]; then
-            clone_dir "${APP}/ui" "${STAGE}/ui"
-            rm -f "${STAGE}/ui.tar.gz"
-            _ui_preserved=1
-        fi
-    elif [[ ! -f "${STAGE}/ui.tar.gz" ]]; then
-        # No tarball in bundle = UI unchanged since last release; keep existing build.
-        clone_dir "${APP}/ui" "${STAGE}/ui"
-        _ui_preserved=1
-    fi
-fi
-if [[ "${_ui_preserved}" -eq 0 && -f "${STAGE}/ui.tar.gz" ]]; then
-    mkdir -p "${STAGE}/ui"
-    tar -xzf "${STAGE}/ui.tar.gz" -C "${STAGE}/ui"
-fi
+# The dashboard is no longer staged here: it's embedded in the tray binary, so
+# the bundle ships neither ui.tar.gz nor a ui/ dir. Any old ~/.meridian/app/ui
+# from a pre-fold install is discarded by the swap below (APP → OLD → rm).
 
 # The swap: two renames on one filesystem. Running daemons keep their open
 # inodes from the old tree until they restart; the installer (exec'd next)

package/services/agents/run_task_linker_mlx.py

@@ -101,6 +101,31 @@ _DEFAULT_MLX_MODEL_MIN_RAM_GB = 6.5
 # runtime by llm_selector.select_mlx_model_id() based on available compute.
 _MLX_MODEL_ID_PIN = os.environ.get("MLX_MODEL_ID")
 
+# `~/.meridian/settings.json` — the SAME file the Rust daemon + tray read/write.
+# We read only `llm_model_preference` here: the HuggingFace repo id the user
+# chose in the setup wizard (written by the tray's `set_model_preference`).
+_SETTINGS_PATH = Path(
+    os.environ.get("MERIDIAN_SETTINGS_PATH")
+    or (Path.home() / ".meridian" / "settings.json")
+)
+
+
+def _settings_model_preference() -> "str | None":
+    """Return the user's chosen model HF id from settings.json, or None.
+
+    A blank/absent value means "no preference" → fall through to dynamic
+    selection. Never raises — a malformed or missing file is treated as unset.
+    """
+    try:
+        with _SETTINGS_PATH.open(encoding="utf-8") as fh:
+            data = json.load(fh)
+    except (OSError, ValueError):
+        return None
+    if not isinstance(data, dict):
+        return None
+    pref = data.get("llm_model_preference")
+    return pref if isinstance(pref, str) and pref.strip() else None
+
 # Resolved lazily and cached for the process lifetime by _resolve_model_id().
 # Kept as a module attribute (not just a function return) so /info, /v1/models,
 # and the llm_inference span all report the same, truthful id.
@@ -127,12 +152,23 @@ def _resolve_model_id() -> str:
         from agents.llm_selector import (
             APPLE_INTELLIGENCE_ID, resolve_model, select_mlx_model_id,
         )
-        entry = resolve_model(_DEFAULT_MLX_MODEL_ID)
+        # The user's wizard choice (if any) becomes the preferred model; otherwise
+        # fall back to the eval-tuned default. Either way `select_mlx_model_id`
+        # keeps the preference when Metal budget allows and degrades when it can't,
+        # so an over-ambitious choice on a small Mac never OOMs.
+        user_pref = _settings_model_preference()
+        preferred_id = user_pref or _DEFAULT_MLX_MODEL_ID
+        if user_pref:
+            log.info(
+                "run_task_linker_mlx: model preference from settings.json",
+                extra={"model_preference": user_pref},
+            )
+        entry = resolve_model(preferred_id)
         preferred_min_ram = (
             entry["min_ram_gb"] if entry else _DEFAULT_MLX_MODEL_MIN_RAM_GB
         )
         selected = select_mlx_model_id(
-            preferred_hf_id=_DEFAULT_MLX_MODEL_ID,
+            preferred_hf_id=preferred_id,
             preferred_min_ram_gb=preferred_min_ram,
         )
         # Propagate the Apple Intelligence sentinel as-is; fall back to the

package/services/agents/server.py

@@ -17,6 +17,7 @@ import argparse
 import logging
 import os
 import sqlite3 as _sqlite3
+import threading
 from contextlib import asynccontextmanager
 from pathlib import Path
 from typing import Any, AsyncIterator
@@ -150,6 +151,151 @@ async def info() -> dict:
     }
 
 
+# ---------------------------------------------------------------------------
+# Model prefetch — eager, spec-aware download for the onboarding wizard
+# ---------------------------------------------------------------------------
+#
+# The wizard's Model step calls /prefetch_model right after the runtime is
+# provisioned so the ~7 GB classifier weights are on disk before the first
+# classification — instead of the lazy, progress-less download that otherwise
+# fires mid-inference. The model id is resolved by `_resolve_model_id()`, which
+# is ALREADY spec-aware (picks the best fit for this machine's Metal headroom /
+# RAM / chip via `llm_selector.select_mlx_model_id`), so eager == spec-aware
+# without any manifest change.
+#
+# We download to the HF cache WITHOUT loading weights into Metal memory: the
+# download primitive is `mlx_lm.utils._download(model_id)` — the SAME call (and
+# therefore the same `allow_patterns` fileset) that `mlx_lm.load()` resolves on
+# the non-sharded path — so the first real `load()` finds everything cached and
+# never touches the network. A bare `snapshot_download` could fetch a different
+# set and leave `load()` to re-download silently; we only fall back to it (with
+# the identical pattern list replicated) if the private primitive is missing.
+
+# MUST stay in sync with `mlx_lm.utils._download`'s default `allow_patterns`
+# (used by `load()` on the non-sharded path) — the fallback relies on parity.
+_MODEL_ALLOW_PATTERNS = [
+    "*.json", "model*.safetensors", "*.py", "tokenizer.model",
+    "*.tiktoken", "tiktoken.model", "*.txt", "*.jsonl", "*.jinja",
+]
+
+# Shared prefetch progress, guarded by _prefetch_lock. states: idle|downloading|done|error
+_prefetch_state: dict[str, Any] = {
+    "state": "idle", "model_id": None, "received": 0, "total": 0, "error": None,
+}
+_prefetch_lock = threading.Lock()
+
+
+def _hf_cache_dir_for(model_id: str) -> Path:
+    """The HF hub cache directory for `model_id` (where partial + complete blobs land)."""
+    from huggingface_hub.constants import HF_HUB_CACHE
+    return Path(HF_HUB_CACHE) / ("models--" + model_id.replace("/", "--"))
+
+
+def _dir_size_bytes(path: Path) -> int:
+    """Sum of all file sizes under `path` (includes HF `.incomplete` partials → live progress)."""
+    total = 0
+    if path.exists():
+        for f in path.rglob("*"):
+            try:
+                if f.is_file():
+                    total += f.stat().st_size
+            except OSError:
+                pass
+    return total
+
+
+def _prefetch_total_bytes(model_id: str) -> int:
+    """Authoritative download size: sum HF sibling sizes filtered to the load() patterns.
+
+    Computed upfront so the wizard's progress bar has a stable denominator, instead
+    of summing concurrent per-file tqdm totals (which lurch as new bars spawn).
+    """
+    import fnmatch
+    from huggingface_hub import HfApi
+    info = HfApi().model_info(model_id, files_metadata=True)
+    total = 0
+    for sib in info.siblings or []:
+        if any(fnmatch.fnmatch(sib.rfilename, pat) for pat in _MODEL_ALLOW_PATTERNS):
+            total += sib.size or 0
+    return total
+
+
+def _run_prefetch(model_id: str) -> None:
+    """Background worker: download the model's weights to the HF cache (no load)."""
+    tracer = trace.get_tracer(__name__)
+    with tracer.start_as_current_span("model_prefetch") as span:
+        span.set_attribute("model_id", model_id)
+        try:
+            try:
+                from mlx_lm.utils import _download as _mlx_download
+                _mlx_download(model_id)  # exact fileset load() resolves; download-only
+            except (ImportError, AttributeError):
+                # Private primitive unavailable — replicate load()'s default patterns.
+                from huggingface_hub import snapshot_download
+                snapshot_download(model_id, allow_patterns=_MODEL_ALLOW_PATTERNS)
+            received = _dir_size_bytes(_hf_cache_dir_for(model_id))
+            with _prefetch_lock:
+                _prefetch_state["received"] = received or _prefetch_state["total"]
+                _prefetch_state["state"] = "done"
+            span.set_attribute("received_bytes", received)
+            log.info("server: model prefetch complete", extra={"model_id": model_id, "received_bytes": received})
+        except Exception as exc:  # noqa: BLE001 — report, never crash the server
+            with _prefetch_lock:
+                _prefetch_state["state"] = "error"
+                _prefetch_state["error"] = str(exc)
+            span.set_status(trace.Status(trace.StatusCode.ERROR, str(exc)))
+            log.error("server: model prefetch failed", extra={"model_id": model_id, "error": str(exc)})
+
+
+@app.post("/prefetch_model")
+async def prefetch_model() -> dict:
+    """Start the eager, spec-aware model download (idempotent). Returns current status.
+
+    Apple Intelligence backend → nothing to download (no-op `done`). Re-POSTing
+    while `downloading`/`done` returns the live state without spawning a second
+    download; an earlier `error` is retried.
+    """
+    from fastapi.concurrency import run_in_threadpool
+
+    from agents.llm_selector import APPLE_INTELLIGENCE_ID
+    m = _app_state.get("mlx_module")
+    model_id = m._resolve_model_id() if m else None
+    if model_id == APPLE_INTELLIGENCE_ID or model_id is None:
+        return {"state": "done", "model_id": model_id, "received": 0, "total": 0, "error": None}
+
+    with _prefetch_lock:
+        # Idempotent only for the SAME model: a completed/in-flight prefetch for
+        # one model must not block starting a different one after the user changes
+        # their model preference (which changes what _resolve_model_id() returns).
+        same_model = _prefetch_state.get("model_id") == model_id
+        if same_model and _prefetch_state["state"] in ("downloading", "done"):
+            return dict(_prefetch_state)  # idempotent — no duplicate downloads
+        _prefetch_state.update(state="downloading", model_id=model_id, received=0, total=0, error=None)
+
+    try:
+        total = await run_in_threadpool(_prefetch_total_bytes, model_id)
+    except Exception as exc:  # noqa: BLE001 — size probe is best-effort; download still runs
+        total = 0
+        log.warning("server: prefetch size-probe failed (bar will be indeterminate)", extra={"error": str(exc)})
+    with _prefetch_lock:
+        _prefetch_state["total"] = total
+
+    threading.Thread(target=_run_prefetch, args=(model_id,), daemon=True).start()
+    log.info("server: model prefetch started", extra={"model_id": model_id, "total_bytes": total})
+    with _prefetch_lock:
+        return dict(_prefetch_state)
+
+
+@app.get("/prefetch_status")
+async def prefetch_status() -> dict:
+    """Live prefetch progress. `received` is recomputed from the cache dir while downloading."""
+    with _prefetch_lock:
+        st = dict(_prefetch_state)
+    if st["state"] == "downloading" and st["model_id"]:
+        st["received"] = _dir_size_bytes(_hf_cache_dir_for(st["model_id"]))
+    return st
+
+
 # ---------------------------------------------------------------------------
 # MLX backend — direct in-process inference, model pre-loaded at startup
 # ---------------------------------------------------------------------------

package/services/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meridian-agents"
-version = "1.62.0"
+version = "1.64.0"
 description = "Meridian agents — MLX classifier server and Jira worklog synthesis for meridian.db"
 requires-python = ">=3.11"
 authors = [{ name = "Meridiona" }]

package/services/uv.lock

@@ -1196,7 +1196,7 @@ wheels = [
 
 [[package]]
 name = "meridian-agents"
-version = "1.48.2"
+version = "1.56.0"
 source = { editable = "." }
 dependencies = [
     { name = "mcp" },

package/bin/node-runtime.meta

@@ -1,2 +0,0 @@
-NODE_RUNTIME_VERSION=22.22.3
-NODE_RUNTIME_SHA=0da7ff74ef8611328c8212f17943368713a2ad953fb7d89a8c8a0eae87c23207

package/scripts/com.meridiona.ui.plist

@@ -1,62 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-    com.meridiona.ui — runs the Next.js dashboard (built by ./install.sh) as
-    a background launchd LaunchAgent. Serves on http://localhost:3939.
-
-    Install via scripts/install-ui-daemon.sh which copies this file into
-    ~/Library/LaunchAgents/ with absolute paths substituted in, then
-    bootstraps it under launchd. The plist below uses {{HOME}}, {{REPO_ROOT}}
-    and {{NPM_BIN}} placeholders that the install script replaces.
-
-    Uninstall:
-        scripts/uninstall-ui-daemon.sh
-    Or manually:
-        launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.meridiona.ui.plist
-        rm ~/Library/LaunchAgents/com.meridiona.ui.plist
--->
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>com.meridiona.ui</string>
-
-    <key>WorkingDirectory</key>
-    <string>{{REPO_ROOT}}/ui</string>
-
-    <key>ProgramArguments</key>
-    <array>
-        <string>{{NPM_BIN}}</string>
-        <string>run</string>
-        <string>start</string>
-    </array>
-
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>PATH</key>
-        <string>{{NODE_BIN_DIR}}/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
-        <key>HOME</key>
-        <string>{{HOME}}</string>
-        <key>MERIDIAN_DB</key>
-        <string>{{HOME}}/.meridian/meridian.db</string>
-        <key>PORT</key>
-        <string>3939</string>
-        <key>NODE_ENV</key>
-        <string>production</string>
-    </dict>
-
-    <key>StandardOutPath</key>
-    <string>{{HOME}}/.meridian/logs/ui.log</string>
-    <key>StandardErrorPath</key>
-    <string>{{HOME}}/.meridian/logs/ui-error.log</string>
-
-    <!-- RunAtLoad true: dashboard should always be available after login. -->
-    <key>RunAtLoad</key>
-    <true/>
-    <key>KeepAlive</key>
-    <true/>
-    <key>ThrottleInterval</key>
-    <integer>30</integer>
-    <key>ProcessType</key>
-    <string>Background</string>
-</dict>
-</plist>

package/scripts/install-ui-daemon.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-# Install the meridian Next.js dashboard as a launchd LaunchAgent under the
-# current user. Serves on http://localhost:3939. Built artifact must exist
-# at ui/.next/ before this script runs (install.sh handles that).
-#
-#   ./scripts/install-ui-daemon.sh
-#
-# Re-running this script is safe — it bootouts the existing agent first,
-# rewrites the plist with current paths, and reloads it.
-#
-# Uninstall:
-#   ./scripts/uninstall-ui-daemon.sh
-
-set -euo pipefail
-
-LABEL="com.meridiona.ui"
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-TEMPLATE="${SCRIPT_DIR}/${LABEL}.plist"
-
-LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
-PLIST_DEST="${LAUNCH_AGENTS}/${LABEL}.plist"
-
-GUI_TARGET="gui/$(id -u)"
-
-if [[ ! -f "${TEMPLATE}" ]]; then
-    echo "✗ template not found: ${TEMPLATE}" >&2
-    exit 1
-fi
-
-NPM_BIN="$(command -v npm 2>/dev/null || true)"
-if [[ -z "${NPM_BIN}" ]]; then
-    echo "✗ npm not found in PATH — install Node.js 18+ and re-run" >&2
-    exit 1
-fi
-# Capture the node binary directory so launchd's restricted PATH includes it.
-# `npm run start` invokes `next start` whose shebang resolves `node` via PATH;
-# NVM / fnm / asdf install node outside /opt/homebrew and /usr/local, so the
-# standard launchd PATH misses it. Injecting NODE_BIN_DIR fixes this.
-NODE_BIN="$(command -v node 2>/dev/null || true)"
-NODE_BIN_DIR_PREFIX=""
-if [[ -n "${NODE_BIN}" ]]; then
-    NODE_BIN_DIR_PREFIX="$(dirname "${NODE_BIN}"):"
-fi
-
-if [[ ! -d "${REPO_ROOT}/ui/.next" ]]; then
-    echo "✗ ui/.next not found — run \`cd ui && npm ci && npm run build\` first" >&2
-    echo "  (or just run ./install.sh which does it for you)" >&2
-    exit 1
-fi
-
-mkdir -p "${HOME}/.meridian/logs"
-mkdir -p "${LAUNCH_AGENTS}"
-
-echo "→ writing ${PLIST_DEST}"
-sed \
-    -e "s|{{REPO_ROOT}}|${REPO_ROOT}|g" \
-    -e "s|{{HOME}}|${HOME}|g" \
-    -e "s|{{NPM_BIN}}|${NPM_BIN}|g" \
-    -e "s|{{NODE_BIN_DIR}}|${NODE_BIN_DIR_PREFIX}|g" \
-    "${TEMPLATE}" > "${PLIST_DEST}"
-
-if ! plutil -lint "${PLIST_DEST}" >/dev/null; then
-    echo "✗ plist failed validation" >&2
-    exit 1
-fi
-
-echo "→ bootout ${LABEL} (if loaded)"
-launchctl bootout "${GUI_TARGET}/${LABEL}" 2>/dev/null || true
-# bootout is async — wait until the domain entry actually clears before
-# bootstrapping, otherwise launchctl bootstrap can fail with EIO (errno 5).
-_bootout_wait=0
-while launchctl print "${GUI_TARGET}/${LABEL}" >/dev/null 2>&1; do
-    sleep 1
-    _bootout_wait=$(( _bootout_wait + 1 ))
-    if [[ "${_bootout_wait}" -ge 15 ]]; then
-        echo "⚠ ${LABEL} still in launchd domain after 15s — proceeding anyway" >&2
-        break
-    fi
-done
-
-echo "→ bootstrap ${LABEL}"
-launchctl enable "${GUI_TARGET}/${LABEL}" 2>/dev/null || true
-launchctl bootstrap "${GUI_TARGET}" "${PLIST_DEST}"
-launchctl enable "${GUI_TARGET}/${LABEL}"
-launchctl kickstart -k "${GUI_TARGET}/${LABEL}"
-
-echo
-echo "✓ UI installed and started"
-echo
-echo "  open  http://localhost:3939                # the dashboard"
-echo "  tail -f ~/.meridian/logs/ui.log            # live stdout"
-echo "  tail -f ~/.meridian/logs/ui-error.log      # live stderr"
-echo "  ${SCRIPT_DIR}/uninstall-ui-daemon.sh       # remove"

package/scripts/ui-start.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-#
-# Startup wrapper for the Next.js UI daemon.
-#
-# The dashboard's better-sqlite3 native addon is ABI-locked to ONE exact Node
-# version — the one CI built it against, recorded in bin/node-runtime.meta as
-# NODE_RUNTIME_VERSION. Running any other Node major triggers a
-# NODE_MODULE_VERSION (ABI) mismatch and the dashboard crash-loops. So on a
-# bundle install we resolve the cached, version-matched runtime under
-# ~/.meridian/node-runtime ourselves — we do NOT trust a stale MERIDIAN_NODE_BIN
-# or system node that a `meridian update` may have left behind (that is exactly
-# how the UI ended up on a mismatched Node). If the matched runtime is missing we
-# fail LOUD with remediation rather than silently crash-looping under the wrong
-# Node. (A source/dev install has no meta file: there better-sqlite3 was compiled
-# against the local node, so we prefer MERIDIAN_NODE_BIN then system node.)
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-APP_ROOT="$(dirname "${SCRIPT_DIR}")"
-META="${APP_ROOT}/bin/node-runtime.meta"
-
-log() { echo "[meridian-ui] $*" >&2; }
-
-# `node -v` → bare version (strip the leading "v"); empty if it can't run.
-node_version() { "${1}" -v 2>/dev/null | sed 's/^v//'; }
-
-# The exact Node version the shipped addon was built against (bundle install
-# only). `|| true` so a malformed/lineless meta doesn't trip `set -e`.
-REQUIRED_VER=""
-if [[ -f "${META}" ]]; then
-    REQUIRED_VER="$(grep '^NODE_RUNTIME_VERSION=' "${META}" 2>/dev/null | cut -d= -f2 | tr -d '[:space:]' || true)"
-fi
-
-NODE=""
-if [[ -n "${REQUIRED_VER}" ]]; then
-    # Bundle install: enforce the ABI-matched runtime. The cached runtime that
-    # install-from-bundle.sh downloaded for this exact version is the source of
-    # truth; accept MERIDIAN_NODE_BIN only if it actually IS that version.
-    cached="${HOME}/.meridian/node-runtime/v${REQUIRED_VER}/bin/node"
-    if [[ -x "${cached}" ]] && [[ "$(node_version "${cached}")" == "${REQUIRED_VER}" ]]; then
-        NODE="${cached}"
-    elif [[ -n "${MERIDIAN_NODE_BIN:-}" ]] && [[ -x "${MERIDIAN_NODE_BIN}" ]] \
-         && [[ "$(node_version "${MERIDIAN_NODE_BIN}")" == "${REQUIRED_VER}" ]]; then
-        NODE="${MERIDIAN_NODE_BIN}"
-    else
-        log "dashboard requires Node ${REQUIRED_VER} (better-sqlite3 ABI), but the"
-        log "cached runtime at ${cached} is missing or wrong-versioned."
-        log "Fetch it: run 'meridian update' with a connection, or reinstall:"
-        log "  curl -fsSL https://raw.githubusercontent.com/Meridiona/meridian/main/scripts/bootstrap.sh | bash"
-        # EX_CONFIG: refuse to start under a mismatched Node. KeepAlive will retry,
-        # but the log now states the exact cause instead of a cryptic ERR_DLOPEN.
-        exit 78
-    fi
-else
-    # Source/dev install (no meta): better-sqlite3 was compiled against the local
-    # node, so prefer MERIDIAN_NODE_BIN then system node — ABI matches by build.
-    # launchd agents don't inherit the user's PATH, so probe known locations.
-    NODE="${MERIDIAN_NODE_BIN:-}"
-    if [[ -z "${NODE}" ]] || [[ ! -x "${NODE}" ]]; then
-        for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-            if [[ -x "${_n}" ]]; then NODE="${_n}"; break; fi
-        done
-    fi
-    [[ -x "${NODE:-}" ]] || { log "node not found — cannot start UI server"; exit 1; }
-fi
-
-exec "${NODE}" "${APP_ROOT}/ui/server.js"

package/scripts/uninstall-ui-daemon.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-# ambient dev tool that watches what you do and updates your PM tickets automatically, boosting developer productivity
-# Stop and remove the meridian UI launchd agent.
-
-set -euo pipefail
-
-LABEL="com.meridiona.ui"
-PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"
-GUI_TARGET="gui/$(id -u)"
-
-if [[ ! -f "${PLIST}" ]]; then
-    echo "(${LABEL} not installed)"
-    exit 0
-fi
-
-if launchctl print "${GUI_TARGET}/${LABEL}" >/dev/null 2>&1; then
-    echo "→ bootout ${LABEL}"
-    launchctl bootout "${GUI_TARGET}" "${PLIST}" || true
-fi
-
-rm -f "${PLIST}"
-echo "✓ ${LABEL} uninstalled"