@meridiona/meridian-darwin-arm64 1.63.0 → 1.65.0

package/VERSION

@@ -1 +1 @@
-1.63.0
+1.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridiona/meridian-darwin-arm64",
-  "version": "1.63.0",
+  "version": "1.65.0",
   "description": "Prebuilt Meridian app for macOS arm64 (daemon binary + dashboard + Python services). Installed via @meridiona/meridian.",
   "homepage": "https://github.com/Meridiona/meridian",
   "repository": {

package/scripts/install-from-bundle.sh

@@ -10,9 +10,14 @@
 set -euo pipefail
 
 APP_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# ⚠️ LICENSE PIN — DO NOT BUMP past 0.4.6 without legal review.
+# screenpipe relicensed MIT → Commercial on 2026-06-10. 0.4.6 (published
+# 2026-06-05) is the LAST MIT npm release; >= 0.4.17 (2026-06-11+) is Commercial,
+# whose "competing product" clause would then bind our users. Meridian ships zero
+# screenpipe code, so MIT 0.4.6 keeps the install license-clean. Bumping this is a
+# deliberate legal decision. CI enforces it — .github/workflows/ci.yml `screenpipe-license-pin`.
 SCREENPIPE_VERSION="0.4.6"
 MLX_PORT="${MLX_PORT:-7823}"
-UI_PORT="${MERIDIAN_UI_PORT:-3939}"   # dashboard port (override via MERIDIAN_UI_PORT)
 SKIP_PERMISSIONS=0
 [[ "${1:-}" == "--skip-permissions" ]] && SKIP_PERMISSIONS=1
 
@@ -22,7 +27,6 @@ SKIP_PERMISSIONS=0
 _HASH_FILE="${HOME}/.meridian/.component-hashes"
 _load_old_hash() { grep "^$1=" "${_HASH_FILE}" 2>/dev/null | cut -d= -f2 || true; }
 _OLD_DAEMON_HASH="$(_load_old_hash daemon_bin)"
-_OLD_UI_HASH="$(_load_old_hash ui_tarball)"
 _OLD_TRAY_HASH="$(_load_old_hash tray_bin)"
 
 info() { echo "→ $*" >&2; }
@@ -125,111 +129,28 @@ source "${APP_ROOT}/scripts/lib-trello-setup.sh"
 GUI_TARGET="gui/$(id -u)"
 LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
 
-# Resolve the Node runtime the dashboard must run on. The better-sqlite3 addon in
-# ui.tar.gz is built against one exact Node version (recorded in
-# bin/node-runtime.meta by package-release.sh); running any other Node major
-# triggers a NODE_MODULE_VERSION (ABI) mismatch and the dashboard crash-loops.
-# The 113 MB Node binary is NOT shipped through npm (it would blow the registry
-# payload limit), so we download that exact official build from nodejs.org once,
-# verify the pinned SHA-256, and cache it under ~/.meridian (survives the APP_ROOT
-# rm-rf on `meridian update`). Echoes the node path on stdout. Failure fallbacks
-# to system node are LOUD because they may not match the addon's ABI.
-resolve_node_runtime() {
-    local meta="${APP_ROOT}/bin/node-runtime.meta"
-    # Dev/source install (no meta file): use system/Homebrew node as-is. Such a
-    # build compiles its own better-sqlite3 against that node, so ABI matches.
-    if [[ ! -f "${meta}" ]]; then
-        local _n
-        for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-            [[ -x "${_n}" ]] && { echo "${_n}"; return 0; }
-        done
-        return 1
-    fi
-    local ver sha
-    ver="$(grep '^NODE_RUNTIME_VERSION=' "${meta}" | cut -d= -f2 | tr -d '[:space:]')"
-    sha="$(grep '^NODE_RUNTIME_SHA=' "${meta}" | cut -d= -f2 | tr -d '[:space:]')"
-    if [[ -z "${ver}" || -z "${sha}" ]]; then
-        warn "node-runtime.meta is malformed (missing VERSION or SHA) — falling back to system node"
-        for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-            [[ -x "${_n}" ]] && { echo "${_n}"; return 0; }
-        done
-        return 1
-    fi
-    local cache_dir="${HOME}/.meridian/node-runtime/v${ver}"
-    local cache_bin="${cache_dir}/bin/node"
-    if [[ -x "${cache_bin}" ]]; then echo "${cache_bin}"; return 0; fi
-    local tmp tgz url got
-    tmp="$(mktemp -d)"; tgz="${tmp}/node.tar.gz"
-    url="https://nodejs.org/dist/v${ver}/node-v${ver}-darwin-arm64.tar.gz"
-    info "Downloading Node ${ver} runtime for the dashboard (one-time, ~40 MB)…"
-    if curl -fsSL --retry 3 "${url}" -o "${tgz}"; then
-        got="$(shasum -a 256 "${tgz}" | cut -d' ' -f1)"
-        if [[ "${got}" == "${sha}" ]]; then
-            tar -xzf "${tgz}" -C "${tmp}"
-            rm -rf "${cache_dir}"; mkdir -p "$(dirname "${cache_dir}")"
-            mv "${tmp}/node-v${ver}-darwin-arm64" "${cache_dir}"
-            rm -rf "${tmp}"
-            ok "Node ${ver} runtime cached (ABI-matched to the dashboard)"
-            echo "${cache_bin}"; return 0
-        fi
-        warn "Node ${ver} SHA-256 mismatch (expected ${sha}, got ${got}) — not using it"
-    else
-        warn "Node ${ver} download failed (offline?) — the dashboard needs it to match better-sqlite3's ABI"
-    fi
-    rm -rf "${tmp}"
-    local _n
-    for _n in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
-        if [[ -x "${_n}" ]]; then
-            warn "Falling back to ${_n} — if the dashboard fails to load, re-run 'meridian update' with a connection"
-            echo "${_n}"; return 0
-        fi
-    done
-    return 1
-}
-
-# Register the dashboard as a launchd agent that runs the prebuilt Next.js
-# standalone server (`node ui/server.js`) — no `npm start`, no node_modules
-# install. Mirrors the EIO-safe bootout/bootstrap pattern of the other agents.
-install_ui_standalone() {
+# Retire the legacy standalone dashboard Node server. The dashboard now ships
+# embedded INSIDE the tray binary (static export, no Node server), so any
+# `com.meridiona.ui` launchd agent from a pre-fold install is a zombie — a
+# KeepAlive=true Node server holding the old dashboard port. Boot it out + remove
+# its plist, and drop the now-orphaned ABI-matched Node runtime cache. Idempotent
+# (no-op when absent) and non-fatal (a launchctl hiccup must not abort the
+# update) — but logged, never silent.
+retire_legacy_ui_server() {
     local label="com.meridiona.ui"
     local plist="${LAUNCH_AGENTS}/${label}.plist"
-    # Resolve the ABI-matched Node runtime (downloads + caches it on first use).
-    local node_bin
-    node_bin="$(resolve_node_runtime)" || { err "node not found — install Node.js: brew install node"; return 1; }
-    local start_script="${APP_ROOT}/scripts/ui-start.sh"
-    chmod +x "${start_script}" 2>/dev/null || true
-    mkdir -p "${HOME}/.meridian/logs" "${LAUNCH_AGENTS}"
-    cat > "${plist}" <<PLIST
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-  <key>Label</key><string>${label}</string>
-  <key>ProgramArguments</key>
-  <array><string>${start_script}</string></array>
-  <key>WorkingDirectory</key><string>${APP_ROOT}/ui</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PORT</key><string>${UI_PORT}</string>
-    <key>HOSTNAME</key><string>127.0.0.1</string>
-    <key>MERIDIAN_DB_PATH</key><string>${HOME}/.meridian/meridian.db</string>
-    <key>MERIDIAN_NODE_BIN</key><string>${node_bin}</string>
-  </dict>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${HOME}/.meridian/logs/ui.log</string>
-  <key>StandardErrorPath</key><string>${HOME}/.meridian/logs/ui-error.log</string>
-  <key>ProcessType</key><string>Background</string>
-</dict></plist>
-PLIST
-    plutil -lint "${plist}" >/dev/null 2>&1 || { warn "ui plist failed lint"; return 1; }
-    launchctl bootout "${GUI_TARGET}/${label}" 2>/dev/null || true
-    local w=0
-    while launchctl print "${GUI_TARGET}/${label}" >/dev/null 2>&1; do
-        sleep 1; w=$((w+1)); [[ $w -ge 15 ]] && break
-    done
-    launchctl enable "${GUI_TARGET}/${label}" 2>/dev/null || true
-    launchctl bootstrap "${GUI_TARGET}" "${plist}"
-    launchctl kickstart -k "${GUI_TARGET}/${label}" 2>/dev/null || true
+    if launchctl print "${GUI_TARGET}/${label}" >/dev/null 2>&1; then
+        info "Retiring the legacy dashboard server (now bundled in the tray app)…"
+        launchctl bootout "${GUI_TARGET}/${label}" 2>/dev/null \
+            || warn "could not bootout ${label} (continuing)"
+    fi
+    if [[ -f "${plist}" ]]; then
+        rm -f "${plist}" && ok "removed legacy ${label} launchd agent" \
+            || warn "could not remove ${plist} (continuing)"
+    fi
+    # The pinned Node runtime existed only to ABI-match better-sqlite3 in the old
+    # server; nothing uses it now.
+    rm -rf "${HOME}/.meridian/node-runtime" 2>/dev/null || true
 }
 
 # Enable accessibility mode in VS Code / Cursor / Antigravity so screenpipe
@@ -339,10 +260,10 @@ ok "node + python ($(${PYTHON_BIN} --version 2>&1)) + uv ($(${UV_BIN} --version
 if ! command -v screenpipe >/dev/null 2>&1; then
     info "Installing screenpipe ${SCREENPIPE_VERSION} via npm…"
     if npm_global_writable; then
-        npm install -g "screenpipe@${SCREENPIPE_VERSION}"
+        npm install -g --ignore-scripts "screenpipe@${SCREENPIPE_VERSION}"
     else
         warn "global npm prefix needs root — elevating just this install (you may be prompted)…"
-        sudo npm install -g "screenpipe@${SCREENPIPE_VERSION}"
+        sudo npm install -g --ignore-scripts "screenpipe@${SCREENPIPE_VERSION}"
     fi
 fi
 ok "screenpipe"
@@ -367,22 +288,18 @@ fi
 if ! command -v ffmpeg >/dev/null 2>&1; then info "Installing ffmpeg…"; brew install ffmpeg; fi
 ok "ffmpeg"
 
-# ── 2. Config: single repo-local .env ────────────────────────────────────────
-ENV_FILE="${APP_ROOT}/.env"
+# ── 2. Config: user credential file ──────────────────────────────────────────
+# Canonical location is ~/.meridian/.env — install-independent, next to
+# meridian.db and settings.json, never inside app/ (the binary tree).
+ENV_FILE="${HOME}/.meridian/.env"
 if [[ ! -f "${ENV_FILE}" ]]; then
     cp "${APP_ROOT}/.env.example" "${ENV_FILE}"
-    info "created ${ENV_FILE} from template — add your Jira creds later: meridian config edit"
+    info "created ${ENV_FILE} from template — add your credentials: meridian config edit"
 fi
 # MLX is the default backend.
 grep -q '^CLASSIFIER_BACKEND=' "${ENV_FILE}" || echo "CLASSIFIER_BACKEND=mlx" >> "${ENV_FILE}"
 grep -q '^MLX_SERVER_PORT='    "${ENV_FILE}" || echo "MLX_SERVER_PORT=${MLX_PORT}" >> "${ENV_FILE}"
-# Dashboard port — honour an existing .env value, otherwise record the default.
-if grep -q '^MERIDIAN_UI_PORT=' "${ENV_FILE}"; then
-    UI_PORT="$(grep '^MERIDIAN_UI_PORT=' "${ENV_FILE}" | tail -n1 | cut -d= -f2 | tr -d '[:space:]')"
-else
-    echo "MERIDIAN_UI_PORT=${UI_PORT}" >> "${ENV_FILE}"
-fi
-ok "config at ${ENV_FILE} (dashboard port ${UI_PORT})"
+ok "config at ${ENV_FILE}"
 
 # Interactive tracker-credential walkthrough — parity with install.sh. A fresh
 # `meridian setup` collects Jira/GitHub/Linear keys here; `meridian update`
@@ -552,7 +469,7 @@ if [[ "${SKIP_PERMISSIONS}" -eq 0 ]]; then
     open "x-apple.systempreferences:com.apple.Notifications-Settings.extension" 2>/dev/null || true
     echo "  → Scroll to the bottom and turn ON"
     echo "    'Allow notifications when mirroring or sharing the display'."
-    echo "  → When 'Meridian Tray' appears, ensure its notifications are allowed"
+    echo "  → When 'Meridian' appears, ensure its notifications are allowed"
     echo "    (style Banners or Alerts, not None)."
     read -r -p "  Press Enter when done… " _ || true
 fi
@@ -561,30 +478,10 @@ fi
 # this, screenpipe falls back to OCR for those editors instead of their a11y tree.
 configure_editor_accessibility
 
-# ── 5b. Unpack the dashboard (Turbopack standalone, shipped as a tarball) ─────
-# The UI ships as ui.tar.gz rather than an expanded ui/ dir so that Turbopack's
-# relative symlinks under .next/node_modules (serverExternalPackages: better-
-# sqlite3, pino, @opentelemetry/*) survive `npm publish`, which strips symlinks.
-# When meridian-npm-setup.sh detected the tarball hash was unchanged it preserved
-# the existing ui/ dir and deleted ui.tar.gz — in that case skip extraction too.
-_ui_changed=1
-_new_ui_hash=""
-if [[ -f "${APP_ROOT}/ui.tar.gz" ]]; then
-    _new_ui_hash="$(shasum -a 256 "${APP_ROOT}/ui.tar.gz" | cut -d' ' -f1)"
-    info "Unpacking dashboard…"
-    rm -rf "${APP_ROOT}/ui"
-    mkdir -p "${APP_ROOT}/ui"
-    tar -xzf "${APP_ROOT}/ui.tar.gz" -C "${APP_ROOT}/ui"
-    rm -f "${APP_ROOT}/ui.tar.gz"
-    ok "dashboard unpacked ($(find "${APP_ROOT}/ui/.next/node_modules" -type l 2>/dev/null | wc -l | tr -d ' ') external symlink(s) restored)"
-elif [[ -d "${APP_ROOT}/ui" ]]; then
-    # ui/ was preserved by meridian-npm-setup.sh — hash matched, no re-extraction needed
-    ok "dashboard unchanged — reusing existing build"
-    _ui_changed=0
-else
-    err "Dashboard bundle missing from ${APP_ROOT} — re-run the installer: curl -fsSL https://raw.githubusercontent.com/Meridiona/meridian/main/scripts/bootstrap.sh | bash"
-    exit 1
-fi
+# ── 5b. Retire the legacy dashboard Node server (one-time, for pre-fold installs) ─
+# The dashboard is now embedded in the tray binary, so an old standalone UI agent
+# is a zombie. This runs on every (re)install/update — idempotent + non-fatal.
+retire_legacy_ui_server
 
 # ── 6. Daemons — restart only what changed ───────────────────────────────────
 # screenpipe: external npm binary, plist may have changed → always refresh.
@@ -679,7 +576,7 @@ if [[ -x "${APP_ROOT}/bin/meridian-tray" ]]; then
     if [[ "${_tray_changed}" -eq 0 ]]; then
         ok "Tray app unchanged — skipping restart"
     else
-        info "Installing Meridian Tray launchd agent…"
+        info "Installing Meridian tray agent…"
         bash "${APP_ROOT}/scripts/install-tray-daemon.sh" || warn "tray agent install failed"
     fi
 else
@@ -716,31 +613,16 @@ if command -v cursor >/dev/null 2>&1 || [[ -d "${HOME}/Library/Application Suppo
     else
         info "  Cursor detected but the cursor-agent CLI is missing — Cursor summaries will use the local model (MLX)."
         info "  To summarise with Cursor's own CLI:  curl https://cursor.com/install -fsS | bash  then: cursor-agent login"
-        info "  Or let the daemon install it on demand: add CURSOR_AGENT_AUTO_INSTALL=1 to ${HOME}/.meridian/app/.env"
+        info "  Or let the daemon install it on demand: add CURSOR_AGENT_AUTO_INSTALL=1 to ${HOME}/.meridian/.env"
     fi
 fi
 
-# UI: even when the build is unchanged we ALWAYS re-pin the Node runtime and
-# reload the launchd job. The better-sqlite3 addon is ABI-locked to one Node
-# version; skipping this reload is how a stale UI job survives `update` and ends
-# up running a mismatched system Node (NODE_MODULE_VERSION crash-loop). The
-# expensive re-extraction is already skipped above when unchanged, so this is
-# cheap — resolve_node_runtime hits the cache, then bootout/bootstrap reloads.
-if [[ "${_ui_changed}" -eq 0 ]]; then
-    info "Dashboard build unchanged — re-pinning Node runtime and reloading UI agent…"
-else
-    info "Installing the dashboard (UI) launchd agent…"
-fi
-install_ui_standalone
-
 # Persist component hashes for the next update's differential check.
 # Write to a temp file and rename atomically so a crash mid-write never leaves
 # a half-written or empty hash file (which would force a full reinstall).
-_final_ui_hash="${_new_ui_hash:-${_OLD_UI_HASH}}"
 _final_tray_hash="${_new_tray_hash:-${_OLD_TRAY_HASH}}"
 {
     [[ -n "${_new_daemon_hash}" ]] && printf 'daemon_bin=%s\n' "${_new_daemon_hash}"
-    [[ -n "${_final_ui_hash}" ]] && printf 'ui_tarball=%s\n' "${_final_ui_hash}"
     [[ -n "${_final_tray_hash}" ]] && printf 'tray_bin=%s\n' "${_final_tray_hash}"
 } > "${_HASH_FILE}.tmp" && mv "${_HASH_FILE}.tmp" "${_HASH_FILE}"
 
@@ -771,7 +653,7 @@ echo "✓ Meridian installed at ${APP_ROOT}"
 echo "  meridian status            # check the daemons"
 echo "  meridian logs -f           # watch the pipeline"
 echo "  meridian config edit       # add Jira creds"
-echo "  open http://localhost:${UI_PORT} # the dashboard"
+echo "  open the Meridian tray icon in the menu bar → Open Dashboard"
 echo ""
 echo "Jira worklogs are DRAFTED only — approve them in the dashboard (Worklogs"
 echo "view) and the daemon posts approved worklogs within ~60s."

package/scripts/meridian-cli.sh

@@ -13,9 +13,10 @@ LABEL_SCREENPIPE="com.meridiona.screenpipe"
 LABEL_DAEMON="com.meridiona.daemon"
 LABEL_UI="com.meridiona.ui"
 LABEL_MLX="com.meridiona.mlx-server"
+# Capture runs in-process in the tray (no screenpipe launchd agent since Bucket-2).
 # Jira worklogs and coding-agent ingest run inside the Rust daemon — no
-# separate launchd agents. Only these four are managed.
-readonly LABELS=("${LABEL_SCREENPIPE}" "${LABEL_DAEMON}" "${LABEL_UI}" "${LABEL_MLX}")
+# separate launchd agents. Only these two are managed.
+readonly LABELS=("${LABEL_DAEMON}" "${LABEL_MLX}")
 GUI_TARGET="gui/$(id -u)"
 LAUNCH_AGENTS="${HOME}/Library/LaunchAgents"
 LOG_DIR="${HOME}/.meridian/logs"
@@ -40,7 +41,7 @@ Commands:
   restart            Stop, wait 1s, start
   status             Show running state of all daemons
   logs [target]      Tail log files
-                     target: daemon|daemon-error|screenpipe|screenpipe-error|ui|ui-error|mlx-server|mlx-server-error
+                     target: daemon|daemon-error|mlx-server|mlx-server-error|tray|tray-error
     -f               Follow (stream)
     -n N             Last N lines (default 100)
   doctor             Run environment health checks (includes pipeline smoke)
@@ -179,7 +180,12 @@ cmd_logs() {
         ui-error)          log_file="${LOG_DIR}/ui-error.log" ;;
         mlx-server)        log_file="${LOG_DIR}/mlx-server.log" ;;
         mlx-server-error)  log_file="${LOG_DIR}/mlx-server-error.log" ;;
-        *) err "unknown log target: ${target} (daemon|daemon-error|screenpipe|screenpipe-error|ui|ui-error|mlx-server|mlx-server-error)"; exit 1 ;;
+        tray)              log_file="${LOG_DIR}/tray.log" ;;
+        tray-error)        log_file="${LOG_DIR}/tray-error.log" ;;
+        # screenpipe/ui are retired post-v1.64.0 (capture is in-process in the
+        # tray; the dashboard is embedded) — kept here so old log files remain
+        # tailable, but `tray`/`tray-error` are the live targets now.
+        *) err "unknown log target: ${target} (daemon|daemon-error|mlx-server|mlx-server-error|tray|tray-error)"; exit 1 ;;
     esac
 
     if [[ ! -f "$log_file" ]]; then
@@ -563,7 +569,7 @@ PYEOF
         "models--mlx-community--phi-4-4bit"
         "models--mlx-community--DeepSeek-R1-Distill-Qwen-14B-4bit"
         "models--mlx-community--gemma-3-12b-it-qat-4bit"
-        "models--mlx-community--Qwen3.5-9B-OptiQ-4bit"
+        "models--mlx-community--Qwen3.5-2B-OptiQ-4bit"
         "models--mlx-community--Qwen3.5-4B-MLX-4bit"
         "models--mlx-community--Llama-3.2-3B-Instruct-4bit"
     )

package/scripts/meridian-npm-setup.sh

@@ -43,13 +43,22 @@ clone_dir() { # <src> <dst>
 }
 
 mkdir -p "${STAGE}"
-# Copy the prebuilt payload (bin/ ui.tar.gz services/ scripts/ .env.example VERSION).
+# Copy the prebuilt payload (bin/ services/ scripts/ .env.example VERSION).
 cp -R "${BUNDLE}/." "${STAGE}/"
 # Drop npm-package metadata that isn't part of the app.
 rm -f "${STAGE}/package.json" "${STAGE}/README.md" "${STAGE}/.gitignore" "${STAGE}/.npmignore"
 
-# Preserve an existing .env across re-installs/updates.
-[[ -f "${APP}/.env" ]] && cp "${APP}/.env" "${STAGE}/.env"
+# One-time migration: move credentials from the old app/.env location to the
+# canonical ~/.meridian/.env (outside the swap area — untouched by updates).
+# If both exist, the canonical wins and the old copy is removed.
+if [[ -f "${APP}/.env" ]]; then
+    if [[ ! -f "${HOME}/.meridian/.env" ]]; then
+        mv "${APP}/.env" "${HOME}/.meridian/.env"
+        echo "migrated credentials: ~/.meridian/app/.env → ~/.meridian/.env"
+    else
+        rm -f "${APP}/.env"
+    fi
+fi
 
 # Preserve the Python venv across updates. The venv is built from PyPI via
 # uv sync at install time; preserving it means install-from-bundle.sh only
@@ -60,35 +69,9 @@ if [[ -d "${APP}/services/.venv" ]]; then
     clone_dir "${APP}/services/.venv" "${STAGE}/services/.venv"
 fi
 
-# UI. Two cases, mirroring install-from-bundle.sh's contract:
-#   * unchanged (tarball hash matches the recorded one, or no tarball shipped):
-#     clone the existing ui/ and drop the tarball — the installer reads
-#     "no tarball + ui/ present" as unchanged and skips re-extraction.
-#   * changed: pre-extract the tarball into staging AND keep the tarball. The
-#     stage is then complete BEFORE the swap, so an installer crash after the
-#     swap still leaves a runnable dashboard; the installer's own extraction
-#     (which records the new hash) re-does only a few seconds of work.
-_hash_file="${HOME}/.meridian/.component-hashes"
-_ui_preserved=0
-if [[ -d "${APP}/ui" ]]; then
-    if [[ -f "${STAGE}/ui.tar.gz" ]] && [[ -f "${_hash_file}" ]]; then
-        _old_ui_hash="$(grep '^ui_tarball=' "${_hash_file}" 2>/dev/null | cut -d= -f2 || true)"
-        _new_ui_hash="$(shasum -a 256 "${STAGE}/ui.tar.gz" | cut -d' ' -f1)"
-        if [[ -n "${_old_ui_hash}" && "${_new_ui_hash}" == "${_old_ui_hash}" ]]; then
-            clone_dir "${APP}/ui" "${STAGE}/ui"
-            rm -f "${STAGE}/ui.tar.gz"
-            _ui_preserved=1
-        fi
-    elif [[ ! -f "${STAGE}/ui.tar.gz" ]]; then
-        # No tarball in bundle = UI unchanged since last release; keep existing build.
-        clone_dir "${APP}/ui" "${STAGE}/ui"
-        _ui_preserved=1
-    fi
-fi
-if [[ "${_ui_preserved}" -eq 0 && -f "${STAGE}/ui.tar.gz" ]]; then
-    mkdir -p "${STAGE}/ui"
-    tar -xzf "${STAGE}/ui.tar.gz" -C "${STAGE}/ui"
-fi
+# The dashboard is no longer staged here: it's embedded in the tray binary, so
+# the bundle ships neither ui.tar.gz nor a ui/ dir. Any old ~/.meridian/app/ui
+# from a pre-fold install is discarded by the swap below (APP → OLD → rm).
 
 # The swap: two renames on one filesystem. Running daemons keep their open
 # inodes from the old tree until they restart; the installer (exec'd next)

package/services/README.md

@@ -4,7 +4,7 @@ The model layer that runs alongside the Rust daemon. A persistent MLX inference
 
 The Rust daemon owns all DDL; this service only does SELECT/INSERT/UPDATE on its agent-side tables.
 
-> **Note:** the coding-agent indexer + summariser, and the pm-worklog (Stage 4) driver, all run **inside the Rust daemon** (`src/coding_agent_session_ingest/`, `src/pm_worklog/`). This service is the model layer: `agents/server.py` is the persistent MLX server, which serves `/classify_sessions` (classification), `/summarise` (the summariser's fallback), and `/synthesise_worklog` (the agno worklog synthesiser). The Rust daemon drives all three over HTTP.
+> **Note:** the coding-agent indexer + summariser, and the pm-worklog (Stage 4) driver, all run **inside the Rust daemon** (`src/coding_agent_session_ingest/`, `src/pm_worklog/`). This service is the model layer: `agents/server.py` is the persistent MLX server, which serves `/summarise` (the summariser's fallback) and `/synthesise_worklog` (the agno worklog synthesiser). The Rust daemon drives both over HTTP.
 
 For the deep technical reference (classification logic, schema, recipes), see [`agents/README.md`](agents/README.md).
 
@@ -15,14 +15,8 @@ For the deep technical reference (classification logic, schema, recipes), see [`
 ```
 app_sessions row (Rust ETL writes it)
         │
-        │  Rust daemon calls POST /classify_sessions
-        ▼           on the persistent MLX server
-┌──────────────────────────────────────────────┐
-│ MLX inference server (FastAPI, port 7823)    │ Apple Silicon only
-│   model: mlx-community/Qwen3.5-9B-OptiQ-4bit│
-│   loaded once at startup, served until killed│
-│   returns: task_key, session_type, confidence│
-└──────────────────────────────────────────────┘
+        ▼
+Rust daemon classifies sessions (src/intelligence/task_linker/)
         │
         ▼
 Rust writes ticket_links + session_dimensions → meridian.db
@@ -50,7 +44,7 @@ The `hermes-agent` package is fetched from GitHub at the pinned tag; an internet
 
 ## MLX server
 
-The Rust daemon calls the MLX server for every classification. It must be running before the daemon starts.
+The Rust daemon calls the MLX server for summarisation and worklog synthesis. It must be running before the daemon starts.
 
 ### Install as a launchd daemon (recommended)
 
@@ -74,7 +68,7 @@ RUST_LOG=meridian=debug CLASSIFIER_BACKEND=mlx cargo run --bin meridian
 python -m agents.server --backend mlx --port 7823
 ```
 
-The model (`Qwen3.5-9B-OptiQ-4bit`) is downloaded from Hugging Face on first run (~4 GB). Subsequent starts load from local cache in ~5 s.
+The model (`Qwen3.5-2B-OptiQ-4bit`) is downloaded from Hugging Face on first run. Subsequent starts load from local cache in ~5 s.
 
 ---
 
@@ -96,7 +90,7 @@ Additional variables are documented in [`agents/README.md`](agents/README.md#con
 
 ### Task classifier
 
-The task classifier runs automatically — the Rust daemon calls `POST /classify_sessions` on the MLX server on each intelligence tick. To inspect or re-run classification:
+The task classifier runs automatically inside the Rust daemon on each intelligence tick. To inspect or re-run classification:
 
 ```bash
 # Re-run classification with full logging — does NOT write to DB

package/services/agents/README.md

@@ -11,7 +11,7 @@ For a higher-level overview (installation, daemon ops, configuration), see [`ser
 The Rust daemon owns the pipeline (ETL, coding-agent ingest, classification
 trigger, pm-worklog driver) and the database. This service is the **model
 layer**: one persistent MLX server (`server.py`) that the daemon calls over HTTP
-for the three jobs that need a local LLM.
+for the two jobs that need a local LLM.
 
 ```
 screenpipe.db (read-only)
@@ -29,16 +29,10 @@ meridian.db  →  app_sessions
         │    MLX server's /summarise is the fallback. Rows walk task_method:
         │    coding_agent_live → pending_summariser → pending_classifier.
         │
-        ├── classification  (src/intelligence/task_linker/, Rust → MLX)
+        ├── classification  (src/intelligence/task_linker/, Rust)
         │    Rust reads unclassified rows and the pending_classifier queue,
-        │    then sends:
-        │      POST http://127.0.0.1:7823/classify_sessions
-        │           {session_ids: [...], meridian_db: ...}
-        │    MLX server (Qwen3.5-9B-OptiQ-4bit, FSM-constrained outlines):
-        │      fetch session + pm_tasks + recent context
-        │      → SessionClassification {task_key, session_type, confidence,
-        │                               reasoning, method, dimensions}
-        │    Rust writes ticket_links + session_dimensions, advances cursor.
+        │    classifies them internally, and writes ticket_links +
+        │    session_dimensions, then advances the cursor.
         │
         └── pm-worklog (Stage 4)  (src/pm_worklog/, Rust → MLX)
              The Rust hour-driven driver collects each (task, hour) bundle and
@@ -260,7 +254,7 @@ When the screen is locked the selector uses `min(0.8, budget_pct × 1.5)` as the
 2. **Largest cached model fits** — if the preferred is too large, return the largest catalog model whose files are already in the HF cache and whose `min_ram_gb ≤ budget`. Avoids surprising multi-GB downloads on constrained machines.
 3. **Largest catalog model that fits (may download)** — if nothing cached fits, return the largest catalog entry where `min_ram_gb ≤ budget`, regardless of cache. This triggers a one-time download of the best available model rather than loading an oversized one that exceeds available memory. Falls back to `preferred_hf_id` only when **no catalog model fits** at all (budget so low even the 1.8 GB model won't load).
 
-**Why stage 3 matters on low-RAM machines:** an M1 Air (8 GB) has Metal headroom ≈ 5.4 GB. At `LLM_BUDGET_PCT=0.5` the budget is ~2.7 GB. The default preferred model is 6.5 GB (`Qwen3.5-9B-OptiQ-4bit`). Without the fix, stage 3 returned the preferred unconditionally — the server then attempted to load a 6.5 GB model into a 2.7 GB budget, causing memory pressure or an outright load failure. With the fix, stage 3 selects `Qwen3.5-4B-MLX-4bit` (2.5 GB) or `Llama-3.2-3B-Instruct-4bit` (1.8 GB) — whichever is largest and fits — and downloads it on first use.
+**Why stage 3 matters on low-RAM machines:** an M1 Air (8 GB) has Metal headroom ≈ 5.4 GB. At `LLM_BUDGET_PCT=0.5` the budget is ~2.7 GB. The default preferred model is 6.5 GB (`Qwen3.5-2B-OptiQ-4bit`). Without the fix, stage 3 returned the preferred unconditionally — the server then attempted to load a 6.5 GB model into a 2.7 GB budget, causing memory pressure or an outright load failure. With the fix, stage 3 selects `Qwen3.5-4B-MLX-4bit` (2.5 GB) or `Llama-3.2-3B-Instruct-4bit` (1.8 GB) — whichever is largest and fits — and downloads it on first use.
 
 **Check what would be selected:**
 
@@ -270,7 +264,7 @@ cd services
 from agents.llm_selector import select_mlx_model_id, probe_compute
 snap = probe_compute()
 print(f'Headroom: {snap.metal_headroom_gb:.1f} GB  thermal: {snap.thermal_level}')
-model = select_mlx_model_id('mlx-community/Qwen3.5-9B-OptiQ-4bit', 6.5, 0.5)
+model = select_mlx_model_id('mlx-community/Qwen3.5-2B-OptiQ-4bit', 6.5, 0.5)
 print(f'Would load: {model}')
 "
 ```
@@ -350,14 +344,14 @@ pip install -e ".[local-llm]"
    FROM ticket_links WHERE session_id = <ID>;
    ```
 
-2. **Re-run the classifier against a live session** — call the MLX server directly with the session id:
+2. **Re-run the classifier against a live session** using the daemon CLI:
+
    ```bash
-   curl -s -X POST http://127.0.0.1:7823/classify_sessions \
-     -H "Content-Type: application/json" \
-     -d "{\"session_ids\": [<ID>]}" | jq .
+   meridian coding-agent-classify
    ```
 
    Or use the standalone MLX script (reads from stdin, prints JSON to stdout):
+
    ```bash
    cd services
    echo '{"session_ids": [<ID>], "meridian_db": "'"$HOME"'/.meridian/meridian.db"}' \

package/services/agents/_state.py

@@ -0,0 +1,34 @@
+"""Process-global server state shared between the FastAPI app and route modules."""
+from __future__ import annotations
+
+import asyncio
+import threading
+from typing import Any
+
+# Populated in _lifespan (mlx_module, loaded_at, model_sem, tracer, self_url, …)
+# and read by every route module.
+app_state: dict[str, Any] = {}
+
+# Shared prefetch progress, guarded by prefetch_lock. states: idle|downloading|done|error
+prefetch_state: dict[str, Any] = {
+    "state": "idle",
+    "model_id": None,
+    "received": 0,
+    "total": 0,
+    "error": None,
+}
+prefetch_lock = threading.Lock()
+
+
+def model_sem() -> "asyncio.Semaphore":
+    """Return the process-global single-slot model semaphore.
+
+    Created once in _lifespan and stored in app_state. Every endpoint that
+    runs a model inference acquires this before calling run_in_threadpool so
+    that concurrent requests never compete on the GPU.
+    """
+    sem = app_state.get("model_sem")
+    if sem is None:  # fallback if called before lifespan (e.g. tests)
+        sem = asyncio.Semaphore(1)
+        app_state["model_sem"] = sem
+    return sem

package/services/agents/agno_viewer.py

@@ -0,0 +1,60 @@
+"""Minimal AgentOS viewer for browsing worklog pipeline traces.
+
+Run this script to expose the agno_traces.db as an AgentOS runtime, then:
+  1. Open https://os.agno.com, sign in (free account)
+  2. Add new OS → Environment: Local → URL: http://localhost:8000
+  3. Click "CONNECT" → refresh the page
+
+Alternatively, browse directly at http://localhost:8000 without the hosted UI.
+
+The DB path defaults to ~/.meridian/agno_traces.db (set AGNO_TRACE_DB to override).
+"""
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path
+
+log = logging.getLogger(__name__)
+
+from agno.agent import Agent
+from agno.db.sqlite import SqliteDb
+from agno.os import AgentOS
+from agno.workflow import Workflow
+
+_DEFAULT_DB = Path("~/.meridian/agno_traces.db").expanduser()
+_db_file = Path(os.environ.get("AGNO_TRACE_DB", "") or _DEFAULT_DB).expanduser()
+
+db = SqliteDb(db_file=str(_db_file))
+
+_agent = Agent(
+    name="Meridian Worklog Pipeline",
+    description="Worklog pipeline agent — match sessions to PM tasks and draft worklogs.",
+    db=db,
+)
+
+# Stub workflow registered so os.agno.com marks the OS as active.
+# The real pipeline runs inside server.py; this is traces-only.
+_workflow = Workflow(
+    name="worklog_hour",
+    description="Hour-level worklog pipeline: distil → report → rerank → match → draft/propose.",
+    db=db,
+)
+
+agent_os = AgentOS(
+    id="meridian-worklog",
+    name="Meridian Worklog Traces",
+    description="Viewer for worklog pipeline traces — worklog.hour, match, propose, draft spans.",
+    agents=[_agent],
+    workflows=[_workflow],
+    db=db,
+    tracing=True,
+)
+
+app = agent_os.get_app()
+
+if __name__ == "__main__":
+    log.info("trace DB: %s", _db_file)
+    log.info("dashboard: http://localhost:8000")
+    log.info("control:   https://os.agno.com → Add new OS → http://localhost:8000")
+    agent_os.serve(app="agno_viewer:app", reload=False, port=8000)