Originally created by: Akarsh-Hegde
screenpipe relicensed MIT → Commercial on 2026-06-10. npm 0.4.6 (published 2026-06-05) is the last MIT release; ≥ 0.4.17 (2026-06-11+) is Commercial, whose "competing product" clause would then bind Meridian's users.
Meridian ships zero screenpipe code (external npm/brew install; reads its SQLite DB only), so staying on MIT 0.4.6 keeps the whole install license-clean. Confirmed: screenpipe@0.4.6 is dated 5 days before the relicense.
The pin sat as a bare SCREENPIPE_VERSION="0.4.6" with no rationale in two install scripts. A routine "bump to latest" would silently ship users a Commercial-licensed dependency.
install.sh, scripts/install-from-bundle.sh).screenpipe-license-pin CI job (mirrors the existing migration-guard) that fails the build if the pin drifts off 0.4.6 in either file — server-side, unskippable. Changing the pin now also requires editing the guard, forcing a conscious legal decision.Verified locally: guard passes at 0.4.6, rejects 0.4.17.
Independent license-hygiene fix, branched off main (not part of the DMG/Bucket-1 chain in [#321]). npm/ copies are generated by package-release.sh from these sources, so fixing the sources covers them.
🤖 Generated with Claude Code
Ticket changed by: Akarsh-Hegde