#440 promote: pre-main → main

[Anonymous]

Originally created by: Akarsh-Hegde

Summary

Promotes 60 commits (~21 PRs, [#417]–#439) from pre-main to main. main ⊆ pre-main invariant holds (verified via git merge-base --is-ancestor); CI is green on pre-main HEAD (9250bfbd). Six threads:

1. Design system — SF Pro + violet accent (#439, plus 3 follow-up fixes)

• Migrates the dashboard/tray/popover to SF Pro and a single violet accent color, replacing the prior multi-color scheme; introduces real per-app brand colors (ui/lib/brand-icons.ts).
• Follow-ups: fixed a broken WhatsApp brand-color lookup and added ChatGPT/VS Code colors (#439 follow-up), fixed ink-theme white-text contrast + a stale .gitignore reference + an em-dash in UI copy, fixed a CSS comment that broke the Turbopack build, and swapped an em-dash for a plain hyphen in the dashboard window title.

2. Auth — Clerk email sign-in (#436)

• Adds email one-time-code sign-in via Clerk, a Settings → Account sign-in/sign-out control, and PostHog identify() on sign-in.

3. Update/release safety (#438, [#435])

• Force-installs updates when the running app version is below a manifest-declared minimum-version floor, with validation rejecting a floor above the release that ships it.
• Forces Tauri's DMG Finder decoration step on GitHub-hosted CI runners (was silently skipping, producing an undecorated DMG).

4. Onboarding & uninstall (#432, [#418], [#420], [#425])

• Adds an in-app uninstall wizard (src/uninstall.rs).
• Adds a notifications-permission card to the first-run wizard, polishes wizard copy/permissions/window chrome, and fixes the notification pane deep-link to open Meridian's own Settings instead of re-requesting redundant permissions.

5. Tray, popover & daily-plan UX (#437, [#429], [#428], [#431], [#433])

• Auto-opens the "Plan your day" view once per day (src/daily_plan.rs), holding the nudge for 1h after auto-open.
• Shows app version + build channel in the dashboard and popover.
• Fixes popover tooltip dismissal on right-click and popover dismissal on other-window focus; drops the popover border.
• Retires the redundant meridian-a11y-helper Accessibility TCC entry.
• Removes top-of-app nudge banners, keeping the sidebar equivalents.

6. Analytics, DMG polish & housekeeping (#427, [#430], [#426], [#424], [#434])

• Adds PostHog product analytics for DMG installs, then bakes the PostHog key at build time instead of hardcoding it.
• Themed drag-to-Applications DMG background with a curved arrow.
• Addresses GitHub Advanced Security findings from PR [#416].
• Docs: clarifies in CLAUDE.md that PRs target pre-main and main is maintainer-only (the rule this very PR follows).

Versions

App version (Cargo.toml / npm/meridian/package.json) is 1.70.0 on both branches — no regression. The MLX runtime version (services/pyproject.toml) is also 1.70.0 on both, matching runtime-staging (already published at 1.70.0). runtime-latest is stale at 1.68.0 (predates this entire batch) — merging will let main's auto-publish gate (scripts/runtime-publish-gate.sh) fire and publish 1.70.0 to runtime-latest. That publish job runs in the production-runtime GitHub Environment and needs a required reviewer to approve it before it ships to users.

No new SQL migrations in this batch.

Test plan

Each commit reports its own verification in-message (cargo build/clippy -D warnings/test, tsc --noEmit, next build, bun test), and CI (Build MLX runtime + CI) is green on pre-main HEAD 9250bfbd. Before merging this PR:

• [ ] cargo test (workspace) passes on main post-merge
• [ ] cargo clippy -- -D warnings clean
• [ ] cd ui && npm run build && npm test clean
• [ ] cd tray/src-tauri && cargo test clean
• [ ] Approve the production-runtime publish job once it queues, so runtime-latest moves off the stale 1.68.0 build
• [ ] Smoke-test Clerk email sign-in, the forced-minimum-version update path, and the uninstall wizard on a packaged build (all need a real .app bundle / OS integration to exercise fully)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
• Added Clerk-based email sign-in/account controls (setup + Settings).
• Added optional daily auto-open for the Plan dashboard with tracking when the Plan modal is dismissed.
• Added “Uninstall Meridian…” wizard and structured uninstall results.
• Added Notifications permission setup, improved deep-link navigation, version/channel badge, and mandatory update enforcement (minimum supported version).
• Bug Fixes
• Prevented plan nudges shortly after an auto-open, using a grace window.
• Style
• Refreshed lilac/ink typography, colors, icons, and modal/card styling.

[Anonymous]

Originally posted by: coderabbitai[bot]

[!NOTE]

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:
- @coderabbitai resume to resume automatic reviews.
- @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:
- [ ] ▶️ Resume reviews
- [ ] 🔍 Trigger review

📝 Walkthrough

## Walkthrough This PR adds daily Plan automation, Clerk sign-in, PostHog analytics, scoped uninstall support, mandatory updates, daemon-only installation, signed and notarized DMGs, notification permissions, deep-link handling, provider-cache retention, design-system packaging, and UI redesign changes. ### Changes **Planner, account, and tray workflows** |Layer / File(s)|Summary| |---|---| |**Daily Plan automation**
`meridian-core/...`, `src/daily_plan.rs`, `tray/src-tauri/src/poll/...`|Shared markers coordinate daily Plan auto-opening, dismissal restamping, and nudge hold-back behavior.| |**Sign-in and analytics**
`tray/src-tauri/src/analytics.rs`, `tray/src-tauri/src/commands/account.rs`, `ui/app/setup/signin/*`|Clerk email sign-in and persistence connect to PostHog installation, usage, and identity events.| |**Deep links and permissions**
`tray/src-tauri/src/deep_link.rs`, `tray/src-tauri/src/commands/*`, `ui/app/setup/*`|Pending dashboard navigation, notification permissions, setup flow changes, and window focus handling are wired into the tray and UI.| **Uninstall and updates** |Layer / File(s)|Summary| |---|---| |**Scoped uninstall**
`src/uninstall.rs`, `tray/src-tauri/src/commands/uninstall.rs`, `ui/app/uninstall/page.tsx`|The CLI and tray wizard support selectable data, runtime, and model removal with JSON planning and results.| |**Mandatory update enforcement**
`tray/src-tauri/src/update.rs`, `scripts/package-updater.sh`|Release manifests carry minimum versions, and the tray periodically installs updates below the configured floor.| **Release, providers, and UI** |Layer / File(s)|Summary| |---|---| |**DMG signing and packaging**
`.github/workflows/*`, `scripts/*`, `tray/package.json`, `tray/src-tauri/tauri.conf.json`|Release jobs inject build settings, generate DMG assets, sign the daemon, notarize artifacts, clean temporary credentials, and verify bundles.| |**Provider and worklog handling**
`src/intelligence/providers/*`, `src/pm_worklog/*`|Worklogged tasks are retained and Jira backfill, issue-type fallback, self-assignment, and terminal posting errors are added.| |**Design system and UI styling**
`ui/app/globals.css`, `ui/lib/brand-icons.ts`, `ui/STYLESHEET.md`, `packages/meridian-design-system/*`, `tray/src/style.css`|System fonts, violet tokens, shadows, brand resolution, design-system exports, and preview assets are added or standardized.| **Estimated code review effort:** 5 (Critical) | ~120 minutes **Possibly related PRs** - [[Meridiona/meridian#352](https://github.com/Meridiona/meridian/issues/352)](https://github.com/Meridiona/meridian/pull/352): Overlaps with removal of the `MustFixBanner` surface. - [[Meridiona/meridian#384](https://github.com/Meridiona/meridian/issues/384)](https://github.com/Meridiona/meridian/pull/384): Touches the tray popover and dashboard window wiring. - [[Meridiona/meridian#427](https://github.com/Meridiona/meridian/issues/427)](https://github.com/Meridiona/meridian/pull/427): Overlaps with the tray PostHog analytics implementation. **Suggested reviewers:** `adityaharish` **Poem** > Violet paths through dawn unfold, > A rabbit hops where plans are told. > Clerk and analytics softly run, > Signed DMGs greet the morning sun. > Worklogs stay, old clutter clears— > I twitch my nose and cheer!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

| Check name | Status | Explanation | | :------------------------: | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Title check | ✅ Passed | The title clearly and concisely describes the main change: promoting pre-main to main. | | Description check | ✅ Passed | The description is mostly complete, with a clear summary, testing notes, version notes, and merge context, though it does not fully follow the template headings. | | Docstring Coverage | ✅ Passed | Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `pre-main`

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Originally posted by: coderabbitai[bot]

[!CAUTION]
Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

putComment timed out

[Anonymous]

Originally posted by: Akarsh-Hegde

Review follow-up — all 21 threads addressed

Went through every CodeRabbit thread on this promotion PR. All are now resolved. Because this is a pre-main → main promotion (head = pre-main, which we don't push to directly), the fixes land via two PRs into pre-main; once those merge, this PR's diff picks them up automatically.

Fix PRs (target pre-main):

• #445 — the main batch: the --purge full-wipe scope bug (critical), the github/linear FK-safe prune, jira/azure reqwest timeouts, the save_account_email PII-in-traces fix, .context on DB calls, warn!→error! on failure paths, plus the approved refactors (split uninstall.rs, Plan/Flags struct, shared fs_utils::atomic_write_json, the import-apple-cert composite action) and the UI fixes (resend-ticker teardown, Clerk catch blocks, privacy copy, BrandIcon type, em-dashes).
• #446 — the Jira worklog-backfill rate-limit critical, split out on its own because it reorders live daemon-sync logic.

Deliberately not changed (commented on the threads):

• Email → PostHog capture is kept (product decision); the onboarding copy was softened instead so it no longer claims "anonymous".
• The commands.rs / api-types.ts / ui_events.rs "missing header" findings — the header is already on line 1 (CodeRabbit anchored mid-file).
• The CLAUDE.md "afterward" locale nit — docs file, not user-facing app text.

⚠️ Merge order: this PR is not ready to merge yet — #445 and [#446] must merge into pre-main first, then this promotion diff will reflect the fixes. I can't merge those (human-only per the repo rules). Once they're in and CI is green on pre-main HEAD, this one is good to go.

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed