#495 release: 1.73.1 - unstick the Windows installer build

[Anonymous]

Originally created by: Akarsh-Hegde

Why now

v1.73.0 shipped macOS-only. Its windows-release job failed, so the release carries no Meridian-setup.exe and production latest.json has no windows-x86_64 key. Windows users can neither install nor auto-update to 1.73.0 - they are stranded on whatever they are running. macOS is unaffected and updating normally.

This promotion carries the fix.

Root cause

A ten-minute miss, not a regression. PR [#490] merged to pre-main at 09:06:13; the 1.73.0 release was cut from main at 08:56. main therefore lacked the Windows cfg-gating, and the tray build died on three macOS-only constructs reaching a Windows compile:

error[E0455]: link kind `framework` is only supported on Apple targets
error[E0425]: cannot find function `with_autorelease_pool` in this scope
error[E0599]: no method named `title_bar_style` found for WebviewWindowBuilder

Confirmed by diffing the branches - pre-main adds the non-macOS fallback main is missing:

+#[cfg(not(target_os = "macos"))]
+fn with_autorelease_pool<R>(f: impl FnOnce() -> R) -> R {

What is in it

pre-main has moved since this PR was opened. It now carries three things, not one:

PR	what	risk to production
[#490]	the Windows port of the in-process capture module - the reason for this PR	the fix itself
[#493]	let the GitHub project picker save after an OAuth connect	small, UI + integrations
[#494]	parallelise the staging release build	none to production - see below

All commits are fix(...) or ci(...), so semantic-release will cut 1.73.1.

[#494] does not touch production release machinery

release.yml is unmodified by this promotion - confirm with git diff origin/main origin/pre-main -- .github/workflows/release.yml (empty). [#494] rewrote release-staging.yml only, which main never runs: it triggers on pushes to pre-main and is gated behind a [staging-release] marker or a manual dispatch. Merging it to main carries the file but cannot execute it.

It also deleted .releaserc.staging.json's prepareCmd. That config is likewise staging-only; production uses .releaserc.json, untouched.

[#494] is not yet proven end to end

It has been observed skipping correctly on an unmarked push (all four jobs, 0s) but has not yet cut a staging release. That proving run is in flight separately. If you would rather not carry an unexercised release workflow into main - even a dormant one - say so and I will re-target this PR at just [#490]'s commits.

Verified

• [x] Merges cleanly (git merge-tree), no conflicts
• [x] The merged tree keeps main's 1.73.0 in Cargo.toml, tauri.conf.json and ui/package.json - pre-main sits at 1.71.0 because staging never commits a version bump, but it has not touched those files since the merge base, so nothing is reverted
• [x] .github/workflows/release.yml unchanged
• [x] No daemon, migration or DB-schema changes

Follow-up worth its own issue

The Windows job only runs after the macOS release has published and tagged. There is no gate that would have caught this before 1.73.0 became "latest" - which is exactly how a half-shipped release happened, and it can recur on any Windows-only breakage. Whether a Windows failure should be able to fail a release that already shipped macOS, or whether both should build before either publishes, is a real design question. Out of scope here; this PR just unsticks Windows.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
• Added intelligence provider chooser+detail flow with install and Cursor sign-in actions, including pinned Cursor install/version handling.
• Improved provider switching to be commit-only (promise-based, non-optimistic) across the settings and setup wizard.
• Added “Worklogs → Auto-generate” settings and a one-time nudge dialog; auto-drafts generate after a configurable local time.
• Bug Fixes
• Fixed macOS dashboard behavior to correctly restore the activation/tray-only mode when the window closes.
• Documentation
• Updated staging release documentation and clarified summarization routing and global fallback behavior.

[Anonymous]

Originally posted by: coderabbitai[bot]

[!NOTE]

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:
- @coderabbitai resume to resume automatic reviews.
- @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:
- [ ] ▶️ Resume reviews
- [ ] 🔍 Trigger review

📝 Walkthrough

## Walkthrough This PR restructures staging releases, adds LLM provider onboarding and committed selection flows, hardens Cursor execution, adds summarization fallback routing, improves integration and platform handling, and introduces scheduled worklog draft generation with settings and UI support. ### Changes **Staging release pipeline** |Layer / File(s)|Summary| |---|---| |**Plan and parallel architecture builds**
`.claude/skills/release/SKILL.md`, `.github/workflows/release-staging.yml`|The workflow computes prerelease metadata and builds version-stamped macOS slices concurrently without bundling.| |**Join, sign, verify, and publish**
`.github/workflows/release-staging.yml`, `.releaserc.staging.json`, `scripts/merge-windows-updater.py`|Universal artifacts are signed, notarized, packaged, verified, and published without `prepareCmd`; Windows stamping and ASCII-safe output are updated.| |**Main-only Rust cache writes**
`.github/workflows/ci.yml`|Rust cache entries are saved only on `main`.| **LLM provider onboarding and connection** |Layer / File(s)|Summary| |---|---| |**Provider installation metadata and selection contracts**
`meridian-core/src/llm_provider.rs`, `meridian-core/src/lib.rs`, `ui/lib/llm-providers.ts`|Provider installer metadata, pinned Cursor constants, chooser text, and shared selection-field construction are added.| |**Provider installation and Cursor sign-in API**
`src/llm/detect.rs`, `tray/src-tauri/src/commands/setup.rs`, `tray/src-tauri/src/lib.rs`|Installer and sign-in operations return structured outcomes, verify CLI availability, handle timeouts, and are exposed as Tauri commands.| |**Chooser, detail, and committed provider flow**
`ui/components/LlmProvider*.tsx`, `ui/app/setup/*`, `ui/components/timeline/settings/IntelligenceSection.tsx`, `ui/__tests__/*provider*.test.ts`|Provider selection commits after persistence and adds recommended tiles, detail phases, async actions, logos, setup wiring, and regression checks.| **Cursor execution and summarization** |Layer / File(s)|Summary| |---|---| |**Hardened Cursor CLI execution ladder**
`src/llm/cursor_cli.rs`|Cursor invocations use safety arguments, sandboxed homes, neutral workspaces, environment controls, failure classification, and retry degradation.| |**Cursor backend and summarizer integration**
`src/llm/cursor.rs`, `src/coding_agent_session_ingest/summariser/cursor_agent.rs`|Cursor prompts include an ingest marker, calls use the hardened path, responses use JSON envelopes, and failures are classified for degradation.| |**Global provider summarization fallback**
`src/coding_agent_session_ingest/summariser/*`, `src/coding_agent_session_ingest/sources/mod.rs`, `src/llm/resolver.rs`|Meridian-issued sessions are filtered, eligible summarization failures use the selected provider, and fallback provenance is persisted.| **Integration validation and platform compatibility** |Layer / File(s)|Summary| |---|---| |**Required credential validation with environment merging**
`tray/src-tauri/src/commands/integrations.rs`|Required credentials are checked across submitted values and the active `.env`, including placeholder handling and partial-edit tests.| |**Platform-specific compilation and warnings**
`tray/src-tauri/src/backend_install.rs`, `tray/src-tauri/src/capture/*`, `tray/src-tauri/src/commands/app_icons.rs`, `tray/src-tauri/src/lib.rs`|macOS-specific code is conditionally compiled or warning-suppressed, with non-macOS fallbacks for permissions and autorelease handling.| |**Dashboard window lifecycle and platform-aware builder**
`tray/src-tauri/src/sys.rs`, `tray/src-tauri/src/commands/system.rs`, `tray/src-tauri/src/tray.rs`|Dashboard closure handling is centralized and wizard title-bar styling is applied conditionally on macOS.| **Worklog auto-generation with time-gating and UI** |Layer / File(s)|Summary| |---|---| |**Auto-generation backend and time validation**
`src/pm_worklog/auto_generate.rs`, `tray/src-tauri/src/commands/settings.rs`|Draft generation is gated by configured time, tracker availability, task duration, and existing drafts; settings validate HH:MM values.| |**Pipeline and settings integration**
`src/pm_worklog/mod.rs`, `src/worklog_pipeline.rs`, `meridian-core/src/settings.rs`, `meridian-core/src/readers/day_task_worklogs/mod.rs`, `ui/lib/settings.ts`, `ui/lib/api-types.ts`|The pipeline invokes auto-generation at startup and hourly intervals, settings store scheduling state, and drafts expose `updated_at`.| |**Worklog settings and setup prompts**
`ui/components/timeline/*Worklog*`, `ui/components/timeline/settings/*`, `ui/components/timeline/MeridianTimelineShell.tsx`, `ui/components/timeline/DayTaskDetailPanel.tsx`|The UI adds a one-time prompt, worklog settings, scheduling controls, and generated-at draft timestamps.| **Estimated code review effort:** 5 (Critical) | ~90 minutes ### Sequence Diagram(s) :::mermaid sequenceDiagram participant SetupWizard participant ProviderPicker participant TauriCommands participant CursorCli SetupWizard->>ProviderPicker: Select provider and open details ProviderPicker->>TauriCommands: Request install, sign-in, or test TauriCommands->>CursorCli: Execute provider CLI CursorCli-->>TauriCommands: Return outcome TauriCommands-->>SetupWizard: Persist provider after successful commit **Possibly related issues** - [Meridiona/meridian#376](https://github.com/Meridiona/meridian/issues/376): Touches the same worklog pipeline loop that now invokes scheduled auto-generation. **Possibly related PRs** - [[Meridiona/meridian#338](https://github.com/Meridiona/meridian/issues/338)](https://github.com/Meridiona/meridian/pull/338): Modifies the same integration credential validation path. - [[Meridiona/meridian#341](https://github.com/Meridiona/meridian/issues/341)](https://github.com/Meridiona/meridian/pull/341): Introduces the hourly worklog loop extended here with auto-generation. - [[Meridiona/meridian#440](https://github.com/Meridiona/meridian/issues/440)](https://github.com/Meridiona/meridian/pull/440): Modifies the same macOS staging release workflow and Apple signing steps. **Suggested reviewers:** `adityaharishch` **Poem** > A rabbit drafts at chosen hours, > While Cursor guards its leafy towers. > Providers install, summaries align, > Staging ships on a measured line— > And worklogs bloom like flowers.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

### ❌ Failed checks (1 warning) | Check name | Status | Explanation | Resolution | | :---------------: | :--------- | :----------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- | | Description check | ⚠️ Warning | The description is detailed and relevant, but it does not follow the required template sections for testing, checklist, or related issues. | Add the template sections explicitly: What does this PR do?, How was it tested?, Checklist, and Related issues, with concrete test evidence or notes. |

✅ Passed checks (4 passed)

| Check name | Status | Explanation | | :------------------------: | :------- | :------------------------------------------------------------------------------------------------------------------------------- | | Title check | ✅ Passed | The title is concise and accurately summarizes the main change: the release promotion that unblocks the Windows installer build. | | Docstring Coverage | ✅ Passed | Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `pre-main`

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Originally posted by: Akarsh-Hegde

Review comments resolved - status update

All 11 inline threads are now resolved. Breakdown of where each was actually addressed, since it is spread across three PRs:

Already fixed by [#496] (merged) - 5 threads

finding	severity
Placeholder could overwrite a stored token	🔴 Critical
Self-referential workflow comments naming release-staging.yml from inside itself	🟡 Minor
Blanket contents: write on the staging workflow	🔵 Trivial
${{ }} interpolated directly into run: shells	🔵 Trivial
detect_install_mode() called twice per save	🔵 Trivial

The Critical one is worth restating: missing_required let a submitted placeholder pass validation when a valid token was already in .env, and upsert_env writes every submitted key verbatim - so your-token-here would land on top of a working credential. The pre-existing test could not catch it (it passed an empty .env); a new test supplies a stored token and fails without the fix.

Fixed in [#504] (open, targets pre-main) - 4 threads

• merge-windows-updater.py file-encoding. PYTHONIOENCODING covers stdin/stdout/stderr only; Path.read_text()/write_text() fall back to cp1252 on Windows. My earlier [#500] fix pinned the console encoding and left the file I/O exposed to the identical failure one line away. Now pinned on all three operations.
• Invoke contracts relocated to ui/lib/api-types.ts - all four (InstallOutcome, ProviderStatus, ProviderTestResult, ProviderTestOutcome), not just the one flagged.
• Spans on install_provider / cursor_sign_in with an explicit failure status, recorded via the single install_failed funnel.
• Shared test helper extracted to ui/__tests__/helpers/source.ts.

Verified: clippy clean, 258 UI tests + 130 Rust tests pass, UI production build succeeds, merge script re-tested on both happy and error paths.

Declined, with reasons on the threads - 2

• Pinning dtolnay/rust-toolchain@master to a SHA. It appears in all seven places across every workflow; pinning one file leaves the mutable ref live in six others. The comment cites an existing repo policy, but nothing in .github/workflows is pinned today. Real repo-wide change, deserves its own PR.
• Loosening the placeholder heuristic. It can in principle reject a valid Jira URL, but the failing examples are contrived and tightening it is a product judgement about what a real credential looks like.

---

Merge readiness

This PR is not blocked by review comments any more. Two things to know before merging:

1. #504 must merge first. It targets pre-main, which is this PR's head, so its fixes flow into this promotion automatically once merged. Merging [#495] ahead of it ships the incomplete encoding fix to main.
2. The urgency is unchanged and real. v1.73.0 shipped macOS-only - no Meridian-setup.exe on the release, no windows-x86_64 key in production latest.json. Windows users can neither install nor auto-update, and have been stranded since this morning. That is what this PR fixes (#490's cfg-gating), and it is the most user-visible open item.

Scope check: git diff origin/main origin/pre-main -- .github/workflows/release.yml is empty - production release machinery is untouched by this promotion.

Recommended order: merge [#504], then merge this.

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed