feat: add meridian community plugin (Astra ideation, personas, competitor research, market intelligence)

[sgang007]

Summary

New community plugin: meridian — Webcmd commands for Meridian (getmeridian.tech), the founder copilot whose Astra agent takes an idea from ideation to validated market intelligence. All commands run through the user's own Meridian account in a logged-in Webcmd browser profile.

Workflows

Authorize the account (browser sign-in/sign-up)

• webcmd meridian login opens Meridian in the Webcmd browser; the user signs in or signs up (email/password or Google), then webcmd meridian whoami verifies the session (email, org, credits). Commands raise typed AUTH_REQUIRED errors whenever the session is missing or expired — never empty results.

Ideation → Approve & Start

• webcmd meridian ideate "<message>" drives one turn of the Astra ideation chat (optionally --research), returning the running problem statement, solution, market opportunity, differentiation, readiness scores, tap-to-answer suggestions, and the web-research sources behind Astra's context. Conversation state persists in the site session; drafts are mirrored to the account via autosave.
• When stage=ready_to_start, webcmd meridian approve starts the project (job-based setup polled to completion) and returns the new project id/URL.

Ideal-user personas

• webcmd meridian persona <project> "<observed behaviour>" or --file interviews.md builds a persona conversationally and saves it to the account when Astra marks it ready; personas lists them. README documents composing with the reddit plugin (subreddit → behaviours → persona).

Competitor research

• competitor-scan runs Meridian's landscape job; competitors returns the board prioritized by relevance; competitor-add feeds in candidates sourced via the ycombinator / hackernews / producthunt plugins so the next scan positions them.

Market intelligence

• agent-start [--scan], agent-status, agent-pause control the Astra background agent and report its parallel branch states (market research, synthesis, planning, execution) plus checkpoints awaiting a human.

Implementation notes

• Commands mirror the app's own API contract from the logged-in page context: httpOnly session_token cookie, credentialed cross-origin fetch from app.getmeridian.tech to api.getmeridian.tech/api (on the platform CORS allowlist).
• Long Astra calls are kicked off inside the page and polled with short evaluates to stay under the CDP evaluate cap; job-based endpoints (project setup, competitor scan) are polled via /jobs/{id}.
• Typed errors throughout: ArgumentError for input validation, AuthRequiredError for 401/plain-403/missing cookie, CommandExecutionError for HTTP failures, credit (402) and subscription-gate (structured 403) responses, timeouts, and the ideation content-safety guardrail.
• Row keys match declared columns exactly (silent-column-drop safe); no generated files touched (plugin-PR scope keeps the diff inside plugins/meridian/).

Verification

• npx vitest run --project plugin plugins/meridian — 49/49 tests pass (fetch machinery, error mapping, chat-state round-trips, and command contracts against a scripted fake page).
• npm test — unit + plugin projects pass except 5 pre-existing, environment-dependent failures in src/fetch/safe-proxy.test.ts (private-DNS-answer tests; fail identically on a clean checkout of main on this machine).
• npm run check-community-plugins — passes (124 plugins).
• node scripts/check-plugin-pr-scope.mjs origin/main HEAD — passes (all changes inside plugins/meridian/).
• Live, against production in a clean profile:
  • webcmd plugin install <path> → all 13 commands discoverable via webcmd list.
  • webcmd meridian whoami (signed out) → typed AUTH_REQUIRED with actionable guidance.
  • webcmd meridian login → opens app.getmeridian.tech in the Webcmd browser, returns action_required + the exact verify command, and Webcmd pauses the adapter session for the human sign-in handoff.
  • Credentialed page-context fetch from the app origin to api.getmeridian.tech/api/auth/me → HTTP 401 {"detail":"Not authenticated"} (CORS and the exact network path the commands use, confirmed; a signed-in session rides the same path).

Notes / limitations

• Meridian meters some actions in account credits (new project, competitor scan/add, research turns); the commands surface the API's 402/403 responses as actionable messages.
• Chat drafts keep conversation state in the persistent site session; a recycled tab starts a fresh draft (--reset does so explicitly). Ideation drafts are additionally autosaved to the account.

🤖 Generated with Claude Code

[github-actions]

🟠 Maintainer review suggested — low confidence

Documentation sync review is deferred until this draft is marked ready for review.

This review is advisory and does not block merging.