@yugabytedb/meko-mcp 1.1.0 → 2.0.0

package/lib/clients/common.mjs

@@ -5,14 +5,18 @@ import {
   symlinkSync,
   cpSync,
   lstatSync,
+  statSync,
   unlinkSync,
   rmSync,
   readFileSync,
+  renameSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
+export const MEKO_MCP_USER_AGENT = "meko-mcp-installer/1.0";
+
 /**
  * @returns {string} Absolute repository root path.
  */
@@ -82,6 +86,16 @@ export function resolveHooksRoot() {
   return join(getAssetRoot(), "hooks-handlers");
 }
 
+/**
+ * @returns {string} absolute path to the statusline script source.
+ *   Lives under skills/scripts/ in source, mirrored under assets/scripts/ in
+ *   the npm-packed install — both roots are siblings of skills/hooks-handlers/
+ *   and skills/skills/.
+ */
+export function resolveStatuslineSource() {
+  return join(getAssetRoot(), "scripts", "meko-statusline.sh");
+}
+
 /**
  * Run a shell command and return stdout.
  * @param {string} cmd
@@ -108,14 +122,98 @@ export function shellQuote(value) {
   return `'${String(value).replace(/'/g, `'\\''`)}'`;
 }
 
+// statSync error codes that mean a symlink is broken — its target cannot be
+// resolved to a real inode. We deliberately do NOT include EACCES / EPERM:
+// those mean "target may exist but I can't see it", and silently removing
+// someone else's link based on a permission failure is unsafe.
+const BROKEN_SYMLINK_STAT_CODES = new Set([
+  "ENOENT", // target does not exist (the textbook "dangling symlink")
+  "ENOTDIR", // a non-directory component appears mid-path (e.g. link -> file/child)
+  "ELOOP", // too many redirections (cyclic symlinks)
+]);
+
+/**
+ * True when `targetPath` is a symlink whose target cannot be resolved. A
+ * regular file/dir or a working symlink returns false; a missing path also
+ * returns false. See `BROKEN_SYMLINK_STAT_CODES` for which resolution
+ * failures count.
+ *
+ * Why this matters: `existsSync` returns false for a broken symlink, so a
+ * naive `if (existsSync(dest)) {...}` branch falls through and tries to write
+ * over the symlink. On macOS, `cpSync` then aborts the entire process via an
+ * uncaught libc++ `filesystem_error` ("Operation not supported" inside
+ * `std::filesystem::equivalent`) whenever one operand is a broken symlink —
+ * not just the ENOENT case but also ENOTDIR (`link -> file/child`) and ELOOP.
+ * Detecting any of these lets callers either treat the path as an existing
+ * entry or clear it before writing.
+ *
+ * @param {string} targetPath
+ * @returns {boolean}
+ */
+export function isDanglingSymlink(targetPath) {
+  let stat;
+  try {
+    stat = lstatSync(targetPath);
+  } catch {
+    return false;
+  }
+  if (!stat.isSymbolicLink()) return false;
+  try {
+    statSync(targetPath);
+    return false;
+  } catch (err) {
+    return BROKEN_SYMLINK_STAT_CODES.has(err.code);
+  }
+}
+
+/**
+ * Unlink that tolerates the narrow race window where another process
+ * already removed `targetPath` between our check and our write (ENOENT)
+ * but propagates every other failure (EACCES, EPERM, EBUSY, etc.) as a
+ * normal JS error.
+ *
+ * Why not `removePath`: that helper swallows ALL errors, which is fine
+ * for cleanup paths but dangerous in front of `cpSync`. If unlink truly
+ * fails (e.g. read-only parent dir), the broken symlink is still on
+ * disk; cpSync would then dive into the macOS libc++ `filesystem_error`
+ * abort path described in `isDanglingSymlink`. Surfacing the unlink
+ * error here lets the surrounding installer surface a clean error
+ * instead of aborting the process.
+ *
+ * @param {string} targetPath
+ */
+function unlinkAllowingMissing(targetPath) {
+  try {
+    unlinkSync(targetPath);
+  } catch (err) {
+    if (err && err.code === "ENOENT") return;
+    throw err;
+  }
+}
+
 /**
  * Create symlink when possible; fallback to copy.
+ *
+ * Pre-clears a broken symlink at `destination` so the copy fallback path
+ * doesn't crash. See `isDanglingSymlink` above for the macOS libc++ trap.
+ * Uses `unlinkAllowingMissing` rather than `removePath` so an unlink
+ * failure (e.g. read-only parent dir) surfaces as a normal JS error
+ * instead of silently leaving the broken link in place — otherwise
+ * `cpSync` below would still abort the process.
+ *
  * @param {string} source
  * @param {string} destination
  * @returns {"symlink"|"copy"}
  */
-export function symlinkOrCopy(source, destination) {
+export function symlinkOrCopy(source, destination, { preferCopy = false } = {}) {
   mkdirSync(dirname(destination), { recursive: true });
+  if (isDanglingSymlink(destination)) {
+    unlinkAllowingMissing(destination);
+  }
+  if (preferCopy) {
+    cpSync(source, destination, { recursive: true });
+    return "copy";
+  }
   try {
     symlinkSync(source, destination, "junction");
     return "symlink";
@@ -125,6 +223,29 @@ export function symlinkOrCopy(source, destination) {
   }
 }
 
+/** Atomically refresh a runtime-owned directory at a stable path. */
+export function installStableTree(source, destination) {
+  if (resolve(source) === resolve(destination)) return;
+  const suffix = `${process.pid}-${Date.now()}`;
+  const staging = `${destination}.tmp-${suffix}`;
+  const backup = `${destination}.bak-${suffix}`;
+
+  mkdirSync(dirname(destination), { recursive: true });
+  try {
+    cpSync(source, staging, { recursive: true });
+    if (existsSync(destination)) renameSync(destination, backup);
+    try {
+      renameSync(staging, destination);
+    } catch (err) {
+      if (existsSync(backup)) renameSync(backup, destination);
+      throw err;
+    }
+    rmSync(backup, { recursive: true, force: true });
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+}
+
 /**
  * Remove path if it is a symlink or directory/file.
  * @param {string} targetPath

package/lib/clients/cursor.mjs

@@ -16,7 +16,11 @@ import {
   writeJsonFile,
 } from "../config.mjs";
 import {
+  MEKO_MCP_USER_AGENT,
   getInstallerVersion,
+  installStableTree,
+  isDanglingSymlink,
+  isPackagedInstall,
   markerIsStale,
   readInstallerMarker,
   resolveHooksRoot,
@@ -29,7 +33,7 @@ import {
 const SKILLS = [{ name: "meko-mcp-tools" }];
 
 const HOOKS = [
-  { event: "sessionStart", script: "session-start.sh", timeout: 15000 },
+  { event: "sessionStart", script: "cursor-session-start.sh", timeout: 15000 },
   { event: "preCompact", script: "pre-compact.sh" },
   { event: "sessionEnd", script: "session-end.sh", timeout: 30000 },
 ];
@@ -38,6 +42,9 @@ const HOOKS = [
  * @returns {object}
  */
 export function createCursorAdapter(customPaths = {}) {
+  const resolveHooksRootPath = customPaths.resolveHooksRoot ?? resolveHooksRoot;
+  const resolveSkillSourcePath = customPaths.resolveSkillSource ?? resolveSkillSource;
+  const packagedInstallDetector = customPaths.isPackagedInstall ?? isPackagedInstall;
   const paths = {
     getMcpPath: customPaths.getMcpPath ?? getCursorMcpPath,
     getHooksPath: customPaths.getHooksPath ?? getCursorHooksPath,
@@ -83,6 +90,7 @@ export function createCursorAdapter(customPaths = {}) {
       if (dryRun) {
         log.dim(`  Would update ${mcpPath}:`);
         log.dim(`    mcpServers.${name}.url = ${url}`);
+        log.dim(`    mcpServers.${name}.headers.User-Agent = ${MEKO_MCP_USER_AGENT}`);
         if (apiKey) {
           log.dim("    mcpServers.<name>.headers.Authorization = <set>");
         }
@@ -93,30 +101,48 @@ export function createCursorAdapter(customPaths = {}) {
       if (!cfg.mcpServers || typeof cfg.mcpServers !== "object") {
         cfg.mcpServers = {};
       }
-      const server = { url };
+      const server = { url, headers: { "User-Agent": MEKO_MCP_USER_AGENT } };
       if (apiKey) {
-        server.headers = { Authorization: `Bearer ${apiKey}` };
+        server.headers.Authorization = `Bearer ${apiKey}`;
       }
       cfg.mcpServers[name] = server;
       writeJsonFile(mcpPath, cfg);
     },
     setHookEnvironment({ url, apiKey, dryRun, log, scope, projectRoot, cursorHookMode }) {
-      const mode = cursorHookMode || "hybrid";
+      const mode = cursorHookMode || "native";
+      const installedHooksRoot = getCursorHooksInstallRoot(paths, scope, projectRoot);
       if (dryRun) {
-        if (mode === "native" || mode === "hybrid") {
+        log.dim(`  Would copy Cursor hook scripts to ${installedHooksRoot}`);
+        if (mode === "native") {
           log.dim(`  Would configure Cursor hooks at ${paths.getHooksPath(scope, projectRoot)}`);
         }
-        if (mode === "claude-compat" || mode === "hybrid") {
+        if (mode === "claude-compat") {
           log.dim(`  Would configure Claude-compatible hooks at ${paths.getClaudeCompatSettingsPath(scope, projectRoot)}`);
         }
         return;
       }
 
-      if (mode === "native" || mode === "hybrid") {
-        installNativeCursorHooks({ scope, projectRoot, url, apiKey, paths });
+      installStableTree(resolveHooksRootPath(), installedHooksRoot);
+
+      if (mode === "native") {
+        installNativeCursorHooks({
+          scope,
+          projectRoot,
+          url,
+          apiKey,
+          paths,
+          handlersRoot: installedHooksRoot,
+        });
       }
-      if (mode === "claude-compat" || mode === "hybrid") {
-        installClaudeCompatHooks({ scope, projectRoot, url, apiKey, paths });
+      if (mode === "claude-compat") {
+        installClaudeCompatHooks({
+          scope,
+          projectRoot,
+          url,
+          apiKey,
+          paths,
+          handlersRoot: installedHooksRoot,
+        });
       }
     },
     installSkills({ dryRun, log, scope, projectRoot }) {
@@ -130,7 +156,7 @@ export function createCursorAdapter(customPaths = {}) {
 
       mkdirSync(skillDir, { recursive: true });
       for (const skill of SKILLS) {
-        const source = resolveSkillSource(skill.name);
+        const source = resolveSkillSourcePath(skill.name);
         const destination = join(skillDir, skill.name);
 
         if (existsSync(destination)) {
@@ -159,9 +185,20 @@ export function createCursorAdapter(customPaths = {}) {
             // Same version already deployed — nothing to do.
             continue;
           }
+        } else if (isDanglingSymlink(destination)) {
+          // Stale symlink left behind by an earlier install whose target
+          // (e.g. a deleted worktree) no longer exists. existsSync is false
+          // for these, so the branch above misses them. Clear it so the
+          // fresh-install path below can replace it cleanly.
+          log.dim?.(
+            `  Replacing dangling symlink at ${destination} (target missing).`,
+          );
+          removePath(destination);
         }
 
-        const strategy = symlinkOrCopy(source, destination);
+        const strategy = symlinkOrCopy(source, destination, {
+          preferCopy: packagedInstallDetector(),
+        });
         // Only stamp a marker when we materialized a real copy. Writing into
         // a symlinked source dir would mutate the shipped asset tree, which
         // is confusing at best and a permission error at worst. Symlinks
@@ -186,7 +223,7 @@ export function createCursorAdapter(customPaths = {}) {
         uninstallCursorHooks({
           scope,
           projectRoot,
-          mode: cursorHookMode || "hybrid",
+          mode: cursorHookMode || "native",
           paths,
         });
         results.push({ key: "hooks", ok: true, message: "Cursor hook configuration cleaned up." });
@@ -206,10 +243,20 @@ export function createCursorAdapter(customPaths = {}) {
     async validateConfig({ serverName, scope, projectRoot }) {
       const mcpPath = paths.getMcpPath(scope, projectRoot);
       const cfg = readJsonFile(mcpPath);
-      if (cfg?.mcpServers?.[serverName]) {
-        return { ok: true, message: `Server "${serverName}" is registered in ${mcpPath}.` };
+      const entry = cfg?.mcpServers?.[serverName];
+      if (!entry) {
+        return { ok: false, message: `Server "${serverName}" not found in ${mcpPath}.` };
       }
-      return { ok: false, message: `Server "${serverName}" not found in ${mcpPath}.` };
+      const hasUserAgent = Object.keys(entry.headers ?? {}).some(
+        (key) => key.toLowerCase() === "user-agent",
+      );
+      if (!hasUserAgent) {
+        return {
+          ok: false,
+          message: `Server "${serverName}" in ${mcpPath} is missing the User-Agent header required by the Cloud WAF.`,
+        };
+      }
+      return { ok: true, message: `Server "${serverName}" is registered in ${mcpPath}.` };
     },
   };
 }
@@ -234,7 +281,22 @@ function ensureEnvBlock(cfg, url, apiKey) {
   }
 }
 
-function installNativeCursorHooks({ scope, projectRoot, url, apiKey, paths }) {
+function getCursorHooksInstallRoot(paths, scope, projectRoot) {
+  return join(
+    dirname(paths.getHooksPath(scope, projectRoot)),
+    "meko-hooks",
+    "hooks-handlers",
+  );
+}
+
+function installNativeCursorHooks({
+  scope,
+  projectRoot,
+  url,
+  apiKey,
+  paths,
+  handlersRoot,
+}) {
   const hooksPath = paths.getHooksPath(scope, projectRoot);
   const cfg = readJsonFile(hooksPath);
   if (!cfg.version) cfg.version = 1;
@@ -242,11 +304,12 @@ function installNativeCursorHooks({ scope, projectRoot, url, apiKey, paths }) {
     cfg.hooks = {};
   }
 
-  const handlersRoot = resolveHooksRoot();
+  pruneNativeCursorMekoHooks(cfg.hooks);
   for (const hook of HOOKS) {
     const scriptPath = join(handlersRoot, hook.script);
     const entry = { command: buildScriptCommand({ scriptPath }) };
     if (hook.timeout) entry.timeout = hook.timeout;
+    if (hook.matcher) entry.matcher = hook.matcher;
     upsertHookEntry(cfg.hooks, hook.event, entry);
   }
 
@@ -268,14 +331,20 @@ function installNativeCursorHooks({ scope, projectRoot, url, apiKey, paths }) {
 // will be pruned; the user must re-run the Cursor installer to restore
 // them. pruneMekoHookEntries emits a warning on any removal so the user
 // has a chance to notice before hooks silently disappear.
-function installClaudeCompatHooks({ scope, projectRoot, url, apiKey, paths }) {
+function installClaudeCompatHooks({
+  scope,
+  projectRoot,
+  url,
+  apiKey,
+  paths,
+  handlersRoot,
+}) {
   const settingsPath = paths.getClaudeCompatSettingsPath(scope, projectRoot);
   const cfg = readJsonFile(settingsPath);
   if (!cfg.hooks || typeof cfg.hooks !== "object") {
     cfg.hooks = {};
   }
 
-  const handlersRoot = resolveHooksRoot();
   const compatMap = {
     SessionStart: { script: "session-start.sh", timeout: 15000 },
     PreCompact: { script: "pre-compact.sh" },
@@ -305,6 +374,30 @@ function upsertHookEntry(hooksObj, event, entry) {
   if (!exists) hooksObj[event].push(entry);
 }
 
+function pruneNativeCursorMekoHooks(hooksObj) {
+  if (!hooksObj || typeof hooksObj !== "object") return;
+  for (const event of Object.keys(hooksObj)) {
+    if (!Array.isArray(hooksObj[event])) continue;
+    hooksObj[event] = hooksObj[event].filter((item) => {
+      if (!item?.command) return true;
+      return !isMekoHookCommand(item.command);
+    });
+  }
+}
+
+function isMekoHookCommand(command) {
+  if (typeof command !== "string") return false;
+  if (!command.includes("hooks-handlers/")) return false;
+  return [
+    "session-start.sh",
+    "cursor-session-start.sh",
+    "before-submit-prompt.sh",
+    "pre-compact.sh",
+    "session-end.sh",
+    "post-tool-context.sh",
+  ].some((script) => command.includes(script));
+}
+
 function upsertClaudeCompatHook(hooksObj, event, entry) {
   if (!Array.isArray(hooksObj[event])) hooksObj[event] = [];
   let bucket = hooksObj[event].find((item) => Array.isArray(item.hooks));
@@ -317,11 +410,9 @@ function upsertClaudeCompatHook(hooksObj, event, entry) {
 }
 
 function uninstallCursorHooks({ scope, projectRoot, mode, paths }) {
-  const handlersRoot = resolveHooksRoot();
-  const scripts = ["session-start.sh", "pre-compact.sh", "session-end.sh"]
-    .map((name) => join(handlersRoot, name));
+  const handlersRoot = getCursorHooksInstallRoot(paths, scope, projectRoot);
 
-  if (mode === "native" || mode === "hybrid") {
+  if (mode === "native") {
     const hooksPath = paths.getHooksPath(scope, projectRoot);
     const cfg = readJsonFile(hooksPath);
     if (cfg?.hooks && typeof cfg.hooks === "object") {
@@ -329,14 +420,14 @@ function uninstallCursorHooks({ scope, projectRoot, mode, paths }) {
         if (!Array.isArray(cfg.hooks[event])) continue;
         cfg.hooks[event] = cfg.hooks[event].filter((item) => {
           if (!item?.command) return true;
-          return !scripts.some((script) => item.command.includes(script));
+          return !isMekoHookCommand(item.command);
         });
       }
       writeJsonFile(hooksPath, cfg);
     }
   }
 
-  if (mode === "claude-compat" || mode === "hybrid") {
+  if (mode === "claude-compat") {
     // NOTE: we deliberately do NOT strip env.MEKO_MCP_URL / env.MEKO_API_KEY here.
     // On scope=user, this file is the same ~/.claude/settings.json the Claude Code
     // adapter owns; the Claude Code uninstall (claude-code.mjs removeKeys call) is
@@ -352,7 +443,7 @@ function uninstallCursorHooks({ scope, projectRoot, mode, paths }) {
           if (!Array.isArray(group?.hooks)) return group;
           const filtered = group.hooks.filter((item) => {
             if (!item?.command) return true;
-            return !scripts.some((script) => item.command.includes(script));
+            return !isMekoHookCommand(item.command);
           });
           return { ...group, hooks: filtered };
         }).filter((group) => {
@@ -363,6 +454,8 @@ function uninstallCursorHooks({ scope, projectRoot, mode, paths }) {
       writeJsonFile(settingsPath, cfg);
     }
   }
+
+  removePath(dirname(handlersRoot));
 }
 
 /**

package/lib/config.mjs

@@ -117,6 +117,58 @@ export function getCodexAgentsMdPath() {
   return join(codexHome, "AGENTS.md");
 }
 
+/**
+ * Return path to Codex's user-level hooks config.
+ * @returns {string}
+ */
+export function getCodexHooksPath() {
+  const codexHome = process.env.CODEX_HOME || join(homedir(), ".codex");
+  return join(codexHome, "hooks.json");
+}
+
+/**
+ * Return path to the Meko env file the Codex hooks source on launch.
+ * Lives next to hooks.json under $CODEX_HOME (default ~/.codex/) and is
+ * written at mode 0600. Used because Codex's hooks.json schema has no
+ * `env` block, and inlining the API key into each hook's `command`
+ * field would expose it via `ps -ef` while the hook runs.
+ *
+ * The hook command becomes `. ~/.codex/meko-env.sh && bash /path/to/hook.sh`,
+ * so the secret never appears in process arguments.
+ *
+ * @returns {string}
+ */
+export function getCodexMekoEnvFilePath() {
+  const codexHome = process.env.CODEX_HOME || join(homedir(), ".codex");
+  return join(codexHome, "meko-env.sh");
+}
+
+/**
+ * Return the stable directory the Codex hook scripts are copied into at
+ * install time.
+ *
+ * Why a dedicated copy instead of referencing the shipped asset root
+ * directly: when the installer runs via `npx @yugabytedb/meko-mcp`, the
+ * asset root resolves to an ephemeral npm cache dir
+ * (`~/.npm/_npx/<hash>/node_modules/@yugabytedb/meko-mcp/assets/...`).
+ * npx garbage-collects those hashed dirs, so a hooks.json that pins the
+ * npx path becomes a dangling pointer on the next npx run — Codex then
+ * spawns `bash '<missing script>'`, which exits 127 ("command not found")
+ * and surfaces as a failed SessionStart hook + the misleading "could not
+ * reach Meko" fallback. Copying the scripts under $CODEX_HOME gives the
+ * hook a home-dir-stable target that outlives the npx cache.
+ *
+ * The `hooks-handlers` leaf is preserved so the command string still
+ * matches `isMekoHookCommand`'s prune regex — that lets a reinstall
+ * auto-heal any stale npx-pinned entry left by an older installer.
+ *
+ * @returns {string}
+ */
+export function getCodexHooksInstallRoot() {
+  const codexHome = process.env.CODEX_HOME || join(homedir(), ".codex");
+  return join(codexHome, "meko-hooks", "hooks-handlers");
+}
+
 /**
  * Return path to the shared agent-skills directory used by Codex
  * (and other agent runtimes that follow the convention).

package/lib/installer.mjs

@@ -33,11 +33,12 @@ export async function install(options) {
     skipSkills = false,
     skipValidation = false,
     skipCanary = false,
+    installStatusline = false,
     dryRun = false,
     verbose = false,
     yes = false,
     projectRoot = process.cwd(),
-    cursorHookMode = "hybrid",
+    cursorHookMode = "native",
   } = options;
 
   const adapters = getClientAdapters();
@@ -50,6 +51,7 @@ export async function install(options) {
 
   let totalSteps = 3; // register + env/hooks + validate
   if (!skipSkills) totalSteps += 1;
+  if (installStatusline && typeof adapter.installStatusline === "function") totalSteps += 1;
   if (skipValidation) totalSteps -= 1;
 
   banner(`Meko Setup for ${adapter.displayName}`);
@@ -171,6 +173,28 @@ export async function install(options) {
     currentStep++;
   }
 
+  if (installStatusline && typeof adapter.installStatusline === "function") {
+    try {
+      adapter.installStatusline({
+        scope,
+        dryRun,
+        verbose,
+        log: LOG,
+        settingsPath,
+        projectRoot,
+      });
+      stepOk(
+        currentStep,
+        totalSteps,
+        dryRun ? "Wiring datapack statusline (dry-run)." : "Datapack statusline wired.",
+      );
+    } catch (err) {
+      stepFail(currentStep, totalSteps, "Failed to wire datapack statusline.");
+      warn(`Non-critical: ${err.message}`);
+    }
+    currentStep++;
+  }
+
   if (!skipValidation) {
     if (dryRun) {
       dim("Would validate config, MCP connectivity, and tool availability.");
@@ -225,7 +249,7 @@ export async function uninstall(options = {}) {
     scope = "user",
     verbose = false,
     projectRoot = process.cwd(),
-    cursorHookMode = "hybrid",
+    cursorHookMode = "native",
   } = options;
 
   const adapters = getClientAdapters();

package/lib/mcp-transport.mjs

@@ -39,6 +39,11 @@ export function jsonRpcRequest(url, payload, apiKey, sessionId, opts = {}) {
     const headers = {
       "Content-Type": "application/json",
       Accept: "application/json, text/event-stream",
+      // Cloud Meko sits behind a WAF that 403s requests with no User-Agent
+      // (Node's http/https send none by default). This transport powers install
+      // validation and migration against cloud URLs, so it hits the same WAF as
+      // the capture hooks — send an explicit UA so those calls aren't rejected.
+      "User-Agent": "meko-installer/1.0 (+https://github.com/yugabyte/meko-mcp-server)",
     };
     if (apiKey) {
       headers["Authorization"] = `Bearer ${apiKey}`;

package/lib/validate.mjs

@@ -32,7 +32,6 @@ const CORE_TOOLS = [
   "memory_search",
   "memory_get_by_id",
   "conversation_create",
-  "db_summarize_database",
   "datapack_list",
 ];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yugabytedb/meko-mcp",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "Single-line installer for Meko MCP Server across Claude and Cursor clients",
   "type": "module",
   "bin": {

package/scripts/bundle-assets.mjs

@@ -18,10 +18,26 @@ const PAYLOAD = [
     from: join(repoRoot, "skills", "skills", "meko-mcp-tools"),
     to: join(assetsDir, "skills", "meko-mcp-tools"),
   },
+  {
+    from: join(repoRoot, "skills", "skills", "meko-mcp-tools-desktop"),
+    to: join(assetsDir, "skills", "meko-mcp-tools-desktop"),
+  },
+  {
+    from: join(repoRoot, "skills", "skills", "meko-select-datapack-desktop"),
+    to: join(assetsDir, "skills", "meko-select-datapack-desktop"),
+  },
   {
     from: join(repoRoot, "skills", "hooks-handlers"),
     to: join(assetsDir, "hooks-handlers"),
   },
+  {
+    from: join(repoRoot, "skills", "scripts", "package-desktop-skill.sh"),
+    to: join(assetsDir, "scripts", "package-desktop-skill.sh"),
+  },
+  {
+    from: join(repoRoot, "skills", "scripts", "meko-statusline.sh"),
+    to: join(assetsDir, "scripts", "meko-statusline.sh"),
+  },
 ];
 
 const cleaning = process.argv.includes("--clean");

package/assets/skills/meko-mcp-tools/references/tools-db-query-patterns.md

@@ -1,38 +0,0 @@
-# Read-Only vs Write Query Execution Patterns
-
-**WRONG:** `db_run_write_query(scope="write", query="SELECT * FROM users")` — requires write scope unnecessarily, triggers guardrail validation, returns `{"rows_affected": -1}` instead of data.
-**WRONG:** `db_run_read_only_query(scope="read", query="INSERT INTO ...")` — fails: "cannot execute INSERT in a read-only transaction."
-
-## How Each Tool Works
-
-**`db_run_read_only_query`:** `BEGIN READ ONLY` → execute → `ROLLBACK`. Returns JSON array of row objects.
-
-**`db_run_write_query`:** Guardrail validation → execute → `COMMIT`. Returns `{"rows_affected": N}`.
-
-## When to Use db_summarize_database
-
-Use instead of writing your own `information_schema` query when you need a table overview:
-
-```
-db_summarize_database(scope="read", schema="public")
--- Returns table names, column schemas, AND row counts in one call
-```
-
-## SQL Best Practices
-
-**Schema qualification:** For non-public schemas, use `analytics."monthly_revenue"` and pass `schema="analytics"` to `db_summarize_database`.
-
-**String escaping:** Queries are passed directly to `cur.execute()` — no parameter placeholders. Escape values in SQL: `WHERE name = 'O''Brien'`.
-
-**LIMIT on exploratory queries:**
-```
-db_run_read_only_query(scope="read", query="SELECT * FROM large_table LIMIT 25")
-```
-
-**Batch large writes:** Due to the 1000-row INSERT cap, split large inserts. Or use `INSERT ... SELECT` for unlimited rows from an existing table.
-
-**One statement per call:**
-```
-WRONG: "CREATE TABLE a (id INT); CREATE TABLE b (id INT);"
-RIGHT: Two separate db_run_write_query calls
-```