@yugabytedb/meko-mcp 2.0.0 → 2.2.0

package/lib/config.mjs

@@ -96,6 +96,96 @@ export function getClaudeCompatSettingsPath(scope, projectRoot) {
   return getClaudeCodeSettingsPath();
 }
 
+/**
+ * Root of Kiro's global config tree.
+ *
+ * Kiro documents $KIRO_HOME as the override every global surface resolves
+ * against (agents, skills, steering, settings, sessions), so honoring it here
+ * keeps all Kiro path helpers consistent with the IDE and `kiro-cli`.
+ * @returns {string}
+ */
+function getKiroHome() {
+  return process.env.KIRO_HOME || join(homedir(), ".kiro");
+}
+
+/**
+ * Return path to Kiro's MCP config file.
+ *
+ * Kiro merges MCP scopes agent -> project -> global, and both the IDE and
+ * `kiro-cli` read the same files, so one pair of paths covers both surfaces.
+ * @param {"user"|"project"} scope
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+export function getKiroMcpPath(scope, projectRoot) {
+  if (scope === "project") {
+    return join(projectRoot, ".kiro", "settings", "mcp.json");
+  }
+  return join(getKiroHome(), "settings", "mcp.json");
+}
+
+/** Return the directory containing standalone Kiro hook definitions. */
+export function getKiroHooksDir(scope, projectRoot) {
+  if (scope === "project") {
+    return join(projectRoot, ".kiro", "hooks");
+  }
+  return join(getKiroHome(), "hooks");
+}
+
+/** Return the installer-owned, legacy CLI 2.x managed-agent path. */
+export function getKiroManagedAgentPath(scope, projectRoot) {
+  if (scope === "project") {
+    return join(projectRoot, ".kiro", "agents", "meko-default.json");
+  }
+  return join(getKiroHome(), "agents", "meko-default.json");
+}
+
+/**
+ * Return Kiro's CLI settings path for the selected installer scope.
+ * CLI 2.x stores dotted setting names as top-level JSON keys.
+ */
+export function getKiroCliSettingsPath(scope, projectRoot) {
+  if (scope === "project") {
+    return join(projectRoot, ".kiro", "settings", "cli.json");
+  }
+  return join(getKiroHome(), "settings", "cli.json");
+}
+
+/**
+ * Return path to the Meko-owned Kiro steering file.
+ *
+ * Kiro reads every file in `steering/` on each interaction, which makes it the
+ * analogue of Codex's AGENTS.md: the place to state behavior the agent must
+ * follow. Because steering is a *directory*, we own `meko.md` outright instead
+ * of upserting a fenced block into a file the user also edits.
+ * @param {"user"|"project"} scope
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+export function getKiroSteeringPath(scope, projectRoot) {
+  if (scope === "project") {
+    return join(projectRoot, ".kiro", "steering", "meko.md");
+  }
+  return join(getKiroHome(), "steering", "meko.md");
+}
+
+/**
+ * Return path to Kiro's skills directory.
+ *
+ * Kiro implements the Agent Skills standard (SKILL.md + name/description
+ * frontmatter), which is the same format our skills already ship in, so they
+ * install by copy with no transformation.
+ * @param {"user"|"project"} scope
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+export function getKiroSkillsDir(scope, projectRoot) {
+  if (scope === "project") {
+    return join(projectRoot, ".kiro", "skills");
+  }
+  return join(getKiroHome(), "skills");
+}
+
 /**
  * Return path to Codex's user-level config (TOML).
  * Honors $CODEX_HOME if set, else defaults to ~/.codex/config.toml.

package/lib/detect.mjs

@@ -110,7 +110,7 @@ export function getClaudeCodeConfigPath() {
  *   `scope`      — "user" (default) or "project". Project scope looks under `projects[projectRoot].mcpServers`.
  *   `projectRoot` — absolute path used as the key into `projects[...]` when `scope === "project"`.
  *                   Ignored for user scope. Must be supplied by the caller for project scope.
- * @returns {{ found: boolean, status: string }}
+ * @returns {{ found: boolean, status: string, url?: string }}
  *   `found`  - true if a matching MCP entry exists at the scope-appropriate location.
  *   `status` - "Configured" when found, "" otherwise. (Kept as a string for
  *              API compatibility with the prior implementation; callers use
@@ -129,5 +129,10 @@ export function detectExistingMeko(serverName = "meko", options = {}) {
   if (!entry) {
     return { found: false, status: "" };
   }
-  return { found: true, status: "Configured" };
+  const url = typeof entry.url === "string" ? entry.url : undefined;
+  return {
+    found: true,
+    status: "Configured",
+    ...(url ? { url } : {}),
+  };
 }

package/lib/installer.mjs

@@ -136,6 +136,7 @@ export async function install(options) {
     adapter.setHookEnvironment({
       url,
       apiKey,
+      name,
       scope,
       dryRun,
       verbose,

package/lib/migrate/adapters/codex.mjs

@@ -0,0 +1,490 @@
+/**
+ * adapters/codex.mjs — Enumerate + parse Codex CLI/Desktop session rollouts.
+ *
+ * Codex writes one JSONL "rollout" file per session under:
+ *   <CODEX_HOME|~/.codex>/sessions/<YYYY>/<MM>/<DD>/rollout-<ts>-<uuid>.jsonl
+ *
+ * Each line is `{timestamp, type, payload}`. The shapes we consume:
+ *   - type "session_meta": payload has `session_id` and `cwd` (the project
+ *     root the session ran in — the source of truth for agent_id derivation).
+ *   - type "event_msg", payload.type "user_message": the AUTHORITATIVE marker
+ *     for a real user prompt. Codex also writes `response_item`/`message`
+ *     role=user records for injected context (`<recommended_plugins>`,
+ *     AGENTS.md, the Meko SessionStart block); those have NO mirrored
+ *     user_message event, so we use the event stream to tell a real prompt
+ *     from injected context.
+ *   - type "response_item", payload.type "message", role "assistant": one
+ *     slice of the assistant's reply. A single turn emits several — phase
+ *     "commentary" updates then phase "final_answer" — so we accumulate ALL
+ *     of them into one assistant side and only close the turn at the
+ *     completion boundary (next user prompt or `event_msg` task_complete).
+ *   - type "response_item", payload.type "reasoning" /
+ *     "custom_tool_call" / "custom_tool_call_output": reasoning + tool
+ *     activity, folded into the turn's `reasoning` (parity with the
+ *     Claude Code / Cursor adapters).
+ *
+ * Completion-boundary discriminator (kept consistent with the live parser in
+ * PR #234): assistant `phase: "final_answer"` and/or the `event_msg`
+ * `payload.type: "task_complete"` record close a turn.
+ *
+ * Unknown line/block shapes are skipped, never fatal — Codex's on-disk
+ * schema drifts across CLI versions.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { agentIdForCodex } from "../id.mjs";
+
+// Cap for the first-record read. Codex embeds `base_instructions` in the
+// session_meta line, which routinely exceeds 16 KiB; read generously so the
+// full first record parses. 4 MiB is far above any real header while still
+// bounding a pathological file.
+const HEADER_READ_CAP = 4 * 1024 * 1024;
+
+function homeDir() {
+  return process.env.HOME || os.homedir();
+}
+
+/**
+ * The `.codex` home. Honors `CODEX_HOME` (production sets it to relocate all
+ * Codex state); otherwise `<home>/.codex`. The injectable `opts.home` override
+ * is preserved for tests and only applies to the default location.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.home]
+ * @returns {string}
+ */
+export function codexHome(opts = {}) {
+  const envHome = (process.env.CODEX_HOME || "").trim();
+  if (envHome) return envHome;
+  return path.join(opts.home ?? homeDir(), ".codex");
+}
+
+/**
+ * The sessions root Codex writes rollout files under.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.home]
+ * @returns {string}
+ */
+export function sessionsRoot(opts = {}) {
+  return path.join(codexHome(opts), "sessions");
+}
+
+/**
+ * @typedef {Object} CodexSessionRef
+ * @property {string} sessionUuid     Rollout filename basename (matches
+ *   capture.js::extractSessionId, so migrator + live capture dedup to the
+ *   same conversation container).
+ * @property {string} path            Absolute path to the rollout .jsonl.
+ * @property {string} cwd             Project root from session_meta.
+ * @property {string} agentId         `codex:<repo-basename>`.
+ * @property {"codex"} source
+ * @property {number} mtimeMs
+ * @property {boolean} likelyInProgress
+ */
+
+/**
+ * Recursively collect rollout-*.jsonl paths under the date-partitioned tree.
+ *
+ * @param {string} dir
+ * @returns {string[]}
+ */
+function collectRolloutFiles(dir) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...collectRolloutFiles(full));
+    } else if (e.isFile() && e.name.startsWith("rollout-") && e.name.endsWith(".jsonl")) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+/**
+ * Read the COMPLETE first JSONL record (through the first newline) and, if it
+ * is the `session_meta` header, harvest `session_id` + `cwd` + `timestamp`.
+ * Reads in chunks up to HEADER_READ_CAP so a large `base_instructions` block
+ * (>16 KiB, common in current rollouts) still parses — a bounded prefix would
+ * truncate the line, fail to parse, and silently drop the session.
+ *
+ * @param {string} filePath
+ * @returns {{ sessionId: string|null, cwd: string|null, startedAt: string|null }}
+ */
+export function peekSessionMeta(filePath) {
+  const empty = { sessionId: null, cwd: null, startedAt: null };
+  let fd;
+  try {
+    fd = fs.openSync(filePath, "r");
+    const chunkSize = 65536;
+    const chunk = Buffer.alloc(chunkSize);
+    let acc = "";
+    let offset = 0;
+    let newlineIdx = -1;
+    while (offset < HEADER_READ_CAP) {
+      const bytesRead = fs.readSync(fd, chunk, 0, chunkSize, offset);
+      if (bytesRead === 0) break;
+      acc += chunk.toString("utf-8", 0, bytesRead);
+      offset += bytesRead;
+      newlineIdx = acc.indexOf("\n");
+      if (newlineIdx !== -1) break;
+    }
+    const firstLine = (newlineIdx === -1 ? acc : acc.slice(0, newlineIdx)).trim();
+    if (!firstLine) return empty;
+    const obj = JSON.parse(firstLine);
+    if (obj && obj.type === "session_meta" && obj.payload && typeof obj.payload === "object") {
+      const p = obj.payload;
+      const str = (v) => (typeof v === "string" ? v : null);
+      return {
+        sessionId: str(p.session_id) || str(p.id),
+        cwd: str(p.cwd),
+        startedAt: str(p.timestamp) || str(obj.timestamp),
+      };
+    }
+    return empty;
+  } catch {
+    return empty;
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* FD already gone */ }
+    }
+  }
+}
+
+/**
+ * The session identifier used for conversation dedup. Standardized on the
+ * rollout FILENAME BASENAME so it matches capture.js::extractSessionId
+ * (`path.basename(transcriptPath, ".jsonl")`) — live hook capture and the
+ * migrator then create/reconnect the SAME conversation container instead of
+ * two divergent ones for the same session.
+ *
+ * @param {string} rolloutPath
+ * @returns {string}
+ */
+export function sessionUuidForRollout(rolloutPath) {
+  return path.basename(rolloutPath, ".jsonl");
+}
+
+/**
+ * @param {object} opts
+ * @param {"user"|"project"} opts.scope
+ * @param {string} [opts.projectCwd]
+ * @param {string} [opts.home]
+ * @returns {CodexSessionRef[]}
+ */
+export function listSessions(opts) {
+  const root = sessionsRoot(opts);
+  if (!fs.existsSync(root)) return [];
+
+  const wantedCwd = opts.scope === "project" ? opts.projectCwd : null;
+
+  const out = [];
+  for (const full of collectRolloutFiles(root)) {
+    const meta = peekSessionMeta(full);
+    if (!meta.cwd) continue;
+    if (wantedCwd && meta.cwd !== wantedCwd) continue;
+    let stat;
+    try {
+      stat = fs.statSync(full);
+    } catch {
+      continue;
+    }
+    out.push({
+      sessionUuid: sessionUuidForRollout(full),
+      path: full,
+      cwd: meta.cwd,
+      agentId: agentIdForCodex(meta.cwd),
+      source: "codex",
+      mtimeMs: stat.mtimeMs,
+      likelyInProgress: stat.mtimeMs > Date.now() - 60_000,
+    });
+  }
+  return out;
+}
+
+/**
+ * Parse a rollout file: pair real user prompts with the full assistant reply.
+ *
+ * @param {string} sessionPath
+ * @returns {{
+ *   sessionUuid: string,
+ *   firstUserText: string,
+ *   cwd: string|null,
+ *   startedAt: string|null,
+ *   exchanges: Array<{user_uuid: string, input: string, output: string, reasoning: string, timestamp: string}>,
+ *   partial: boolean,
+ * }}
+ */
+export function parseSession(sessionPath) {
+  const { records, realPrompts, hasUserMessageEvents } = collectRecords(sessionPath);
+
+  let cwd = null;
+  let startedAt = null;
+  let firstUserText = "";
+
+  // Turn assembly. A real user prompt opens a turn; every assistant slice and
+  // reasoning/tool record until the next real prompt (or a task_complete)
+  // belongs to it. `turnIdx` — the positional id fallback for id-less Codex
+  // user records — increments ONLY when a turn is emitted, so a turn that is
+  // held on one run gets the SAME id when it is finally emitted on a later run
+  // (all preceding emitted turns are identical), keeping seed dedup stable.
+  const exchanges = [];
+  let turnIdx = 0;
+  // current: { input, uuid, timestamp, lastTimestamp, outputs, reasoning,
+  //            hasAssistant, sawPhase, sawFinalAnswer, boundaryClosed }
+  let current = null;
+
+  // A turn is safe to emit once it has reached its completion boundary — the
+  // SAME boundary the live parser in PR #234 uses:
+  //   - a `task_complete` event closed it (boundaryClosed), OR
+  //   - an assistant slice with phase `final_answer` arrived, OR
+  //   - it is the legacy/simple shape: assistant content but no phase info at
+  //     all (older rollouts don't tag phases) — complete as soon as any
+  //     assistant message exists, like non-Codex turns.
+  // A turn still streaming commentary with no boundary, or with no assistant
+  // reply yet, is NOT complete and must be held (see the EOF flush below) so
+  // the whole turn is captured once on a later run rather than sent early and
+  // then permanently skipped by lastUuid resume when its final answer arrives.
+  const isComplete = (t) =>
+    t.boundaryClosed || t.sawFinalAnswer || (t.hasAssistant && !t.sawPhase);
+
+  // Emit `current` as an exchange. `allowIncomplete` is true only when a new
+  // real prompt supersedes it (the turn is definitively over — no more content
+  // will ever be appended to it) or a task_complete closed it; at EOF we pass
+  // false so a still-in-progress trailing turn is HELD, not emitted.
+  const flush = (allowIncomplete) => {
+    if (!current) return;
+    const t = current;
+    current = null;
+    if (!allowIncomplete && !isComplete(t)) return; // hold: do not emit or advance turnIdx
+    const output = t.outputs.join("\n\n");
+    const reasoning = t.reasoning.join("\n---\n");
+    if (t.input || output) {
+      exchanges.push({
+        user_uuid: t.uuid || `codex-${turnIdx}`,
+        input: t.input,
+        output,
+        reasoning,
+        timestamp: t.lastTimestamp || t.timestamp || "",
+      });
+      turnIdx++;
+    }
+  };
+
+  for (const rec of records) {
+    if (rec.kind === "meta") {
+      if (!cwd) cwd = rec.cwd;
+      if (!startedAt) startedAt = rec.timestamp;
+      continue;
+    }
+    if (!startedAt && rec.timestamp) startedAt = rec.timestamp;
+
+    if (rec.kind === "user") {
+      // Only real prompts open a turn. When user_message events exist they are
+      // authoritative: a role=user response_item whose text isn't among them is
+      // injected context (plugins/AGENTS.md/Meko block) and is dropped.
+      if (hasUserMessageEvents && !realPrompts.has(rec.text)) continue;
+      // A new real prompt means the previous turn is definitively over — emit
+      // it even if it never saw an explicit boundary (it won't get more).
+      flush(true);
+      if (!firstUserText && rec.text) firstUserText = rec.text.slice(0, 240);
+      current = {
+        input: rec.text,
+        uuid: rec.uuid,
+        timestamp: rec.timestamp,
+        lastTimestamp: rec.timestamp,
+        outputs: [],
+        reasoning: [],
+        hasAssistant: false,
+        sawPhase: false,
+        sawFinalAnswer: false,
+        boundaryClosed: false,
+      };
+    } else if (rec.kind === "assistant") {
+      if (!current) continue; // assistant with no preceding real prompt — skip
+      current.hasAssistant = true;
+      if (rec.phase) current.sawPhase = true;
+      if (rec.phase === "final_answer") current.sawFinalAnswer = true;
+      if (rec.text) current.outputs.push(rec.text);
+      if (rec.timestamp) current.lastTimestamp = rec.timestamp;
+    } else if (rec.kind === "reasoning" || rec.kind === "tool_call" || rec.kind === "tool_result") {
+      if (!current) continue;
+      if (rec.text) current.reasoning.push(rec.text);
+      if (rec.timestamp) current.lastTimestamp = rec.timestamp;
+    } else if (rec.kind === "task_complete") {
+      // Completion boundary: the current turn is finished — emit it.
+      if (current) {
+        current.boundaryClosed = true;
+        if (rec.timestamp) current.lastTimestamp = rec.timestamp;
+      }
+      flush(true);
+    }
+  }
+  // EOF: hold a still-incomplete trailing turn (no boundary / no assistant yet)
+  // so it is captured whole on a later run once its completion is appended.
+  flush(false);
+
+  return {
+    sessionUuid: sessionUuidForRollout(sessionPath),
+    firstUserText,
+    cwd,
+    startedAt,
+    exchanges,
+    // Codex keeps a session's rollout open across turns and writes a
+    // `task_complete` after EACH one, so there is no reliable end-of-session
+    // marker: an interactive session can sit idle for minutes (well past any
+    // mtime window) and then append another prompt. Finalizing from a quiet
+    // period or a trailing task_complete would mark the session done and make
+    // the orchestrator skip it forever, dropping every later turn. So Codex
+    // rollouts stay rescan-capable (`partial: true`) unconditionally; the
+    // orchestrator re-reads them each run, lastUuid resume skips already-sent
+    // turns, and seed dedup (<conv>:<user_uuid>) makes the re-scan a no-op when
+    // nothing new was appended. Combined with the incomplete-trailing-turn hold
+    // above, this guarantees any appended turn is eventually migrated exactly
+    // once.
+    partial: true,
+  };
+}
+
+/**
+ * Read + classify every JSONL record we care about, and collect the set of
+ * authoritative real-prompt texts from `event_msg`/`user_message`.
+ */
+function collectRecords(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8");
+  } catch {
+    return { records: [], realPrompts: new Set(), hasUserMessageEvents: false };
+  }
+  const records = [];
+  const realPrompts = new Set();
+  let hasUserMessageEvents = false;
+
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let obj;
+    try {
+      obj = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const payload = obj.payload;
+    if (!payload || typeof payload !== "object") continue;
+    const ts = obj.timestamp || null;
+
+    if (obj.type === "session_meta") {
+      records.push({
+        kind: "meta",
+        cwd: typeof payload.cwd === "string" ? payload.cwd : null,
+        timestamp: ts || (typeof payload.timestamp === "string" ? payload.timestamp : null),
+      });
+      continue;
+    }
+
+    if (obj.type === "event_msg") {
+      if (payload.type === "user_message" && typeof payload.message === "string") {
+        hasUserMessageEvents = true;
+        realPrompts.add(payload.message);
+      } else if (payload.type === "task_complete") {
+        records.push({ kind: "task_complete", timestamp: ts });
+      }
+      continue;
+    }
+
+    if (obj.type !== "response_item") continue;
+
+    if (payload.type === "message") {
+      const role = payload.role;
+      if (role === "user") {
+        records.push({
+          kind: "user", uuid: payload.id || null, timestamp: ts,
+          text: extractTextBlocks(payload.content),
+        });
+      } else if (role === "assistant") {
+        records.push({
+          kind: "assistant",
+          timestamp: ts,
+          phase: payload.phase || null,
+          text: extractTextBlocks(payload.content),
+        });
+      }
+      // developer / system messages are Codex-internal — dropped.
+      continue;
+    }
+
+    if (payload.type === "reasoning") {
+      const text = extractReasoningSummary(payload.summary);
+      if (text) records.push({ kind: "reasoning", timestamp: ts, text: `THINKING:\n${text}` });
+      continue;
+    }
+
+    if (payload.type === "custom_tool_call") {
+      const name = typeof payload.name === "string" ? payload.name : "unknown";
+      const input = typeof payload.input === "string"
+        ? payload.input.slice(0, 500)
+        : (payload.input ? JSON.stringify(payload.input).slice(0, 500) : "");
+      records.push({ kind: "tool_call", timestamp: ts, text: `TOOL CALL: ${name}(${input})` });
+      continue;
+    }
+
+    if (payload.type === "custom_tool_call_output") {
+      const output = typeof payload.output === "string"
+        ? payload.output
+        : (payload.output != null ? JSON.stringify(payload.output) : "");
+      if (output) {
+        records.push({ kind: "tool_result", timestamp: ts, text: `TOOL RESULT:\n${output.slice(0, 3000)}` });
+      }
+      continue;
+    }
+  }
+
+  return { records, realPrompts, hasUserMessageEvents };
+}
+
+/**
+ * Codex message content blocks are `{type:"input_text"|"output_text"|"text",
+ * text}`. Concatenate the text; ignore non-text blocks.
+ */
+function extractTextBlocks(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const b of content) {
+    if (!b) continue;
+    if (typeof b === "string") { parts.push(b); continue; }
+    if (
+      (b.type === "input_text" || b.type === "output_text" || b.type === "text")
+      && typeof b.text === "string"
+    ) {
+      parts.push(b.text);
+    }
+  }
+  return parts.join("\n");
+}
+
+/**
+ * Codex reasoning items carry a `summary` array of `{type:"summary_text",
+ * text}` blocks. Concatenate their text.
+ */
+function extractReasoningSummary(summary) {
+  if (typeof summary === "string") return summary;
+  if (!Array.isArray(summary)) return "";
+  const parts = [];
+  for (const b of summary) {
+    if (!b) continue;
+    if (typeof b === "string") { parts.push(b); continue; }
+    if (typeof b.text === "string") parts.push(b.text);
+  }
+  return parts.join("\n");
+}

package/lib/migrate/id.mjs

@@ -44,7 +44,7 @@ export const COMMON_BUCKET_AGENT_ID = "meko_agent";
 
 const AGENT_ID_MAX_LEN = 64;
 const KNOWN_LOOSE_CLIENTS = new Set(["claude-desktop", "claude_desktop"]);
-const KNOWN_CODING_CLIENTS = new Set(["claude_code", "cursor"]);
+const KNOWN_CODING_CLIENTS = new Set(["claude_code", "cursor", "codex", "kiro"]);
 
 /**
  * Sanitize a project segment: lowercase, collapse non-`[a-z0-9-]` to `-`,
@@ -67,13 +67,13 @@ function sanitizeProjectSegment(segment) {
  * Contract:
  *   - `envOverride` (typically `MEKO_AGENT_ID`) wins if non-empty.
  *   - Loose clients (Claude Desktop) → bare `claude_desktop`; no schema.
- *   - Coding clients (Claude Code, Cursor) → `<client>:<repo-basename>`.
+ *   - Coding clients (Claude Code, Cursor, Codex, Kiro) → `<client>:<repo-basename>`.
  *     Outside a repo (basename is empty/`.`/`/`) → bare client name to
  *     keep coding-agent traffic out of the common bucket.
  *   - Anything else → `meko_agent` (the common cross-project bucket).
  *
  * @param {object} opts
- * @param {string} [opts.client]       e.g. "claude_code", "cursor", "claude-desktop"
+ * @param {string} [opts.client]       e.g. "claude_code", "cursor", "codex", "kiro", "claude-desktop"
  * @param {string} [opts.cwd]          Absolute working directory, for coding clients
  * @param {string} [opts.envOverride]  Raw value of `MEKO_AGENT_ID`, if set
  * @returns {string}
@@ -133,6 +133,31 @@ export function agentIdForCursor(cwd) {
   });
 }
 
+/**
+ * @param {string} [cwd] Absolute project cwd of the Codex session (from the
+ *   rollout's `session_meta.payload.cwd`). Omit for user-scope writes
+ *   (returns the common bucket).
+ * @returns {string}
+ */
+export function agentIdForCodex(cwd) {
+  if (!cwd) return COMMON_BUCKET_AGENT_ID;
+  return deriveAgentId({
+    client: "codex",
+    cwd,
+    envOverride: process.env.MEKO_AGENT_ID,
+  });
+}
+
+/** Derive the project-scoped owner used by Kiro hook capture. */
+export function agentIdForKiro(cwd) {
+  if (!cwd) return COMMON_BUCKET_AGENT_ID;
+  return deriveAgentId({
+    client: "kiro",
+    cwd,
+    envOverride: process.env.MEKO_AGENT_ID,
+  });
+}
+
 /**
  * Deterministic seed for `conversation_add_message` dedup.
  * sha256(agentId + ":" + sessionUuid + ":" + messageUuid), truncated.