@yugabytedb/meko-mcp 2.1.0 → 2.3.0

package/lib/migrate/mcp-client.mjs

@@ -93,7 +93,31 @@ export class McpClient {
         lastErr = err;
         const code = err.statusCode;
         if (code === 401 || code === 403) {
-          // Auth is fatal; surface immediately.
+          // Auth errors are never worth retrying: the same credential will
+          // be rejected again. Whether they're fatal depends on the caller.
+          //
+          // A fire-and-forget call is one whose loss the run can absorb
+          // (conversation_add_message, memory_add). A token that expires
+          // partway through a multi-hour migration used to kill the whole
+          // run from inside one such call; now the call is dropped, the skip
+          // is recorded, and the run finishes with the gap visible.
+          //
+          // The initial auth probe is `connect()`, which does not come
+          // through here, so a bad key still aborts before any work starts.
+          if (opts.fireAndForget) {
+            this.log.warn?.("mcp_skipped_auth", {
+              tool: name,
+              statusCode: code,
+              error: err.message,
+            });
+            return {
+              ok: false,
+              skipped: true,
+              authSkipped: true,
+              statusCode: code,
+              error: { message: err.message },
+            };
+          }
           throw err;
         }
         if (attempt < maxRetries) {

package/lib/migrate/opencode-normalizer.mjs

@@ -0,0 +1,132 @@
+/** OpenCode session → canonical exchanges. Keep in sync with the CJS handler mirror. */
+
+const SYNTHETIC_PART_TYPES = new Set(["compaction", "subtask", "continuation"]);
+const EXCLUDED_PART_TYPES = new Set([
+  "tool", "tool-invocation", "tool-result", "tool_result", "reasoning",
+  "file", "attachment", "step", "snapshot", "patch",
+]);
+const INTERRUPTED_MARKER =
+  "[Meko capture: assistant response was interrupted before completion.]";
+export function normalizeOpenCodeSession(exportShape, opts = {}) {
+  const root = exportShape && typeof exportShape === "object" ? exportShape : {};
+  const info = root.info && typeof root.info === "object" ? root.info : {};
+  const rawMessages = Array.isArray(root.messages) ? root.messages : [];
+  const sessionId = firstString(info.id, info.sessionID, info.sessionId, root.sessionId) || "unknown";
+  const cwd = firstString(info.cwd, info.directory, info.projectPath, root.cwd) || "";
+  const parentSessionId = firstString(info.parentID, info.parentId, info.parentSessionId) || null;
+  const title = firstString(info.title, info.name) || sessionId;
+  const startedAt = firstTimestamp(info.time?.created, info.created, info.startedAt, info.time);
+  const visibleMessages = rawMessages.map(normalizeMessage).filter(Boolean).sort(compareMessageOrder);
+  const exchanges = [];
+  let pendingUser = null;
+  let firstUserText = "";
+  for (const msg of visibleMessages) {
+    if (msg.role === "user") {
+      if (pendingUser) exchanges.push(makeExchange(pendingUser, null, { forceInterrupted: true }));
+      pendingUser = msg;
+      if (!firstUserText && msg.text) firstUserText = msg.text.slice(0, 240);
+    } else if (msg.role === "assistant" && pendingUser) {
+      exchanges.push(makeExchange(pendingUser, msg, {}));
+      pendingUser = null;
+    }
+  }
+  let partial = Boolean(pendingUser);
+  if (pendingUser && (opts.terminalError || opts.interrupted)) {
+    exchanges.push(makeExchange(pendingUser, null, { ...opts, interrupted: true }));
+    pendingUser = null;
+    partial = false;
+  } else if (!pendingUser && (opts.terminalError || opts.interrupted) && exchanges.length) {
+    markInterrupted(exchanges[exchanges.length - 1]);
+  }
+  return {
+    sessionId, cwd, parentSessionId, title,
+    startedAt: startedAt || visibleMessages[0]?.timestamp || null,
+    firstUserText,
+    exchanges: exchanges.filter((ex) => ex.input || ex.output),
+    partial,
+  };
+}
+function normalizeMessage(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const info = raw.info && typeof raw.info === "object" ? raw.info : raw;
+  const role = firstString(info.role, raw.role)?.toLowerCase();
+  if (role !== "user" && role !== "assistant") return null;
+  const synthetic = Boolean(
+    info.synthetic || info.compaction || info.subtask || info.continuation ||
+    SYNTHETIC_PART_TYPES.has(String(info.type || "").toLowerCase()),
+  );
+  if (synthetic) return null;
+  const parts = Array.isArray(raw.parts) ? raw.parts : [];
+  const text = joinVisibleText(parts);
+  if (!text && role === "assistant") return null;
+  return {
+    role,
+    id: firstString(info.id, raw.id, raw.uuid) || "",
+    timestamp: firstTimestamp(info.time?.created, info.createdAt, info.timestamp, raw.timestamp) || "",
+    text,
+    order: Number.isFinite(Number(info.order)) ? Number(info.order) : null,
+  };
+}
+function joinVisibleText(parts) {
+  const chunks = [];
+  for (const part of parts) {
+    if (!part || typeof part !== "object") continue;
+    if (part.synthetic || part.ignored) continue;
+    const type = String(part.type || "text").toLowerCase();
+    if (EXCLUDED_PART_TYPES.has(type) || SYNTHETIC_PART_TYPES.has(type)) continue;
+    if (type !== "text") continue;
+    const text = typeof part.text === "string" ? part.text : "";
+    if (!text.trim()) continue;
+    chunks.push(text);
+  }
+  return chunks.join("\n");
+}
+function compareMessageOrder(a, b) {
+  const ao = a.order; const bo = b.order;
+  if (ao != null && bo != null && ao !== bo) return ao - bo;
+  if (a.timestamp && b.timestamp && a.timestamp !== b.timestamp) {
+    return a.timestamp < b.timestamp ? -1 : 1;
+  }
+  return String(a.id).localeCompare(String(b.id));
+}
+function makeExchange(userMsg, assistantMsg, opts) {
+  const interrupted = Boolean(opts.interrupted || (!assistantMsg && opts.forceInterrupted));
+  return {
+    userId: userMsg.id || `opencode-user-${hashish(userMsg.text)}`,
+    assistantId: assistantMsg?.id || null,
+    input: userMsg.text,
+    output: interrupted ? INTERRUPTED_MARKER : (assistantMsg?.text || ""),
+    timestamp: assistantMsg?.timestamp || userMsg.timestamp || "",
+    interrupted,
+  };
+}
+function markInterrupted(exchange) {
+  exchange.interrupted = true;
+  exchange.output = exchange.output
+    ? `${exchange.output}\n\n${INTERRUPTED_MARKER}`
+    : INTERRUPTED_MARKER;
+}
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function firstTimestamp(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) return value.trim();
+    if (typeof value === "number" && Number.isFinite(value)) {
+      const date = new Date(value);
+      if (!Number.isNaN(date.getTime())) return date.toISOString();
+    }
+    if (value instanceof Date && !Number.isNaN(value.getTime())) return value.toISOString();
+  }
+  return "";
+}
+function hashish(text) {
+  let h = 0;
+  const s = String(text || "");
+  for (let i = 0; i < s.length; i++) h = ((h << 5) - h + s.charCodeAt(i)) | 0;
+  return Math.abs(h).toString(36);
+}
+export { INTERRUPTED_MARKER };

package/lib/migrate/orchestrator.mjs

@@ -15,9 +15,55 @@ import { McpClient } from "./mcp-client.mjs";
 import { createLogger, nullLogger } from "./logger.mjs";
 import { seedFor } from "./id.mjs";
 import { resolveDestinationDatapack } from "./datapack.mjs";
-import * as claudeCodeAdapter from "./adapters/claude-code.mjs";
-import * as cursorAdapter from "./adapters/cursor.mjs";
 import * as memoryMdAdapter from "./adapters/memory-md.mjs";
+import {
+  enumerateSessionRefs,
+  parseTaggedSession,
+  sessionsByAdapter,
+} from "./registry.mjs";
+
+/**
+ * Preserve the owner used by a previous migrator run. Conversation ownership
+ * is immutable server-side, and resume state is keyed by agent_id, so moving
+ * an existing session to its newly derived repo-root id would both miss the
+ * done/partial record and retry against the wrong owner.
+ */
+function compatibleSessionAgentId(st, ref) {
+  if (state.getSession(st, ref.agentId, ref.sessionUuid)) return ref.agentId;
+  if (
+    ref.legacyAgentId
+    && ref.legacyAgentId !== ref.agentId
+    && state.getSession(st, ref.legacyAgentId, ref.sessionUuid)
+  ) {
+    return ref.legacyAgentId;
+  }
+  return ref.agentId;
+}
+
+/**
+ * Keep project memories with an existing pre-MEKO-590 bucket when prior
+ * migration state proves that bucket is already in use. New migrations use
+ * the repo-root id.
+ */
+function compatibleMemoryAgentId(st, persistedAgentIds, item) {
+  const current = st.agents?.[item.agentId];
+  if (current?.memories?.[item.hash] || current?.memoryConversationId) {
+    return item.agentId;
+  }
+  if (!item.legacyAgentId || item.legacyAgentId === item.agentId) {
+    return item.agentId;
+  }
+  const legacy = st.agents?.[item.legacyAgentId];
+  if (legacy?.memories?.[item.hash] || legacy?.memoryConversationId) {
+    return item.legacyAgentId;
+  }
+  // Base the bucket choice on state that existed before this run. Sessions
+  // created earlier in this run must not make project memories abandon the
+  // legacy bucket that proves prior ownership.
+  if (persistedAgentIds.has(item.agentId)) return item.agentId;
+  if (persistedAgentIds.has(item.legacyAgentId)) return item.legacyAgentId;
+  return item.agentId;
+}
 
 /**
  * @param {object} opts
@@ -43,10 +89,13 @@ import * as memoryMdAdapter from "./adapters/memory-md.mjs";
  *                                            destination is explicit on the
  *                                            wire rather than relying on the
  *                                            server's tenant-context fallback.
+ * @param {Array<object>} [opts.sessionAdapters] Test-only adapter override.
  * @returns {Promise<{ok: boolean, summary: object, counts: object}>}
  */
 export async function runMigration(opts) {
-  fs.mkdirSync(opts.runDir, { recursive: true });
+  // A planning pass is intentionally read-only. In particular, don't create
+  // a run directory that `--migrate-status` can mistake for an active run.
+  if (!opts.dryRun) fs.mkdirSync(opts.runDir, { recursive: true });
 
   const log = opts.dryRun
     ? nullLogger()
@@ -55,10 +104,33 @@ export async function runMigration(opts) {
   const prog = progress.initial(opts.runId, opts.scope);
   const progressPath = path.join(opts.runDir, "progress.json");
   const writeProgress = () => {
+    if (opts.dryRun) return;
     try { progress.write(progressPath, prog); } catch { /* best effort */ }
   };
 
+  /**
+   * Move the run into a terminal state: stop the heartbeat, stamp
+   * `finishedAt`, clear the `current*` fields, and mirror the transition
+   * into the event log so `log.ndjson` carries the same story as
+   * `progress.json`.
+   *
+   * @param {"succeeded"|"failed"} status
+   * @param {string|null} [error]
+   */
+  const finish = (status, error = null) => {
+    progress.stopHeartbeat();
+    prog.status = status;
+    prog.error = error;
+    prog.finishedAt = new Date().toISOString();
+    prog.currentAgent = null;
+    prog.currentSession = null;
+    prog.currentMessage = null;
+    writeProgress();
+    log.info("status", { status, error, runId: opts.runId });
+  };
+
   let st = state.load(opts.statePath);
+  const persistedAgentIds = new Set(Object.keys(st.agents || {}));
   let opsSinceFlush = 0;
   const FLUSH_EVERY = 25;
   const flushState = () => {
@@ -80,49 +152,91 @@ export async function runMigration(opts) {
     lockAcquiredHere = true;
   }
 
+  // A silently killed daemon (kill -9, OOM, laptop sleep) runs none of the
+  // handlers below, so the reader needs an independent liveness signal.
+  // Ordinary progress writes refresh `heartbeatAt` too; this timer only
+  // covers the long gaps between them (a slow `memory_add` extraction).
+  // It starts after the lock, so the `lock_busy` return above leaves no
+  // `running` record and no timer behind.
+  if (!opts.dryRun) {
+    writeProgress();
+    progress.startHeartbeat(progressPath, prog);
+  }
+
   // Plan the work.
-  const claudeSessions = await claudeCodeAdapter.listSessions({
-    scope: opts.scope,
-    projectCwd: opts.projectCwd,
-    home: opts.home,
-  });
-  const cursorSessions = cursorAdapter.listSessions({
-    scope: opts.scope,
-    projectCwd: opts.projectCwd,
-    home: opts.home,
-  });
-  const memoryItems = await memoryMdAdapter.enumerateMemoryItems({
+  const sourceErrors = [];
+  const listOpts = {
     scope: opts.scope,
     projectCwd: opts.projectCwd,
     home: opts.home,
-  });
+    sessionAdapters: opts.sessionAdapters,
+    opencodeBin: opts.opencodeBin,
+    runExport: opts.runExport,
+    onSourceError({ source, displayName, error }) {
+      const detail = error?.message || String(error);
+      sourceErrors.push({ source, error: detail });
+      prog.counts.warnings++;
+      log.warn("source_enumeration_failed", { source, displayName, error: detail });
+    },
+  };
+  let taggedSessions;
+  try {
+    taggedSessions = await enumerateSessionRefs(listOpts);
+  } catch (err) {
+    log.error("source_enumeration_failed", { error: err.message });
+    prog.status = "failed";
+    prog.finishedAt = new Date().toISOString();
+    writeProgress();
+    log.close();
+    releaseLock();
+    return {
+      ok: false,
+      summary: { error: "source_enumeration_failed", detail: err.message },
+      counts: prog.counts,
+    };
+  }
+  const byAdapter = sessionsByAdapter(taggedSessions);
+  const memoryItems = await memoryMdAdapter.enumerateMemoryItems(listOpts);
 
-  prog.counts.sessionsPlanned = claudeSessions.length + cursorSessions.length;
+  prog.counts.sessionsPlanned = taggedSessions.length;
   writeProgress();
 
   log.info("plan", {
     scope: opts.scope,
-    claudeSessions: claudeSessions.length,
-    cursorSessions: cursorSessions.length,
+    claudeSessions: byAdapter["claude-code"] || 0,
+    cursorSessions: byAdapter.cursor || 0,
+    codexSessions: byAdapter.codex || 0,
+    openCodeSessions: byAdapter.opencode || 0,
+    sessionsByAdapter: byAdapter,
     memoryItems: memoryItems.length,
     dryRun: !!opts.dryRun,
     noExtract: !!opts.noExtract,
   });
 
   if (opts.dryRun) {
-    // Peek-parse every session so we can report planned turn counts and
-    // the total expected MCP call volume — helps users estimate
-    // LLM-extraction cost before firing a real run.
     let pairedTurns = 0;
-    for (const ref of claudeSessions) {
-      const parsed = await claudeCodeAdapter.parseSession(ref.path);
-      pairedTurns += parsed.exchanges.length;
-    }
-    for (const ref of cursorSessions) {
-      const parsed = cursorAdapter.parseSession(ref.path);
+    let parsedSessions = 0;
+    const sessionErrors = [];
+    /** @type {Record<string, number>} */
+    const turnsByAdapter = {};
+    for (const tagged of taggedSessions) {
+      let parsed;
+      try {
+        parsed = await Promise.resolve(parseTaggedSession(tagged, listOpts));
+      } catch (err) {
+        sessionErrors.push({
+          source: tagged.source,
+          sessionUuid: tagged.ref.sessionUuid,
+          error: err.message,
+        });
+        continue;
+      }
+      parsedSessions++;
       pairedTurns += parsed.exchanges.length;
+      turnsByAdapter[tagged.source] = (turnsByAdapter[tagged.source] || 0) + parsed.exchanges.length;
     }
-    const plannedConversationCreates = claudeSessions.length + cursorSessions.length
+    const plannedConversationCreates =
+      parsedSessions
       + (memoryItems.length > 0 ? countDistinctMemoryAgents(memoryItems) : 0);
     const plannedConversationAddMessage = pairedTurns;
     const plannedMemoryAddExtract = opts.noExtract ? 0 : pairedTurns;
@@ -130,10 +244,16 @@ export async function runMigration(opts) {
 
     const summary = {
       scope: opts.scope,
-      claudeSessions: claudeSessions.length,
-      cursorSessions: cursorSessions.length,
+      claudeSessions: byAdapter["claude-code"] || 0,
+      cursorSessions: byAdapter.cursor || 0,
+      codexSessions: byAdapter.codex || 0,
+      openCodeSessions: byAdapter.opencode || 0,
+      sessionsByAdapter: byAdapter,
+      turnsByAdapter,
       memoryItems: memoryItems.length,
       pairedTurns,
+      sourceErrors,
+      sessionErrors,
       plannedCalls: {
         conversation_create: plannedConversationCreates,
         conversation_add_message: plannedConversationAddMessage,
@@ -163,9 +283,7 @@ export async function runMigration(opts) {
   } catch (err) {
     log.error("mcp_connect_failed", { error: err.message, code: err.statusCode });
     releaseLock();
-    prog.status = "failed";
-    prog.finishedAt = new Date().toISOString();
-    writeProgress();
+    finish("failed", `mcp_connect_failed: ${err.message}`);
     return { ok: false, summary: { error: "mcp_connect_failed", detail: err.message }, counts: prog.counts };
   }
 
@@ -182,9 +300,7 @@ export async function runMigration(opts) {
     if (!resolved.ok) {
       log.error("resolve_datapack_failed", { message: resolved.message });
       releaseLock();
-      prog.status = "failed";
-      prog.finishedAt = new Date().toISOString();
-      writeProgress();
+      finish("failed", `resolve_datapack_failed: ${resolved.message}`);
       return {
         ok: false,
         summary: { error: "resolve_datapack_failed", detail: resolved.message },
@@ -201,9 +317,7 @@ export async function runMigration(opts) {
   } catch (err) {
     log.error("resolve_datapack_threw", { error: err.message });
     releaseLock();
-    prog.status = "failed";
-    prog.finishedAt = new Date().toISOString();
-    writeProgress();
+    finish("failed", `resolve_datapack_threw: ${err.message}`);
     return {
       ok: false,
       summary: { error: "resolve_datapack_threw", detail: err.message },
@@ -218,7 +332,19 @@ export async function runMigration(opts) {
   const withDp = (args) => (datapackId ? { ...args, datapack_id: datapackId } : args);
 
   // -- Conversations --
-  for (const ref of [...claudeSessions, ...cursorSessions]) {
+  for (const tagged of taggedSessions) {
+    const { ref: discoveredRef, source } = tagged;
+    const compatibleAgentId = compatibleSessionAgentId(st, discoveredRef);
+    const ref = compatibleAgentId === discoveredRef.agentId
+      ? discoveredRef
+      : { ...discoveredRef, agentId: compatibleAgentId };
+    if (ref.agentId !== discoveredRef.agentId) {
+      log.info("session_legacy_agent_id", {
+        agentId: ref.agentId,
+        derivedAgentId: discoveredRef.agentId,
+        sessionUuid: ref.sessionUuid,
+      });
+    }
     let existing = state.getSession(st, ref.agentId, ref.sessionUuid);
     if (existing?.status === "done" && !opts.force) {
       log.info("session_skip_done", { agentId: ref.agentId, sessionUuid: ref.sessionUuid });
@@ -241,11 +367,28 @@ export async function runMigration(opts) {
 
     prog.currentAgent = ref.agentId;
     prog.currentSession = ref.sessionUuid;
+    prog.currentMessage = null;
     writeProgress();
 
-    const parsed = (ref.path && ref.path.endsWith(".jsonl"))
-      ? await claudeCodeAdapter.parseSession(ref.path)
-      : cursorAdapter.parseSession(ref.path);
+    let parsed;
+    try {
+      parsed = await Promise.resolve(parseTaggedSession(tagged, listOpts));
+    } catch (err) {
+      log.error("session_parse_failed", {
+        source,
+        agentId: ref.agentId,
+        sessionUuid: ref.sessionUuid,
+        error: err.message,
+      });
+      state.markSession(st, ref.agentId, ref.sessionUuid, {
+        status: "failed",
+        lastError: err.message,
+      });
+      prog.counts.warnings++;
+      if (++opsSinceFlush >= FLUSH_EVERY) flushState();
+      writeProgress();
+      continue;
+    }
 
     if (parsed.partial) {
       log.warn("session_partial", { path: ref.path });
@@ -260,8 +403,9 @@ export async function runMigration(opts) {
         session_id: ref.sessionUuid,
         title: (parsed.firstUserText || ref.sessionUuid).slice(0, 120),
         metadata: JSON.stringify({
-          source: ref.path.endsWith(".jsonl") ? "claude-code" : "cursor",
-          cwd: ref.cwd || null,
+          source,
+          cwd: ref.cwd || parsed.cwd || null,
+          parentSessionId: parsed.parentSessionId || ref.parentSessionId || null,
           gitBranch: ref.slug ? (parsed.gitBranch || null) : null,
           startedAt: parsed.startedAt || null,
         }),
@@ -279,6 +423,26 @@ export async function runMigration(opts) {
         continue;
       }
 
+      // MEKO-592: mcp-client sets ok:true whenever the HTTP call itself
+      // succeeded, so a tool body of `{"error":"datapack_id_required"}` still
+      // arrives as ok. Without this guard the extractId below returns "" and
+      // every subsequent add_message fires against an empty conversation_id,
+      // the session is marked done, and a rerun skips it - exactly the
+      // silent-drop shape this PR exists to close. Mirror the isErrorText
+      // check applied to memory_add below.
+      if (isErrorText(createRes.text)) {
+        const detail = errorDetail(createRes) || "conversation_create returned error";
+        log.error("conversation_create_error_body", { agentId: ref.agentId, sessionUuid: ref.sessionUuid, detail });
+        state.markSession(st, ref.agentId, ref.sessionUuid, {
+          status: "failed",
+          lastError: detail,
+        });
+        prog.counts.warnings++;
+        if (++opsSinceFlush >= FLUSH_EVERY) flushState();
+        writeProgress();
+        continue;
+      }
+
       conversationId = extractId(createRes.text) || "";
       state.markSession(st, ref.agentId, ref.sessionUuid, {
         conversationId,
@@ -292,14 +456,24 @@ export async function runMigration(opts) {
     let memoryPairsSent = existing?.memoryPairsSent ?? 0;
     let lastUuid = existing?.lastUuid ?? null;
 
-    // Resume from lastUuid if present.
+    // Set when a turn loses a call to a mid-run 401/403. See below.
+    let authFailure = null;
+
+    // Resume from lastUuid if present. A cursor saved by an older parser
+    // can name an entry that is now folded into a turn (MEKO-710); resume
+    // after that turn instead of skipping the rest of the session.
     let skipping = !!lastUuid;
     for (const ex of parsed.exchanges) {
       if (skipping) {
-        if (ex.user_uuid === lastUuid) skipping = false;
+        if (ex.user_uuid === lastUuid || ex.folded_uuids?.includes(lastUuid)) {
+          skipping = false;
+        }
         continue;
       }
       const seed = seedFor(ref.agentId, ref.sessionUuid, ex.user_uuid);
+      // `--migrate-status` reports this as the message id, so it has to be
+      // set before the calls that could hang, not after they return.
+      prog.currentMessage = ex.user_uuid;
 
       // (a) conversation_add_message — fire-and-forget; server batches.
       const addMsgPromise = client.callTool("conversation_add_message", withDp({
@@ -338,7 +512,33 @@ export async function runMigration(opts) {
         }), { fireAndForget: true });
       }
 
-      const [, memRes] = await Promise.all([addMsgPromise, memPromise]);
+      const [addMsgRes, memRes] = await Promise.all([addMsgPromise, memPromise]);
+
+      // A mid-run 401/403 on a fire-and-forget call is dropped rather than
+      // fatal (see mcp-client). Record each dropped call, then stop this
+      // session without checkpointing the turn: `lastUuid` stays on the last
+      // fully delivered turn, so a plain re-run resumes here instead of
+      // skipping the session as done. A resent conversation_add_message
+      // carries the same seed, so it resolves to the same message id.
+      const authSkips = [];
+      if (addMsgRes?.authSkipped) authSkips.push(["conversation_add_message", addMsgRes]);
+      if (!opts.noExtract && memRes?.authSkipped) authSkips.push(["memory_add", memRes]);
+      if (authSkips.length > 0) {
+        for (const [tool, res] of authSkips) {
+          prog.counts.authSkipped++;
+          log.warn("message_skipped_auth", {
+            agentId: ref.agentId,
+            sessionUuid: ref.sessionUuid,
+            userUuid: ex.user_uuid,
+            tool,
+            statusCode: res.statusCode,
+          });
+        }
+        const [tool, res] = authSkips[0];
+        authFailure = `auth rejected (HTTP ${res.statusCode}) on ${tool}`;
+        break;
+      }
+
       messagesSent++;
       if (!opts.noExtract) {
         if (memRes && memRes.ok && !isErrorText(memRes.text)) {
@@ -368,6 +568,30 @@ export async function runMigration(opts) {
       writeProgress();
     }
 
+    if (authFailure) {
+      // Not `done`: the resume check only skips `done` sessions, so the next
+      // run picks this one up from `lastUuid`.
+      state.markSession(st, ref.agentId, ref.sessionUuid, {
+        conversationId,
+        status: "failed",
+        messagesSent,
+        memoryPairsSent,
+        lastUuid,
+        lastError: authFailure,
+      });
+      flushState();
+      prog.currentMessage = null;
+      writeProgress();
+      log.warn("session_auth_failed", {
+        agentId: ref.agentId,
+        sessionUuid: ref.sessionUuid,
+        messagesSent,
+        lastUuid,
+        error: authFailure,
+      });
+      continue;
+    }
+
     state.markSession(st, ref.agentId, ref.sessionUuid, {
       conversationId,
       status: parsed.partial ? "partial" : "done",
@@ -391,7 +615,15 @@ export async function runMigration(opts) {
 
   // -- Memory MD files --
   const umbrellaPerAgent = new Map();
-  for (const item of memoryItems) {
+  for (const discoveredItem of memoryItems) {
+    const compatibleAgentId = compatibleMemoryAgentId(
+      st,
+      persistedAgentIds,
+      discoveredItem,
+    );
+    const item = compatibleAgentId === discoveredItem.agentId
+      ? discoveredItem
+      : { ...discoveredItem, agentId: compatibleAgentId };
     if (state.isMemoryDone(st, item.agentId, item.hash) && !opts.force) continue;
 
     let convId = umbrellaPerAgent.get(item.agentId);
@@ -411,6 +643,13 @@ export async function runMigration(opts) {
           prog.counts.warnings++;
           continue;
         }
+        // MEKO-592: guard against a structured error body (e.g.
+        // datapack_id_required) that the transport reports as ok:true.
+        if (isErrorText(res.text)) {
+          log.error("memory_umbrella_error_body", { agentId: item.agentId, detail: errorDetail(res) });
+          prog.counts.warnings++;
+          continue;
+        }
         convId = extractId(res.text) || "";
         state.ensureAgent(st, item.agentId).memoryConversationId = convId;
       }
@@ -425,7 +664,15 @@ export async function runMigration(opts) {
       metadata: JSON.stringify(item.metadata),
     }), { fireAndForget: true });
 
-    if (res.ok && !isErrorText(res.text)) {
+    if (res?.authSkipped) {
+      prog.counts.authSkipped++;
+      log.warn("message_skipped_auth", {
+        agentId: item.agentId,
+        name: item.name,
+        tool: "memory_add",
+        statusCode: res.statusCode,
+      });
+    } else if (res.ok && !isErrorText(res.text)) {
       state.markMemory(st, item.agentId, item.hash, {
         memoryId: extractId(res.text) || "",
         name: item.name,
@@ -446,18 +693,14 @@ export async function runMigration(opts) {
   }
 
   flushState();
-  prog.status = "done";
-  prog.finishedAt = new Date().toISOString();
-  prog.currentAgent = null;
-  prog.currentSession = null;
-  writeProgress();
+  finish("succeeded");
 
   st.runs.push({
     runId: opts.runId,
     startedAt: prog.startedAt,
     finishedAt: prog.finishedAt,
     scope: opts.scope,
-    status: "done",
+    status: "succeeded",
     counts: prog.counts,
   });
   flushState();