@yugabytedb/meko-mcp 2.2.0 → 2.5.0

package/assets/skills/meko-select-datapack-desktop/references/cookbook.md

@@ -1,6 +1,6 @@
 # Cookbook — meko-select-datapack-desktop
 
-Concrete transcripts of the four flows the skill supports on Claude Desktop.
+Concrete transcripts of the flows the skill supports on Claude Desktop.
 
 ## Flow 1 — First pin (no existing pin memory)
 
@@ -8,11 +8,11 @@ Concrete transcripts of the four flows the skill supports on Claude Desktop.
 
 **Skill:**
 ```
-> memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
+> memory_search(query="meko_active_datapack", agent_id="claude_desktop", conversation_id="<conv-id>", limit=1)
 [empty]
 
-> datapack_list(conversation_id="<conv-id>")
-[14 entries returned, filtering by "prod-research"]
+> datapack_search(conversation_id="<conv-id>", query="prod-research", limit=10, include_total=true)
+[1 row, has_more=false, next_cursor="", total=1]
 
 One match: `prod-research`. Pinning.
 
@@ -23,7 +23,7 @@ One match: `prod-research`. Pinning.
              metadata='{"type":"active-datapack-pin"}')
 [returns id=mem_abc123]
 
-> memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
+> memory_search(query="meko_active_datapack", agent_id="claude_desktop", conversation_id="<conv-id>", limit=1)
 [verifies the row exists]
 
 Pinned datapack `prod-research` (`8b1c…f4a2`) for Claude Desktop.
@@ -41,11 +41,11 @@ datapack_id flows through automatically.
 
 **Skill:**
 ```
-> memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
+> memory_search(query="meko_active_datapack", agent_id="claude_desktop", conversation_id="<conv-id>", limit=1)
 [returns id=mem_abc123, text="meko_active_datapack=8b1c…f4a2 name=prod-research …"]
 
-> datapack_list(conversation_id="<conv-id>")
-[14 entries returned, filtering by "q2-roadmap-deck"]
+> datapack_search(conversation_id="<conv-id>", query="q2-roadmap-deck", limit=10, include_total=true)
+[1 row, has_more=false, next_cursor="", total=1]
 
 One match: `q2-roadmap-deck`. Switching pin.
 
@@ -66,11 +66,11 @@ The `memory_update` is critical here — using `memory_add` again would create a
 
 **Skill:**
 ```
-> memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
+> memory_search(query="meko_active_datapack", agent_id="claude_desktop", conversation_id="<conv-id>", limit=1)
 [empty]
 
-> datapack_list(conversation_id="<conv-id>")
-[1 entry returned]
+> datapack_search(conversation_id="<conv-id>", limit=10, include_total=true)
+[1 row, has_more=false, next_cursor="", total=1]
 
 Only one datapack: `meko-local-setup`. Auto-selecting.
 
@@ -90,7 +90,7 @@ Pinned datapack `meko-local-setup` (`a17d…cc91`). Run this skill again with
 
 **Skill:**
 ```
-> memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
+> memory_search(query="meko_active_datapack", agent_id="claude_desktop", conversation_id="<conv-id>", limit=1)
 [returns id=mem_abc123]
 
 > memory_delete_by_id(
@@ -119,3 +119,35 @@ This isn't a user-triggered flow — it's the per-turn lookup the skill teaches
 ```
 
 Cache the UUID for the rest of the turn — don't call `memory_search` once per Meko tool call.
+
+## Flow 6: Browse and page
+
+**User:** `list my datapacks`
+
+**Skill:**
+```
+> datapack_search(conversation_id="<conv-id>", limit=10, include_total=true)
+[10 rows, has_more=true, next_cursor="eyJ2Ijox…", total=14]
+
+Your datapacks (showing 1-10 of 14):
+…
+```
+
+**User:** `next`
+
+```
+> datapack_search(conversation_id="<conv-id>", limit=10, cursor="eyJ2Ijox…")
+[4 rows, has_more=false, next_cursor=""]
+
+Your datapacks (showing 11-14 of 14):
+…
+
+Reply with: a number (11-14) to pin · a substring to search · `prev` to page
+            · `clear` to unset · `cancel` to leave the current pin alone
+```
+
+The skill remembers each cursor it used. On `prev` it drops the last one and repeats the call for page 1, which had no cursor. The total (14) is reused from page 1. A substring reply calls `datapack_search(query="<text>", limit=10, include_total=true)` and starts a new listing.
+
+## Flow 7: Older server without `datapack_search`
+
+The tool list has `datapack_list` but no `datapack_search`. The skill calls `datapack_list(conversation_id="<conv-id>")` once, then sorts, pages and filters that array in the conversation. The table and replies look the same.

package/assets/skills/meko-select-datapack-desktop/references/role-display-future.md

@@ -2,7 +2,7 @@
 
 ## Today: render `grant` verbatim
 
-The deployed Meko `GET /datapacks` response includes a `grant` field on every datapack. Possible values (per maintainer guidance, 2026-05-26):
+The deployed Meko `GET /datapacks` response includes a `grant` field on every datapack, and so does every row that `datapack_search` and `datapack_list` return. Possible values (per maintainer guidance, 2026-05-26):
 
 - `"owner"` — datapacks the caller created.
 - `"maintainer"` — write access to a shared datapack including memories AND collective learnings/knowledge.
@@ -20,21 +20,25 @@ Use the field directly in the **Role** column:
 
 Do not invent values, do not normalize the casing, do not display `"Owner"` if the field says `"owner"`. The deployed schema is the source of truth.
 
-Note that the upstream Go source (the `Datapack` struct in `api_server/internal/models/models.go` of the `meko` API-server repo) does NOT declare `grant` — the deployed server enriches the response beyond what the public Go code lists. Don't rely on the public struct for the wire schema; trust the actual response.
+Note that the server's `Datapack` model doesn't declare `grant`: the deployed server enriches the response beyond what the public Go code lists. Don't rely on the public struct for the wire schema; trust the actual response.
 
-## Other fields the live response includes
+## Counts are not on the list response
 
-Beyond the columns the skill renders by default, `datapack_list` returns counts that may be useful in some flows:
+Neither `datapack_search` nor `datapack_list` computes counts; their rows carry no count fields. If the user asks for counts, call `datapack_describe(datapack_id=<id>, conversation_id="<conversation id>")` and read them from that response:
 
-- `memory_count` — total memories the caller has under this datapack (per `(user_id, agent_id)` scoping).
-- `knowledge_count` — knowledge-base entries on the datapack.
-- `learnings_count` — promoted-to-shared memories on the datapack.
+- `memory_count`: all memories stored in the datapack.
+- `collective_memory_count`: memories promoted to shared knowledge.
+- `learnings_count`: memories awaiting a promotion decision.
+- `knowledge_base_file_count`: uploaded KB documents (`null` if the status endpoint is unreachable).
+- `knowledge_chunk_count`: KB chunks across all documents. `knowledge_count` is a deprecated alias.
 
-These aren't in the spec column set. Don't add them silently. If the user asks for counts, render them on request — and read the numbers from the live response, never invent them.
+Don't add counts to the table silently, and never invent the numbers.
 
-## Sharing UI vs API state
+## Sharing a datapack
 
-The Cloud console "Share <datapack>" page (`meko_ui/src/features/datapacks/pages/DatapackSharePage.tsx`) shows interactive controls with "Coming Soon" overlays on a few specific actions (e.g. invite-by-email link sharing, transfer-ownership). Those overlays mean *those specific UI affordances* aren't shipped — NOT that the underlying `grant`/sharing model is absent. Contributor/maintainer/viewer grants are functional in the data layer today; only the user-facing self-serve invite flow is gated.
+An owner or maintainer shares a datapack from the Cloud console's **Share** page. Each datapack has one share link. The owner or maintainer can turn it on or off, reset it, and choose whether people who open it join as viewer or contributor. Anyone signed in who opens an active link joins straight away. There are no MCP tools to manage sharing.
+
+A viewer is read-only, and the server enforces it: over MCP, conversation and memory writes return `read_only_access`. If the user picks a datapack where they're a viewer, tell them that Meko won't record conversations or save memories there.
 
 ## Why the skill ships without Mine / Shared / All filter tabs
 

package/assets/skills/meko-select-datapack-desktop/references/troubleshooting.md

@@ -18,12 +18,12 @@ You (or an earlier run) created duplicates by using `memory_add` instead of `mem
 
 The cookbook's Flow 2 demonstrates the correct switch path.
 
-## Symptom: A pinned datapack returns "not found" when used
+## Symptom: A pinned datapack returns `datapack_access_denied` when used
 
-The pin became stale — the datapack was deleted in another client. Tell the user:
+The pin became stale: the datapack was deleted, or its share to you was revoked, in another client. The server checks ownership and shares on every call that passes a `datapack_id`, so the call fails with `datapack_access_denied` (older servers returned a not-found error). The check also fails closed on a transient server database error, so retry the call once before treating the pin as stale. Tell the user:
 
 ```
-The pinned datapack `<name>` (`<id>`) no longer exists on the server.
+The pinned datapack `<name>` (`<id>`) no longer exists or is no longer shared with you.
 Run `meko-select-datapack-desktop` to pick a fresh one, or `clear` to unpin.
 ```
 
@@ -33,20 +33,32 @@ Then either re-run the skill or delete the pin memory. Do not silently fall back
 
 Never auto-pick when there's ambiguity. Re-render just the matching rows numbered from 1, and ask the user to pick a number from the filtered subset. Same as the Claude Code variant.
 
-## Symptom: `datapack_list` returns an empty array
+## Symptom: The account has no datapacks (`total` is 0, or `datapack_list` returns an empty array)
 
 The user has zero datapacks. Print:
 
 ```
 You don't have any datapacks yet. Create one with:
 
-  datapack_create(name="<your-datapack-name>")
+  datapack_create(name="<your-datapack-name>", conversation_id="<conversation id>")
 
 Or visit the Meko Cloud console (Datapacks → New datapack).
 ```
 
 Stop. Don't `memory_add` an empty pin.
 
+## Symptom: `next` or `prev` returns an error about the cursor
+
+The cursor is tied to the search it came from. It stops working if you change `query`, `sort` or `grant` while paging, or if you edit it. Always send the cursor back unchanged, with the same filters as the call that returned it. Tell the user the page could not be loaded and start again from page 1 of the same search (no cursor).
+
+## Symptom: `datapack_list` returns `too_many_datapacks`
+
+The account can see more datapacks than `datapack_list` returns in one array (1000 by default). The server that sends this error also has `datapack_search`. Use the main flow with `datapack_search`; if it is missing from your tool list, the list is stale, so reload the Meko tools.
+
+## Symptom: The tool list has no `datapack_search`
+
+The Meko server is older than that tool. Use the skill's fallback flow with `datapack_list`: one call, then sort, page and filter the array in the conversation. On an older server, this call can fail for an account with a very large number of datapacks; that account needs a server that has `datapack_search`.
+
 ## Symptom: User typed `cancel` after the table rendered
 
 Leave the existing pin memory alone. Print:

package/bin/create-meko-setup.mjs

@@ -7,7 +7,8 @@ import { dirname, join } from 'node:path';
 
 import { install, uninstall } from '../lib/installer.mjs';
 import { askChoice, askMultiChoice, askText, askSecret, askYesNo, close as closePrompts } from '../lib/prompt.mjs';
-import { banner, error, dim, info, warn } from '../lib/logger.mjs';
+import { banner, error, dim, info, success, warn } from '../lib/logger.mjs';
+import { BrowserLoginError, consoleUrlFor, loginAndCreateApiKey } from '../lib/browser-login.mjs';
 import {
   isPackagedInstall,
   MEKO_PRODUCTION_CONSOLE_URL,
@@ -19,6 +20,8 @@ import { parseClientList } from '../lib/clients/aliases.mjs';
 import { startMigration, runChildMigration, readStatus, stopMigration } from '../lib/migrate.mjs';
 import { checkLatest } from '../lib/version-check.mjs';
 import { runCaptureStatus } from '../lib/capture-status.mjs';
+import { captureCleanupArgs, runCaptureCleanup } from '../lib/capture-cleanup.mjs';
+import { applyAutofixSetting, describeAutofix } from '../lib/autofix.mjs';
 
 // ---------------------------------------------------------------------------
 // Flag definitions
@@ -27,6 +30,7 @@ import { runCaptureStatus } from '../lib/capture-status.mjs';
 const options = {
   url:                { type: 'string' },
   'api-key':          { type: 'string' },
+  'no-browser':       { type: 'boolean', default: false },
   local:              { type: 'boolean', default: false },
   scope:              { type: 'string',  default: 'user' },
   name:               { type: 'string',  default: 'meko' },
@@ -36,6 +40,8 @@ const options = {
   'skip-validation':  { type: 'boolean', default: false },
   statusline:         { type: 'boolean', default: false },
   'no-statusline':    { type: 'boolean', default: false },
+  autofix:            { type: 'boolean', default: false },
+  'no-autofix':       { type: 'boolean', default: false },
   'no-canary':        { type: 'boolean', default: false },
   'dry-run':          { type: 'boolean', default: false },
   'check-updates':    { type: 'boolean', default: false },
@@ -48,6 +54,11 @@ const options = {
   // --- Capture health (Capture V2 Workstream D) ---
   'capture-status':   { type: 'boolean', default: false },
   json:               { type: 'boolean', default: false },
+  'capture-cleanup':  { type: 'string' },
+  session:            { type: 'string', multiple: true },
+  all:                { type: 'boolean', default: false },
+  'max-exchanges':    { type: 'string' },
+  'pace-ms':          { type: 'string' },
 
   // --- Migrate subcommand ---
   migrate:            { type: 'boolean', default: false },
@@ -75,11 +86,11 @@ function readVersion() {
   return pkg.version;
 }
 
-const ALL_CLIENTS = ['claude-code', 'claude-desktop', 'cursor', 'codex', 'kiro'];
+const ALL_CLIENTS = ['claude-code', 'claude-desktop', 'cursor', 'codex', 'kiro', 'opencode'];
 
 function printHelp() {
   const text = `
-Meko Setup for Claude Code, Claude Desktop, Cursor, Codex, and Kiro
+Meko Setup for Claude Code, Claude Desktop, Cursor, Codex, Kiro, and OpenCode
 
 Install and configure Meko MCP Server in one command.
 
@@ -90,7 +101,10 @@ Examples:
   # Interactive setup (recommended for first-time users):
   create-meko-setup
 
-  # Cloud Meko for Claude Code (non-interactive):
+  # Cloud Meko for Claude Code (signs in through your browser):
+  create-meko-setup --url https://mcp.mekodata.ai/mcp --client claude-code
+
+  # Cloud Meko with an existing API key (unattended, e.g. CI):
   create-meko-setup --url https://mcp.mekodata.ai/mcp --api-key "$MEKO_API_KEY" --yes
 
   # Local Meko with Cursor config:
@@ -108,11 +122,13 @@ Examples:
   # Install for Kiro (IDE and kiro-cli share the same config):
   create-meko-setup --client kiro --yes
 
+  create-meko-setup --client opencode --scope user --yes
+
   # Local Meko (docker-compose stack, Claude Code):
   create-meko-setup --local --yes
 
 Options:
-  --client <list>       Target clients: one or more of claude-code, claude-desktop, cursor, codex, kiro.
+  --client <list>       Target clients: one or more of claude-code, claude-desktop, cursor, codex, kiro, opencode.
                         "claude" is accepted as an alias for claude-code;
                         "kiro-cli" and "kiro-ide" for kiro.
                         Comma-separated, or "all" to target every supported client (default: claude-code)
@@ -123,7 +139,10 @@ Options:
                         untrusted IDE workspaces and non-managed CLI agents fall
                         back to agent-driven persistence.
   --url <url>           MCP server URL (from cloud.mekodata.ai > Datapacks > Connect)
-  --api-key <key>       API key for Cloud Meko authentication
+  --api-key <key>       Use an existing Cloud Meko API key instead of signing in
+                        through the browser. Also read from $MEKO_API_KEY.
+                        Required when no terminal is attached (CI, scripts).
+  --no-browser          Print the sign-in URL instead of opening a browser
   --local               Use local Meko at http://localhost:8000/mcp
   --scope <scope>       Config scope: user or project (default: user)
                         codex always installs at user scope (no project-level
@@ -136,8 +155,13 @@ Options:
                         Default: ON under --yes, prompted otherwise.
                         Claude Code only.
   --no-statusline       Skip statusline wiring even under --yes.
+  --no-autofix          Turn off automatic capture repair: the capture timer
+                        otherwise runs --capture-cleanup fix every 30 minutes
+                        (MEKO_AUTOFIX_INTERVAL) when a session is stuck.
+  --autofix             Turn automatic capture repair back on.
   --skip-validation     Skip post-install validation
-  --no-canary           Skip the canary datapack_list call. The
+  --no-canary           Skip the canary datapack_search (or, on older
+                        servers, datapack_list) call. The
                         connectivity + tools/list checks still run.
   --dry-run             Show what would be done without making changes
   --check-updates       Compare installed version against npm registry and exit
@@ -153,7 +177,31 @@ Capture health (durable outbox / recovery):
                         Exit 0 = healthy|catching_up, 2 = degraded_retrying,
                         3 = blocked_action_required.
   --json                With --capture-status, print machine-readable JSON
-                        matching the capture-health cache shape.
+                        matching the capture-health cache shape. Also
+                        accepted by --capture-cleanup.
+  --capture-cleanup <action>
+                        Clean up stuck capture on this machine:
+                          status   list sessions with unsent work and the
+                                   background capture processes (read-only)
+                          fix      diagnose each stuck session and fix it:
+                                   repair, drain, or move unsent turns to a
+                                   new conversation; reports what only you
+                                   can fix (start here)
+                          stop     stop SessionEnd workers and in-flight
+                                   drains, and park all unsent work so no
+                                   hook retries it (nothing is deleted)
+                          resume   unpark and hand back to the hooks
+                          drain    send now, one session at a time; stops
+                                   and re-parks at the first failure
+                          discard  skip a session's unsent exchanges for
+                                   good (needs --yes)
+                          repair   clear stale failure fields and leftover
+                                   PID, lease, and job files
+                        Options: --session <id> or a bare session ID
+                        (repeatable, prefix ok),
+                        --all, --dry-run, --json, --yes,
+                        --max-exchanges N (drain, default 200),
+                        --pace-ms N (drain, default 1000).
 
 Migrate existing conversations and memories into Meko:
   --migrate             Start a detached migration of existing Claude Code
@@ -267,12 +315,53 @@ function parseRate(raw) {
   return n;
 }
 
+// Placeholder shown in --dry-run output in place of a key that browser
+// sign-in would create. Never sent anywhere: dry runs make no changes.
+const DRY_RUN_SIGN_IN_KEY = 'mko_tkn_<created-by-browser-sign-in>';
+
+/**
+ * Sign in through the browser and create an API key for this install.
+ * Returns the key, or null after printing why sign-in failed.
+ */
+async function signInWithBrowser({ url, noBrowser, dryRun }) {
+  if (dryRun) {
+    dim('Would sign in with your browser and create an API key (skipped: --dry-run).');
+    return DRY_RUN_SIGN_IN_KEY;
+  }
+  info('Signing in to Meko with your browser to create an API key...');
+  try {
+    const key = await loginAndCreateApiKey({ url, noBrowser, notify: (msg) => dim(msg) });
+    const expires = key.expiresAt ? ` (expires ${String(key.expiresAt).slice(0, 10)})` : '';
+    success(`Signed in. Created API key "${key.name}"${expires}.`);
+    dim(`Manage or revoke it at ${consoleUrlFor(url)} > Settings > API Keys.`);
+    return key.apiKey;
+  } catch (err) {
+    error(err instanceof BrowserLoginError ? err.message : `Browser sign-in failed: ${err?.message ?? err}`);
+    return null;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 
 async function main() {
-  const { values: flags } = parseArgs({ options, strict: true });
+  const { values: flags, positionals } = parseArgs({
+    options,
+    strict: true,
+    allowPositionals: true,
+  });
+  // Only --capture-cleanup takes bare arguments: session IDs, so
+  // `--capture-cleanup drain c0acdeb2` works like `--session c0acdeb2`.
+  if (positionals.length > 0) {
+    if (flags['capture-cleanup'] === undefined) {
+      error(
+        `Unexpected argument '${positionals[0]}'. This command does not take positional arguments`,
+      );
+      process.exit(1);
+    }
+    flags.session = [...(flags.session || []), ...positionals];
+  }
   const projectRoot = process.cwd();
 
   // --help
@@ -297,8 +386,17 @@ async function main() {
     if (out.stderr) process.stderr.write(out.stderr);
     process.exit(out.code);
   }
+  // --capture-cleanup <action>: inspect, fix, stop, park, drain, or discard
+  // stuck capture sessions. Exit codes: 0 done, 1 error, 2 partly done.
+  if (flags['capture-cleanup'] !== undefined) {
+    const out = runCaptureCleanup(
+      captureCleanupArgs(flags['capture-cleanup'], flags),
+    );
+    if (out.error) error(out.error);
+    process.exit(out.code);
+  }
   if (flags.json) {
-    error('--json requires --capture-status');
+    error('--json requires --capture-status or --capture-cleanup');
     process.exit(1);
   }
 
@@ -456,6 +554,10 @@ async function main() {
   // submitting an empty value at the full-flow prompt would re-ask the
   // same question.
   let promptedForApiKey = false;
+  // Set when the user picked "Sign in with browser" at the interactive auth
+  // prompt. Someone answered that prompt, so sign-in runs even when stdin
+  // is not a TTY (e.g. piped answers in the smoke harness).
+  let choseBrowserSignIn = false;
 
   // --local shortcut
   if (flags.local) {
@@ -478,6 +580,7 @@ async function main() {
         cursor: 'Cursor',
         codex: 'OpenAI Codex (CLI + App)',
         kiro: 'Kiro (IDE + kiro-cli)',
+        opencode: 'OpenCode CLI/TUI',
       }[id];
       return {
         label: id,
@@ -538,7 +641,7 @@ async function main() {
     // When only Cloud is available, skip the prompt entirely — asking to
     // pick between one option is pointless UX.
     const connectionOptions = [
-      { label: 'Cloud Meko', description: 'Hosted at mekodata.ai (requires an API key)' },
+      { label: 'Cloud Meko', description: 'Hosted at mekodata.ai (sign in with your browser)' },
     ];
     if (!isPackagedInstall()) {
       connectionOptions.push({
@@ -567,11 +670,24 @@ async function main() {
         suggestedUrl?.url ?? undefined,
       );
 
-      // Step 3 — API key. Normalize: terminal paste can drag in trailing
-      // whitespace/CR or accidental surrounding quotes, all of which would
-      // sail straight into `Authorization: Bearer ...` and 401.
-      apiKey = normalizeApiKey(await askSecret('API key:'));
-      promptedForApiKey = true;
+      // Step 3 — authentication. Browser sign-in is the default and runs
+      // in the Cloud-URL check below; pasting a key is the advanced path.
+      // An existing --api-key or $MEKO_API_KEY skips the question.
+      if (!apiKey && !normalizeApiKey(process.env.MEKO_API_KEY)) {
+        const authChoice = await askChoice('How do you want to authenticate?', [
+          { label: 'Sign in with browser', description: 'Recommended. Creates an API key for you' },
+          { label: 'Paste an API key', description: `From ${consoleUrlFor(url)} > Settings > API Keys` },
+        ]);
+        if (authChoice === 'Paste an API key') {
+          // Normalize: terminal paste can drag in trailing whitespace/CR or
+          // accidental surrounding quotes, all of which would sail straight
+          // into `Authorization: Bearer ...` and 401.
+          apiKey = normalizeApiKey(await askSecret('API key:'));
+          promptedForApiKey = true;
+        } else {
+          choseBrowserSignIn = true;
+        }
+      }
     } else {
       url    = 'http://localhost:8000/mcp';
       apiKey = null;
@@ -610,25 +726,38 @@ async function main() {
 
   // Validation — Cloud URL requires an API key.
   // Resolution order: --api-key (already in `apiKey`) → $MEKO_API_KEY →
-  // interactive prompt (only on a TTY, not under --yes, and only if the
-  // full interactive flow above didn't already ask). The prompt fallback
-  // exists so a user who pastes the cloud one-liner from the UI (which
-  // only shows --url and --client) isn't dead-ended on a hard error when
-  // they forgot to supply the key. Skipping it after a full-flow prompt
-  // avoids re-asking the same question when the user submitted empty.
+  // browser sign-in, which creates a key through the server's
+  // POST /api-keys. Sign-in also covers the cloud one-liner from the UI,
+  // which only shows --url and --client. It is skipped when the full
+  // interactive flow already took a pasted key (an empty paste is an
+  // error, not a silent switch to the browser), and whenever stdin is not
+  // a terminal, with or without --yes: a script or CI step may have nobody
+  // at the browser, and a 5-minute callback wait would stall it. The one
+  // exception is an explicit "Sign in with browser" answer at the prompt.
   if (isCloudUrl(url) && !apiKey) {
     apiKey = normalizeApiKey(process.env.MEKO_API_KEY);
+    let signInFailed = false;
     if (apiKey) {
       dim('Using API key from MEKO_API_KEY environment variable.');
-    } else if (!flags.yes && !promptedForApiKey && process.stdin.isTTY) {
-      dim('No --api-key or MEKO_API_KEY env var found; prompting for API key.');
-      apiKey = normalizeApiKey(await askSecret('API key:'));
+    } else if (!promptedForApiKey && (process.stdin.isTTY || choseBrowserSignIn)) {
+      apiKey = await signInWithBrowser({
+        url,
+        noBrowser: flags['no-browser'],
+        dryRun: flags['dry-run'],
+      });
+      signInFailed = !apiKey;
     }
     if (!apiKey) {
-      error(
-        'API key is required for Cloud Meko. ' +
-        'Provide --api-key, set MEKO_API_KEY env var, or run interactively.',
-      );
+      let message;
+      if (signInFailed) {
+        message = `Browser sign-in did not complete. To use an existing key instead, create one at ${consoleUrlFor(url)} > Settings > API Keys and rerun with --api-key, or set MEKO_API_KEY.`;
+      } else if (promptedForApiKey) {
+        message = 'No API key entered. Rerun and choose Sign in with browser, or pass --api-key.';
+      } else {
+        message = 'API key is required for Cloud Meko. ' +
+          'Provide --api-key, set MEKO_API_KEY env var, or run in a terminal to sign in with your browser.';
+      }
+      error(message);
       process.exit(1);
     }
   }
@@ -663,6 +792,23 @@ async function main() {
     }
   }
 
+  // Automatic capture repair runs inside the capture timer the hooks start,
+  // so installing the hooks deploys it. Save --autofix / --no-autofix once,
+  // for every client (they share one capture directory).
+  if (errors.length < clients.length) {
+    if (flags.autofix && flags['no-autofix']) {
+      warn('Both --autofix and --no-autofix were given; keeping the current setting.');
+    }
+    const enable =
+      flags['no-autofix'] && !flags.autofix ? false : flags.autofix && !flags['no-autofix'] ? true : undefined;
+    try {
+      const res = applyAutofixSetting({ enable, dryRun: flags['dry-run'], projectRoot });
+      info(describeAutofix(res.enabled));
+    } catch (err) {
+      warn(`Could not save the automatic repair setting: ${err.message}`);
+    }
+  }
+
   if (errors.length === clients.length) {
     process.exit(1);
   } else if (errors.length > 0) {
@@ -760,15 +906,23 @@ async function maybeOfferMigration({ url, apiKey, scope, projectRoot, datapack }
       dryRun: true,
       datapack: datapack ?? null,
     });
+    if (dry && dry.ok === false) {
+      dim(`Skipped migration offer: ${dry.message || "dry run failed"}`);
+      return;
+    }
     const s = dry?.message?.match(/Claude Code sessions: *(\d+)/);
     const c = dry?.message?.match(/Cursor sessions: *(\d+)/);
+    const x = dry?.message?.match(/Codex sessions: *(\d+)/);
+    const o = dry?.message?.match(/OpenCode sessions: *(\d+)/);
     const m = dry?.message?.match(/Memory items \(MD\): *(\d+)/);
     const counts = {
       claude: s ? Number(s[1]) : 0,
       cursor: c ? Number(c[1]) : 0,
+      codex: x ? Number(x[1]) : 0,
+      opencode: o ? Number(o[1]) : 0,
       memory: m ? Number(m[1]) : 0,
     };
-    const total = counts.claude + counts.cursor + counts.memory;
+    const total = counts.claude + counts.cursor + counts.codex + counts.opencode + counts.memory;
     if (total === 0) return;
 
     console.log('');
@@ -776,6 +930,8 @@ async function maybeOfferMigration({ url, apiKey, scope, projectRoot, datapack }
       `Found existing data to migrate: ` +
       `${counts.claude} Claude Code sessions, ` +
       `${counts.cursor} Cursor sessions, ` +
+      `${counts.codex} Codex sessions, ` +
+      `${counts.opencode} OpenCode sessions, ` +
       `${counts.memory} memory items.`,
     );
     const proceed = await askYesNo(