The first minor release since 1.0.x. Headline additions: new server auth options (Meko Token + combined PAT/Cognito), AWS Bedrock support, an OpenAI Codex client (CLI + Desktop App), and a fully documented three-bucket `agent_id` model that gives Claude Code, Cursor, Claude Desktop, and cross-project memory each their own namespace.

### New Features

#### MCP Server

- **Meko Token auth** — a PAT-style bearer token auth path, as an alternative to the existing Cognito flow, with support for enabling both simultaneously.
- **AWS Bedrock support** — `LLM_PROVIDER`, `LLM_MODEL`, `EMBEDDER_PROVIDER`, and `EMBEDDER_MODEL` are now env-configurable (supported providers: `openai` and `aws_bedrock`).
- **`MEKO_SERVER_INSTRUCTIONS`** — sent on the `initialize` handshake so LLMs get a use-case-oriented overview without extra prompting.
- **`flush_pending_memory_candidates` MCP tool** — a read-scope tool used by the Desktop skill to compensate for missing hook events. (Deprecated as of [v2.0.0](../v2.0.0/).)

#### Integrations

- **OpenAI Codex client (CLI + Desktop App)** — a single install configures both surfaces. The bearer token is resolved from `$MEKO_API_KEY` at runtime and never written to disk.
- **Three-bucket `agent_id` model** — documented and aligned across the server, hooks, skills, and installer: a per-project bucket (`<client>:<repo-basename>`), a cross-project common bucket (`meko_agent`), and a stable bare name for non-coding clients (`claude_desktop`).
- **Independent Claude Desktop skill** (`meko-mcp-tools-desktop`) — a fully independent plugin with its own setup guide and packaging, using `agent_id="claude_desktop"`.

### Changes

#### MCP Server

- **Breaking: auth header format** — `API_KEY: <key>` → `Authorization: Bearer <key>` across all clients, hooks, and the `.mcpb` launcher. The Cloud gateway rejects the legacy header.
- **MCP spec compliance** — authorization/connection logic updated to match the latest MCP spec.

### Bug Fixes

#### MCP Server

- `memory_search` and `conversation_list` — `conversation_id` is now optional, as expected for read-only tools.
- **`mcpdebugger.dev` compatibility** — fixed the `/generate-token/callback` path under `client_secret_basic`.

#### Installer

- **`askSecret` paste handling** — fixed stdin reset between readlines; readline now correctly handles ANSI sequences, bracketed paste, backspace, arrows, and UTF-8.
- **Canary check** — switched from a `memory_add` round trip (which the LLM fact-extractor could non-deterministically return empty for) to the read-only `datapack_list` call.

### Install or upgrade

```bash
npx @yugabytedb/meko-mcp@1.1.0
```