Rolls up everything queued for the never-shipped 1.1.1 (OAuth branding, Cursor hook race, dangling skill symlink, Desktop skill packaging), plus two additions that landed afterward: Codex session hooks (auto-capture now works on Codex, matching Claude Code) and a Cursor native-hook context injection rewrite.

### New Features

#### MCP Server

- **Meko-branded OAuth screens** — consent, approval, error, and callback-success pages now render through a single Meko-themed template instead of stock OAuth library HTML.

#### Installer

- **Codex session hooks** — Codex now installs SessionStart, PreCompact, and SessionEnd hooks into `~/.codex/hooks.json`, matching the Claude Code auto-capture path. Credentials are written to `~/.codex/meko-env.sh` (mode `0600`) rather than inlined into hook commands, so the API key never appears in process arguments.

### Improvements

#### Installer

- **Cursor native-hook context injection rewrite** — `SessionStart` is now the supported context-injection path; the hybrid hook mode that emitted Claude-compatible payloads from `beforeSubmitPrompt` (and could pollute the agent's view) is removed.

### Bug Fixes

#### MCP Server

- **OAuth branding assets missing from the published wheel** — `pip install meko-mcp-server` was missing `mcp_auth/assets/`, causing a `FileNotFoundError` on first OAuth flow.
- **`expires_at` decimal precision** — the Cognito token-expiry parser now tolerates any microsecond precision instead of erroring.

#### Installer

- **Cursor hook bootstrap race** — capture is now split across a fast cache-writing SessionStart script and a blocking prompt-time injector that reads the populated cache synchronously, so Meko context is in place before the agent sees your first message.
- **Dangling skill symlink crashed macOS installs** — a stale broken `~/.agents/skills/meko-mcp-tools` symlink is now detected and cleared before retrying.
- **Desktop skill packaging script missing from the npm tarball** — fixed for installs via `npx @yugabytedb/meko-mcp` (previously worked only from a source checkout).
- **Codex API key no longer exposed via `ps`** — credentials moved from inline hook commands to a mode-`0600` env file that hooks source in-process.

### Install or upgrade

```bash
npx @yugabytedb/meko-mcp@1.2.0
```