[ishaanxgupta]

Summary

Replace the Codex plugin's browser API-key bootstrap with the same DCR/OAuth flow as the Claude plugin in supermemoryai/claude-supermemory#121.

• Discover the authorization server, register a public client named Supermemory for Codex, and reuse its client ID across logins. The repository URI identifies Codex on the Console consent screen from https://github.com/supermemoryai/mono/pull/3087; that PR also attributes API requests to verified OAuth client/session IDs.
• Authorize with S256 PKCE, random state, issuer validation, and a loopback-only callback. Store access/refresh tokens atomically with owner-only permissions, bound to the API URL, issuer, and MCP resource.
• Refresh credentials at request time across v5, legacy REST, recall/capture hooks, status probes, and the long-running MCP proxy. Serialize refresh rotation across processes, preserve credentials on transient failures, and require reauthentication for invalid grants/clients. Hooks retain bounded, fail-open behavior.
• Add codex-supermemory login and logout. Explicit login migrates saved API-key credentials; logout revokes the refresh token and pauses automatic browser login. Status shows authentication type/client ID without exposing OAuth tokens.
• Preserve explicit environment/config API-key precedence and existing saved API-key compatibility, including self-hosted REST usage.

Supermemory CLI

login --print-url prints the authorize link (SUPERMEMORY_AUTHORIZE_URL=…) instead of opening a browser and keeps waiting for the callback. npx supermemory plugin uses it to sign in every selected plugin on one consent screen (https://github.com/supermemoryai/mono/pull/3636, https://github.com/supermemoryai/mono/pull/3637). Verified with all four plugins in one batch against a PR preview.