feat: authenticate with OAuth DCR and PKCE

README.md

@@ -45,11 +45,21 @@ Muse runs hooks with a cleared environment, so the API key is read from a file,
 
 ## Auth
 
-The first session opens a browser login and writes `~/.supermemory-muse/credentials.json`.
+The first session opens a browser login (OAuth with PKCE) and writes `~/.supermemory-muse/credentials.json`. Tokens refresh automatically.
 
-If you already logged in through the Claude Code plugin, that key is reused from `~/.supermemory-claude/credentials.json`.
+Log in, out, or check status explicitly from the plugin directory:
 
-Or write the file yourself:
+```bash
+node hooks/lib/auth.js login    # also migrates a saved API key to OAuth
+node hooks/lib/auth.js logout   # revokes the token, removes Muse credentials only
+node hooks/lib/auth.js status
+```
+
+For a custom backend set `baseUrl` (project config) or `SUPERMEMORY_API_URL`; when that host does not start with `api.`, also set `SUPERMEMORY_MCP_URL`.
+
+A legacy API key saved by the Claude Code plugin in `~/.supermemory-claude/credentials.json` is still reused. Claude Code's OAuth tokens are not shared.
+
+Or use an API key: write the file yourself:
 
 ```json
 { "apiKey": "sm_..." }
@@ -63,7 +73,7 @@ Get a key at [app.supermemory.ai](https://app.supermemory.ai).
 | --- | --- |
 | `/supermemory:index` | Index codebase architecture and patterns |
 | `/supermemory:status` | Auth, container tag, and API reachability |
-| `/supermemory:logout` | Clear saved Muse credentials |
+| `/supermemory:logout` | Revoke and clear saved Muse credentials |
 
 ## Configuration
 

commands/logout.md

@@ -2,6 +2,11 @@
 description: Clear saved Supermemory credentials for Muse Code
 ---
 
-Delete `~/.supermemory-muse/credentials.json` if it exists. Do not delete `~/.supermemory-claude/credentials.json` unless the user explicitly asks to log out of Claude Code too.
+Log the user out of Supermemory for Muse Code.
 
-Confirm the file is gone and tell the user the next Muse session will prompt them to log in again.
+1. Locate this plugin's `hooks/lib/auth.js` (in the installed supermemory plugin directory, next to `.muse-plugin/plugin.json`) and run `node <path-to>/hooks/lib/auth.js logout`. It revokes the OAuth refresh token and removes `~/.supermemory-muse/credentials.json`. Never print the file's contents or any token.
+2. If the script cannot be found, delete `~/.supermemory-muse/credentials.json` instead.
+
+Do not delete `~/.supermemory-claude/credentials.json` unless the user explicitly asks to log out of Claude Code too.
+
+Confirm the file is gone and tell the user the next Muse session will open the browser login again (if `~/.supermemory-claude/credentials.json` holds a legacy API key, that key is reused instead).

commands/status.md

@@ -4,8 +4,8 @@ description: Show Supermemory authentication and connection status
 
 Report the user's Supermemory status for this Muse Code session.
 
-1. Read `~/.supermemory-muse/credentials.json` (may not exist). Never print the full API key — show at most the first 6 and last 4 characters. Also check `~/.supermemory-claude/credentials.json` as a fallback. The key source is env `SUPERMEMORY_API_KEY` / `SUPERMEMORY_MUSE_API_KEY` when set, otherwise those files.
-2. Probe real connectivity with the resolved key:
+1. Determine the credential source. Env `SUPERMEMORY_MUSE_API_KEY` / `SUPERMEMORY_API_KEY` / `SUPERMEMORY_CC_API_KEY` and a project `apiKey` take precedence. Otherwise run `node <path-to>/hooks/lib/auth.js status` from this plugin's directory (next to `.muse-plugin/plugin.json`); it prints only the auth type (`oauth`, `api_key` or `none`) and the OAuth client ID. If you read `~/.supermemory-muse/credentials.json` yourself, never print `accessToken`, `refreshToken` or a full API key — show at most the first 6 and last 4 characters of an API key. A legacy `{"apiKey":...}` in `~/.supermemory-claude/credentials.json` is used as a fallback; OAuth tokens in that file belong to Claude Code and are never used.
+2. For an API key, probe real connectivity with it (skip this for OAuth; the MCP check below covers it):
 
 ```
 curl -sS -o /dev/null -w '%{http_code}' -m 8 -X POST "${SUPERMEMORY_API_URL:-https://api.supermemory.ai}/v4/profile" \
@@ -18,4 +18,4 @@ Interpret loudly: `200` → reachable and the key works; `401`/`403` → reachab
 3. Call the `whoAmI` MCP tool if the supermemory MCP server is connected.
 4. Report: authenticated or not, key source, the active project container tag, API reachability, and MCP reachability.
 
-If not authenticated, tell the user a new session will open the browser login automatically, or they can write `{"apiKey":"sm_..."}` to `~/.supermemory-muse/credentials.json`.
+If not authenticated, tell the user to run `node <path-to>/hooks/lib/auth.js login` (or start a new session, which opens the browser login automatically), or to write `{"apiKey":"sm_..."}` to `~/.supermemory-muse/credentials.json`.

hooks/capture.js

@@ -5,7 +5,8 @@ const {
   getProjectName,
 } = require('./lib/container-tag');
 const { loadProjectConfig } = require('./lib/project-config');
-const { loadSettings, getApiKey, getBaseUrl, debugLog } = require('./lib/settings');
+const { loadSettings, getAuthToken, getBaseUrl, debugLog } = require('./lib/settings');
+const { settleAuth } = require('./lib/auth');
 const { readStdin, writeOutput } = require('./lib/stdin');
 const {
   formatNewEntries,
@@ -32,7 +33,7 @@ async function main() {
 
     let apiKey;
     try {
-      apiKey = getApiKey(cwd, projectConfig);
+      apiKey = await getAuthToken(cwd, projectConfig);
     } catch {
       writeOutput({ continue: true });
       return;
@@ -84,7 +85,8 @@ async function main() {
   }
 }
 
-main().catch((err) => {
+main().catch(async (err) => {
   console.error(`Supermemory fatal: ${err.message}`);
+  await settleAuth();
   process.exit(1);
 });