[ishaanxgupta]

First-run sign-in ran startAuthFlow inside the SessionStart hook with a 25s budget (AUTH_TIMEOUT = 25000). When the hook returned, the callback listener on port 19881 closed, so anyone who spent more than 25s on the consent page landed on a dead redirect.

This ports the Claude Code fix (claude-supermemory #155) as-is:

• startBackgroundAuth(config, waitMs) spawns a detached hooks/auth-server.js <apiBaseUrl> <resource>. It runs startAuthFlow for AUTH_WAIT_MS (5 minutes) with { background: true }.
• The hook polls for fresh credentials for up to 20s. It rejects with AUTH_FAILED when the child exits non-zero without a signal, and with AUTH_PENDING on timeout.
• On AUTH_PENDING, SessionStart says: "Finish connecting Supermemory in the browser window (you have 5 minutes). Memory turns on from your next message."
• withAuthLock records {pid, background}. A newer login stops a waiting background one via stopBackgroundLogin instead of failing on a busy port.
• Bumps package.json and .muse-plugin/plugin.json to 0.3.0.

Testing

• node --test test/unit.mjs: 9/9 pass. New tests run against a mock OAuth server. In one, consent approved after the hook stopped waiting still saves credentials, and getAccessToken returns the new token. In the other, an unreachable issuer gives AUTH_FAILED.
• Prod, sandboxed HOME, with an open shim that records the URL:
  • First SessionStart exited in 21s with the "Finish connecting" message. The detached child (reparented to PID 1) kept 127.0.0.1:19881 open.
  • Consent was approved in the browser 64s after the hook started. The callback page showed "Supermemory connected", and credentials were saved at +76s. The child then exited and released the lock.
  • Next SessionStart authenticated in 1s. With cwd in a repo whose container has memories: ◪ supermemory · 5 memories loaded for mono.
  • The test grant was revoked with auth.js logout and disconnected in the console.
• Local preemption check: auth.js login sent SIGTERM to a waiting background auth-server.js, took the lock, and completed.