supermemoryai · ishaanxgupta · Jun 11, 2026 · Jun 19, 2026
diff --git a/assets/cursor.png b/assets/cursor.png
diff --git a/package.json b/package.json
@@ -19,7 +19,7 @@
     "@types/bun": "latest",
     "typescript": "^5"
   },
-  "files": ["dist", "rules", "skills", "commands", "hooks", ".cursor-plugin", ".mcp.json"],
+  "files": ["dist", "rules", "skills", "commands", "hooks", ".cursor-plugin", ".mcp.json", "assets"],
   "keywords": ["cursor", "supermemory", "mcp", "memory", "ai", "plugin"],
   "license": "MIT",
   "repository": {

diff --git a/src/auth.ts b/src/auth.ts
@@ -1,17 +1,137 @@
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";
+import { randomBytes } from "node:crypto";
 
 const CREDENTIALS_DIR = path.join(os.homedir(), ".supermemory-cursor");
 const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
-const AUTH_PORT = 19878;
-const AUTH_URL = "https://console.supermemory.ai/auth/connect";
+const AUTH_URL = process.env.SUPERMEMORY_AUTH_URL || "https://app.supermemory.ai/auth/connect";
+const CURSOR_LOGO_FILE = path.join(import.meta.dir, "..", "assets", "cursor.png");
 
 const SUCCESS_HTML = `<!DOCTYPE html>
-<html><head><style>
-  body { background: #111; color: #fff; font-family: system-ui; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
-  h1 { font-size: 2rem; }
-</style></head><body><h1>Connected to Cursor!</h1></body></html>`;
+<html>
+<head>
+  <title>Connected - Supermemory</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    html, body { min-height: 100%; }
+    body {
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      background:
+        radial-gradient(circle at 50% 0%, rgba(75, 160, 250, 0.16), transparent 38%),
+        #08090b;
+      color: #fafafa;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+    }
+    .card {
+      width: min(440px, 100%);
+      padding: 32px;
+      border: 1px solid rgba(255, 255, 255, 0.08);
+      border-radius: 18px;
+      background: #14161a;
+      box-shadow:
+        inset 2px 2px 4px rgba(11, 15, 21, 0.7),
+        0 24px 80px rgba(0, 0, 0, 0.28);
+      text-align: center;
+    }
+    .status {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      height: 32px;
+      padding: 0 14px;
+      margin-bottom: 22px;
+      border: 1px solid rgba(34, 197, 94, 0.24);
+      border-radius: 999px;
+      background: rgba(34, 197, 94, 0.08);
+      color: #4ade80;
+      font-size: 13px;
+      font-weight: 500;
+    }
+    .dot {
+      width: 8px;
+      height: 8px;
+      border-radius: 50%;
+      background: #22c55e;
+      box-shadow: 0 0 18px rgba(34, 197, 94, 0.7);
+    }
+    .logos {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      gap: 14px;
+      margin-bottom: 24px;
+    }
+    .logo-box {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      width: 52px;
+      height: 52px;
+      border: 1px solid rgba(255, 255, 255, 0.08);
+      border-radius: 14px;
+      background: #080b0f;
+    }
+    .plus {
+      color: #737373;
+      font-size: 20px;
+      font-weight: 500;
+    }
+    .cursor-logo {
+      width: 34px;
+      height: 34px;
+      object-fit: contain;
+      display: block;
+    }
+    .supermemory-mark {
+      width: 28px;
+      height: 28px;
+      color: #fafafa;
+    }
+    h1 {
+      margin-bottom: 8px;
+      font-size: 26px;
+      line-height: 1.18;
+      font-weight: 650;
+      letter-spacing: -0.02em;
+    }
+    p {
+      color: #9ca3af;
+      font-size: 15px;
+      line-height: 1.55;
+    }
+    .hint {
+      margin-top: 22px;
+      padding-top: 20px;
+      border-top: 1px solid rgba(255, 255, 255, 0.08);
+      color: #737373;
+      font-size: 13px;
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="status"><span class="dot"></span><span>Connected</span></div>
+    <div class="logos">
+      <div class="logo-box" aria-label="Cursor"><img class="cursor-logo" src="/cursor.png" alt="Cursor" /></div>
+      <span class="plus">+</span>
+      <div class="logo-box" aria-label="Supermemory">
+        <svg class="supermemory-mark" fill="none" viewBox="0 0 230 168" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
+          <path fill="currentColor" d="M205.864 66.263h-76.401V0h-24.684v71.897c0 7.636 3.021 14.97 8.391 20.373l62.383 62.777 17.454-17.564-46.076-46.365h58.948v-24.84l-.015-.015ZM12.872 30.517l46.075 46.365H0v24.84h76.4v66.264h24.685V96.089c0-7.637-3.021-14.97-8.39-20.374l-62.37-62.762-17.453 17.564Z"/>
+        </svg>
+      </div>
+    </div>
+    <h1>Cursor is connected</h1>
+    <p>Supermemory is ready to provide persistent context inside Cursor.</p>
+    <div class="hint">You can close this tab and return to Cursor.</div>
+  </main>
+</body>
+</html>`;
 
 export function loadCredentials(): { apiKey: string; createdAt: string } | null {
   try {
@@ -47,16 +167,31 @@ export async function startAuthFlow(
 ): Promise<{ success: boolean; apiKey?: string; error?: string }> {
   return new Promise((resolve) => {
     let settled = false;
+    const stateToken = randomBytes(16).toString("hex");
 
     const server = Bun.serve({
-      port: AUTH_PORT,
+      port: 0,
       hostname: "127.0.0.1",
       fetch(req) {
         const url = new URL(req.url);
+
+        if (url.pathname === "/cursor.png") {
+          return new Response(Bun.file(CURSOR_LOGO_FILE), {
+            headers: {
+              "Content-Type": "image/png",
+              "Cache-Control": "no-store",
+            },
+          });
+        }
+
         if (url.pathname !== "/callback") {
           return new Response("Not found", { status: 404 });
         }
 
+        if (url.searchParams.get("state") !== stateToken) {
+          return new Response("Invalid state", { status: 403 });
+        }
+
         const apiKey = url.searchParams.get("apikey") || url.searchParams.get("api_key");
         if (!apiKey?.startsWith("sm_")) {
           return new Response("Invalid API key", { status: 400 });
@@ -74,12 +209,13 @@ export async function startAuthFlow(
       },
     });
 
-    const callbackUrl = `http://localhost:${AUTH_PORT}/callback`;
+    const callbackUrl = `http://127.0.0.1:${server.port}/callback?state=${stateToken}`;
     const authUrl = `${AUTH_URL}?callback=${encodeURIComponent(callbackUrl)}&client=cursor`;
 
     process.stderr.write(`\nOpen this URL to connect Supermemory to Cursor:\n\n  ${authUrl}\n\nWaiting...\n`);
-    const opener = process.platform === "win32" ? "start" : process.platform === "darwin" ? "open" : "xdg-open";
-    Bun.$`${opener} ${authUrl}`.quiet().nothrow();
+    openUrl(authUrl).catch((error) => {
+      process.stderr.write(`Failed to open browser automatically: ${error.message}\n`);
+    });
 
     const timer = setTimeout(() => {
       if (!settled) {
@@ -89,3 +225,15 @@ export async function startAuthFlow(
     }, timeoutMs);
   });
 }
+
+async function openUrl(url: string): Promise<void> {
+  if (process.platform === "win32") {
+    const result = await Bun.spawn(["rundll32.exe", "url.dll,FileProtocolHandler", url]).exited;
+    if (result !== 0) throw new Error(`browser opener exited with code ${result}`);
+    return;
+  }
+
+  const opener = process.platform === "darwin" ? "open" : "xdg-open";
+  const result = await Bun.spawn([opener, url]).exited;
+  if (result !== 0) throw new Error(`browser opener exited with code ${result}`);
+}
diff --git a/src/hooks/session-start.ts b/src/hooks/session-start.ts
@@ -48,7 +48,7 @@ async function main() {
   process.stdout.write(JSON.stringify({
     continue: true,
     hookSpecificOutput: {
-      hookEventName: "sessionStart",
+      hookEventName: "SessionStart",
       additionalContext: context,
     },
   }));