Logout does not suppress SessionStart authentication

[abhinavkr26104]

Summary

After running /supermemory-logout, the SessionStart hook still initiates the browser authentication flow on the next startup. This occurs because session-start.ts does not check the .logged-out marker before calling startAuthFlow().

Current behavior

/supermemory-logout creates the logout marker (~/.codex/supermemory/.logged-out), but on the next Codex startup (without SUPERMEMORY_CODEX_API_KEY), the SessionStart hook only checks .auth-attempted and proceeds to invoke startAuthFlow(), reopening the browser authentication flow.

The UserPromptSubmit recall hook already respects the .logged-out marker, making the behavior inconsistent across hooks.

Steps to reproduce

1. Install and authenticate the plugin.
2. Run /supermemory-logout.
3. Ensure SUPERMEMORY_CODEX_API_KEY is not set.
4. Restart Codex.
5. Observe that the browser authentication flow is launched again.

Expected behavior

After logout, all automatic authentication attempts should be suppressed until the user explicitly runs /supermemory-login.

Root cause

In src/hooks/session-start.ts, the unauthenticated path checks only the .auth-attempted marker before calling startAuthFlow(). It does not check whether the user has explicitly logged out via the .logged-out marker.

Since the recall hook already checks the logout marker, the authentication logic is inconsistent.

Suggested fix

Update src/hooks/session-start.ts to check for the same .logged-out marker before invoking startAuthFlow(). Reusing the existing LOGGED_OUT_FILE constant (if available) would help keep the authentication behavior consistent across hooks.

[abhinavkr26104]

@MaheshtheDev @Dhravya @Prasanna721 Can you please review the PR raised