diff --git a/README.md b/README.md
index 7ab7b0d..3fbe093 100644
--- a/README.md
+++ b/README.md
@@ -25,8 +25,9 @@ and the lessons learned across every project — automatically.
   `~/.codex/hooks.json` for you.
 - 🪶 **No runtime deps in hooks** — the hook scripts are pre-bundled with esbuild for
   fast cold starts.
-- 🔧 **Fallback skills** — explicit `/supermemory-search`, `/supermemory-save`, and
-  `/supermemory-forget` commands available when hooks don't cover your use case.
+- 🔧 **Fallback skills** — explicit `/supermemory-search`, `/supermemory-save`,
+  `/supermemory-forget`, `/supermemory-status`, and `/supermemory-logout` commands available when hooks
+  don't cover your use case.
 
 ## Quick start
 
@@ -132,7 +133,10 @@ All memory skills support `--container <tag>` to target a specific custom contai
 | `/supermemory-search`  | `/supermemory-search [--container <tag>] <query>`           | Search memories manually.                |
 | `/supermemory-save`    | `/supermemory-save [--container <tag>] <content>`           | Save a specific memory explicitly.       |
 | `/supermemory-forget`  | `/supermemory-forget [--container <tag>] <content>`         | Remove a memory.                         |
+| `/supermemory-profile` | `/supermemory-profile`                                      | Show remembered profile facts.           |
+| `/supermemory-status`  | `/supermemory-status`                                       | Show connection and account status.      |
 | `/supermemory-login`   | `/supermemory-login`                                        | Re-authenticate with Supermemory.        |
+| `/supermemory-logout`  | `/supermemory-logout`                                       | Remove saved local credentials.          |
 
 Skills are fallback commands — the hooks handle most use cases automatically.
 
diff --git a/build.mjs b/build.mjs
index a3477dc..d59d18d 100644
--- a/build.mjs
+++ b/build.mjs
@@ -1,5 +1,5 @@
 import * as esbuild from "esbuild";
-import { mkdirSync, writeFileSync, chmodSync, copyFileSync } from "node:fs";
+import { mkdirSync, writeFileSync, chmodSync, copyFileSync, rmSync } from "node:fs";
 
 const sharedConfig = {
   bundle: true,
@@ -16,12 +16,14 @@ const executableEntries = [
     in: `src/hooks/${n}.ts`,
     out: `dist/hooks/${n}.js`,
   })),
-  ...["search-memory", "save-memory", "forget-memory", "profile-memory", "login"].map((n) => ({
+  ...["search-memory", "save-memory", "forget-memory", "profile-memory", "status", "login", "logout"].map((n) => ({
     in: `src/skills/${n}.ts`,
     out: `dist/skills/${n}.js`,
   })),
 ];
 
+rmSync("dist", { recursive: true, force: true });
+
 const libraryEntries = [
   { in: "src/services/session.ts", out: "dist/services/session.js" },
   { in: "src/services/tags.ts", out: "dist/services/tags.js" },
@@ -48,7 +50,7 @@ await Promise.all(
 );
 
 // Copy SKILL.md files to dist
-for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-profile", "supermemory-login"]) {
+for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-profile", "supermemory-status", "supermemory-login", "supermemory-logout"]) {
   mkdirSync(`dist/skills/${skillName}`, { recursive: true });
   copyFileSync(
     `src/skills/${skillName}/SKILL.md`,
diff --git a/src/cli.ts b/src/cli.ts
index e01450f..bb9b2e0 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -45,8 +45,15 @@ const SKILLS = [
   { name: "supermemory-search", script: "search-memory.js" },
   { name: "supermemory-save", script: "save-memory.js" },
   { name: "supermemory-forget", script: "forget-memory.js" },
+  { name: "supermemory-status", script: "status.js" },
   { name: "supermemory-profile", script: "profile-memory.js" },
   { name: "supermemory-login", script: "login.js" },
+  { name: "supermemory-logout", script: "logout.js" },
+] as const;
+
+const LEGACY_SUPERMEMORY_SCRIPTS = [
+  "capture.js",
+  "tags.js",
 ] as const;
 
 const SCRIPT_DIR = getScriptDir();
@@ -267,10 +274,10 @@ function install() {
   copyFileSync(flushSrc, FLUSH_SCRIPT);
   copyFileSync(sessionStartSrc, SESSION_START_SCRIPT);
 
-  // Remove old capture.js if it exists
-  const oldCapture = join(SUPERMEMORY_HOOKS_DIR, "capture.js");
-  if (existsSync(oldCapture)) {
-    rmSync(oldCapture);
+  // Remove script names left by older package layouts.
+  for (const script of LEGACY_SUPERMEMORY_SCRIPTS) {
+    const oldScript = join(SUPERMEMORY_HOOKS_DIR, script);
+    if (existsSync(oldScript)) rmSync(oldScript);
   }
 
   // Copy skill scripts and SKILL.md files
@@ -302,7 +309,7 @@ Installation complete!
 
 You now have:
   • Session-start profile recall (${getRecallModeSummary()})
-  • Explicit memory — supermemory-search, supermemory-save, supermemory-forget, supermemory-profile, supermemory-login
+  • Explicit memory — supermemory-search, supermemory-save, supermemory-forget, supermemory-profile, supermemory-status, supermemory-login, and supermemory-logout skills
 
 ${hadExistingConfig
     ? "Existing install: legacy per-prompt recall/capture preserved in ~/.codex/supermemory.json.\nTo opt into new defaults, set autoRecallEveryPrompt=false and captureEveryNTurns=0.\n"
@@ -316,7 +323,7 @@ Next steps:
      /supermemory-login      (inside Codex)
      export SUPERMEMORY_CODEX_API_KEY="sm_..."   (in your shell profile)
 
-  2. Get an API key at: https://console.supermemory.ai/keys (if needed)
+  2. Get an API key at: https://app.supermemory.ai/?view=integrations (if needed)
 
 Optional: Enable debug logging:
   export SUPERMEMORY_DEBUG=true
diff --git a/src/config.ts b/src/config.ts
index dfcf5d6..8680506 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import { loadCredentials } from "./services/auth.js";
+import { loadCredentialData, loadCredentials } from "./services/auth.js";
 
 export const CONFIG_FILE = join(homedir(), ".codex", "supermemory.json");
 export const PLUGIN_VERSION = "1.0.7";
@@ -132,6 +132,15 @@ export function getApiKeyValue(): string | undefined {
   return SUPERMEMORY_API_KEY;
 }
 
+export function getApiBaseUrl(): string {
+  return (
+    process.env.SUPERMEMORY_API_URL ||
+    process.env.SUPERMEMORY_BASE_URL ||
+    loadCredentialData()?.apiBaseUrl ||
+    "https://api.supermemory.ai"
+  );
+}
+
 export function getSignalConfig(): {
   enabled: boolean;
   keywords: string[];
diff --git a/src/hooks/recall.ts b/src/hooks/recall.ts
index 48bc154..bc87781 100644
--- a/src/hooks/recall.ts
+++ b/src/hooks/recall.ts
@@ -12,6 +12,7 @@ import { getSeenFacts, addSeenFacts } from "../services/factCache.js";
 import { getSessionId } from "../services/session.js";
 
 const AUTH_ATTEMPTED_FILE = join(homedir(), ".codex", "supermemory", ".auth-attempted");
+const LOGGED_OUT_FILE = join(homedir(), ".codex", "supermemory", ".logged-out");
 
 interface CodexHookPayload {
   session_id?: string;
@@ -45,6 +46,11 @@ async function main() {
   }
 
   if (!isConfigured()) {
+    if (existsSync(LOGGED_OUT_FILE)) {
+      log("recall: logged out marker present, skipping browser auth");
+      exitWithContext("");
+    }
+
     const alreadyAttempted = existsSync(AUTH_ATTEMPTED_FILE);
 
     if (!alreadyAttempted) {
diff --git a/src/services/auth.ts b/src/services/auth.ts
index 9e23455..5f5a773 100644
--- a/src/services/auth.ts
+++ b/src/services/auth.ts
@@ -2,16 +2,21 @@ import { createServer, type IncomingMessage, type ServerResponse } from "node:ht
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir, hostname, platform, arch } from "node:os";
-import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import type { AddressInfo } from "node:net";
+import { openUrl } from "./openUrl.js";
 
 const SUPERMEMORY_DIR = join(homedir(), ".codex", "supermemory");
 const CREDENTIALS_FILE = join(SUPERMEMORY_DIR, "credentials.json");
+export interface Credentials {
+  apiKey?: string;
+  apiBaseUrl?: string;
+  savedAt?: string;
+}
 
 const AUTH_BASE_URL =
-  process.env.SUPERMEMORY_AUTH_URL || "https://console.supermemory.ai/auth/agent-connect";
-const AUTH_TIMEOUT = Number(process.env.SUPERMEMORY_AUTH_TIMEOUT) || 60_000;
+  process.env.SUPERMEMORY_AUTH_URL || "https://app.supermemory.ai/auth/agent-connect";
+const AUTH_TIMEOUT = Number(process.env.SUPERMEMORY_AUTH_TIMEOUT) || 5 * 60_000;
 
 const AUTH_SUCCESS_HTML = `<!DOCTYPE html>
 <html><head><title>Connected - Supermemory</title><style>
@@ -39,38 +44,47 @@ p{color:#666;font-size:16px}
 <p>Invalid API key received. Please try again.</p>
 </body></html>`;
 
-export function loadCredentials(): string | undefined {
+export function loadCredentialData(): Credentials | null {
   try {
     if (existsSync(CREDENTIALS_FILE)) {
-      const data = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8")) as {
-        apiKey?: string;
-      };
-      if (data.apiKey) return data.apiKey;
+      return JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8")) as Credentials;
     }
   } catch {}
+  return null;
+}
+
+export function loadCredentials(): string | undefined {
+  const data = loadCredentialData();
+  if (data?.apiKey) return data.apiKey;
   return undefined;
 }
 
-function saveCredentials(apiKey: string): void {
+function normalizeApiBaseUrl(apiBaseUrl: string | null | undefined): string | undefined {
+  if (!apiBaseUrl) return undefined;
+  try {
+    const url = new URL(apiBaseUrl);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return undefined;
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return undefined;
+  }
+}
+
+function saveCredentials(apiKey: string, apiBaseUrl?: string): void {
   mkdirSync(SUPERMEMORY_DIR, { recursive: true, mode: 0o700 });
+  const credentials: Credentials = { apiKey, savedAt: new Date().toISOString() };
+  const normalizedApiBaseUrl = normalizeApiBaseUrl(apiBaseUrl);
+  if (normalizedApiBaseUrl) credentials.apiBaseUrl = normalizedApiBaseUrl;
   writeFileSync(
     CREDENTIALS_FILE,
-    JSON.stringify({ apiKey, savedAt: new Date().toISOString() }, null, 2),
+    JSON.stringify(credentials, null, 2),
     { mode: 0o600 }
   );
 }
 
-function openBrowser(url: string): void {
-  const onError = () => {};
-  if (process.platform === "win32") {
-    execFile("explorer.exe", [url], onError);
-  } else if (process.platform === "darwin") {
-    execFile("open", [url], onError);
-  } else {
-    execFile("xdg-open", [url], onError);
-  }
-}
-
 export function startAuthFlow(): Promise<string> {
   return new Promise((resolve, reject) => {
     let resolved = false;
@@ -89,9 +103,11 @@ export function startAuthFlow(): Promise<string> {
 
         const apiKey =
           url.searchParams.get("apikey") || url.searchParams.get("api_key");
+        const apiBaseUrl =
+          url.searchParams.get("api_url") || url.searchParams.get("api_base_url");
 
         if (apiKey?.startsWith("sm_")) {
-          saveCredentials(apiKey);
+          saveCredentials(apiKey, apiBaseUrl ?? undefined);
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end(AUTH_SUCCESS_HTML);
           resolved = true;
@@ -112,7 +128,7 @@ export function startAuthFlow(): Promise<string> {
     // the callback URL so the console redirects it back through the redirect.
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address() as AddressInfo;
-      const callbackUrl = `http://localhost:${port}/callback?state=${stateToken}`;
+      const callbackUrl = `http://127.0.0.1:${port}/callback?state=${stateToken}`;
       const params = new URLSearchParams({
         callback: callbackUrl,
         client: "codex",
@@ -122,7 +138,13 @@ export function startAuthFlow(): Promise<string> {
         cli_version: "1.0.0",
       });
       const authUrl = `${AUTH_BASE_URL}?${params.toString()}`;
-      openBrowser(authUrl);
+      openUrl(authUrl).catch((error) => {
+        if (!resolved) {
+          clearTimeout(timer);
+          server.close();
+          reject(new Error(`Failed to open browser: ${error.message}`));
+        }
+      });
     });
 
     server.on("error", (err) => {
diff --git a/src/services/client.ts b/src/services/client.ts
index c8f4eff..f4d6bc1 100644
--- a/src/services/client.ts
+++ b/src/services/client.ts
@@ -1,5 +1,5 @@
 import Supermemory from "supermemory";
-import { CONFIG, isConfigured, getApiKeyValue, PLUGIN_VERSION } from "../config.js";
+import { CONFIG, isConfigured, getApiBaseUrl, getApiKeyValue, PLUGIN_VERSION } from "../config.js";
 import { log } from "./logger.js";
 import type { MemoryType } from "../types/index.js";
 
@@ -74,6 +74,7 @@ export class SupermemoryClient {
       // writes to the Codex plugin in PostHog / `document.source`.
       this.client = new Supermemory({
         apiKey: getApiKeyValue(),
+        baseURL: getApiBaseUrl(),
         defaultHeaders: { "x-sm-source": CODEX_SOURCE },
       });
     }
diff --git a/src/services/openUrl.ts b/src/services/openUrl.ts
new file mode 100644
index 0000000..dae8053
--- /dev/null
+++ b/src/services/openUrl.ts
@@ -0,0 +1,34 @@
+import { execFile } from "node:child_process";
+
+function run(command: string, args: string[]): Promise<void> {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { windowsHide: true }, (error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  });
+}
+
+export async function openUrl(url: string | URL): Promise<void> {
+  const href = url.toString();
+  if (!/^https?:\/\//i.test(href)) {
+    throw new Error("Refusing to open non-http URL");
+  }
+
+  if (process.platform === "win32") {
+    try {
+      await run("rundll32.exe", ["url.dll,FileProtocolHandler", href]);
+      return;
+    } catch {}
+
+    await run("cmd.exe", ["/c", "start", '""', href]);
+    return;
+  }
+
+  if (process.platform === "darwin") {
+    await run("open", [href]);
+    return;
+  }
+
+  await run("xdg-open", [href]);
+}
diff --git a/src/skills/login.ts b/src/skills/login.ts
index 6bcedf8..e64385b 100644
--- a/src/skills/login.ts
+++ b/src/skills/login.ts
@@ -5,19 +5,24 @@ import { isConfigured } from "../config.js";
 import { startAuthFlow, AUTH_BASE_URL, CREDENTIALS_FILE } from "../services/auth.js";
 
 const AUTH_ATTEMPTED_FILE = join(homedir(), ".codex", "supermemory", ".auth-attempted");
+const LOGGED_OUT_FILE = join(homedir(), ".codex", "supermemory", ".logged-out");
 
 async function main(): Promise<void> {
-  // Clear the auth-attempted marker so the recall hook will try browser auth again
   try {
-    if (existsSync(AUTH_ATTEMPTED_FILE)) unlinkSync(AUTH_ATTEMPTED_FILE);
+    if (existsSync(LOGGED_OUT_FILE)) unlinkSync(LOGGED_OUT_FILE);
   } catch {}
 
   if (isConfigured()) {
     console.log("Already authenticated with Supermemory. Memory is active.");
     console.log(`To re-authenticate, remove ${CREDENTIALS_FILE} and run this again.`);
-    return;
+    process.exit(0);
   }
 
+  // Clear the auth-attempted marker so the recall hook will try browser auth again.
+  try {
+    if (existsSync(AUTH_ATTEMPTED_FILE)) unlinkSync(AUTH_ATTEMPTED_FILE);
+  } catch {}
+
   console.log("Opening browser to authenticate with Supermemory...");
   console.log(`If the browser does not open, visit: ${AUTH_BASE_URL}`);
 
@@ -27,6 +32,7 @@ async function main(): Promise<void> {
       if (existsSync(AUTH_ATTEMPTED_FILE)) unlinkSync(AUTH_ATTEMPTED_FILE);
     } catch {}
     console.log("\nAuthenticated successfully! Supermemory is now active.");
+    process.exit(0);
   } catch (err) {
     const isTimeout = err instanceof Error && err.message === "AUTH_TIMEOUT";
     if (isTimeout) {
@@ -36,7 +42,7 @@ async function main(): Promise<void> {
     }
     console.error(`\nAlternatively, set the API key manually:`);
     console.error(`  export SUPERMEMORY_CODEX_API_KEY="sm_..."`);
-    console.error(`  Get your key at: https://console.supermemory.ai/keys`);
+    console.error(`  Get your key at: https://app.supermemory.ai/?view=integrations`);
     process.exit(1);
   }
 }
diff --git a/src/skills/logout.ts b/src/skills/logout.ts
new file mode 100644
index 0000000..8a79445
--- /dev/null
+++ b/src/skills/logout.ts
@@ -0,0 +1,66 @@
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { CREDENTIALS_FILE } from "../services/auth.js";
+
+const SUPERMEMORY_DIR = join(homedir(), ".codex", "supermemory");
+const AUTH_ATTEMPTED_FILE = join(SUPERMEMORY_DIR, ".auth-attempted");
+const LOGGED_OUT_FILE = join(SUPERMEMORY_DIR, ".logged-out");
+const CONFIG_FILE = join(homedir(), ".codex", "supermemory.json");
+
+function removeFile(path: string): boolean {
+  try {
+    if (!existsSync(path)) return false;
+    unlinkSync(path);
+    return true;
+  } catch (error) {
+    console.error(`Failed to remove ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  }
+}
+
+function removeConfigApiKey(): boolean {
+  try {
+    if (!existsSync(CONFIG_FILE)) return false;
+    const parsed = JSON.parse(readFileSync(CONFIG_FILE, "utf-8")) as Record<string, unknown>;
+    if (!Object.prototype.hasOwnProperty.call(parsed, "apiKey")) return false;
+    delete parsed.apiKey;
+    writeFileSync(CONFIG_FILE, `${JSON.stringify(parsed, null, 2)}\n`);
+    return true;
+  } catch (error) {
+    console.error(`Failed to update ${CONFIG_FILE}: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  }
+}
+
+function main(): void {
+  const removedCredentials = removeFile(CREDENTIALS_FILE);
+  const removedAuthMarker = removeFile(AUTH_ATTEMPTED_FILE);
+  const removedConfigApiKey = removeConfigApiKey();
+  const envApiKeySet = !!process.env.SUPERMEMORY_CODEX_API_KEY;
+  mkdirSync(SUPERMEMORY_DIR, { recursive: true });
+  writeFileSync(LOGGED_OUT_FILE, new Date().toISOString());
+
+  if (removedCredentials || removedConfigApiKey || removedAuthMarker) {
+    console.log("Logged out of Supermemory for Codex.");
+  } else {
+    console.log("No saved Supermemory login was found.");
+  }
+
+  if (removedCredentials) {
+    console.log(`Removed credentials file: ${CREDENTIALS_FILE}`);
+  }
+  if (removedConfigApiKey) {
+    console.log(`Removed apiKey from ${CONFIG_FILE}`);
+  }
+
+  if (envApiKeySet) {
+    console.log("");
+    console.log("SUPERMEMORY_CODEX_API_KEY is still set in this shell, so memory may remain active until you unset it or restart Codex.");
+  } else {
+    console.log("Supermemory memory is inactive until you run /supermemory-login again.");
+    console.log("This only logs out this local Codex install. To revoke the account-level Codex integration key, disconnect it from the Supermemory integrations page.");
+  }
+}
+
+main();
diff --git a/src/skills/status.ts b/src/skills/status.ts
new file mode 100644
index 0000000..413feb5
--- /dev/null
+++ b/src/skills/status.ts
@@ -0,0 +1,152 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { CONFIG, getApiBaseUrl, getApiKeyValue, isConfigured } from "../config.js";
+import { CREDENTIALS_FILE, loadCredentials } from "../services/auth.js";
+import { SupermemoryClient } from "../services/client.js";
+import { getTags } from "../services/tags.js";
+
+const API_URL =
+  getApiBaseUrl();
+const CONFIG_FILE = join(homedir(), ".codex", "supermemory.json");
+
+function maskKey(key: string | undefined): string {
+  if (!key) return "not set";
+  if (key.length <= 12) return `${key.slice(0, 4)}...`;
+  return `${key.slice(0, 6)}...${key.slice(-4)}`;
+}
+
+function getConfiguredApiKeyFromFile(): string | undefined {
+  try {
+    if (!existsSync(CONFIG_FILE)) return undefined;
+    const parsed = JSON.parse(readFileSync(CONFIG_FILE, "utf-8")) as { apiKey?: string };
+    return parsed.apiKey;
+  } catch {
+    return undefined;
+  }
+}
+
+function getKeySource(): string {
+  if (process.env.SUPERMEMORY_CODEX_API_KEY) return "SUPERMEMORY_CODEX_API_KEY env var";
+  if (getConfiguredApiKeyFromFile()) return "~/.codex/supermemory.json";
+  if (loadCredentials()) return "~/.codex/supermemory/credentials.json";
+  return "not configured";
+}
+
+function getDevTlsHint(): string | null {
+  if (!API_URL.includes(".dev.supermemory.ai")) return null;
+  if (process.env.NODE_EXTRA_CA_CERTS) return null;
+  return "Dev API TLS: set NODE_EXTRA_CA_CERTS to your Portless CA before starting Codex.";
+}
+
+async function fetchJson(path: string): Promise<unknown | null> {
+  const apiKey = getApiKeyValue();
+  if (!apiKey) return null;
+
+  try {
+    const response = await fetch(`${API_URL}${path}`, {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "x-sm-source": "codex",
+      },
+    });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+
+function findAccountInfo(value: unknown): { email?: string; name?: string; userId?: string; orgName?: string } {
+  const seen = new Set<unknown>();
+  const stack = [value];
+  const result: { email?: string; name?: string; userId?: string; orgName?: string } = {};
+
+  while (stack.length > 0) {
+    const item = stack.pop();
+    if (!item || typeof item !== "object" || seen.has(item)) continue;
+    seen.add(item);
+
+    const record = item as Record<string, unknown>;
+    for (const [key, raw] of Object.entries(record)) {
+      const lower = key.toLowerCase();
+      if (!result.email && lower === "email" && typeof raw === "string") result.email = raw;
+      if (!result.name && lower === "name" && typeof raw === "string") result.name = raw;
+      if (!result.userId && (lower === "userid" || lower === "user_id") && typeof raw === "string") result.userId = raw;
+      if (!result.orgName && (lower === "organizationname" || lower === "orgname") && typeof raw === "string") result.orgName = raw;
+
+      if (raw && typeof raw === "object") stack.push(raw);
+    }
+  }
+
+  return result;
+}
+
+async function getAccountInfo(): Promise<{ email?: string; name?: string; userId?: string; orgName?: string }> {
+  for (const path of ["/v3/auth/account/memberships", "/v3/account/memberships", "/v3/me"]) {
+    const data = await fetchJson(path);
+    const info = findAccountInfo(data);
+    if (info.email || info.name || info.userId || info.orgName) return info;
+  }
+  return {};
+}
+
+async function main(): Promise<void> {
+  const cwd = process.cwd();
+  const tags = getTags(cwd);
+  const apiKey = getApiKeyValue();
+  const lines: string[] = [];
+
+  lines.push("supermemory status");
+  lines.push("");
+  lines.push(`Connected: ${isConfigured() ? "checking..." : "no"}`);
+  lines.push(`API key: ${maskKey(apiKey)} (${getKeySource()})`);
+  lines.push(`API URL: ${API_URL}`);
+  lines.push(`Memory scope: current project + user profile`);
+  lines.push(`Recall mode: auto-recall on every prompt`);
+  lines.push(`Capture cadence: ${CONFIG.autoSaveEveryTurns > 0 ? `every ${CONFIG.autoSaveEveryTurns} turn${CONFIG.autoSaveEveryTurns === 1 ? "" : "s"} + session end` : "session end only"}`);
+  lines.push(`Project tag: ${tags.project}`);
+  lines.push(`User tag: ${tags.user}`);
+
+  if (!isConfigured()) {
+    lines[2] = "Connected: no";
+    lines.push("");
+    lines.push("Run /supermemory-login to connect, or set SUPERMEMORY_CODEX_API_KEY.");
+    console.log(lines.join("\n"));
+    process.exit(0);
+  }
+
+  const client = new SupermemoryClient();
+  const [profileResult, accountInfo] = await Promise.all([
+    client.getProfile(tags.user),
+    getAccountInfo(),
+  ]);
+
+  lines[2] = profileResult.success ? "Connected: yes" : "Connected: no";
+
+  if (accountInfo.email || accountInfo.name || accountInfo.userId || accountInfo.orgName) {
+    lines.push("");
+    lines.push("Account:");
+    if (accountInfo.email) lines.push(`Email: ${accountInfo.email}`);
+    if (accountInfo.name) lines.push(`Name: ${accountInfo.name}`);
+    if (accountInfo.userId) lines.push(`User ID: ${accountInfo.userId}`);
+    if (accountInfo.orgName) lines.push(`Organization: ${accountInfo.orgName}`);
+  } else {
+    lines.push("");
+    lines.push("Account: authenticated API key (account details unavailable from API key)");
+  }
+
+  if (!profileResult.success) {
+    lines.push("");
+    lines.push(`Connection check failed: ${profileResult.error}`);
+    const devTlsHint = getDevTlsHint();
+    if (devTlsHint) lines.push(devTlsHint);
+  }
+
+  console.log(lines.join("\n"));
+}
+
+main().catch((error) => {
+  console.error(`Failed to get Supermemory status: ${error instanceof Error ? error.message : String(error)}`);
+  process.exit(1);
+});
diff --git a/src/skills/supermemory-login/SKILL.md b/src/skills/supermemory-login/SKILL.md
index 5b332df..a8b9452 100644
--- a/src/skills/supermemory-login/SKILL.md
+++ b/src/skills/supermemory-login/SKILL.md
@@ -14,6 +14,14 @@ Authenticate with Supermemory to enable persistent memory across Codex sessions.
 node ~/.codex/supermemory/login.js
 ```
 
+## Windows Sandbox
+
+On Windows, if running the command from Codex, request escalated shell execution immediately instead of trying the sandbox first. The script lives under `~/.codex`, reads/writes auth state there, and may open the browser. Use a narrow approval reason such as:
+
+> Run Supermemory login from the Codex home directory so it can read credentials and open the browser auth flow.
+
 This opens a browser window for authentication. Once complete, the API key is saved automatically and memory features activate immediately.
 
 If the browser does not open, the script prints a URL to visit manually.
+
+Never print the full API key. If the script reports that Supermemory is already authenticated, tell the user memory is active and do not ask them to log in again.
diff --git a/src/skills/supermemory-logout/SKILL.md b/src/skills/supermemory-logout/SKILL.md
new file mode 100644
index 0000000..0a80de8
--- /dev/null
+++ b/src/skills/supermemory-logout/SKILL.md
@@ -0,0 +1,23 @@
+---
+name: supermemory-logout
+description: Log out of Supermemory in Codex. Use when the user wants to disconnect Supermemory, remove saved credentials, switch accounts, clear auth state, or stop memory from using the current saved API key.
+allowed-tools: Bash(node:*)
+---
+
+# Supermemory Logout
+
+Remove saved Supermemory credentials for Codex:
+
+```bash
+node ~/.codex/supermemory/logout.js
+```
+
+Logout creates an intentional disconnected marker so the automatic recall hook will not reopen browser auth on the next prompt. `/supermemory-status` should report disconnected after logout. `/supermemory-login` clears the marker and reconnects.
+
+On Windows, if running the command from Codex, request escalated shell execution immediately instead of trying the sandbox first. The script removes auth files under `~/.codex`. Use a narrow approval reason such as:
+
+> Run Supermemory logout from the Codex home directory so it can remove saved credentials.
+
+If `SUPERMEMORY_CODEX_API_KEY` is set in the parent shell, the script cannot unset it. Tell the user to unset that environment variable or restart Codex if the script reports it is still active.
+
+Never print the full API key.
diff --git a/src/skills/supermemory-status/SKILL.md b/src/skills/supermemory-status/SKILL.md
new file mode 100644
index 0000000..3459073
--- /dev/null
+++ b/src/skills/supermemory-status/SKILL.md
@@ -0,0 +1,23 @@
+---
+name: supermemory-status
+description: Show Supermemory connection status for Codex. Use when the user asks whether Supermemory is connected, which account or API key is active, memory hook health, or plugin status.
+allowed-tools: Bash(node:*)
+---
+
+# Supermemory Status
+
+Show whether Supermemory is connected and which credential source is active:
+
+```bash
+node ~/.codex/supermemory/status.js
+```
+
+## Windows Sandbox
+
+On Windows, if running the command from Codex and sandbox execution is likely to fail for `~/.codex` paths, request escalated shell execution immediately instead of trying the sandbox first. Use a narrow approval reason such as:
+
+> Run Supermemory status from the Codex home directory so it can read the installed credentials.
+
+Use this when the user asks whether memory is active, what Supermemory account is connected, or whether Codex can currently use Supermemory.
+
+Never print the full API key. The script masks credentials; preserve that masking in the response.
diff --git a/test/e2e-battle-test.mjs b/test/e2e-battle-test.mjs
index bdee262..c3564f7 100644
--- a/test/e2e-battle-test.mjs
+++ b/test/e2e-battle-test.mjs
@@ -132,9 +132,12 @@ record("flush.js exists", existsSync(join(supermemoryDir, "flush.js")));
 record("search-memory.js exists", existsSync(join(supermemoryDir, "search-memory.js")));
 record("save-memory.js exists", existsSync(join(supermemoryDir, "save-memory.js")));
 record("forget-memory.js exists", existsSync(join(supermemoryDir, "forget-memory.js")));
+record("status.js exists", existsSync(join(supermemoryDir, "status.js")));
+record("login.js exists", existsSync(join(supermemoryDir, "login.js")));
+record("logout.js exists", existsSync(join(supermemoryDir, "logout.js")));
 
 // SKILL.md files
-for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget"]) {
+for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-status", "supermemory-login", "supermemory-logout"]) {
   const skillMd = join(skillsDir, skillName, "SKILL.md");
   const exists = existsSync(skillMd);
   record(`${skillName}/SKILL.md exists`, exists);
@@ -383,7 +386,7 @@ console.log("  stdout:", uninstallResult.stdout.trim().split("\n").map(l => `
 
 record("uninstall exits 0", uninstallResult.status === 0);
 record("hooks dir removed", !existsSync(supermemoryDir));
-for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget"]) {
+for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-status", "supermemory-login", "supermemory-logout"]) {
   record(`${skillName} skill dir removed`, !existsSync(join(skillsDir, skillName)));
 }
 
diff --git a/test/unit.mjs b/test/unit.mjs
index c80fcf7..a3fb3f3 100644
--- a/test/unit.mjs
+++ b/test/unit.mjs
@@ -34,7 +34,7 @@ function setupCodexHome(t) {
 
 function runCli(cliBin, cmd, tmpDir) {
   return spawnSync("node", [cliBin, cmd], {
-    env: { ...process.env, HOME: tmpDir, SUPERMEMORY_CODEX_API_KEY: "sm_test" },
+    env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "sm_test" },
     encoding: "utf-8",
   });
 }
@@ -229,6 +229,16 @@ describe("stripPrivateContent", () => {
   });
 });
 
+describe("browser auth opener", () => {
+  test("login bundle uses Windows-safe URL opener", () => {
+    const content = readFileSync(new URL("../dist/skills/login.js", import.meta.url), "utf-8");
+    assert.ok(content.includes("Refusing to open non-http URL"));
+    assert.ok(content.includes("rundll32.exe"));
+    assert.ok(content.includes("url.dll,FileProtocolHandler"));
+    assert.ok(!content.includes("explorer.exe"));
+  });
+});
+
 // ─── hooks.json format ──────────────────────────────────────────────────────
 
 describe("hooks.json format", () => {
@@ -342,7 +352,7 @@ describe("integration: install/uninstall", () => {
     assert.equal(result.status, 0, `install should exit 0: ${result.stderr}`);
 
     const skillsDir = join(codexDir, "skills");
-    for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-login"]) {
+    for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-status", "supermemory-login", "supermemory-logout"]) {
       const skillMd = join(skillsDir, skillName, "SKILL.md");
       assert.ok(existsSync(skillMd), `${skillName}/SKILL.md should exist`);
       const content = readFileSync(skillMd, "utf-8");
@@ -362,7 +372,7 @@ describe("integration: install/uninstall", () => {
     assert.equal(uninstallResult.status, 0, `uninstall should exit 0: ${uninstallResult.stderr}`);
 
     const skillsDir = join(codexDir, "skills");
-    for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-login"]) {
+    for (const skillName of ["supermemory-search", "supermemory-save", "supermemory-forget", "supermemory-status", "supermemory-login", "supermemory-logout"]) {
       assert.ok(
         !existsSync(join(skillsDir, skillName)),
         `${skillName} skill dir should be removed`
@@ -391,16 +401,17 @@ describe("integration: install/uninstall", () => {
 describe("recall hook output envelope", () => {
   const recallBin = fileURLToPath(new URL("../dist/hooks/recall.js", import.meta.url));
 
-  // Helper: run recall hook with an isolated HOME and a short auth timeout so
-  // the first-invocation browser flow times out in 2s rather than 60s.
+  // Helper: run recall hook with an isolated HOME. Pre-create the auth marker
+  // so the unit test exercises the hook envelope without launching a browser.
   function runRecallUnconfigured(t, input) {
     const tmpDir = makeTmpDir();
-    mkdirSync(join(tmpDir, ".codex", "supermemory"), { recursive: true });
+    const supermemoryDir = join(tmpDir, ".codex", "supermemory");
+    mkdirSync(supermemoryDir, { recursive: true });
+    writeFileSync(join(supermemoryDir, ".auth-attempted"), new Date().toISOString());
     t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
     return spawnSync("node", [recallBin], {
       input,
-      // Use a 2s auth timeout so the browser flow times out quickly in CI.
-      env: { ...process.env, HOME: tmpDir, SUPERMEMORY_CODEX_API_KEY: "", SUPERMEMORY_AUTH_TIMEOUT: "2000" },
+      env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
       encoding: "utf-8",
       timeout: 5_000,
     });
@@ -414,6 +425,24 @@ describe("recall hook output envelope", () => {
     assert.equal(typeof parsed.hookSpecificOutput.additionalContext, "string");
   });
 
+  test("exits silently after explicit logout marker", (t) => {
+    const tmpDir = makeTmpDir();
+    const supermemoryDir = join(tmpDir, ".codex", "supermemory");
+    mkdirSync(supermemoryDir, { recursive: true });
+    writeFileSync(join(supermemoryDir, ".logged-out"), new Date().toISOString());
+    t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
+
+    const result = spawnSync("node", [recallBin], {
+      input: JSON.stringify({ session_id: "s1", prompt: "$supermemory-status" }),
+      env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
+      encoding: "utf-8",
+      timeout: 5_000,
+    });
+
+    assert.equal(result.status, 0);
+    assert.equal(result.stdout, "");
+  });
+
   test("emits no envelope on empty prompt (so Codex doesn't render an empty hook context line)", () => {
     const result = spawnSync("node", [recallBin], {
       input: JSON.stringify({ session_id: "s1", prompt: "" }),
@@ -445,7 +474,7 @@ describe("recall hook output envelope", () => {
 
     const result = spawnSync("node", [recallBin], {
       input: JSON.stringify({ prompt: "test" }),
-      env: { ...process.env, HOME: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
+      env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
       encoding: "utf-8",
     });
     const parsed = JSON.parse(result.stdout);
@@ -462,7 +491,7 @@ describe("recall hook output envelope", () => {
 
     const result = spawnSync("node", [recallBin], {
       input: JSON.stringify({ prompt: "test" }),
-      env: { ...process.env, HOME: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
+      env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
       encoding: "utf-8",
     });
     assert.equal(result.status, 0);
@@ -538,16 +567,18 @@ describe("flush hook Stop payload", () => {
   });
 });
 
-// ─── skill scripts (search/save/forget) ─────────────────────────────────────
+// ─── skill scripts (search/save/forget/status/logout) ───────────────────────
 //
 // These scripts (dist/skills/*.js) are entry-points invoked by Codex skills.
 // They reuse SupermemoryClient + tags, so we only smoke-test the CLI shape:
 // argument parsing, the unconfigured-fallback message, and clean exit codes.
 
-describe("skill scripts: search/save/forget", () => {
+describe("skill scripts: search/save/forget/status/logout", () => {
   const searchBin = fileURLToPath(new URL("../dist/skills/search-memory.js", import.meta.url));
   const saveBin = fileURLToPath(new URL("../dist/skills/save-memory.js", import.meta.url));
   const forgetBin = fileURLToPath(new URL("../dist/skills/forget-memory.js", import.meta.url));
+  const statusBin = fileURLToPath(new URL("../dist/skills/status.js", import.meta.url));
+  const logoutBin = fileURLToPath(new URL("../dist/skills/logout.js", import.meta.url));
 
   // Run a script with a fresh empty $HOME (no config file) and an empty
   // SUPERMEMORY_CODEX_API_KEY so isConfigured() is false. Returns the spawn result.
@@ -556,7 +587,7 @@ describe("skill scripts: search/save/forget", () => {
     mkdirSync(join(tmpDir, ".codex"), { recursive: true });
     t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
     return spawnSync("node", [bin, ...args], {
-      env: { PATH: process.env.PATH, HOME: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
+      env: { PATH: process.env.PATH, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
       encoding: "utf-8",
     });
   }
@@ -568,7 +599,7 @@ describe("skill scripts: search/save/forget", () => {
     mkdirSync(join(tmpDir, ".codex"), { recursive: true });
     t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
     return spawnSync("node", [bin], {
-      env: { PATH: process.env.PATH, HOME: tmpDir, SUPERMEMORY_CODEX_API_KEY: "sm_test" },
+      env: { PATH: process.env.PATH, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "sm_test" },
       encoding: "utf-8",
     });
   }
@@ -592,6 +623,36 @@ describe("skill scripts: search/save/forget", () => {
     assert.match(result.stderr, /Supermemory is not authenticated/);
   });
 
+  test("status prints disconnected state and exits 0 when no API key", (t) => {
+    const result = runSkillUnconfigured(t, statusBin, []);
+    assert.equal(result.status, 0);
+    assert.match(result.stdout, /Connected: no/);
+    assert.match(result.stdout, /supermemory-login/);
+  });
+
+  test("logout removes saved credentials and config apiKey", (t) => {
+    const tmpDir = makeTmpDir();
+    const codexDir = join(tmpDir, ".codex");
+    const supermemoryDir = join(codexDir, "supermemory");
+    mkdirSync(supermemoryDir, { recursive: true });
+    writeFileSync(join(supermemoryDir, "credentials.json"), JSON.stringify({ apiKey: "sm_test" }));
+    writeFileSync(join(supermemoryDir, ".auth-attempted"), new Date().toISOString());
+    writeFileSync(join(codexDir, "supermemory.json"), JSON.stringify({ apiKey: "sm_config", maxMemories: 3 }));
+    t.after(() => rmSync(tmpDir, { recursive: true, force: true }));
+
+    const result = spawnSync("node", [logoutBin], {
+      env: { PATH: process.env.PATH, HOME: tmpDir, USERPROFILE: tmpDir, SUPERMEMORY_CODEX_API_KEY: "" },
+      encoding: "utf-8",
+    });
+
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /Logged out/);
+    assert.ok(!existsSync(join(supermemoryDir, "credentials.json")), "credentials should be removed");
+    assert.ok(!existsSync(join(supermemoryDir, ".auth-attempted")), "auth marker should be removed");
+    assert.ok(existsSync(join(supermemoryDir, ".logged-out")), "logged-out marker should be created");
+    assert.deepEqual(JSON.parse(readFileSync(join(codexDir, "supermemory.json"), "utf-8")), { maxMemories: 3 });
+  });
+
   test("search-memory prints usage and exits 0 when no query is given", (t) => {
     const result = runSkillNoArgs(t, searchBin);
     assert.equal(result.status, 0);