prism-mcp-server 20.21.10 → 20.21.11

package/README.md

@@ -151,6 +151,19 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.11
+
+### Linked accounts persist across dashboard refreshes
+
+- A host process with an obsolete launch credential now recovers from the
+  newer account saved by the dashboard after the obsolete credential is
+  rejected.
+- Valid host credentials remain authoritative; sign-out, concurrent account
+  changes, network failures, and server failures do not trigger an unsafe
+  credential switch.
+- `prism dashboard` opens the active local dashboard without relabeling a
+  linked Standard, Advanced, or Enterprise account as Free.
+
 ## What's New in v20.21.10
 
 ### Signed-out Free dashboards keep working locally

package/dist/dashboard/ui.js

@@ -34,12 +34,12 @@ export function renderDashboardLocalOpenHTML() {
 </head>
 <body>
   <main>
-    <div class="eyebrow">Local Prism Free</div>
-    <h1>No account is required.</h1>
-    <p>This browser needs the current local dashboard link after Prism starts. Run this command in Terminal; it opens the dashboard directly without Synalux sign-in or plan redemption.</p>
+    <div class="eyebrow">Local dashboard access</div>
+    <h1>Open the current Prism dashboard.</h1>
+    <p>This browser does not have the current local dashboard link. Run this command in Terminal to open the active dashboard securely. Your Synalux account and plan remain unchanged.</p>
     <code>prism dashboard</code>
     <button type="button" onclick="navigator.clipboard.writeText('prism dashboard').then(() => { this.textContent = 'Copied'; })">Copy command</button>
-    <p class="note">Synalux sign-in remains optional for cloud sync, billing, and paid features.</p>
+    <p class="note">This local browser access check is separate from Synalux sign-in.</p>
   </main>
 </body>
 </html>`;

package/dist/storage/index.js

@@ -4,6 +4,7 @@ import { SupabaseStorage } from "./supabase.js";
 import { getSetting } from "./configStorage.js";
 import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
 import { isSynaluxSignedOut, setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { getSynaluxJwt, isUsableSynaluxApiKey } from "../utils/synaluxJwt.js";
 export function isValidHttpUrl(url) {
     try {
         const parsed = new URL(url);
@@ -56,15 +57,35 @@ export async function ensureSynaluxCredentials() {
         delete process.env.PRISM_SYNALUX_API_KEY;
         return false;
     }
-    if (SYNALUX_CONFIGURED)
-        return true;
     // Re-check process.env directly: SYNALUX_CONFIGURED is captured at module
     // load, so credentials injected later by another caller would be invisible
     // to it. Mirrors ensureSupabaseCredentials below.
     const rawEnvUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || process.env.SYNALUX_BASE_URL?.trim();
     const envUrl = rawEnvUrl ? upgradeInsecureCloudUrl(rawEnvUrl) : rawEnvUrl;
     const envKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
-    if (envUrl && envKey && isValidHttpUrl(envUrl))
+    if (envUrl && envKey && isValidHttpUrl(envUrl)) {
+        const storedKey = (await getSetting("PRISM_SYNALUX_API_KEY", ""))?.trim();
+        if (isUsableSynaluxApiKey(storedKey) &&
+            storedKey !== envKey) {
+            // Validate the launcher credential before SynaluxStorage captures it.
+            // getSynaluxJwt keeps a valid explicit env key authoritative and promotes
+            // the persisted key only after the env key receives 401/403 and the
+            // persisted key succeeds.
+            const validatedJwt = await getSynaluxJwt();
+            if (!validatedJwt) {
+                // A launcher can retain a revoked credential while the dashboard has
+                // already saved the replacement. Do not let SynaluxStorage capture
+                // the launcher key when the validation/recovery request is currently
+                // unavailable: its refresh token is immutable, so publishing that
+                // singleton would keep project access broken even after recovery.
+                throw new Error("[Prism Storage] Could not validate the active Synalux account credential. " +
+                    "Refusing to initialize cloud storage with an unverified credential because that could " +
+                    "strand project access or split session history. Retry when Synalux is reachable.");
+            }
+        }
+        return true;
+    }
+    if (SYNALUX_CONFIGURED)
         return true;
     const rawUrl = (await getSetting("PRISM_SYNALUX_BASE_URL"))?.trim() ||
         (await getSetting("SYNALUX_BASE_URL"))?.trim();

package/dist/utils/synaluxJwt.js

@@ -27,6 +27,67 @@ const MIN_CACHE_MS = 60_000;
 let cache = null;
 let inFlight = null;
 let generation = 0;
+async function exchangeJwt(baseUrl, apiKey) {
+    try {
+        const res = await fetch(`${baseUrl}/api/v1/auth/jwt`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        if (!res.ok) {
+            debugLog(`[synaluxJwt] exchange HTTP ${res.status}`);
+            return { kind: "http_error", status: res.status };
+        }
+        const data = (await res.json());
+        if (!data?.jwt) {
+            debugLog(`[synaluxJwt] exchange returned no jwt (status=${data?.status})`);
+            return { kind: "invalid_response" };
+        }
+        return {
+            kind: "success",
+            jwt: data.jwt,
+            ttlMs: Math.max(MIN_CACHE_MS, (data.expires_in ?? 900) * 1000),
+        };
+    }
+    catch (err) {
+        debugLog(`[synaluxJwt] exchange error: ${err instanceof Error ? err.message : String(err)}`);
+        return { kind: "network_error" };
+    }
+}
+async function readPersistedCredentialState() {
+    try {
+        const { getSetting } = await import("../storage/configStorage.js");
+        const signedOut = (await getSetting("PRISM_SYNALUX_SIGNED_OUT", "")) === "true";
+        const baseUrl = normalizePortalBaseUrl(await getSetting("PRISM_SYNALUX_BASE_URL", ""));
+        const apiKey = (await getSetting("PRISM_SYNALUX_API_KEY", "")).trim();
+        return { signedOut, baseUrl, apiKey };
+    }
+    catch (err) {
+        debugLog(`[synaluxJwt] persisted credential lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+function normalizePortalBaseUrl(raw) {
+    try {
+        const parsed = new URL(raw.trim());
+        const loopback = parsed.hostname === "localhost" ||
+            parsed.hostname === "127.0.0.1" || parsed.hostname === "::1" || parsed.hostname === "[::1]";
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback))
+            return "";
+        return parsed.origin;
+    }
+    catch {
+        return "";
+    }
+}
+const SYNALUX_API_KEY_PREFIX = ["synalux", "sk", ""].join("_");
+export function isUsableSynaluxApiKey(apiKey) {
+    return apiKey.startsWith(SYNALUX_API_KEY_PREFIX) && apiKey.length <= 512;
+}
 /**
  * Returns a usable JWT, exchanging from the sk_ token if needed.
  * Returns null when synalux is not configured or exchange fails.
@@ -54,24 +115,48 @@ export async function getSynaluxJwt() {
     let exchange;
     exchange = (async () => {
         try {
-            const url = `${baseUrl}/api/v1/auth/jwt`;
-            const res = await fetch(url, {
-                method: "POST",
-                headers: {
-                    "Authorization": `Bearer ${apiKey}`,
-                    "Content-Type": "application/json",
-                },
-                signal: AbortSignal.timeout(10_000),
-                redirect: "error",
-            });
-            if (!res.ok) {
-                debugLog(`[synaluxJwt] exchange HTTP ${res.status}`);
-                cache = null;
-                return null;
+            let attempt = await exchangeJwt(baseUrl, apiKey);
+            const requestOrigin = normalizePortalBaseUrl(baseUrl);
+            // MCP launchers can keep an older environment snapshot after the
+            // dashboard saves a freshly-linked account token. A valid explicit
+            // environment token remains authoritative; only an authentication
+            // rejection may try the newer persisted token, and only once.
+            if (attempt.kind === "http_error" && (attempt.status === 401 || attempt.status === 403)) {
+                const persisted = await readPersistedCredentialState();
+                if (persisted &&
+                    !persisted.signedOut &&
+                    !isSynaluxSignedOut() &&
+                    !!persisted.baseUrl &&
+                    persisted.baseUrl === requestOrigin &&
+                    isUsableSynaluxApiKey(persisted.apiKey) &&
+                    persisted.apiKey !== apiKey) {
+                    // The saved key may only recover the same portal origin.
+                    // Callers can resolve their request URL before this helper
+                    // returns, so cross-origin recovery would expose either the
+                    // refresh key or its short-lived JWT to the launcher URL.
+                    const recovered = await exchangeJwt(persisted.baseUrl, persisted.apiKey);
+                    if (recovered.kind === "success") {
+                        // Re-read after the network boundary. A sign-out or a
+                        // newer account link must win over this older retry.
+                        const current = await readPersistedCredentialState();
+                        if (current &&
+                            !current.signedOut &&
+                            !isSynaluxSignedOut() &&
+                            generation === requestGeneration &&
+                            current.baseUrl === persisted.baseUrl &&
+                            current.apiKey === persisted.apiKey) {
+                            process.env.PRISM_SYNALUX_API_KEY = persisted.apiKey;
+                            attempt = recovered;
+                            debugLog("[synaluxJwt] recovered from a stale launcher credential");
+                        }
+                        else {
+                            cache = null;
+                            return null;
+                        }
+                    }
+                }
             }
-            const data = (await res.json());
-            if (!data?.jwt) {
-                debugLog(`[synaluxJwt] exchange returned no jwt (status=${data?.status})`);
+            if (attempt.kind !== "success") {
                 cache = null;
                 return null;
             }
@@ -81,10 +166,9 @@ export async function getSynaluxJwt() {
             if (isSynaluxSignedOut() || generation !== requestGeneration) {
                 return null;
             }
-            const ttlMs = Math.max(MIN_CACHE_MS, (data.expires_in ?? 900) * 1000);
-            cache = { jwt: data.jwt, expiresAt: Date.now() + ttlMs };
-            debugLog(`[synaluxJwt] exchanged ok, ttl=${ttlMs}ms`);
-            return data.jwt;
+            cache = { jwt: attempt.jwt, expiresAt: Date.now() + attempt.ttlMs };
+            debugLog(`[synaluxJwt] exchanged ok, ttl=${attempt.ttlMs}ms`);
+            return attempt.jwt;
         }
         catch (err) {
             debugLog(`[synaluxJwt] exchange error: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.10",
+  "version": "20.21.11",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",