prism-mcp-server 20.21.10 → 20.21.12

package/README.md

@@ -151,6 +151,29 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.12
+
+### Multiple MCP hosts keep a working dashboard link
+
+- Each running Prism host now registers its local dashboard independently.
+- `prism dashboard` and the startup message verify the newest candidates and
+  fall back to an older live dashboard when a newer host stops.
+- Instance cleanup cannot remove another host's registration, and the open
+  message preserves the linked account and plan description.
+
+## What's New in v20.21.11
+
+### Linked accounts persist across dashboard refreshes
+
+- A host process with an obsolete launch credential now recovers from the
+  newer account saved by the dashboard after the obsolete credential is
+  rejected.
+- Valid host credentials remain authoritative; sign-out, concurrent account
+  changes, network failures, and server failures do not trigger an unsafe
+  credential switch.
+- `prism dashboard` opens the active local dashboard without relabeling a
+  linked Standard, Advanced, or Enterprise account as Free.
+
 ## What's New in v20.21.10
 
 ### Signed-out Free dashboards keep working locally

package/dist/cli.js

@@ -15,7 +15,7 @@ import { runBrowserCli } from './browserCli.js';
 import { filterPrismMemoryContext } from './utils/memoryQuality.js';
 import { isRecoverableStartupStorageError } from './utils/startupRecovery.js';
 import { verifyBehaviorHandler } from './tools/behavioralVerifierHandler.js';
-import { isLocalDashboardRunning, openDashboardUrl, readDashboardAccessState, } from './dashboard/dashboardAccess.js';
+import { dashboardOpenSuccessMessage, findRunningDashboardAccessState, openDashboardUrl, } from './dashboard/dashboardAccess.js';
 const program = new Command();
 /** Build the stable `prism load --json` envelope from depth-specific context. */
 export function buildLoadJsonOutput(project, data, level, metadata) {
@@ -121,16 +121,13 @@ program
     .option('--print', 'Print the current local dashboard link instead of opening a browser')
     .action(async (options) => {
     try {
-        const { url, probeKey } = readDashboardAccessState();
-        if (!(await isLocalDashboardRunning(url, probeKey))) {
-            throw new Error('The recorded Prism dashboard is not running. Restart your connected MCP host first.');
-        }
+        const { url } = await findRunningDashboardAccessState();
         if (options.print) {
             console.log(url);
             return;
         }
         openDashboardUrl(url);
-        console.log('Opened the local Prism Free dashboard. No Synalux account is required.');
+        console.log(dashboardOpenSuccessMessage());
     }
     catch (error) {
         console.error(`Dashboard unavailable: ${error instanceof Error ? error.message : String(error)}`);

package/dist/dashboard/dashboardAccess.js

@@ -1,14 +1,19 @@
 import { spawnSync } from "node:child_process";
-import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { createDashboardProbeRequest, DASHBOARD_PROBE_PATH, generateDashboardProbeKey, validateDashboardProbeKey, verifyDashboardProbeResponse, } from "./dashboardProbe.js";
 const DASHBOARD_URL_FILE = "dashboard.url";
+const DASHBOARD_REGISTRY_DIRECTORY = "dashboard-instances";
 const MAX_DASHBOARD_URL_BYTES = 4096;
+const DASHBOARD_INSTANCE_ID = /^[a-f0-9]{32}$/;
 export function dashboardAccessUrlPath(home = homedir()) {
     return join(home, ".prism-mcp", DASHBOARD_URL_FILE);
 }
+export function dashboardAccessRegistryPath(home = homedir()) {
+    return join(home, ".prism-mcp", DASHBOARD_REGISTRY_DIRECTORY);
+}
 function dashboardAccessDirectory(home) {
     const directory = join(home, ".prism-mcp");
     mkdirSync(directory, { recursive: true, mode: 0o700 });
@@ -20,6 +25,18 @@ function dashboardAccessDirectory(home) {
         chmodSync(directory, 0o700);
     return directory;
 }
+function dashboardRegistryDirectory(home) {
+    dashboardAccessDirectory(home);
+    const directory = dashboardAccessRegistryPath(home);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error("Local dashboard registry is not a regular directory");
+    }
+    if (process.platform !== "win32")
+        chmodSync(directory, 0o700);
+    return directory;
+}
 function validateDashboardUrl(raw) {
     const value = raw.trim();
     if (!value || Buffer.byteLength(value, "utf8") > MAX_DASHBOARD_URL_BYTES) {
@@ -49,22 +66,11 @@ function validateDashboardUrl(raw) {
     }
     return parsed.toString();
 }
-/**
- * Persist the current local dashboard link for the `prism dashboard` command.
- * The token is a localhost capability, so the file is owner-only and symlinks
- * present at validation time are rejected rather than followed. This is not a
- * boundary against another process running as the same OS user: that process
- * can already read or replace owner-only Prism state.
- */
-export function writeDashboardAccessUrl(url, home = homedir(), probeKey = generateDashboardProbeKey()) {
-    const validated = validateDashboardUrl(url);
-    const validatedProbeKey = validateDashboardProbeKey(probeKey);
-    const directory = dashboardAccessDirectory(home);
-    const filePath = dashboardAccessUrlPath(home);
+function writeOwnerOnlyJson(filePath, directory, value, label) {
     try {
         const existing = lstatSync(filePath);
         if (!existing.isFile() || existing.isSymbolicLink()) {
-            throw new Error("Local dashboard link path is not a regular file");
+            throw new Error(`${label} path is not a regular file`);
         }
     }
     catch (error) {
@@ -77,14 +83,14 @@ export function writeDashboardAccessUrl(url, home = homedir(), probeKey = genera
     // symlink cannot redirect the token write even on platforms without
     // O_NOFOLLOW. The containing directory follows the same-OS-user trust model
     // documented above.
-    const tempPath = join(directory, `.${DASHBOARD_URL_FILE}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+    const tempPath = join(directory, `.${basename(filePath)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
     const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
     const fd = openSync(tempPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, 0o600);
     let tempExists = true;
     try {
         if (process.platform !== "win32")
             fchmodSync(fd, 0o600);
-        writeFileSync(fd, `${JSON.stringify({ version: 1, url: validated, probe_key: validatedProbeKey })}\n`, "utf8");
+        writeFileSync(fd, `${JSON.stringify(value)}\n`, "utf8");
     }
     finally {
         closeSync(fd);
@@ -105,9 +111,7 @@ export function writeDashboardAccessUrl(url, home = homedir(), probeKey = genera
     }
     return filePath;
 }
-export function readDashboardAccessState(home = homedir()) {
-    dashboardAccessDirectory(home);
-    const filePath = dashboardAccessUrlPath(home);
+function readOwnerOnlyJson(filePath, label, missingMessage) {
     const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
     let fd;
     try {
@@ -115,11 +119,10 @@ export function readDashboardAccessState(home = homedir()) {
     }
     catch (error) {
         const code = error.code;
-        if (code === "ENOENT") {
-            throw new Error("No current local dashboard link. Restart your connected MCP host first.");
-        }
+        if (code === "ENOENT" && missingMessage)
+            throw new Error(missingMessage);
         if (code === "ELOOP")
-            throw new Error("Local dashboard link path is not a regular file");
+            throw new Error(`${label} path is not a regular file`);
         throw error;
     }
     try {
@@ -129,40 +132,215 @@ export function readDashboardAccessState(home = homedir()) {
         // race on POSIX without broadening the same-OS-user trust boundary.
         const stat = fstatSync(fd);
         if (!stat.isFile())
-            throw new Error("Local dashboard link path is not a regular file");
+            throw new Error(`${label} path is not a regular file`);
         if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
-            throw new Error("Local dashboard link file permissions are unsafe");
+            throw new Error(`${label} file permissions are unsafe`);
         }
         const raw = readFileSync(fd, "utf8");
         if (!raw || Buffer.byteLength(raw, "utf8") > MAX_DASHBOARD_URL_BYTES) {
-            throw new Error("Local dashboard link is missing or invalid");
+            throw new Error(`${label} is missing or invalid`);
         }
-        let parsed;
         try {
-            parsed = JSON.parse(raw);
+            return JSON.parse(raw);
         }
         catch {
-            throw new Error("Local dashboard link is invalid");
-        }
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("Local dashboard link is invalid");
-        }
-        const state = parsed;
-        if (state.version !== 1 || typeof state.url !== "string" || typeof state.probe_key !== "string") {
-            throw new Error("Local dashboard link is invalid");
+            throw new Error(`${label} is invalid`);
         }
-        return {
-            url: validateDashboardUrl(state.url),
-            probeKey: validateDashboardProbeKey(state.probe_key),
-        };
     }
     finally {
         closeSync(fd);
     }
 }
+function parseDashboardAccessState(parsed, label) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`${label} is invalid`);
+    }
+    const state = parsed;
+    if (state.version !== 1 || typeof state.url !== "string" || typeof state.probe_key !== "string") {
+        throw new Error(`${label} is invalid`);
+    }
+    return {
+        url: validateDashboardUrl(state.url),
+        probeKey: validateDashboardProbeKey(state.probe_key),
+    };
+}
+/**
+ * Persist the latest local dashboard link for older Prism clients. Current
+ * clients discover live dashboards from the per-instance registry below.
+ * The token is a localhost capability, so the file is owner-only and symlinks
+ * present at validation time are rejected rather than followed. This is not a
+ * boundary against another process running as the same OS user: that process
+ * can already read or replace owner-only Prism state.
+ */
+export function writeDashboardAccessUrl(url, home = homedir(), probeKey = generateDashboardProbeKey()) {
+    const validated = validateDashboardUrl(url);
+    const validatedProbeKey = validateDashboardProbeKey(probeKey);
+    const directory = dashboardAccessDirectory(home);
+    return writeOwnerOnlyJson(dashboardAccessUrlPath(home), directory, { version: 1, url: validated, probe_key: validatedProbeKey }, "Local dashboard link");
+}
+export function readDashboardAccessState(home = homedir()) {
+    dashboardAccessDirectory(home);
+    return parseDashboardAccessState(readOwnerOnlyJson(dashboardAccessUrlPath(home), "Local dashboard link", "No current local dashboard link. Restart your connected MCP host first."), "Local dashboard link");
+}
 export function readDashboardAccessUrl(home = homedir()) {
     return readDashboardAccessState(home).url;
 }
+function validateDashboardInstanceId(value) {
+    if (!DASHBOARD_INSTANCE_ID.test(value)) {
+        throw new Error("Local dashboard instance ID is invalid");
+    }
+    return value;
+}
+function validateRegistrationInteger(value, label, allowZero = false) {
+    if (!Number.isSafeInteger(value) || (allowZero ? value < 0 : value < 1)) {
+        throw new Error(`Local dashboard ${label} is invalid`);
+    }
+    return value;
+}
+function parseDashboardAccessRecord(parsed, recordPath, expectedInstanceId) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Local dashboard registry record is invalid");
+    }
+    const record = parsed;
+    if (record.version !== 1 ||
+        typeof record.instance_id !== "string" ||
+        typeof record.pid !== "number" ||
+        typeof record.registered_at_ms !== "number" ||
+        typeof record.url !== "string" ||
+        typeof record.probe_key !== "string") {
+        throw new Error("Local dashboard registry record is invalid");
+    }
+    const instanceId = validateDashboardInstanceId(record.instance_id);
+    if (instanceId !== expectedInstanceId) {
+        throw new Error("Local dashboard registry record is invalid");
+    }
+    return {
+        instanceId,
+        pid: validateRegistrationInteger(record.pid, "process ID"),
+        registeredAtMs: validateRegistrationInteger(record.registered_at_ms, "registration time", true),
+        url: validateDashboardUrl(record.url),
+        probeKey: validateDashboardProbeKey(record.probe_key),
+        recordPath,
+    };
+}
+function readDashboardAccessRecord(recordPath, instanceId) {
+    return parseDashboardAccessRecord(readOwnerOnlyJson(recordPath, "Local dashboard registry record"), recordPath, instanceId);
+}
+function unregisterDashboardAccessRecord(record) {
+    let current;
+    try {
+        current = readDashboardAccessRecord(record.recordPath, record.instanceId);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        return;
+    }
+    if (current.pid !== record.pid ||
+        current.registeredAtMs !== record.registeredAtMs ||
+        current.url !== record.url ||
+        current.probeKey !== record.probeKey) {
+        return;
+    }
+    try {
+        unlinkSync(record.recordPath);
+    }
+    catch {
+        // Best effort: an unreadable registry must not block another live instance.
+    }
+}
+function isDashboardProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM proves the process exists but is owned by a different principal.
+        return error.code === "EPERM";
+    }
+}
+/** Register one running dashboard without replacing records for other hosts. */
+export function registerDashboardAccessUrl(url, home = homedir(), probeKey = generateDashboardProbeKey(), options = {}) {
+    const validatedUrl = validateDashboardUrl(url);
+    const validatedProbeKey = validateDashboardProbeKey(probeKey);
+    const instanceId = validateDashboardInstanceId(options.instanceId ?? randomBytes(16).toString("hex"));
+    const pid = validateRegistrationInteger(options.pid ?? process.pid, "process ID");
+    const registeredAtMs = validateRegistrationInteger(options.registeredAtMs ?? Date.now(), "registration time", true);
+    // Preserve the singleton file for clients released before the registry.
+    writeDashboardAccessUrl(validatedUrl, home, validatedProbeKey);
+    const directory = dashboardRegistryDirectory(home);
+    const recordPath = join(directory, `${instanceId}.json`);
+    const record = {
+        instanceId,
+        pid,
+        registeredAtMs,
+        url: validatedUrl,
+        probeKey: validatedProbeKey,
+        recordPath,
+    };
+    writeOwnerOnlyJson(recordPath, directory, {
+        version: 1,
+        instance_id: instanceId,
+        pid,
+        registered_at_ms: registeredAtMs,
+        url: validatedUrl,
+        probe_key: validatedProbeKey,
+    }, "Local dashboard registry record");
+    return {
+        recordPath,
+        state: { url: validatedUrl, probeKey: validatedProbeKey },
+        unregister: () => unregisterDashboardAccessRecord(record),
+    };
+}
+function readDashboardAccessRecords(home) {
+    const directory = dashboardRegistryDirectory(home);
+    const records = [];
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const match = /^([a-f0-9]{32})\.json$/.exec(entry.name);
+        if (!match || !entry.isFile() || entry.isSymbolicLink())
+            continue;
+        try {
+            records.push(readDashboardAccessRecord(join(directory, entry.name), match[1]));
+        }
+        catch {
+            // A malformed or unsafe record can never become a dashboard capability.
+        }
+    }
+    return records.sort((left, right) => right.registeredAtMs - left.registeredAtMs || right.instanceId.localeCompare(left.instanceId));
+}
+/**
+ * Return the newest cryptographically verified dashboard that is still alive.
+ * Dead registry entries are removed one at a time; a surviving instance is
+ * never deleted just because a newer process stopped.
+ */
+export async function findRunningDashboardAccessState(home = homedir(), fetcher = fetch) {
+    const records = readDashboardAccessRecords(home);
+    const probed = new Set();
+    for (const record of records) {
+        const key = `${record.url}\n${record.probeKey}`;
+        probed.add(key);
+        if (await isLocalDashboardRunning(record.url, record.probeKey, fetcher)) {
+            return { url: record.url, probeKey: record.probeKey };
+        }
+        // One timeout is not proof that a live host is dead. Remove the record only
+        // when the owning PID is also gone; otherwise preserve it for a later retry.
+        if (!isDashboardProcessAlive(record.pid))
+            unregisterDashboardAccessRecord(record);
+    }
+    // A singleton-only record was written by Prism versions before this registry.
+    try {
+        const legacy = readDashboardAccessState(home);
+        const key = `${legacy.url}\n${legacy.probeKey}`;
+        if (!probed.has(key) && await isLocalDashboardRunning(legacy.url, legacy.probeKey, fetcher)) {
+            return legacy;
+        }
+    }
+    catch (error) {
+        if (records.length === 0)
+            throw error;
+    }
+    throw new Error("No registered Prism dashboard is running. Restart your connected MCP host first.");
+}
 export async function isLocalDashboardRunning(dashboardUrl, probeKey, fetcher = fetch) {
     const validated = validateDashboardUrl(dashboardUrl);
     const challenge = createDashboardProbeRequest(probeKey);
@@ -190,6 +368,9 @@ export async function isLocalDashboardRunning(dashboardUrl, probeKey, fetcher =
         return false;
     }
 }
+export function dashboardOpenSuccessMessage() {
+    return "Opened the current local Prism dashboard in your default browser. Your Synalux account and plan are unchanged.";
+}
 export function dashboardOpenCommand(url, platform = process.platform) {
     const validated = validateDashboardUrl(url);
     if (platform === "darwin")

package/dist/dashboard/server.js

@@ -26,7 +26,7 @@ import { activeStorageBackend } from "../storage/index.js";
 import { readDashboardLedger } from "./ledgerReader.js";
 import { PRISM_USER_ID, SERVER_CONFIG } from "../config.js";
 import { renderDashboardHTML, renderDashboardLocalOpenHTML } from "./ui.js";
-import { writeDashboardAccessUrl } from "./dashboardAccess.js";
+import { registerDashboardAccessUrl } from "./dashboardAccess.js";
 import { createDashboardProbeResponse, DASHBOARD_PROBE_PATH, generateDashboardProbeKey, verifyDashboardProbeRequest, } from "./dashboardProbe.js";
 import { computeIntentHealth } from "./intentHealth.js";
 import { getAllSettings, setSetting, getSetting, getSettingSync } from "../storage/configStorage.js";
@@ -1488,7 +1488,13 @@ self.addEventListener('message', (e) => {
         // Non-fatal — just means the user has to know the port
     }
     try {
-        writeDashboardAccessUrl(dashboardUrl, os.homedir(), DASHBOARD_PROBE_KEY);
+        const registration = registerDashboardAccessUrl(dashboardUrl, os.homedir(), DASHBOARD_PROBE_KEY);
+        const unregister = registration.unregister;
+        httpServer.once("close", () => {
+            unregister();
+            process.removeListener("exit", unregister);
+        });
+        process.once("exit", unregister);
     }
     catch (error) {
         console.error(`[Dashboard] Could not save local opener link: ${error instanceof Error ? error.message : String(error)}`);

package/dist/dashboard/ui.js

@@ -34,12 +34,12 @@ export function renderDashboardLocalOpenHTML() {
 </head>
 <body>
   <main>
-    <div class="eyebrow">Local Prism Free</div>
-    <h1>No account is required.</h1>
-    <p>This browser needs the current local dashboard link after Prism starts. Run this command in Terminal; it opens the dashboard directly without Synalux sign-in or plan redemption.</p>
+    <div class="eyebrow">Local dashboard access</div>
+    <h1>Open the current Prism dashboard.</h1>
+    <p>This browser does not have the current local dashboard link. Run this command in Terminal to open the active dashboard securely. Your Synalux account and plan remain unchanged.</p>
     <code>prism dashboard</code>
     <button type="button" onclick="navigator.clipboard.writeText('prism dashboard').then(() => { this.textContent = 'Copied'; })">Copy command</button>
-    <p class="note">Synalux sign-in remains optional for cloud sync, billing, and paid features.</p>
+    <p class="note">This local browser access check is separate from Synalux sign-in.</p>
   </main>
 </body>
 </html>`;

package/dist/storage/index.js

@@ -4,6 +4,7 @@ import { SupabaseStorage } from "./supabase.js";
 import { getSetting } from "./configStorage.js";
 import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
 import { isSynaluxSignedOut, setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { getSynaluxJwt, isUsableSynaluxApiKey } from "../utils/synaluxJwt.js";
 export function isValidHttpUrl(url) {
     try {
         const parsed = new URL(url);
@@ -56,15 +57,35 @@ export async function ensureSynaluxCredentials() {
         delete process.env.PRISM_SYNALUX_API_KEY;
         return false;
     }
-    if (SYNALUX_CONFIGURED)
-        return true;
     // Re-check process.env directly: SYNALUX_CONFIGURED is captured at module
     // load, so credentials injected later by another caller would be invisible
     // to it. Mirrors ensureSupabaseCredentials below.
     const rawEnvUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || process.env.SYNALUX_BASE_URL?.trim();
     const envUrl = rawEnvUrl ? upgradeInsecureCloudUrl(rawEnvUrl) : rawEnvUrl;
     const envKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
-    if (envUrl && envKey && isValidHttpUrl(envUrl))
+    if (envUrl && envKey && isValidHttpUrl(envUrl)) {
+        const storedKey = (await getSetting("PRISM_SYNALUX_API_KEY", ""))?.trim();
+        if (isUsableSynaluxApiKey(storedKey) &&
+            storedKey !== envKey) {
+            // Validate the launcher credential before SynaluxStorage captures it.
+            // getSynaluxJwt keeps a valid explicit env key authoritative and promotes
+            // the persisted key only after the env key receives 401/403 and the
+            // persisted key succeeds.
+            const validatedJwt = await getSynaluxJwt();
+            if (!validatedJwt) {
+                // A launcher can retain a revoked credential while the dashboard has
+                // already saved the replacement. Do not let SynaluxStorage capture
+                // the launcher key when the validation/recovery request is currently
+                // unavailable: its refresh token is immutable, so publishing that
+                // singleton would keep project access broken even after recovery.
+                throw new Error("[Prism Storage] Could not validate the active Synalux account credential. " +
+                    "Refusing to initialize cloud storage with an unverified credential because that could " +
+                    "strand project access or split session history. Retry when Synalux is reachable.");
+            }
+        }
+        return true;
+    }
+    if (SYNALUX_CONFIGURED)
         return true;
     const rawUrl = (await getSetting("PRISM_SYNALUX_BASE_URL"))?.trim() ||
         (await getSetting("SYNALUX_BASE_URL"))?.trim();

package/dist/tools/ledgerHandlers.js

@@ -36,6 +36,7 @@ import { renderFloorDigestBlock, skillDigestFromSource, splitSkillFrontmatter }
 import { mergeHandoff, dbToHandoffSchema, sanitizeForMerge } from "../utils/crdtMerge.js";
 import { resolveProject } from "../utils/projectResolver.js";
 import { getUpdateNotice } from "../updateNotice.js";
+import { findRunningDashboardAccessState } from "../dashboard/dashboardAccess.js";
 // The running server's own version, for the update-available notice. A read
 // failure must never affect startup: an empty string fails the notice's
 // semver gate, so no notice renders rather than a bogus "running 0.0.0".
@@ -610,14 +611,29 @@ function freeTierUpgradeLine(tier) {
  * a private localhost capability, so startup advertises the local CLI opener
  * rather than copying that link into agent context.
  */
-async function readDashboardUrl() {
+export async function readDashboardUrlForStartup(home = os.homedir()) {
+    const explicitPort = (process.env.PRISM_DASHBOARD_PORT || "").trim();
+    // Current Prism versions keep one signed record per dashboard instance. The
+    // newest record may belong to a host that just stopped, so use the same
+    // verified fallback selection as `prism dashboard` before consulting legacy
+    // singleton state. An explicit port remains authoritative for this process.
+    if (!explicitPort) {
+        try {
+            const state = await findRunningDashboardAccessState(home);
+            return new URL(state.url).origin;
+        }
+        catch {
+            // Continue into the legacy port probe for older installations and the
+            // startup instant before this process has written its registry record.
+        }
+    }
     // Precedence: explicit env override > recorded port file > default. The
     // file is written by whatever dashboard ran last and persists across boots,
     // so it must never outrank configuration the operator set for THIS process.
-    let port = (process.env.PRISM_DASHBOARD_PORT || "").trim();
+    let port = explicitPort;
     if (!port) {
         try {
-            const recorded = fs.readFileSync(nodePath.join(os.homedir(), ".prism-mcp", "dashboard.port"), "utf8").trim();
+            const recorded = fs.readFileSync(nodePath.join(home, ".prism-mcp", "dashboard.port"), "utf8").trim();
             if (/^\d{2,5}$/.test(recorded))
                 port = recorded;
         }
@@ -2338,7 +2354,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         ? greeting
         : `${greeting}\n\n${identityBlock}${updateNotice ? `\n${updateNotice}` : ""}`;
     if (projects.length === 0) {
-        const dashboardUrl = await readDashboardUrl();
+        const dashboardUrl = await readDashboardUrlForStartup();
         const dashboardLine = dashboardUrl
             ? `- 🎛️ **Dashboard:** run \`prism dashboard\` — opens locally with no Synalux account required`
             : `- 🎛️ **Dashboard:** not running — start Prism's dashboard to configure projects, identity, and context depth`;

package/dist/utils/synaluxJwt.js

@@ -27,6 +27,67 @@ const MIN_CACHE_MS = 60_000;
 let cache = null;
 let inFlight = null;
 let generation = 0;
+async function exchangeJwt(baseUrl, apiKey) {
+    try {
+        const res = await fetch(`${baseUrl}/api/v1/auth/jwt`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        if (!res.ok) {
+            debugLog(`[synaluxJwt] exchange HTTP ${res.status}`);
+            return { kind: "http_error", status: res.status };
+        }
+        const data = (await res.json());
+        if (!data?.jwt) {
+            debugLog(`[synaluxJwt] exchange returned no jwt (status=${data?.status})`);
+            return { kind: "invalid_response" };
+        }
+        return {
+            kind: "success",
+            jwt: data.jwt,
+            ttlMs: Math.max(MIN_CACHE_MS, (data.expires_in ?? 900) * 1000),
+        };
+    }
+    catch (err) {
+        debugLog(`[synaluxJwt] exchange error: ${err instanceof Error ? err.message : String(err)}`);
+        return { kind: "network_error" };
+    }
+}
+async function readPersistedCredentialState() {
+    try {
+        const { getSetting } = await import("../storage/configStorage.js");
+        const signedOut = (await getSetting("PRISM_SYNALUX_SIGNED_OUT", "")) === "true";
+        const baseUrl = normalizePortalBaseUrl(await getSetting("PRISM_SYNALUX_BASE_URL", ""));
+        const apiKey = (await getSetting("PRISM_SYNALUX_API_KEY", "")).trim();
+        return { signedOut, baseUrl, apiKey };
+    }
+    catch (err) {
+        debugLog(`[synaluxJwt] persisted credential lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+function normalizePortalBaseUrl(raw) {
+    try {
+        const parsed = new URL(raw.trim());
+        const loopback = parsed.hostname === "localhost" ||
+            parsed.hostname === "127.0.0.1" || parsed.hostname === "::1" || parsed.hostname === "[::1]";
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback))
+            return "";
+        return parsed.origin;
+    }
+    catch {
+        return "";
+    }
+}
+const SYNALUX_API_KEY_PREFIX = ["synalux", "sk", ""].join("_");
+export function isUsableSynaluxApiKey(apiKey) {
+    return apiKey.startsWith(SYNALUX_API_KEY_PREFIX) && apiKey.length <= 512;
+}
 /**
  * Returns a usable JWT, exchanging from the sk_ token if needed.
  * Returns null when synalux is not configured or exchange fails.
@@ -54,24 +115,48 @@ export async function getSynaluxJwt() {
     let exchange;
     exchange = (async () => {
         try {
-            const url = `${baseUrl}/api/v1/auth/jwt`;
-            const res = await fetch(url, {
-                method: "POST",
-                headers: {
-                    "Authorization": `Bearer ${apiKey}`,
-                    "Content-Type": "application/json",
-                },
-                signal: AbortSignal.timeout(10_000),
-                redirect: "error",
-            });
-            if (!res.ok) {
-                debugLog(`[synaluxJwt] exchange HTTP ${res.status}`);
-                cache = null;
-                return null;
+            let attempt = await exchangeJwt(baseUrl, apiKey);
+            const requestOrigin = normalizePortalBaseUrl(baseUrl);
+            // MCP launchers can keep an older environment snapshot after the
+            // dashboard saves a freshly-linked account token. A valid explicit
+            // environment token remains authoritative; only an authentication
+            // rejection may try the newer persisted token, and only once.
+            if (attempt.kind === "http_error" && (attempt.status === 401 || attempt.status === 403)) {
+                const persisted = await readPersistedCredentialState();
+                if (persisted &&
+                    !persisted.signedOut &&
+                    !isSynaluxSignedOut() &&
+                    !!persisted.baseUrl &&
+                    persisted.baseUrl === requestOrigin &&
+                    isUsableSynaluxApiKey(persisted.apiKey) &&
+                    persisted.apiKey !== apiKey) {
+                    // The saved key may only recover the same portal origin.
+                    // Callers can resolve their request URL before this helper
+                    // returns, so cross-origin recovery would expose either the
+                    // refresh key or its short-lived JWT to the launcher URL.
+                    const recovered = await exchangeJwt(persisted.baseUrl, persisted.apiKey);
+                    if (recovered.kind === "success") {
+                        // Re-read after the network boundary. A sign-out or a
+                        // newer account link must win over this older retry.
+                        const current = await readPersistedCredentialState();
+                        if (current &&
+                            !current.signedOut &&
+                            !isSynaluxSignedOut() &&
+                            generation === requestGeneration &&
+                            current.baseUrl === persisted.baseUrl &&
+                            current.apiKey === persisted.apiKey) {
+                            process.env.PRISM_SYNALUX_API_KEY = persisted.apiKey;
+                            attempt = recovered;
+                            debugLog("[synaluxJwt] recovered from a stale launcher credential");
+                        }
+                        else {
+                            cache = null;
+                            return null;
+                        }
+                    }
+                }
             }
-            const data = (await res.json());
-            if (!data?.jwt) {
-                debugLog(`[synaluxJwt] exchange returned no jwt (status=${data?.status})`);
+            if (attempt.kind !== "success") {
                 cache = null;
                 return null;
             }
@@ -81,10 +166,9 @@ export async function getSynaluxJwt() {
             if (isSynaluxSignedOut() || generation !== requestGeneration) {
                 return null;
             }
-            const ttlMs = Math.max(MIN_CACHE_MS, (data.expires_in ?? 900) * 1000);
-            cache = { jwt: data.jwt, expiresAt: Date.now() + ttlMs };
-            debugLog(`[synaluxJwt] exchanged ok, ttl=${ttlMs}ms`);
-            return data.jwt;
+            cache = { jwt: attempt.jwt, expiresAt: Date.now() + attempt.ttlMs };
+            debugLog(`[synaluxJwt] exchanged ok, ttl=${attempt.ttlMs}ms`);
+            return attempt.jwt;
         }
         catch (err) {
             debugLog(`[synaluxJwt] exchange error: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.10",
+  "version": "20.21.12",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",