prism-mcp-server 20.21.7 → 20.21.10

package/README.md

@@ -58,12 +58,14 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 ```bash
 npm install -g prism-mcp-server
 prism connect
+prism dashboard
 ```
 
 Use `prism connect --dry-run` to preview changes, `prism connect --all` to
 configure every detected host, or `prism connect --refresh` to reconcile
 Prism-managed entries after an upgrade. Restart the host after connecting.
 
+`prism dashboard` opens the current local Mind Palace without a Synalux login.
 Prism works locally without an account, API key, or cloud subscription. Add a
 Synalux subscription when you want cloud memory, paid-tier skills, or team
 features.
@@ -149,6 +151,49 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.10
+
+### Signed-out Free dashboards keep working locally
+
+- Signing out now switches Project View, project details, and graph reads to
+  local SQLite without requiring an account, configuration edit, or restart.
+- The saved Synalux backend preference remains ready for the next sign-in;
+  accidental missing cloud credentials still fail closed.
+- Latest Activity uses the newest durable session when it is newer than the
+  saved handoff. Recent Sessions are newest first, and saved handoff versions
+  remain available as restore points.
+
+## What's New in v20.21.9
+
+### Prism Free opens without a Synalux account
+
+- Run `prism dashboard` to open the current local Mind Palace. No sign-in,
+  account-link code, API key, paid plan, or Free-plan redemption is required.
+- A bare local dashboard address now gives the exact local-open command instead
+  of rendering a broken account state.
+- Account & Settings shows Prism Free as active. Synalux linking remains an
+  optional action for cloud sync, billing, and paid features.
+- Local access stays protected without printing its browser capability into
+  startup output, and unsafe state paths or redirected identity probes fail
+  closed.
+
+## What's New in v20.21.8
+
+### Dashboard graphs use the authenticated Portal
+
+- The selected cloud project now shows its real session nodes and stored links
+  instead of collapsing to a keyword-only project bubble.
+- **Synthesize Edges** uses the authenticated Synalux Portal embedding contract;
+  the Prism dashboard process does not need a Google or Gemini API key.
+- Existing vectors and links are reused on repeat runs, synthesis fan-out is
+  bounded, and Portal failures are shown rather than rendered as an empty graph.
+- **Account & Settings** now shows the current user, role, and Free, Standard,
+  Advanced, or Enterprise plan, with visible sign-in, upgrade, billing, and
+  sign-out actions.
+- A selected paid plan survives the Portal sign-in round trip, live and test
+  Stripe catalogs resolve every paid tier, and localized checkout never reuses
+  a USD Price for another currency.
+
 ## What's New in v20.18.1
 
 ### Task skills survive compaction and update in place
@@ -912,8 +957,9 @@ Every conversation feeds a persistent store. The next session loads the right co
 
 The dashboard shows your current project state, pending TODOs, intent health, and a neural knowledge graph — all built automatically from your agent sessions.
 
-It runs on loopback and is gated by a per-startup token by default — open the
-tokenized URL printed in the startup log (`http://localhost:3000/?token=…`).
+It runs on loopback and is gated by a local token by default — run
+`prism dashboard` to open it without signing in. This local browser step is not
+a Free-plan redemption.
 Requests with an untrusted `Host`/`Origin` are refused, closing the DNS-rebinding
 exposure fixed in GHSA-9cvx-7x8q-3g6m. See [docs/IDE_SETUP.md](docs/IDE_SETUP.md#securing-the-dashboard)
 to pin the token, disable it, or configure Basic Auth / JWKS.

package/dist/cli.js

@@ -15,6 +15,7 @@ import { runBrowserCli } from './browserCli.js';
 import { filterPrismMemoryContext } from './utils/memoryQuality.js';
 import { isRecoverableStartupStorageError } from './utils/startupRecovery.js';
 import { verifyBehaviorHandler } from './tools/behavioralVerifierHandler.js';
+import { isLocalDashboardRunning, openDashboardUrl, readDashboardAccessState, } from './dashboard/dashboardAccess.js';
 const program = new Command();
 /** Build the stable `prism load --json` envelope from depth-specific context. */
 export function buildLoadJsonOutput(project, data, level, metadata) {
@@ -114,6 +115,28 @@ program
     .command('bootstrap')
     .description('Print the canonical dashboard-configured first-turn Prism greeting')
     .action(runBootstrapCommand);
+program
+    .command('dashboard')
+    .description('Open the current local Mind Palace dashboard (no Synalux account required)')
+    .option('--print', 'Print the current local dashboard link instead of opening a browser')
+    .action(async (options) => {
+    try {
+        const { url, probeKey } = readDashboardAccessState();
+        if (!(await isLocalDashboardRunning(url, probeKey))) {
+            throw new Error('The recorded Prism dashboard is not running. Restart your connected MCP host first.');
+        }
+        if (options.print) {
+            console.log(url);
+            return;
+        }
+        openDashboardUrl(url);
+        console.log('Opened the local Prism Free dashboard. No Synalux account is required.');
+    }
+    catch (error) {
+        console.error(`Dashboard unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+    }
+});
 /**
  * One-shot fallback for hosts whose long-lived MCP transport has closed.
  * This calls the canonical handler, including its authenticated portal path

package/dist/dashboard/accountRouter.js

@@ -0,0 +1,328 @@
+import { invalidateEntitlements } from "../utils/entitlements.js";
+import { getSynaluxJwt, invalidateSynaluxJwt } from "../utils/synaluxJwt.js";
+import { resolvePortalBaseUrl, usablePortalKey } from "../utils/synaluxSearch.js";
+import { isSynaluxSignedOut, setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
+const DEFAULT_PORTAL_URL = "https://synalux.ai";
+const MAX_BODY_BYTES = 16 * 1024;
+const VALID_PLANS = new Set(["free", "standard", "advanced", "enterprise"]);
+let accountMutationQueue = Promise.resolve();
+async function serializeAccountMutation(operation) {
+    const previous = accountMutationQueue;
+    let release;
+    accountMutationQueue = new Promise((resolve) => { release = resolve; });
+    await previous.catch(() => { });
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+    }
+}
+const defaultDeps = {
+    fetcher: fetch,
+    getSetting: async (key, defaultValue) => (await import("../storage/configStorage.js")).getSetting(key, defaultValue),
+    setSetting: async (key, value) => (await import("../storage/configStorage.js")).setSetting(key, value),
+    getJwt: getSynaluxJwt,
+    invalidateJwt: invalidateSynaluxJwt,
+    invalidateEntitlements,
+    closeStorage: async () => (await import("../storage/index.js")).closeStorage(),
+    resolvePortalBaseUrl,
+    usablePortalKey,
+};
+function json(res, status, body) {
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Cache-Control": "private, no-store",
+    });
+    res.end(JSON.stringify(body));
+}
+async function readJson(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > MAX_BODY_BYTES)
+            throw new Error("Request body too large");
+        chunks.push(buffer);
+    }
+    const raw = Buffer.concat(chunks).toString("utf8");
+    if (!raw)
+        return {};
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Body must be a JSON object");
+    }
+    return value;
+}
+function safePortalOrigin(raw) {
+    if (!raw)
+        return null;
+    try {
+        const upgraded = upgradeInsecureCloudUrl(raw.trim());
+        const parsed = new URL(upgraded);
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1", "::1", "[::1]"].includes(parsed.hostname))) {
+            return null;
+        }
+        return parsed.origin;
+    }
+    catch {
+        return null;
+    }
+}
+async function portalOrigin(deps) {
+    return safePortalOrigin(deps.resolvePortalBaseUrl())
+        ?? safePortalOrigin(await deps.getSetting("PRISM_SYNALUX_BASE_URL", ""))
+        ?? safePortalOrigin(await deps.getSetting("SYNALUX_BASE_URL", ""))
+        ?? DEFAULT_PORTAL_URL;
+}
+async function applyStoredSignOut(deps) {
+    const signedOut = (await deps.getSetting("PRISM_SYNALUX_SIGNED_OUT", "")) === "true";
+    setSynaluxSignedOut(signedOut);
+    if (signedOut)
+        delete process.env.PRISM_SYNALUX_API_KEY;
+    return signedOut;
+}
+function authUrl(origin) {
+    return `${origin}/auth?source=prism`;
+}
+function signedOutAccount(origin) {
+    return {
+        signed_in: false,
+        configured: false,
+        name: null,
+        role_key: null,
+        plan: "free",
+        billing: { action: "upgrade", url: `${origin}/pricing` },
+        auth_url: authUrl(origin),
+    };
+}
+function normalizeAccount(value, origin) {
+    if (!value || typeof value !== "object")
+        throw new Error("Portal returned an invalid account response");
+    const raw = value;
+    const plan = typeof raw.plan === "string" && VALID_PLANS.has(raw.plan) ? raw.plan : "free";
+    const billingRaw = raw.billing && typeof raw.billing === "object"
+        ? raw.billing
+        : {};
+    const action = billingRaw.action === "manage" || billingRaw.action === "included"
+        ? billingRaw.action
+        : "upgrade";
+    const url = typeof billingRaw.url === "string" && isAllowedBillingUrl(billingRaw.url, origin)
+        ? billingRaw.url
+        : null;
+    return {
+        signed_in: raw.signed_in === true,
+        configured: true,
+        name: typeof raw.name === "string" ? raw.name.slice(0, 160) : null,
+        role_key: typeof raw.role_key === "string" ? raw.role_key.slice(0, 80) : null,
+        plan: plan,
+        plan_source: raw.plan_source === "managed" ? "managed" : "stripe",
+        billing: { action, url },
+        auth_url: authUrl(origin),
+    };
+}
+function isAllowedBillingUrl(raw, origin) {
+    try {
+        const url = new URL(raw);
+        return url.origin === origin
+            || (url.protocol === "https:" && url.hostname === "billing.stripe.com");
+    }
+    catch {
+        return false;
+    }
+}
+async function accountWithJwt(deps, origin) {
+    let jwt = await deps.getJwt();
+    if (!jwt || isSynaluxSignedOut())
+        throw new Error("Synalux sign-in expired. Sign in again.");
+    const send = (token) => deps.fetcher(`${origin}/api/v1/prism/account`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+        signal: AbortSignal.timeout(10_000),
+        redirect: "error",
+    });
+    let response = await send(jwt);
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (response.status === 401) {
+        deps.invalidateJwt();
+        jwt = await deps.getJwt();
+        if (!jwt)
+            throw new Error("Synalux sign-in expired. Sign in again.");
+        response = await send(jwt);
+        if (isSynaluxSignedOut())
+            throw new Error("Synalux account is signed out");
+    }
+    if (!response.ok)
+        throw new Error(`Unable to load Synalux account (HTTP ${response.status})`);
+    const data = await response.json();
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    return normalizeAccount(data, origin);
+}
+export async function loadDashboardAccount(overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const origin = await portalOrigin(deps);
+    if (await applyStoredSignOut(deps))
+        return signedOutAccount(origin);
+    if (!deps.usablePortalKey())
+        return signedOutAccount(origin);
+    return accountWithJwt(deps, origin);
+}
+async function revokeRawToken(deps, origin, token) {
+    try {
+        const response = await deps.fetcher(`${origin}/api/v1/prism/account`, {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        return response.ok || response.status === 401;
+    }
+    catch {
+        return false;
+    }
+}
+export async function connectDashboardAccount(code, overrides = {}) {
+    return serializeAccountMutation(async () => {
+        const deps = { ...defaultDeps, ...overrides };
+        if (typeof code !== "string" || !code.startsWith("synalux_code_") || code.length > 256) {
+            throw new Error("Enter a valid one-time Prism sign-in code");
+        }
+        const origin = await portalOrigin(deps);
+        const response = await deps.fetcher(`${origin}/api/v1/auth/code-exchange`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Prism-Client": "prism-dashboard" },
+            body: JSON.stringify({ code, client: "prism" }),
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok)
+            throw new Error(typeof data.error === "string" ? data.error : "Prism sign-in failed");
+        const token = typeof data.api_token === "string" ? data.api_token : "";
+        if (!token.startsWith("synalux_sk_") || token.length > 512) {
+            throw new Error("Portal returned an invalid Prism credential");
+        }
+        try {
+            await deps.setSetting("PRISM_SYNALUX_BASE_URL", origin);
+            await deps.setSetting("PRISM_SYNALUX_API_KEY", token);
+            await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "false");
+        }
+        catch (error) {
+            await revokeRawToken(deps, origin, token);
+            await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "true").catch(() => { });
+            await deps.setSetting("PRISM_SYNALUX_API_KEY", "").catch(() => { });
+            throw new Error(`Could not save Prism sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        setSynaluxSignedOut(false);
+        process.env.PRISM_SYNALUX_BASE_URL = origin;
+        process.env.PRISM_SYNALUX_API_KEY = token;
+        deps.invalidateJwt();
+        deps.invalidateEntitlements();
+        await deps.closeStorage();
+        return accountWithJwt(deps, origin);
+    });
+}
+export async function openDashboardBilling(overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const origin = await portalOrigin(deps);
+    if (await applyStoredSignOut(deps) || !deps.usablePortalKey()) {
+        return { url: `${origin}/pricing`, action: "upgrade" };
+    }
+    let jwt = await deps.getJwt();
+    if (!jwt || isSynaluxSignedOut())
+        throw new Error("Synalux sign-in expired. Sign in again.");
+    const send = (token) => deps.fetcher(`${origin}/api/v1/prism/account`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+        signal: AbortSignal.timeout(10_000),
+        redirect: "error",
+    });
+    let response = await send(jwt);
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (response.status === 401) {
+        deps.invalidateJwt();
+        jwt = await deps.getJwt();
+        if (!jwt)
+            throw new Error("Synalux sign-in expired. Sign in again.");
+        response = await send(jwt);
+        if (isSynaluxSignedOut())
+            throw new Error("Synalux account is signed out");
+    }
+    const data = await response.json().catch(() => ({}));
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (!response.ok)
+        throw new Error(typeof data.error === "string" ? data.error : `Billing unavailable (HTTP ${response.status})`);
+    if (typeof data.url !== "string" || !isAllowedBillingUrl(data.url, origin)) {
+        throw new Error("Portal returned an unsafe billing URL");
+    }
+    return { url: data.url, action: typeof data.action === "string" ? data.action : "manage" };
+}
+export async function signOutDashboardAccount(overrides = {}) {
+    return serializeAccountMutation(async () => {
+        const deps = { ...defaultDeps, ...overrides };
+        const origin = await portalOrigin(deps);
+        const token = deps.usablePortalKey() ?? (await deps.getSetting("PRISM_SYNALUX_API_KEY", "")).trim();
+        // Cut off every local credential path before waiting on the network. The
+        // storage singleton captures its refresh token at construction, so clearing
+        // only process.env would leave an already-created backend signed in.
+        setSynaluxSignedOut(true);
+        delete process.env.PRISM_SYNALUX_API_KEY;
+        deps.invalidateJwt();
+        deps.invalidateEntitlements();
+        await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "true");
+        await deps.setSetting("PRISM_SYNALUX_API_KEY", "");
+        await deps.closeStorage();
+        const revoked = token ? await revokeRawToken(deps, origin, token) : true;
+        return { signed_out: true, revoked };
+    });
+}
+export async function handleAccountRoutes(url, req, res) {
+    if (url.pathname === "/api/account" && req.method === "GET") {
+        try {
+            json(res, 200, await loadDashboardAccount());
+        }
+        catch (error) {
+            json(res, 502, { error: error instanceof Error ? error.message : "Unable to load account" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/connect" && req.method === "POST") {
+        try {
+            const body = await readJson(req);
+            json(res, 200, await connectDashboardAccount(body.code));
+        }
+        catch (error) {
+            json(res, 400, { error: error instanceof Error ? error.message : "Prism sign-in failed" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/billing" && req.method === "POST") {
+        try {
+            json(res, 200, await openDashboardBilling());
+        }
+        catch (error) {
+            json(res, 502, { error: error instanceof Error ? error.message : "Billing unavailable" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/signout" && req.method === "POST") {
+        try {
+            const result = await signOutDashboardAccount();
+            json(res, result.revoked ? 200 : 502, {
+                ...result,
+                ...(result.revoked ? {} : { warning: "Signed out locally, but remote token revocation could not be confirmed" }),
+            });
+        }
+        catch (error) {
+            json(res, 500, { error: error instanceof Error ? error.message : "Sign-out failed" });
+        }
+        return true;
+    }
+    return false;
+}

package/dist/dashboard/dashboardAccess.js

@@ -0,0 +1,213 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createDashboardProbeRequest, DASHBOARD_PROBE_PATH, generateDashboardProbeKey, validateDashboardProbeKey, verifyDashboardProbeResponse, } from "./dashboardProbe.js";
+const DASHBOARD_URL_FILE = "dashboard.url";
+const MAX_DASHBOARD_URL_BYTES = 4096;
+export function dashboardAccessUrlPath(home = homedir()) {
+    return join(home, ".prism-mcp", DASHBOARD_URL_FILE);
+}
+function dashboardAccessDirectory(home) {
+    const directory = join(home, ".prism-mcp");
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error("Local dashboard directory is not a regular directory");
+    }
+    if (process.platform !== "win32")
+        chmodSync(directory, 0o700);
+    return directory;
+}
+function validateDashboardUrl(raw) {
+    const value = raw.trim();
+    if (!value || Buffer.byteLength(value, "utf8") > MAX_DASHBOARD_URL_BYTES) {
+        throw new Error("Local dashboard link is missing or invalid");
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error("Local dashboard link is invalid");
+    }
+    const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+    const queryKeys = [...parsed.searchParams.keys()];
+    if (parsed.protocol !== "http:" ||
+        !loopbackHosts.has(parsed.hostname) ||
+        !/^\d{1,5}$/.test(parsed.port) ||
+        Number(parsed.port) < 1 ||
+        Number(parsed.port) > 65535 ||
+        parsed.username ||
+        parsed.password ||
+        parsed.pathname !== "/" ||
+        parsed.hash ||
+        queryKeys.some((key) => key !== "token") ||
+        (parsed.searchParams.has("token") && !parsed.searchParams.get("token"))) {
+        throw new Error("Local dashboard link is invalid");
+    }
+    return parsed.toString();
+}
+/**
+ * Persist the current local dashboard link for the `prism dashboard` command.
+ * The token is a localhost capability, so the file is owner-only and symlinks
+ * present at validation time are rejected rather than followed. This is not a
+ * boundary against another process running as the same OS user: that process
+ * can already read or replace owner-only Prism state.
+ */
+export function writeDashboardAccessUrl(url, home = homedir(), probeKey = generateDashboardProbeKey()) {
+    const validated = validateDashboardUrl(url);
+    const validatedProbeKey = validateDashboardProbeKey(probeKey);
+    const directory = dashboardAccessDirectory(home);
+    const filePath = dashboardAccessUrlPath(home);
+    try {
+        const existing = lstatSync(filePath);
+        if (!existing.isFile() || existing.isSymbolicLink()) {
+            throw new Error("Local dashboard link path is not a regular file");
+        }
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    // Write a new regular file and atomically replace the directory entry. This
+    // never opens an existing target for writing, so a pre-existing target
+    // symlink cannot redirect the token write even on platforms without
+    // O_NOFOLLOW. The containing directory follows the same-OS-user trust model
+    // documented above.
+    const tempPath = join(directory, `.${DASHBOARD_URL_FILE}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+    const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
+    const fd = openSync(tempPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, 0o600);
+    let tempExists = true;
+    try {
+        if (process.platform !== "win32")
+            fchmodSync(fd, 0o600);
+        writeFileSync(fd, `${JSON.stringify({ version: 1, url: validated, probe_key: validatedProbeKey })}\n`, "utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(tempPath, filePath);
+        tempExists = false;
+        if (process.platform !== "win32")
+            chmodSync(filePath, 0o600);
+    }
+    finally {
+        if (tempExists) {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+    return filePath;
+}
+export function readDashboardAccessState(home = homedir()) {
+    dashboardAccessDirectory(home);
+    const filePath = dashboardAccessUrlPath(home);
+    const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
+    let fd;
+    try {
+        fd = openSync(filePath, fsConstants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            throw new Error("No current local dashboard link. Restart your connected MCP host first.");
+        }
+        if (code === "ELOOP")
+            throw new Error("Local dashboard link path is not a regular file");
+        throw error;
+    }
+    try {
+        // Validate and read the same opened object. A path-level lstat followed by
+        // readFileSync(path) permits the directory entry to be swapped between the
+        // check and use; O_NOFOLLOW plus fstat/read on this descriptor closes that
+        // race on POSIX without broadening the same-OS-user trust boundary.
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error("Local dashboard link path is not a regular file");
+        if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
+            throw new Error("Local dashboard link file permissions are unsafe");
+        }
+        const raw = readFileSync(fd, "utf8");
+        if (!raw || Buffer.byteLength(raw, "utf8") > MAX_DASHBOARD_URL_BYTES) {
+            throw new Error("Local dashboard link is missing or invalid");
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Local dashboard link is invalid");
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("Local dashboard link is invalid");
+        }
+        const state = parsed;
+        if (state.version !== 1 || typeof state.url !== "string" || typeof state.probe_key !== "string") {
+            throw new Error("Local dashboard link is invalid");
+        }
+        return {
+            url: validateDashboardUrl(state.url),
+            probeKey: validateDashboardProbeKey(state.probe_key),
+        };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function readDashboardAccessUrl(home = homedir()) {
+    return readDashboardAccessState(home).url;
+}
+export async function isLocalDashboardRunning(dashboardUrl, probeKey, fetcher = fetch) {
+    const validated = validateDashboardUrl(dashboardUrl);
+    const challenge = createDashboardProbeRequest(probeKey);
+    const probe = new URL(DASHBOARD_PROBE_PATH, validated);
+    probe.searchParams.set("nonce", challenge.nonce);
+    probe.searchParams.set("proof", challenge.proof);
+    try {
+        const response = await fetcher(probe, {
+            redirect: "error",
+            signal: AbortSignal.timeout(1_500),
+        });
+        if (!response.ok)
+            return false;
+        const finalUrl = response.url ? new URL(response.url) : probe;
+        if (finalUrl.href !== probe.href) {
+            return false;
+        }
+        const body = await response.json();
+        return body.name === "Prism Mind Palace" &&
+            body.nonce === challenge.nonce &&
+            typeof body.proof === "string" &&
+            verifyDashboardProbeResponse(probeKey, challenge.nonce, body.proof);
+    }
+    catch {
+        return false;
+    }
+}
+export function dashboardOpenCommand(url, platform = process.platform) {
+    const validated = validateDashboardUrl(url);
+    if (platform === "darwin")
+        return { command: "open", args: [validated] };
+    if (platform === "win32") {
+        return { command: "rundll32", args: ["url.dll,FileProtocolHandler", validated] };
+    }
+    return { command: "xdg-open", args: [validated] };
+}
+export function openDashboardUrl(url, platform = process.platform, runner = (command, args) => spawnSync(command, args, {
+    shell: false,
+    stdio: "ignore",
+    timeout: 5_000,
+    windowsHide: true,
+})) {
+    const launch = dashboardOpenCommand(url, platform);
+    const result = runner(launch.command, launch.args);
+    if (result.error || result.status !== 0) {
+        throw new Error("Could not open the local dashboard browser");
+    }
+}