prism-mcp-server 20.21.8 → 20.21.11

package/README.md

@@ -58,12 +58,14 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 ```bash
 npm install -g prism-mcp-server
 prism connect
+prism dashboard
 ```
 
 Use `prism connect --dry-run` to preview changes, `prism connect --all` to
 configure every detected host, or `prism connect --refresh` to reconcile
 Prism-managed entries after an upgrade. Restart the host after connecting.
 
+`prism dashboard` opens the current local Mind Palace without a Synalux login.
 Prism works locally without an account, API key, or cloud subscription. Add a
 Synalux subscription when you want cloud memory, paid-tier skills, or team
 features.
@@ -149,6 +151,45 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.11
+
+### Linked accounts persist across dashboard refreshes
+
+- A host process with an obsolete launch credential now recovers from the
+  newer account saved by the dashboard after the obsolete credential is
+  rejected.
+- Valid host credentials remain authoritative; sign-out, concurrent account
+  changes, network failures, and server failures do not trigger an unsafe
+  credential switch.
+- `prism dashboard` opens the active local dashboard without relabeling a
+  linked Standard, Advanced, or Enterprise account as Free.
+
+## What's New in v20.21.10
+
+### Signed-out Free dashboards keep working locally
+
+- Signing out now switches Project View, project details, and graph reads to
+  local SQLite without requiring an account, configuration edit, or restart.
+- The saved Synalux backend preference remains ready for the next sign-in;
+  accidental missing cloud credentials still fail closed.
+- Latest Activity uses the newest durable session when it is newer than the
+  saved handoff. Recent Sessions are newest first, and saved handoff versions
+  remain available as restore points.
+
+## What's New in v20.21.9
+
+### Prism Free opens without a Synalux account
+
+- Run `prism dashboard` to open the current local Mind Palace. No sign-in,
+  account-link code, API key, paid plan, or Free-plan redemption is required.
+- A bare local dashboard address now gives the exact local-open command instead
+  of rendering a broken account state.
+- Account & Settings shows Prism Free as active. Synalux linking remains an
+  optional action for cloud sync, billing, and paid features.
+- Local access stays protected without printing its browser capability into
+  startup output, and unsafe state paths or redirected identity probes fail
+  closed.
+
 ## What's New in v20.21.8
 
 ### Dashboard graphs use the authenticated Portal
@@ -929,8 +970,9 @@ Every conversation feeds a persistent store. The next session loads the right co
 
 The dashboard shows your current project state, pending TODOs, intent health, and a neural knowledge graph — all built automatically from your agent sessions.
 
-It runs on loopback and is gated by a per-startup token by default — open the
-tokenized URL printed in the startup log (`http://localhost:3000/?token=…`).
+It runs on loopback and is gated by a local token by default — run
+`prism dashboard` to open it without signing in. This local browser step is not
+a Free-plan redemption.
 Requests with an untrusted `Host`/`Origin` are refused, closing the DNS-rebinding
 exposure fixed in GHSA-9cvx-7x8q-3g6m. See [docs/IDE_SETUP.md](docs/IDE_SETUP.md#securing-the-dashboard)
 to pin the token, disable it, or configure Basic Auth / JWKS.

package/dist/cli.js

@@ -15,6 +15,7 @@ import { runBrowserCli } from './browserCli.js';
 import { filterPrismMemoryContext } from './utils/memoryQuality.js';
 import { isRecoverableStartupStorageError } from './utils/startupRecovery.js';
 import { verifyBehaviorHandler } from './tools/behavioralVerifierHandler.js';
+import { isLocalDashboardRunning, openDashboardUrl, readDashboardAccessState, } from './dashboard/dashboardAccess.js';
 const program = new Command();
 /** Build the stable `prism load --json` envelope from depth-specific context. */
 export function buildLoadJsonOutput(project, data, level, metadata) {
@@ -114,6 +115,28 @@ program
     .command('bootstrap')
     .description('Print the canonical dashboard-configured first-turn Prism greeting')
     .action(runBootstrapCommand);
+program
+    .command('dashboard')
+    .description('Open the current local Mind Palace dashboard (no Synalux account required)')
+    .option('--print', 'Print the current local dashboard link instead of opening a browser')
+    .action(async (options) => {
+    try {
+        const { url, probeKey } = readDashboardAccessState();
+        if (!(await isLocalDashboardRunning(url, probeKey))) {
+            throw new Error('The recorded Prism dashboard is not running. Restart your connected MCP host first.');
+        }
+        if (options.print) {
+            console.log(url);
+            return;
+        }
+        openDashboardUrl(url);
+        console.log('Opened the local Prism Free dashboard. No Synalux account is required.');
+    }
+    catch (error) {
+        console.error(`Dashboard unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+    }
+});
 /**
  * One-shot fallback for hosts whose long-lived MCP transport has closed.
  * This calls the canonical handler, including its authenticated portal path

package/dist/dashboard/dashboardAccess.js

@@ -0,0 +1,213 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createDashboardProbeRequest, DASHBOARD_PROBE_PATH, generateDashboardProbeKey, validateDashboardProbeKey, verifyDashboardProbeResponse, } from "./dashboardProbe.js";
+const DASHBOARD_URL_FILE = "dashboard.url";
+const MAX_DASHBOARD_URL_BYTES = 4096;
+export function dashboardAccessUrlPath(home = homedir()) {
+    return join(home, ".prism-mcp", DASHBOARD_URL_FILE);
+}
+function dashboardAccessDirectory(home) {
+    const directory = join(home, ".prism-mcp");
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error("Local dashboard directory is not a regular directory");
+    }
+    if (process.platform !== "win32")
+        chmodSync(directory, 0o700);
+    return directory;
+}
+function validateDashboardUrl(raw) {
+    const value = raw.trim();
+    if (!value || Buffer.byteLength(value, "utf8") > MAX_DASHBOARD_URL_BYTES) {
+        throw new Error("Local dashboard link is missing or invalid");
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error("Local dashboard link is invalid");
+    }
+    const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+    const queryKeys = [...parsed.searchParams.keys()];
+    if (parsed.protocol !== "http:" ||
+        !loopbackHosts.has(parsed.hostname) ||
+        !/^\d{1,5}$/.test(parsed.port) ||
+        Number(parsed.port) < 1 ||
+        Number(parsed.port) > 65535 ||
+        parsed.username ||
+        parsed.password ||
+        parsed.pathname !== "/" ||
+        parsed.hash ||
+        queryKeys.some((key) => key !== "token") ||
+        (parsed.searchParams.has("token") && !parsed.searchParams.get("token"))) {
+        throw new Error("Local dashboard link is invalid");
+    }
+    return parsed.toString();
+}
+/**
+ * Persist the current local dashboard link for the `prism dashboard` command.
+ * The token is a localhost capability, so the file is owner-only and symlinks
+ * present at validation time are rejected rather than followed. This is not a
+ * boundary against another process running as the same OS user: that process
+ * can already read or replace owner-only Prism state.
+ */
+export function writeDashboardAccessUrl(url, home = homedir(), probeKey = generateDashboardProbeKey()) {
+    const validated = validateDashboardUrl(url);
+    const validatedProbeKey = validateDashboardProbeKey(probeKey);
+    const directory = dashboardAccessDirectory(home);
+    const filePath = dashboardAccessUrlPath(home);
+    try {
+        const existing = lstatSync(filePath);
+        if (!existing.isFile() || existing.isSymbolicLink()) {
+            throw new Error("Local dashboard link path is not a regular file");
+        }
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    // Write a new regular file and atomically replace the directory entry. This
+    // never opens an existing target for writing, so a pre-existing target
+    // symlink cannot redirect the token write even on platforms without
+    // O_NOFOLLOW. The containing directory follows the same-OS-user trust model
+    // documented above.
+    const tempPath = join(directory, `.${DASHBOARD_URL_FILE}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+    const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
+    const fd = openSync(tempPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow, 0o600);
+    let tempExists = true;
+    try {
+        if (process.platform !== "win32")
+            fchmodSync(fd, 0o600);
+        writeFileSync(fd, `${JSON.stringify({ version: 1, url: validated, probe_key: validatedProbeKey })}\n`, "utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        renameSync(tempPath, filePath);
+        tempExists = false;
+        if (process.platform !== "win32")
+            chmodSync(filePath, 0o600);
+    }
+    finally {
+        if (tempExists) {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+    return filePath;
+}
+export function readDashboardAccessState(home = homedir()) {
+    dashboardAccessDirectory(home);
+    const filePath = dashboardAccessUrlPath(home);
+    const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
+    let fd;
+    try {
+        fd = openSync(filePath, fsConstants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            throw new Error("No current local dashboard link. Restart your connected MCP host first.");
+        }
+        if (code === "ELOOP")
+            throw new Error("Local dashboard link path is not a regular file");
+        throw error;
+    }
+    try {
+        // Validate and read the same opened object. A path-level lstat followed by
+        // readFileSync(path) permits the directory entry to be swapped between the
+        // check and use; O_NOFOLLOW plus fstat/read on this descriptor closes that
+        // race on POSIX without broadening the same-OS-user trust boundary.
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error("Local dashboard link path is not a regular file");
+        if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
+            throw new Error("Local dashboard link file permissions are unsafe");
+        }
+        const raw = readFileSync(fd, "utf8");
+        if (!raw || Buffer.byteLength(raw, "utf8") > MAX_DASHBOARD_URL_BYTES) {
+            throw new Error("Local dashboard link is missing or invalid");
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Local dashboard link is invalid");
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("Local dashboard link is invalid");
+        }
+        const state = parsed;
+        if (state.version !== 1 || typeof state.url !== "string" || typeof state.probe_key !== "string") {
+            throw new Error("Local dashboard link is invalid");
+        }
+        return {
+            url: validateDashboardUrl(state.url),
+            probeKey: validateDashboardProbeKey(state.probe_key),
+        };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function readDashboardAccessUrl(home = homedir()) {
+    return readDashboardAccessState(home).url;
+}
+export async function isLocalDashboardRunning(dashboardUrl, probeKey, fetcher = fetch) {
+    const validated = validateDashboardUrl(dashboardUrl);
+    const challenge = createDashboardProbeRequest(probeKey);
+    const probe = new URL(DASHBOARD_PROBE_PATH, validated);
+    probe.searchParams.set("nonce", challenge.nonce);
+    probe.searchParams.set("proof", challenge.proof);
+    try {
+        const response = await fetcher(probe, {
+            redirect: "error",
+            signal: AbortSignal.timeout(1_500),
+        });
+        if (!response.ok)
+            return false;
+        const finalUrl = response.url ? new URL(response.url) : probe;
+        if (finalUrl.href !== probe.href) {
+            return false;
+        }
+        const body = await response.json();
+        return body.name === "Prism Mind Palace" &&
+            body.nonce === challenge.nonce &&
+            typeof body.proof === "string" &&
+            verifyDashboardProbeResponse(probeKey, challenge.nonce, body.proof);
+    }
+    catch {
+        return false;
+    }
+}
+export function dashboardOpenCommand(url, platform = process.platform) {
+    const validated = validateDashboardUrl(url);
+    if (platform === "darwin")
+        return { command: "open", args: [validated] };
+    if (platform === "win32") {
+        return { command: "rundll32", args: ["url.dll,FileProtocolHandler", validated] };
+    }
+    return { command: "xdg-open", args: [validated] };
+}
+export function openDashboardUrl(url, platform = process.platform, runner = (command, args) => spawnSync(command, args, {
+    shell: false,
+    stdio: "ignore",
+    timeout: 5_000,
+    windowsHide: true,
+})) {
+    const launch = dashboardOpenCommand(url, platform);
+    const result = runner(launch.command, launch.args);
+    if (result.error || result.status !== 0) {
+        throw new Error("Could not open the local dashboard browser");
+    }
+}

package/dist/dashboard/dashboardProbe.js

@@ -0,0 +1,52 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+export const DASHBOARD_PROBE_PATH = "/api/dashboard/probe";
+const HEX_256 = /^[a-f0-9]{64}$/;
+const PROBE_PROTOCOL = "prism-dashboard-probe:v1";
+export function generateDashboardProbeKey() {
+    return randomBytes(32).toString("hex");
+}
+export function validateDashboardProbeKey(value) {
+    if (!HEX_256.test(value))
+        throw new Error("Local dashboard probe key is invalid");
+    return value;
+}
+function validateNonce(value) {
+    if (!HEX_256.test(value))
+        throw new Error("Local dashboard probe nonce is invalid");
+    return value;
+}
+function proof(key, purpose, nonce) {
+    const validatedKey = validateDashboardProbeKey(key);
+    const validatedNonce = validateNonce(nonce);
+    return createHmac("sha256", Buffer.from(validatedKey, "hex"))
+        .update(`${PROBE_PROTOCOL}:${purpose}:${validatedNonce}`)
+        .digest("hex");
+}
+function proofMatches(expected, candidate) {
+    if (!HEX_256.test(candidate))
+        return false;
+    return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(candidate, "hex"));
+}
+export function createDashboardProbeRequest(key, nonce = randomBytes(32).toString("hex")) {
+    const validatedNonce = validateNonce(nonce);
+    return { nonce: validatedNonce, proof: proof(key, "request", validatedNonce) };
+}
+export function verifyDashboardProbeRequest(key, nonce, candidate) {
+    try {
+        return proofMatches(proof(key, "request", nonce), candidate);
+    }
+    catch {
+        return false;
+    }
+}
+export function createDashboardProbeResponse(key, nonce) {
+    return proof(key, "response", nonce);
+}
+export function verifyDashboardProbeResponse(key, nonce, candidate) {
+    try {
+        return proofMatches(proof(key, "response", nonce), candidate);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/dashboard/dashboardToken.js

@@ -47,3 +47,7 @@ export function buildTokenCookie(token, maxAgeMs, secure, cookieName = 'prism_da
     return (`${cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
         `Max-Age=${Math.floor(maxAgeMs / 1000)}${secure ? "; Secure" : ""}`);
 }
+/** Every dashboard data API, including optional account linking, uses the local gate. */
+export function isDashboardTokenProtectedPath(pathname) {
+    return pathname.startsWith('/api/');
+}

package/dist/dashboard/server.js

@@ -22,10 +22,12 @@ import * as os from "os";
 import * as fs from "fs";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { createServer, getAllPossibleTools } from "../server.js";
-import { getStorage, activeStorageBackend } from "../storage/index.js";
+import { activeStorageBackend } from "../storage/index.js";
 import { readDashboardLedger } from "./ledgerReader.js";
 import { PRISM_USER_ID, SERVER_CONFIG } from "../config.js";
-import { renderDashboardHTML } from "./ui.js";
+import { renderDashboardHTML, renderDashboardLocalOpenHTML } from "./ui.js";
+import { writeDashboardAccessUrl } from "./dashboardAccess.js";
+import { createDashboardProbeResponse, DASHBOARD_PROBE_PATH, generateDashboardProbeKey, verifyDashboardProbeRequest, } from "./dashboardProbe.js";
 import { computeIntentHealth } from "./intentHealth.js";
 import { getAllSettings, setSetting, getSetting, getSettingSync } from "../storage/configStorage.js";
 import { compactLedgerHandler } from "../tools/compactionHandler.js";
@@ -34,9 +36,10 @@ import { buildVaultDirectory } from "../utils/vaultExporter.js";
 import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
 import { handleAccountRoutes } from "./accountRouter.js";
+import { createDashboardStorageAccessor } from "./storageAccessor.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
 import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
-import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, } from "./dashboardToken.js";
+import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, isDashboardTokenProtectedPath, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
 /** Read HTTP request body as string (Buffer-based to avoid GC thrash on large imports) */
@@ -61,20 +64,10 @@ function readBody(req) {
 export async function startDashboardServer() {
     // Port 3000 conflicts are gracefully handled by server.ts catching EADDRINUSE
     // which will just disable the dashboard on secondary instances, keeping MCP alive.
-    // Lazy storage accessor — returns null if storage isn't ready yet.
-    // API routes gracefully degrade with 503 instead of blocking startup.
-    let _storage = null;
-    const getStorageSafe = async () => {
-        if (_storage)
-            return _storage;
-        try {
-            _storage = await getStorage();
-            return _storage;
-        }
-        catch {
-            return null;
-        }
-    };
+    // Resolve through the canonical singleton on each request. Account
+    // connect/sign-out closes that singleton so the next request switches to the
+    // newly selected cloud or local backend without restarting the MCP host.
+    const getStorageSafe = createDashboardStorageAccessor();
     /**
      * v5.1: Optional HTTP Basic Auth for remote dashboard access.
      *
@@ -108,6 +101,7 @@ export async function startDashboardServer() {
         pinnedToken: process.env.PRISM_DASHBOARD_TOKEN,
         optOut: process.env.PRISM_DASHBOARD_NO_TOKEN,
     });
+    const DASHBOARD_PROBE_KEY = generateDashboardProbeKey();
     const COOKIE_SECURE = !!process.env.PRISM_DASHBOARD_ORIGIN?.startsWith("https://") || !!process.env.PRISM_DASHBOARD_SECURE;
     // Auth config object — injectable for testing via authUtils.ts
     const authConfig = {
@@ -227,6 +221,24 @@ return false;}
         }
         // ─── v5.1: Auth login endpoint (always accessible) ───
         const reqUrl = new URL(req.url || "/", `http://${req.headers.host}`);
+        // Authenticate the recorded listener before the CLI opens a browser. The
+        // request and response use domain-separated HMACs over a fresh nonce, so a
+        // foreign process that copied the public manifest cannot impersonate this
+        // dashboard or learn the local dashboard capability from the probe.
+        if (req.method === "GET" && reqUrl.pathname === DASHBOARD_PROBE_PATH) {
+            const nonce = reqUrl.searchParams.get("nonce") || "";
+            const requestProof = reqUrl.searchParams.get("proof") || "";
+            if (!verifyDashboardProbeRequest(DASHBOARD_PROBE_KEY, nonce, requestProof)) {
+                res.writeHead(401, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                return res.end(JSON.stringify({ error: "Invalid dashboard probe" }));
+            }
+            res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+            return res.end(JSON.stringify({
+                name: "Prism Mind Palace",
+                nonce,
+                proof: createDashboardProbeResponse(DASHBOARD_PROBE_KEY, nonce),
+            }));
+        }
         // ─── SECURITY: dashboard token gate (GHSA-9cvx-7x8q-3g6m, remediation #2) ───
         // Second layer beneath the Host guard. Inert when DASHBOARD_TOKEN is null
         // (real auth configured, or opted out). A page load carrying a valid ?token=
@@ -235,24 +247,34 @@ return false;}
         // token via cookie, X-Prism-Dashboard-Token header, or ?token= query.
         if (DASHBOARD_TOKEN) {
             const qToken = reqUrl.searchParams.get("token");
-            const isApiPath = reqUrl.pathname.startsWith("/api/");
+            const isApiPath = isDashboardTokenProtectedPath(reqUrl.pathname);
+            const cookieName = dashboardTokenCookieName(req.socket.localPort);
+            const hasToken = requestHasToken({
+                cookie: req.headers.cookie,
+                headerToken: req.headers["x-prism-dashboard-token"] || null,
+            }, qToken, DASHBOARD_TOKEN, cookieName);
             if (!isApiPath && qToken && safeCompare(qToken, DASHBOARD_TOKEN)) {
                 reqUrl.searchParams.delete("token");
                 const cleanTarget = reqUrl.pathname + (reqUrl.search ? reqUrl.search : "");
                 res.writeHead(302, {
-                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE, dashboardTokenCookieName(req.socket.localPort)),
+                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE, cookieName),
                     Location: cleanTarget,
                 });
                 return res.end();
             }
-            if (isApiPath &&
-                !requestHasToken({
-                    cookie: req.headers.cookie,
-                    headerToken: req.headers["x-prism-dashboard-token"] || null,
-                }, qToken, DASHBOARD_TOKEN, dashboardTokenCookieName(req.socket.localPort))) {
+            if (req.method === "GET" &&
+                (reqUrl.pathname === "/" || reqUrl.pathname === "/index.html") &&
+                !hasToken) {
+                res.writeHead(200, {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-store, no-cache, must-revalidate",
+                });
+                return res.end(renderDashboardLocalOpenHTML());
+            }
+            if (isApiPath && !hasToken) {
                 res.writeHead(401, { "Content-Type": "application/json" });
                 return res.end(JSON.stringify({
-                    error: "Dashboard token required — open the tokenized URL printed in the Prism startup log.",
+                    error: "Local dashboard access required — run prism dashboard.",
                 }));
             }
         }
@@ -394,6 +416,31 @@ return false;}
                 return res.end(JSON.stringify({ error: err.message || "Failed to generate server card" }));
             }
         }
+        // Public PWA metadata also serves as the CLI's bounded local identity
+        // probe. It contains no dashboard data and must remain reachable when an
+        // operator configures Basic Auth or JWKS for the actual dashboard.
+        if (reqUrl.pathname === "/manifest.json" && req.method === "GET") {
+            const manifest = {
+                name: "Prism Mind Palace",
+                short_name: "Prism",
+                description: "Prism MCP Mobile Dashboard",
+                start_url: "/",
+                display: "standalone",
+                background_color: "#0a0e1a",
+                theme_color: "#0a0e1a",
+                icons: [
+                    { src: "/icon-192.svg", sizes: "192x192", type: "image/svg+xml", purpose: "any" },
+                    { src: "/icon-192-maskable.svg", sizes: "192x192", type: "image/svg+xml", purpose: "maskable" },
+                    { src: "/icon-512.svg", sizes: "512x512", type: "image/svg+xml", purpose: "any" },
+                    { src: "/icon-512-maskable.svg", sizes: "512x512", type: "image/svg+xml", purpose: "maskable" },
+                ],
+            };
+            res.writeHead(200, {
+                "Content-Type": "application/json",
+                "Cache-Control": "public, max-age=86400",
+            });
+            return res.end(JSON.stringify(manifest));
+        }
         // ─── AUTHENTICATION GATE ───
         // Basic Auth & Session & JWKS
         if (AUTH_ENABLED && !(await isAuthenticated(req, authConfig))) {
@@ -1143,28 +1190,6 @@ return false;}
                     return res.end(JSON.stringify({ error: "Failed to abort pipeline" }));
                 }
             }
-            if (url.pathname === "/manifest.json" && req.method === "GET") {
-                const manifest = {
-                    name: "Prism Mind Palace",
-                    short_name: "Prism",
-                    description: "Prism MCP Mobile Dashboard",
-                    start_url: "/",
-                    display: "standalone",
-                    background_color: "#0a0e1a",
-                    theme_color: "#0a0e1a",
-                    icons: [
-                        { src: "/icon-192.svg", sizes: "192x192", type: "image/svg+xml", purpose: "any" },
-                        { src: "/icon-192-maskable.svg", sizes: "192x192", type: "image/svg+xml", purpose: "maskable" },
-                        { src: "/icon-512.svg", sizes: "512x512", type: "image/svg+xml", purpose: "any" },
-                        { src: "/icon-512-maskable.svg", sizes: "512x512", type: "image/svg+xml", purpose: "maskable" }
-                    ]
-                };
-                res.writeHead(200, {
-                    "Content-Type": "application/json",
-                    "Cache-Control": "public, max-age=86400"
-                });
-                return res.end(JSON.stringify(manifest));
-            }
             // ─── PWA: Service Worker (v5.4) ───
             if (url.pathname === "/sw.js" && req.method === "GET") {
                 const swContent = `
@@ -1451,7 +1476,10 @@ self.addEventListener('message', (e) => {
             }
         }
     }
-    // Write the active port to a file for discoverability
+    const dashboardUrl = DASHBOARD_TOKEN
+        ? `http://localhost:${boundPort}/?token=${DASHBOARD_TOKEN}`
+        : `http://localhost:${boundPort}/`;
+    // Write the active port and owner-only local opener link for discoverability.
     try {
         const portFile = path.join(os.homedir(), ".prism-mcp", "dashboard.port");
         fs.writeFileSync(portFile, String(boundPort), "utf8");
@@ -1459,13 +1487,19 @@ self.addEventListener('message', (e) => {
     catch {
         // Non-fatal — just means the user has to know the port
     }
+    try {
+        writeDashboardAccessUrl(dashboardUrl, os.homedir(), DASHBOARD_PROBE_KEY);
+    }
+    catch (error) {
+        console.error(`[Dashboard] Could not save local opener link: ${error instanceof Error ? error.message : String(error)}`);
+    }
     if (DASHBOARD_TOKEN) {
-        console.error(`[Prism] 🔐 Mind Palace Dashboard → http://localhost:${boundPort}/?token=${DASHBOARD_TOKEN}`);
-        console.error(`[Prism]    Data API is token-gated by default (GHSA-9cvx-7x8q-3g6m). Open the URL above once; ` +
+        console.error(`[Prism] 🔐 Mind Palace Dashboard ready on http://localhost:${boundPort}. ` +
+            `Run prism dashboard to open locally without a Synalux account; ` +
             `pin it with PRISM_DASHBOARD_TOKEN, or disable with PRISM_DASHBOARD_NO_TOKEN=1.`);
     }
     else {
-        console.error(`[Prism] 🧠 Mind Palace Dashboard → http://localhost:${boundPort}`);
+        console.error(`[Prism] 🧠 Mind Palace Dashboard → ${dashboardUrl}`);
     }
     // ─── v3.1: TTL Sweep — runs at startup + every 12 hours ───────────
     // NOTE (v5.4): The Background Scheduler in server.ts now also handles

package/dist/dashboard/storageAccessor.js

@@ -0,0 +1,17 @@
+import { getStorage } from "../storage/index.js";
+/**
+ * Resolve dashboard storage through the canonical storage singleton on every
+ * request. Account connect/sign-out closes that singleton so the next request
+ * can select the newly active cloud or local backend. Keeping a second cache
+ * here would retain a closed backend across that transition.
+ */
+export function createDashboardStorageAccessor(resolveStorage = getStorage) {
+    return async () => {
+        try {
+            return await resolveStorage();
+        }
+        catch {
+            return null;
+        }
+    };
+}

package/dist/dashboard/ui.js

@@ -13,6 +13,37 @@
  *   - Responsive grid layout
  * ═══════════════════════════════════════════════════════════════════
  */
+export function renderDashboardLocalOpenHTML() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Prism — Open Local Dashboard</title>
+  <style>
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; background: #0a0e1a; color: #f1f5f9; font-family: Inter, system-ui, sans-serif; }
+    main { width: min(620px, 100%); padding: 36px; border: 1px solid rgba(139,92,246,.35); border-radius: 20px; background: #111827; box-shadow: 0 24px 80px rgba(0,0,0,.35); }
+    .eyebrow { color: #22d3ee; font-weight: 700; letter-spacing: .08em; text-transform: uppercase; font-size: 13px; }
+    h1 { margin: 12px 0; font-size: clamp(30px, 6vw, 46px); line-height: 1.05; }
+    p { color: #a5b4cf; font-size: 17px; line-height: 1.6; }
+    code { display: block; margin: 24px 0 12px; padding: 16px 18px; border-radius: 12px; background: #080d19; border: 1px solid #293554; color: #c4b5fd; font: 600 18px ui-monospace, SFMono-Regular, Menlo, monospace; }
+    button { width: 100%; padding: 14px 18px; border: 0; border-radius: 12px; color: white; background: linear-gradient(135deg,#8b5cf6,#2563eb); font: 700 16px Inter,system-ui,sans-serif; cursor: pointer; }
+    .note { margin-top: 18px; color: #71809c; font-size: 14px; }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="eyebrow">Local dashboard access</div>
+    <h1>Open the current Prism dashboard.</h1>
+    <p>This browser does not have the current local dashboard link. Run this command in Terminal to open the active dashboard securely. Your Synalux account and plan remain unchanged.</p>
+    <code>prism dashboard</code>
+    <button type="button" onclick="navigator.clipboard.writeText('prism dashboard').then(() => { this.textContent = 'Copied'; })">Copy command</button>
+    <p class="note">This local browser access check is separate from Synalux sign-in.</p>
+  </main>
+</body>
+</html>`;
+}
 export function renderDashboardHTML(version) {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -206,7 +237,12 @@ export function renderDashboardHTML(version) {
     }
 
     /* ─── State Panel ─── */
-    .summary-text { color: var(--text-secondary); font-size: 0.9rem; line-height: 1.7; margin-bottom: 1rem; }
+    .summary-text { color: var(--text-secondary); font-size: 0.9rem; line-height: 1.7; margin-bottom: 0.4rem; }
+    .state-source, .timeline-note {
+      color: var(--text-muted); font-size: 0.72rem; line-height: 1.5;
+    }
+    .state-source { margin-bottom: 1rem; }
+    .timeline-note { margin: -0.25rem 0 0.8rem; }
     .todo-list { list-style: none; padding: 0; }
     .todo-list li {
       padding: 0.5rem 0; border-bottom: 1px solid rgba(255,255,255,0.05);
@@ -527,6 +563,9 @@ export function renderDashboardHTML(version) {
     .account-connect {
       padding: 1rem; border: 1px solid var(--border-glass); border-radius: var(--radius-sm); background: rgba(15,23,42,0.42);
     }
+    .account-connect summary { cursor: pointer; color: var(--text-secondary); font-size: 0.8rem; font-weight: 600; }
+    .account-connect summary::marker { color: var(--accent-purple); }
+    .account-connect[open] summary { margin-bottom: 0.8rem; color: var(--text-primary); }
     .account-connect label { display: block; margin-bottom: 0.45rem; color: var(--text-primary); font-size: 0.8rem; font-weight: 600; }
     .account-code-row { display: flex; gap: 0.6rem; }
     .account-code-input {
@@ -792,10 +831,11 @@ export function renderDashboardHTML(version) {
     <div id="content" class="grid grid-main fade-in">
       <!-- Left Column -->
       <div class="grid" style="align-content: start;">
-        <!-- Current State -->
+        <!-- Latest Activity -->
         <div class="card">
-          <div class="card-title"><span class="dot" style="background:var(--accent-blue)"></span> Current State <span id="versionBadge" class="badge badge-purple" style="margin-left:auto"></span></div>
+          <div class="card-title"><span class="dot" style="background:var(--accent-blue)"></span> Latest Activity <span id="versionBadge" class="badge badge-purple" style="margin-left:auto"></span></div>
           <div class="summary-text" id="summary"></div>
+          <div class="state-source" id="currentStateSource"></div>
           <div class="card-title" style="margin-top:0.5rem"><span class="dot" style="background:var(--accent-cyan)"></span> Pending TODOs</div>
           <ul class="todo-list" id="todos"></ul>
         </div>
@@ -1037,16 +1077,18 @@ export function renderDashboardHTML(version) {
           </div>
         </div>
 
-        <!-- Time Travel -->
+        <!-- Recent Sessions -->
         <div class="card">
-          <div class="card-title"><span class="dot" style="background:var(--accent-purple)"></span> Time Travel History 🕰️</div>
-          <div class="timeline" id="historyTimeline"></div>
+          <div class="card-title"><span class="dot" style="background:var(--accent-amber)"></span> Recent Sessions</div>
+          <div class="timeline-note">Durable session activity, newest first.</div>
+          <div class="timeline" id="ledgerTimeline"></div>
         </div>
 
-        <!-- Ledger -->
+        <!-- Saved Handoff Versions -->
         <div class="card">
-          <div class="card-title"><span class="dot" style="background:var(--accent-amber)"></span> Session Ledger</div>
-          <div class="timeline" id="ledgerTimeline"></div>
+          <div class="card-title"><span class="dot" style="background:var(--accent-purple)"></span> Saved Handoff Versions 🕰️</div>
+          <div class="timeline-note">Restore points created when an agent saves a handoff.</div>
+          <div class="timeline" id="historyTimeline"></div>
         </div>
         </div>
 
@@ -2126,13 +2168,14 @@ function renderAccountPanel(account, error) {
             '<div class="account-card-head"><div><div class="account-badges">' +
             '<span class="account-badge">Free</span><span class="account-badge role">Local</span></div>' +
             '<div class="account-name">Prism Free</div><div class="account-summary">' + accountPlanSummary('free') +
-            ' Sign in to add cloud sync, larger models, and team features.</div></div></div>' +
-            '<div class="account-actions"><button class="account-action" onclick="startAccountSignIn()">Sign in</button>' +
+            ' No sign-in or redemption is required. Link a Synalux account only for cloud sync, larger models, or team features.</div></div></div>' +
+            '<div class="account-actions"><button class="account-action" onclick="startAccountSignIn()">Link Synalux account</button>' +
             '<button class="account-action secondary" onclick="openAccountBilling()">View plans</button></div></div>' +
-            '<div class="account-connect"><label for="accountCodeInput">Complete sign-in with a one-time code</label>' +
+            '<details class="account-connect" id="accountConnectDetails"><summary>Already have a Synalux account-link code? (optional)</summary>' +
+            '<label for="accountCodeInput">Account-link code</label>' +
             '<div class="account-code-row"><input class="account-code-input" id="accountCodeInput" autocomplete="off" spellcheck="false" placeholder="synalux_code_…" />' +
             '<button class="account-action" id="accountConnectButton" onclick="connectAccount()">Connect account</button></div>' +
-            '<div class="account-status" id="accountStatus">Sign in opens Synalux in a new tab. Paste the code shown there.</div></div>' +
+            '<div class="account-status" id="accountStatus">Use this only after choosing Link Synalux account. Prism Free is already active locally.</div></details>' +
             renderPlanLadder('free');
         return;
     }
@@ -2185,8 +2228,14 @@ function loadIdentityChip() {
 }
 function startAccountSignIn() {
     var url = currentAccount && currentAccount.auth_url ? currentAccount.auth_url : 'https://synalux.ai/auth?source=prism';
+    var details = document.getElementById('accountConnectDetails');
+    if (details)
+        details.open = true;
     window.open(url, '_blank', 'noopener,noreferrer');
     setAccountStatus('Finish sign-in in Synalux, then paste the one-time code here.');
+    var input = document.getElementById('accountCodeInput');
+    if (input)
+        input.focus();
 }
 function openAccountBilling() {
     var target = window.open('about:blank', '_blank');
@@ -2325,7 +2374,7 @@ function signOutAccount() {
 })();
 function loadProject() {
     return __awaiter(this, void 0, void 0, function () {
-        var project, res, data, ctx, todos, todoList, meta, briefingCard, visualCard, visuals, historyEl, ledgerEl, healthRes, healthData, healthCard, healthDot, healthLabel, healthSummary, healthIssues, statusMap, t, issues, cleanupBtn, sevIcons, he_1, e_3;
+        var project, res, data, ctx, ledgerEntries, latestLedger, contextTime, latestLedgerTime, useLatestLedger, versionBadge, currentStateSource, currentSummary, todos, todoList, meta, briefingCard, visualCard, visuals, historyEl, ledgerEl, healthRes, healthData, healthCard, healthDot, healthLabel, healthSummary, healthIssues, statusMap, t, issues, cleanupBtn, sevIcons, he_1, e_3;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
@@ -2354,9 +2403,41 @@ function loadProject() {
                 case 3:
                     data = _a.sent();
                     ctx = data.context || {};
-                    document.getElementById('versionBadge').textContent = 'v' + (ctx.version || '?');
-                    document.getElementById('summary').textContent = ctx.last_summary || ctx.summary || 'No summary available.';
-                    todos = ctx.pending_todo || ctx.active_context || [];
+                    ledgerEntries = Array.isArray(data.ledger) ? data.ledger.slice() : [];
+                    ledgerEntries.sort(function (a, b) {
+                        var aTime = Date.parse(a && a.created_at ? a.created_at : '');
+                        var bTime = Date.parse(b && b.created_at ? b.created_at : '');
+                        if (!Number.isFinite(aTime)) aTime = 0;
+                        if (!Number.isFinite(bTime)) bTime = 0;
+                        return bTime - aTime;
+                    });
+                    latestLedger = ledgerEntries.length > 0 ? ledgerEntries[0] : null;
+                    contextTime = Date.parse(ctx.updated_at || '');
+                    latestLedgerTime = Date.parse(latestLedger && latestLedger.created_at ? latestLedger.created_at : '');
+                    useLatestLedger = !!latestLedger && !!(latestLedger.summary || latestLedger.content) &&
+                        ((!Number.isFinite(contextTime) && Number.isFinite(latestLedgerTime)) ||
+                            (Number.isFinite(latestLedgerTime) && latestLedgerTime > contextTime) ||
+                            !(ctx.last_summary || ctx.summary));
+                    versionBadge = document.getElementById('versionBadge');
+                    versionBadge.textContent = useLatestLedger ? 'latest' : 'v' + (ctx.version || '?');
+                    versionBadge.className = 'badge ' + (useLatestLedger ? 'badge-amber' : 'badge-purple');
+                    currentSummary = useLatestLedger
+                        ? (latestLedger.summary || latestLedger.content)
+                        : (ctx.last_summary || ctx.summary);
+                    document.getElementById('summary').textContent = currentSummary || 'No summary available.';
+                    currentStateSource = document.getElementById('currentStateSource');
+                    if (useLatestLedger) {
+                        currentStateSource.textContent = 'Latest session' +
+                            (latestLedger.created_at ? ' · ' + formatDate(latestLedger.created_at) : '') +
+                            (ctx.version ? ' · saved handoff v' + ctx.version + ' remains available below' : '');
+                    }
+                    else {
+                        currentStateSource.textContent = 'Saved handoff' +
+                            (ctx.updated_at ? ' · ' + formatDate(ctx.updated_at) : '');
+                    }
+                    todos = useLatestLedger && Array.isArray(latestLedger.todos)
+                        ? latestLedger.todos
+                        : (ctx.pending_todo || ctx.active_context || []);
                     todoList = document.getElementById('todos');
                     if (Array.isArray(todos) && todos.length > 0) {
                         todoList.innerHTML = todos.map(function (t) { return '<li>' + escapeHtml(t) + '</li>'; }).join('');
@@ -2405,8 +2486,8 @@ function loadProject() {
                         historyEl.innerHTML = '<div style="color:var(--text-muted);font-size:0.85rem;padding:1rem;text-align:center">No time travel history yet.</div>';
                     }
                     ledgerEl = document.getElementById('ledgerTimeline');
-                    if (data.ledger && data.ledger.length > 0) {
-                        ledgerEl.innerHTML = data.ledger.map(function (l) {
+                    if (ledgerEntries.length > 0) {
+                        ledgerEl.innerHTML = ledgerEntries.map(function (l) {
                             var summary = l.summary || l.content || 'Entry';
                             var decisions = l.decisions;
                             var extra = '';

package/dist/onboarding/wizard.js

@@ -177,7 +177,7 @@ function getCompleteContent() {
             "Your AI agents now have persistent, searchable memory across all sessions.",
         instructions: [
             "📖 Full documentation: https://github.com/synalux/prism",
-            "🎛️ Dashboard: http://localhost:3080 (when server is running)",
+            "🎛️ Dashboard: run `prism dashboard` after the MCP host starts (no account required)",
             "💬 Community: GitHub Discussions for questions and feedback",
             "🐛 Issues: GitHub Issues for bug reports",
         ],

package/dist/storage/index.js

@@ -3,7 +3,8 @@ import { debugLog } from "../utils/logger.js";
 import { SupabaseStorage } from "./supabase.js";
 import { getSetting } from "./configStorage.js";
 import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
-import { setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { isSynaluxSignedOut, setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { getSynaluxJwt, isUsableSynaluxApiKey } from "../utils/synaluxJwt.js";
 export function isValidHttpUrl(url) {
     try {
         const parsed = new URL(url);
@@ -56,15 +57,35 @@ export async function ensureSynaluxCredentials() {
         delete process.env.PRISM_SYNALUX_API_KEY;
         return false;
     }
-    if (SYNALUX_CONFIGURED)
-        return true;
     // Re-check process.env directly: SYNALUX_CONFIGURED is captured at module
     // load, so credentials injected later by another caller would be invisible
     // to it. Mirrors ensureSupabaseCredentials below.
     const rawEnvUrl = process.env.PRISM_SYNALUX_BASE_URL?.trim() || process.env.SYNALUX_BASE_URL?.trim();
     const envUrl = rawEnvUrl ? upgradeInsecureCloudUrl(rawEnvUrl) : rawEnvUrl;
     const envKey = process.env.PRISM_SYNALUX_API_KEY?.trim();
-    if (envUrl && envKey && isValidHttpUrl(envUrl))
+    if (envUrl && envKey && isValidHttpUrl(envUrl)) {
+        const storedKey = (await getSetting("PRISM_SYNALUX_API_KEY", ""))?.trim();
+        if (isUsableSynaluxApiKey(storedKey) &&
+            storedKey !== envKey) {
+            // Validate the launcher credential before SynaluxStorage captures it.
+            // getSynaluxJwt keeps a valid explicit env key authoritative and promotes
+            // the persisted key only after the env key receives 401/403 and the
+            // persisted key succeeds.
+            const validatedJwt = await getSynaluxJwt();
+            if (!validatedJwt) {
+                // A launcher can retain a revoked credential while the dashboard has
+                // already saved the replacement. Do not let SynaluxStorage capture
+                // the launcher key when the validation/recovery request is currently
+                // unavailable: its refresh token is immutable, so publishing that
+                // singleton would keep project access broken even after recovery.
+                throw new Error("[Prism Storage] Could not validate the active Synalux account credential. " +
+                    "Refusing to initialize cloud storage with an unverified credential because that could " +
+                    "strand project access or split session history. Retry when Synalux is reachable.");
+            }
+        }
+        return true;
+    }
+    if (SYNALUX_CONFIGURED)
         return true;
     const rawUrl = (await getSetting("PRISM_SYNALUX_BASE_URL"))?.trim() ||
         (await getSetting("SYNALUX_BASE_URL"))?.trim();
@@ -154,10 +175,19 @@ export async function getStorage() {
     // (startupRecovery.ts): a missing credential is a configuration fault, not a
     // transient one, so startup must not paper over it with last-good context.
     if (requested === "synalux" && !(await ensureSynaluxCredentials())) {
-        throw new Error("[Prism Storage] PRISM_STORAGE=synalux but Synalux credentials are missing or invalid " +
-            "(need PRISM_SYNALUX_BASE_URL and PRISM_SYNALUX_API_KEY). " +
-            "Refusing to fall back to local storage because that silently splits session history. " +
-            "Set PRISM_STORAGE=local explicitly if local-only storage is intended.");
+        if (isSynaluxSignedOut()) {
+            // Sign-out is an explicit request to stop using the account. Keep the
+            // configured cloud preference intact for a later sign-in, but serve the
+            // unauthenticated Free dashboard from local SQLite in the meantime.
+            requested = "local";
+            debugLog("[Prism Storage] Synalux account signed out — using local SQLite");
+        }
+        else {
+            throw new Error("[Prism Storage] PRISM_STORAGE=synalux but Synalux credentials are missing or invalid " +
+                "(need PRISM_SYNALUX_BASE_URL and PRISM_SYNALUX_API_KEY). " +
+                "Refusing to fall back to local storage because that silently splits session history. " +
+                "Set PRISM_STORAGE=local explicitly if local-only storage is intended.");
+        }
     }
     if (requested === "supabase" && !(await ensureSupabaseCredentials())) {
         throw new Error("[Prism Storage] PRISM_STORAGE=supabase but Supabase credentials are missing or invalid " +

package/dist/tools/ledgerHandlers.js

@@ -606,10 +606,9 @@ function freeTierUpgradeLine(tier) {
         `super-skills, and agent routing → ${FREE_ENTITLEMENTS.upgrade_url}`;
 }
 /**
- * Dashboard URL for startup output. The bound port is announced on stderr
- * only (MCP stdio owns stdout), so users never saw it; the dashboard also
- * writes the port to ~/.prism-mcp/dashboard.port — read that, then the env
- * override, then the default.
+ * Detect the local dashboard for startup output. The browser link may contain
+ * a private localhost capability, so startup advertises the local CLI opener
+ * rather than copying that link into agent context.
  */
 async function readDashboardUrl() {
     // Precedence: explicit env override > recorded port file > default. The
@@ -633,14 +632,25 @@ async function readDashboardUrl() {
     // URL as the first-run headline action is worse than omitting it.
     //
     // A TCP connect is NOT sufficient: it proves something is listening, not
-    // that it is Prism. The default is 3000 — the single most commonly occupied
-    // port on a developer machine — so a bare liveness check would confidently
-    // point a first-run user at their own dev server. Hit the dashboard's
-    // /api/health instead, so identity is verified rather than assumed.
+    // that it is Prism. Probe the public PWA manifest instead of a token-gated API
+    // so an accountless install is detected without weakening dashboard access.
     const healthy = await new Promise((resolveProbe) => {
-        const request = http.get({ host: "127.0.0.1", port: Number(port), path: "/api/health", timeout: 300 }, (response) => {
-            response.resume(); // drain so the socket can close
-            resolveProbe(response.statusCode === 200);
+        const request = http.get({ host: "127.0.0.1", port: Number(port), path: "/manifest.json", timeout: 300 }, (response) => {
+            let body = "";
+            response.setEncoding("utf8");
+            response.on("data", (chunk) => {
+                if (body.length <= 4096)
+                    body += String(chunk);
+            });
+            response.on("end", () => {
+                try {
+                    const parsed = JSON.parse(body);
+                    resolveProbe(response.statusCode === 200 && parsed.name === "Prism Mind Palace");
+                }
+                catch {
+                    resolveProbe(false);
+                }
+            });
         });
         request.once("timeout", () => { request.destroy(); resolveProbe(false); });
         request.once("error", () => resolveProbe(false));
@@ -2330,7 +2340,7 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
     if (projects.length === 0) {
         const dashboardUrl = await readDashboardUrl();
         const dashboardLine = dashboardUrl
-            ? `- 🎛️ **Dashboard:** ${dashboardUrl} — configure projects, identity, and context depth`
+            ? `- 🎛️ **Dashboard:** run \`prism dashboard\` — opens locally with no Synalux account required`
             : `- 🎛️ **Dashboard:** not running — start Prism's dashboard to configure projects, identity, and context depth`;
         if (isFirstRun) {
             // Action-first instead of absence-first: every line is a capability or

package/dist/utils/synaluxJwt.js

@@ -27,6 +27,67 @@ const MIN_CACHE_MS = 60_000;
 let cache = null;
 let inFlight = null;
 let generation = 0;
+async function exchangeJwt(baseUrl, apiKey) {
+    try {
+        const res = await fetch(`${baseUrl}/api/v1/auth/jwt`, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        if (!res.ok) {
+            debugLog(`[synaluxJwt] exchange HTTP ${res.status}`);
+            return { kind: "http_error", status: res.status };
+        }
+        const data = (await res.json());
+        if (!data?.jwt) {
+            debugLog(`[synaluxJwt] exchange returned no jwt (status=${data?.status})`);
+            return { kind: "invalid_response" };
+        }
+        return {
+            kind: "success",
+            jwt: data.jwt,
+            ttlMs: Math.max(MIN_CACHE_MS, (data.expires_in ?? 900) * 1000),
+        };
+    }
+    catch (err) {
+        debugLog(`[synaluxJwt] exchange error: ${err instanceof Error ? err.message : String(err)}`);
+        return { kind: "network_error" };
+    }
+}
+async function readPersistedCredentialState() {
+    try {
+        const { getSetting } = await import("../storage/configStorage.js");
+        const signedOut = (await getSetting("PRISM_SYNALUX_SIGNED_OUT", "")) === "true";
+        const baseUrl = normalizePortalBaseUrl(await getSetting("PRISM_SYNALUX_BASE_URL", ""));
+        const apiKey = (await getSetting("PRISM_SYNALUX_API_KEY", "")).trim();
+        return { signedOut, baseUrl, apiKey };
+    }
+    catch (err) {
+        debugLog(`[synaluxJwt] persisted credential lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+function normalizePortalBaseUrl(raw) {
+    try {
+        const parsed = new URL(raw.trim());
+        const loopback = parsed.hostname === "localhost" ||
+            parsed.hostname === "127.0.0.1" || parsed.hostname === "::1" || parsed.hostname === "[::1]";
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback))
+            return "";
+        return parsed.origin;
+    }
+    catch {
+        return "";
+    }
+}
+const SYNALUX_API_KEY_PREFIX = ["synalux", "sk", ""].join("_");
+export function isUsableSynaluxApiKey(apiKey) {
+    return apiKey.startsWith(SYNALUX_API_KEY_PREFIX) && apiKey.length <= 512;
+}
 /**
  * Returns a usable JWT, exchanging from the sk_ token if needed.
  * Returns null when synalux is not configured or exchange fails.
@@ -54,24 +115,48 @@ export async function getSynaluxJwt() {
     let exchange;
     exchange = (async () => {
         try {
-            const url = `${baseUrl}/api/v1/auth/jwt`;
-            const res = await fetch(url, {
-                method: "POST",
-                headers: {
-                    "Authorization": `Bearer ${apiKey}`,
-                    "Content-Type": "application/json",
-                },
-                signal: AbortSignal.timeout(10_000),
-                redirect: "error",
-            });
-            if (!res.ok) {
-                debugLog(`[synaluxJwt] exchange HTTP ${res.status}`);
-                cache = null;
-                return null;
+            let attempt = await exchangeJwt(baseUrl, apiKey);
+            const requestOrigin = normalizePortalBaseUrl(baseUrl);
+            // MCP launchers can keep an older environment snapshot after the
+            // dashboard saves a freshly-linked account token. A valid explicit
+            // environment token remains authoritative; only an authentication
+            // rejection may try the newer persisted token, and only once.
+            if (attempt.kind === "http_error" && (attempt.status === 401 || attempt.status === 403)) {
+                const persisted = await readPersistedCredentialState();
+                if (persisted &&
+                    !persisted.signedOut &&
+                    !isSynaluxSignedOut() &&
+                    !!persisted.baseUrl &&
+                    persisted.baseUrl === requestOrigin &&
+                    isUsableSynaluxApiKey(persisted.apiKey) &&
+                    persisted.apiKey !== apiKey) {
+                    // The saved key may only recover the same portal origin.
+                    // Callers can resolve their request URL before this helper
+                    // returns, so cross-origin recovery would expose either the
+                    // refresh key or its short-lived JWT to the launcher URL.
+                    const recovered = await exchangeJwt(persisted.baseUrl, persisted.apiKey);
+                    if (recovered.kind === "success") {
+                        // Re-read after the network boundary. A sign-out or a
+                        // newer account link must win over this older retry.
+                        const current = await readPersistedCredentialState();
+                        if (current &&
+                            !current.signedOut &&
+                            !isSynaluxSignedOut() &&
+                            generation === requestGeneration &&
+                            current.baseUrl === persisted.baseUrl &&
+                            current.apiKey === persisted.apiKey) {
+                            process.env.PRISM_SYNALUX_API_KEY = persisted.apiKey;
+                            attempt = recovered;
+                            debugLog("[synaluxJwt] recovered from a stale launcher credential");
+                        }
+                        else {
+                            cache = null;
+                            return null;
+                        }
+                    }
+                }
             }
-            const data = (await res.json());
-            if (!data?.jwt) {
-                debugLog(`[synaluxJwt] exchange returned no jwt (status=${data?.status})`);
+            if (attempt.kind !== "success") {
                 cache = null;
                 return null;
             }
@@ -81,10 +166,9 @@ export async function getSynaluxJwt() {
             if (isSynaluxSignedOut() || generation !== requestGeneration) {
                 return null;
             }
-            const ttlMs = Math.max(MIN_CACHE_MS, (data.expires_in ?? 900) * 1000);
-            cache = { jwt: data.jwt, expiresAt: Date.now() + ttlMs };
-            debugLog(`[synaluxJwt] exchanged ok, ttl=${ttlMs}ms`);
-            return data.jwt;
+            cache = { jwt: attempt.jwt, expiresAt: Date.now() + attempt.ttlMs };
+            debugLog(`[synaluxJwt] exchanged ok, ttl=${attempt.ttlMs}ms`);
+            return attempt.jwt;
         }
         catch (err) {
             debugLog(`[synaluxJwt] exchange error: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.8",
+  "version": "20.21.11",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",