refactor(open-sse): remove reverse coupling open-sse -> src (E2)

Move clineAuth into open-sse/shared (src re-exports back). Add standalone
open-sse/shared/machineId for codex session hashing (no @/lib/dataDir).
sttCore receives sttConfig via param instead of importing AI_PROVIDERS.
No behavior change; gate: no regression (26 known-fails unchanged).

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/shared/clineAuth.js

@@ -0,0 +1,37 @@
+import pkg from "../../package.json" with { type: "json" };
+
+const APP_VERSION = pkg.version || "0.0.0";
+
+export function getClineAccessToken(token) {
+  if (typeof token !== "string") return "";
+  const trimmed = token.trim();
+  if (!trimmed) return "";
+  return trimmed.startsWith("workos:") ? trimmed : `workos:${trimmed}`;
+}
+
+export function getClineAuthorizationHeader(token) {
+  const accessToken = getClineAccessToken(token);
+  return accessToken ? `Bearer ${accessToken}` : "";
+}
+
+export function buildClineHeaders(token, extraHeaders = {}) {
+  const authorization = getClineAuthorizationHeader(token);
+  const headers = {
+    "HTTP-Referer": "https://cline.bot",
+    "X-Title": "Cline",
+    "User-Agent": `9Router/${APP_VERSION}`,
+    "X-PLATFORM": process.platform || "unknown",
+    "X-PLATFORM-VERSION": process.version || "unknown",
+    "X-CLIENT-TYPE": "9router",
+    "X-CLIENT-VERSION": APP_VERSION,
+    "X-CORE-VERSION": APP_VERSION,
+    "X-IS-MULTIROOT": "false",
+    ...extraHeaders,
+  };
+
+  if (authorization) {
+    headers.Authorization = authorization;
+  }
+
+  return headers;
+}

open-sse/shared/machineId.js

@@ -0,0 +1,19 @@
+import { machineIdSync } from "node-machine-id";
+import crypto from "node:crypto";
+
+let cachedRawId = null;
+
+function loadRawMachineId() {
+  if (cachedRawId) return cachedRawId;
+  try {
+    cachedRawId = machineIdSync();
+  } catch {
+    cachedRawId = crypto.randomUUID();
+  }
+  return cachedRawId;
+}
+
+export async function getConsistentMachineId(salt = "endpoint-proxy-salt") {
+  const rawId = loadRawMachineId();
+  return crypto.createHash("sha256").update(rawId + salt).digest("hex").substring(0, 16);
+}