Fix tunnel

src/shared/utils/machineId.js

@@ -5,7 +5,11 @@ import crypto from 'node:crypto';
 import { DATA_DIR } from '@/lib/dataDir';
 
 const MACHINE_ID_FILE = path.join(DATA_DIR, 'machine-id');
+const AUTH_DIR = path.join(DATA_DIR, 'auth');
+const CLI_SECRET_FILE = path.join(AUTH_DIR, 'cli-secret');
+const CLI_AUTH_SALT = '9r-cli-auth';
 let cachedRawId = null;
+let cachedCliSecret = null;
 
 // Persist raw machine ID to file → guarantees CLI/server/middleware see same value
 // even when machineIdSync fails or returns inconsistent values across runtimes.
@@ -27,10 +31,26 @@ function loadRawMachineId() {
   return cachedRawId;
 }
 
+// Random secret persisted on first run → unpredictable CLI token even when machineId leaks.
+function loadCliSecret() {
+  if (cachedCliSecret) return cachedCliSecret;
+  try {
+    cachedCliSecret = fs.readFileSync(CLI_SECRET_FILE, 'utf8').trim();
+    if (cachedCliSecret) return cachedCliSecret;
+  } catch {}
+  cachedCliSecret = crypto.randomBytes(32).toString('hex');
+  try {
+    fs.mkdirSync(AUTH_DIR, { recursive: true });
+    fs.writeFileSync(CLI_SECRET_FILE, cachedCliSecret, { mode: 0o600 });
+  } catch {}
+  return cachedCliSecret;
+}
+
 export async function getConsistentMachineId(salt = null) {
   const saltValue = salt || process.env.MACHINE_ID_SALT || 'endpoint-proxy-salt';
   const raw = loadRawMachineId();
-  return crypto.createHash('sha256').update(raw + saltValue).digest('hex').substring(0, 16);
+  const extra = saltValue === CLI_AUTH_SALT ? loadCliSecret() : '';
+  return crypto.createHash('sha256').update(raw + saltValue + extra).digest('hex').substring(0, 16);
 }
 
 export async function getRawMachineId() {