@claw-link/gateway-host 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/src/machine.js

@@ -1,29 +1,58 @@
 'use strict';
-// Stable machine fingerprint for host binding. Derived from the host's physical
-// MAC address(es) + hostname, then hashed — we send only the HASH to ClawLink, so
-// raw MACs never leave the machine. Supabase binds this on first connect; after
-// that, only this machine may act for the agent (a stolen token from elsewhere
-// fails the binding check).
+// Stable machine fingerprint for host binding. We bind an agent's token to ONE
+// machine so a stolen token can't be used elsewhere. The fingerprint MUST be
+// stable across reboots and network changes — earlier versions hashed MAC
+// addresses, which rotate (Tailscale/Docker/VPN/private-WiFi) and caused false
+// "host binding mismatch" errors. We now use the OS hardware machine id, with a
+// persisted random id as a fallback, and send only the HASH.
 
 const os = require('os');
+const fs = require('fs');
+const path = require('path');
 const crypto = require('crypto');
+const { execSync } = require('child_process');
+const { enrichedEnv } = require('./paths');
 
-function macAddresses() {
-  const macs = [];
-  const ifaces = os.networkInterfaces();
-  for (const name of Object.keys(ifaces)) {
-    for (const ni of ifaces[name] || []) {
-      if (ni.internal) continue;
-      if (!ni.mac || ni.mac === '00:00:00:00:00:00') continue;
-      macs.push(ni.mac.toLowerCase());
+const HOME_DIR = path.join(os.homedir(), '.clawlink-host');
+
+function execSafe(cmd) {
+  try { return execSync(cmd, { stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000, env: enrichedEnv() }).toString(); }
+  catch { return ''; }
+}
+
+// Stable, hardware-tied id where available.
+function hardwareId() {
+  try {
+    if (process.platform === 'darwin') {
+      const m = execSafe('ioreg -rd1 -c IOPlatformExpertDevice').match(/IOPlatformUUID"\s*=\s*"([^"]+)"/);
+      if (m) return 'hw:' + m[1];
+    } else if (process.platform === 'linux') {
+      for (const p of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try { const id = fs.readFileSync(p, 'utf8').trim(); if (id) return 'hw:' + id; } catch { /* next */ }
+      }
+    } else if (process.platform === 'win32') {
+      const m = execSafe('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid').match(/MachineGuid\s+REG_SZ\s+([\w-]+)/i);
+      if (m) return 'hw:' + m[1];
     }
-  }
-  return [...new Set(macs)].sort();
+  } catch { /* fall through */ }
+  return null;
+}
+
+// Stable random id persisted under the home dir (fallback when no hardware id).
+function persistedId() {
+  const idPath = path.join(HOME_DIR, 'machine-id');
+  try { const id = fs.readFileSync(idPath, 'utf8').trim(); if (id) return 'id:' + id; } catch { /* create below */ }
+  try {
+    fs.mkdirSync(HOME_DIR, { recursive: true });
+    const id = crypto.randomBytes(32).toString('hex');
+    fs.writeFileSync(idPath, id, { mode: 0o600 });
+    try { fs.chmodSync(idPath, 0o600); } catch { /* best effort */ }
+    return 'id:' + id;
+  } catch { return null; }
 }
 
 function machineId() {
-  const macs = macAddresses();
-  const basis = (macs.length ? macs.join(',') : 'no-mac') + '|' + os.hostname();
+  const basis = hardwareId() || persistedId() || ('host:' + os.hostname());
   return crypto.createHash('sha256').update(basis).digest('hex');
 }