Hotfix/machine id header

[mikhailm-coder]

Description

Improvements

Task

Link

Summary by CodeRabbit

• New Features

  • Added OpenFrame support for identifying devices with a platform-specific machine ID.
  • OpenFrame requests now include machine identification and secure bearer authentication.
  • Support extends to tunnels, file downloads, console connections, and agent updates.
  • Added an openFrameMode status property to indicate when OpenFrame support is active.

• Reliability

  • Machine ID retrieval safely handles missing files, read errors, empty values, and platform-specific locations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b3648a84-2be9-4195-a236-41f5b74de6f7

📥 Commits

Reviewing files that changed from the base of the PR and between 1db9462 and 0626d8f.

📒 Files selected for processing (1)

• CoreModule.js

🚧 Files skipped from review as they are similar to previous changes (1)

• CoreModule.js

---

📝 Walkthrough

Walkthrough

The change adds cross-platform OpenFrame machine-ID reading and conditionally sends x-machine-id and Bearer Authorization headers across native and JavaScript request paths.

Changes

OpenFrame request identity

Layer / File(s)	Summary
Machine-ID reader contract and implementation openframe/machine_id_reader.h, openframe/machine_id_reader.c	Defines read_machine_id() and implements platform-specific file lookup, allocation, cleanup, newline trimming, and empty-value rejection.
Native OpenFrame integration meshcore/agentcore.c, makefile, meshconsole/MeshConsole-2022.vcxproj, meshservice/MeshService-2022.vcxproj	Exposes readonly openFrameMode, adds machine-ID and Bearer headers to native connection requests, and includes the reader in native builds.
JavaScript request-header integration CoreModule.js, modules/RecoveryCore.js	Caches the machine ID and applies OpenFrame headers to tunnel, download, console HTTP/WebSocket, file-fetch, and agent self-update requests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding machine ID and related headers for OpenFrame requests.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hotfix/machine-id-header

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Biome (2.5.6)

CoreModule.js

File contains syntax errors that prevent linting: Line 612: the target for a delete operator cannot be a single identifier; Line 1396: the target for a delete operator cannot be a single identifier; Line 3188: the target for a delete operator cannot be a single identifier

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CoreModule.js`:
- Around line 739-755: Restrict OpenFrame credentials to approved server
authorities over TLS: update addOpenFrameHeaders to validate the destination
authority and require https: or wss: before attaching x-machine-id or
Authorization. Apply the same guard at CoreModule.js lines 5139-5140, 5168-5169,
and 5818-5819, modules/RecoveryCore.js lines 25-41, and meshcore/agentcore.c
lines 4758-4781; reject or omit credentials for untrusted authorities and
insecure ws:/http: targets.

In `@openframe/machine_id_reader.c`:
- Around line 32-36: Update both machine-ID reading paths in
openframe/machine_id_reader.c at lines 32-36 and 75-79 to reject overlong lines
or continue reading until the complete line is consumed; never return a
truncated machine ID. Apply identical handling in both sites, preserving the
existing cleanup and failure behavior when rejecting invalid input.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2b841b21-bf5f-4179-b1a0-ff3b4f05f7df

📥 Commits

Reviewing files that changed from the base of the PR and between 9918480 and 1db9462.

📒 Files selected for processing (8)

• CoreModule.js
• makefile
• meshconsole/MeshConsole-2022.vcxproj
• meshcore/agentcore.c
• meshservice/MeshService-2022.vcxproj
• modules/RecoveryCore.js
• openframe/machine_id_reader.c
• openframe/machine_id_reader.h