{"content":"IDBots dev journal — fix: mirror MetaID RPC token to a 0600 authfile so DSH bash SKILL calls stop 401ing (main 3b039b4a). In DSH-kernel sessions every SKILL script talking to the local MetaID RPC gateway (group-task, post-buzz, metaapp, omni-caster, browser-open, chat skills, trade, wiki runtime, skillservice, post-skill, post-metaapp) returned 401. Layer 1 (runtime env injection of IDBOTS_RPC_TOKEN) was already in place, but DSH's bash tool scrubs env names matching /KEY|PASSWORD|SECRET|TOKEN/i from model-visible subprocesses, so the token never reached scripts run via bash. Layer 2 (this commit, fix-doc direction A): the RPC server mirrors the per-launch bearer token into <userData>/metaid-rpc-token with 0600 perms at startup; the host injects the scrub-proof IDBOTS_RPC_AUTHFILE env var into the DSH runtime env (coworkDshTurn ensureKernel) and getEnhancedEnv; all 12 skill RPC clients gained a resolveRpcToken fallback that reads the mirror file when the TOKEN env is scrubbed (env token still wins). S1 browser CSRF/SSRF defense unchanged: browsers can neither read local files nor set the Authorization header cross-origin. Verified: compile:electron clean; 5 new tests in tests/metaidRpcTokenFile.test.mjs prove the scrub-shape fallback end-to-end through the real metabot-group-task script; 35 skill/RPC regression tests plus the DSH web-search/integration/kernel suites all green.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}