From 436f11cd6a7947452d1b1be9f54eae3ce3231b68 Mon Sep 17 00:00:00 2001
From: Tallsome <tallsome24@gmail.com>
Date: Mon, 8 Jun 2026 00:46:46 +0100
Subject: [PATCH] =?UTF-8?q?fix(mission-control):=20Math.random()=20in=20ra?=
 =?UTF-8?q?ndomId()=20=E2=80=94=20weak=20entropy=20for=20mission=20IDs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace Math.random() with crypto.randomBytes(4).toString('hex').

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/missionControl.ts                        |  2 +-
 tests/test_mission_control_random_id.test.ts | 26 ++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 tests/test_mission_control_random_id.test.ts

diff --git a/src/missionControl.ts b/src/missionControl.ts
index 5b734454c..41d32320e 100644
--- a/src/missionControl.ts
+++ b/src/missionControl.ts
@@ -29,7 +29,7 @@ function truncate(value: string, maxLength: number): string {
 }
 
 function randomId(): string {
-  return Math.random().toString(36).slice(2, 8);
+  return require('crypto').randomBytes(4).toString('hex');
 }
 
 function missionControlDisabled(): boolean {
diff --git a/tests/test_mission_control_random_id.test.ts b/tests/test_mission_control_random_id.test.ts
new file mode 100644
index 000000000..abc0e0676
--- /dev/null
+++ b/tests/test_mission_control_random_id.test.ts
@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'crypto';
+
+function randomId(): string {
+	return randomBytes(4).toString('hex');
+}
+
+describe('missionControl randomId', () => {
+	it('produces an 8-character hex string', () => {
+		expect(randomId()).toMatch(/^[0-9a-f]{8}$/);
+	});
+	it('does not use Math.random', () => {
+		const src = randomId.toString();
+		expect(src).not.toContain('Math.random');
+	});
+	it('generates 1000 unique IDs', () => {
+		const ids = Array.from({ length: 1000 }, () => randomId());
+		expect(new Set(ids).size).toBeGreaterThan(990);
+	});
+	it('returns a string', () => {
+		expect(typeof randomId()).toBe('string');
+	});
+	it('has correct length', () => {
+		expect(randomId()).toHaveLength(8);
+	});
+});