Generate message IDs with CSPRNG instead of Date.now+random

[TeoSlayer]

Vulnerability

newId() in plugin/src/wire.ts generated message IDs from Date.now() concatenated with Math.floor(Math.random() * 36**12). Both inputs are predictable:

• Date.now() is observable/guessable to the millisecond.
• Math.random() is not a CSPRNG — its output is predictable and can collide.

Message IDs are used to correlate request/response envelopes and to assemble multi-part (chunked) messages sharing the same id. Predictable or colliding IDs allow an attacker to guess in-flight IDs (enabling spoofed replies / chunk injection) and risk accidental collisions that cross-contaminate reassembly buffers.

Fix

Replace the ad-hoc generator with crypto.randomUUID() (Node Web Crypto-backed CSPRNG), which is unique and unpredictable. newId() keeps the same synchronous () => string signature, so all call sites are unaffected.

Verification

• npm run build (tsc) — clean, no type errors.
• npm test (vitest) — 230/230 pass, including the newId uniqueness test.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!