fix(security): harden channel token and id generation

src/infra/outbound/delivery-queue.ts

@@ -1,9 +1,9 @@
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import type { ReplyPayload } from "../../auto-reply/types.js";
 import type { OpenClawConfig } from "../../config/config.js";
 import { resolveStateDir } from "../../config/paths.js";
+import { generateSecureUuid } from "../secure-random.js";
 import type { OutboundChannel } from "./targets.js";
 
 const QUEUE_DIRNAME = "delivery-queue";
@@ -83,7 +83,7 @@ export async function enqueueDelivery(
   stateDir?: string,
 ): Promise<string> {
   const queueDir = await ensureQueueDir(stateDir);
-  const id = crypto.randomUUID();
+  const id = generateSecureUuid();
   const entry: QueuedDelivery = {
     id,
     enqueuedAt: Date.now(),

src/infra/secure-random.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { generateSecureToken, generateSecureUuid } from "./secure-random.js";
+
+describe("secure-random", () => {
+  it("generates UUIDs", () => {
+    const first = generateSecureUuid();
+    const second = generateSecureUuid();
+    expect(first).not.toBe(second);
+    expect(first).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+    );
+  });
+
+  it("generates url-safe tokens", () => {
+    const defaultToken = generateSecureToken();
+    const token18 = generateSecureToken(18);
+    expect(defaultToken).toMatch(/^[A-Za-z0-9_-]+$/);
+    expect(token18).toMatch(/^[A-Za-z0-9_-]{24}$/);
+  });
+});

src/infra/secure-random.ts

@@ -0,0 +1,9 @@
+import { randomBytes, randomUUID } from "node:crypto";
+
+export function generateSecureUuid(): string {
+  return randomUUID();
+}
+
+export function generateSecureToken(bytes = 16): string {
+  return randomBytes(bytes).toString("base64url");
+}