From 933019b6a9fae4d7aa2aa2c877f83f3113602e82 Mon Sep 17 00:00:00 2001
From: Kevin Codex <kevin@gitlawb.com>
Date: Sun, 18 Oct 2026 12:00:39 +0800
Subject: [PATCH] test: use crypto.randomUUID for query-engine fixture uuids
 (#2289)

CodeQL default setup flagged js/insecure-randomness (alert #72, high)
on the custom-pricing budget fixture, which built message uuids from
Math.random(). The values never leave the test process, but the field
is typed as UUID and the same pattern appeared in three places across
two fixtures.

Generate the uuids with crypto.randomUUID() instead. This clears the
alert, matches the Message uuid type, and drops the
`as Message['uuid']` cast in the manual-compact cooldown fixture.
Nothing depended on the old user-/assistant-/test- prefixes.

Co-authored-by: OpenClaude <openclaude@gitlawb.com>
---
 src/test/fixtures/queryEngineCustomPricingBudget.fixture.ts  | 5 +++--
 .../fixtures/queryEngineManualCompactCooldown.fixture.ts     | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/test/fixtures/queryEngineCustomPricingBudget.fixture.ts b/src/test/fixtures/queryEngineCustomPricingBudget.fixture.ts
index 142cfd8f5..9ebcf9a8b 100644
--- a/src/test/fixtures/queryEngineCustomPricingBudget.fixture.ts
+++ b/src/test/fixtures/queryEngineCustomPricingBudget.fixture.ts
@@ -1,5 +1,6 @@
 import { mock } from 'bun:test'
 import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -45,7 +46,7 @@ mock.module('../../utils/processUserInput/processUserInput.js', () => ({
         type: 'user',
         message: { role: 'user', content: 'run' },
         isMeta: false,
-        uuid: `user-${Math.random()}`,
+        uuid: randomUUID(),
         timestamp: new Date().toISOString(),
       } as Message,
     ],
@@ -112,7 +113,7 @@ async function* pricedQuery({
       stop_sequence: null,
       usage,
     },
-    uuid: `assistant-${Math.random()}`,
+    uuid: randomUUID(),
     timestamp: new Date().toISOString(),
   } as Message
 }
diff --git a/src/test/fixtures/queryEngineManualCompactCooldown.fixture.ts b/src/test/fixtures/queryEngineManualCompactCooldown.fixture.ts
index 68a1c9069..c7f1bfe56 100644
--- a/src/test/fixtures/queryEngineManualCompactCooldown.fixture.ts
+++ b/src/test/fixtures/queryEngineManualCompactCooldown.fixture.ts
@@ -1,5 +1,6 @@
 import { mock } from 'bun:test'
 import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -19,7 +20,7 @@ function compactBoundaryMessage(): Message {
     content: 'Conversation compacted',
     isMeta: false,
     timestamp: new Date().toISOString(),
-    uuid: `test-${Math.random()}` as Message['uuid'],
+    uuid: randomUUID(),
     level: 'info',
     compactMetadata: {
       trigger: 'manual',