From a1d72086861054455ac2b01b9955104a525224e9 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nousagent.com>
Date: Wed, 12 Aug 2026 04:45:19 -0700
Subject: [PATCH] [grade=A] DC-085: Replace Math.random() with crypto for
 security-sensitive IDs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- port-lock-manager.js: lockId uses crypto.randomBytes(8) instead of Math.random()
- openclaw.js: generateToken() uses crypto.randomBytes(24).toString('base64url') — 192 bits entropy
- Sampling uses (health-checker 5%, resource-monitor 10%) intentionally left as Math.random

Codex grade: A (21,294 tokens). All 1539 tests pass.
---
 dashcaddy-api/routes/openclaw.js                | 8 ++------
 dashcaddy-api/src/managers/port-lock-manager.js | 3 ++-
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/dashcaddy-api/routes/openclaw.js b/dashcaddy-api/routes/openclaw.js
index f916534..5977c24 100644
--- a/dashcaddy-api/routes/openclaw.js
+++ b/dashcaddy-api/routes/openclaw.js
@@ -1,5 +1,6 @@
 const express = require('express');
 const http = require('http');
+const crypto = require('crypto');
 const { ok, errorResponse, notFound, conflict } = require('../src/utils/responses');
 
 /**
@@ -263,10 +264,5 @@ module.exports = function openClawRoutes(ctx) {
 // ── token generator ──────────────────────────────────────────────────────────
 
 function generateToken() {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-  let result = '';
-  for (let i = 0; i < 32; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return result;
+  return crypto.randomBytes(24).toString('base64url');
 }
diff --git a/dashcaddy-api/src/managers/port-lock-manager.js b/dashcaddy-api/src/managers/port-lock-manager.js
index d52ce39..73e4814 100644
--- a/dashcaddy-api/src/managers/port-lock-manager.js
+++ b/dashcaddy-api/src/managers/port-lock-manager.js
@@ -6,6 +6,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const lockfile = require('proper-lockfile');
 const platformPaths = require('../../platform-paths');
 const { log } = require('../utils/logging');
@@ -58,7 +59,7 @@ class PortLockManager {
       throw new Error('Ports must be a non-empty array');
     }
 
-    const lockId = `lock-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+    const lockId = `lock-${Date.now()}-${crypto.randomBytes(8).toString('hex')}`;
     const sortedPorts = [...new Set(ports)].sort((a, b) => parseInt(a) - parseInt(b));
     const acquiredLocks = [];
     const releaseFunctions = [];