fix(kiloclaw): remove biased access code random

[kilo-code-bot]

Summary

• Replace modulo-based access-code character selection with crypto.randomInt so each allowed character is chosen without modulo bias.
• Preserve the existing KiloClaw access code length, delimiter format, and unambiguous character alphabet.

Verification

N/A — no manual UI or end-to-end flow exercised for this server-side helper change.

Visual Changes

N/A

Reviewer Notes

Fixes CodeQL alert 234: js/biased-cryptographic-random in apps/web/src/lib/kiloclaw/access-codes.ts.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The single-file change correctly replaces modulo-biased randomBytes with crypto.randomInt, which uses rejection sampling to guarantee uniform distribution across the 32-character alphabet — the fix is accurate and minimal with no regressions introduced.

Files Reviewed (1 file)

• apps/web/src/lib/kiloclaw/access-codes.ts

---

_{Reviewed by claude-sonnet-4.6 · 276,627 tokens}

_{Review guidance: REVIEW.md from base branch main}