fix(security): crypto-strong session/terminal IDs in cli + mcp — bump 1.3.5

Replaces Math.random()-based ID generation (js/insecure-randomness) with
crypto.randomBytes — predictable session/terminal IDs are guessable and enable
session-fixation/hijacking:

- cli/mcp-tools/session-tools.ts ×2 (session create + rotate): the
  session-${Date.now()}-${Math.random().toString(36).slice(2,8)} id → randomBytes(6).toString('hex').
- cli/mcp-tools/terminal-tools.ts ×2 (term ids): same swap.
- mcp/session-manager.ts generateSessionId(): third copy of the session-id
  pattern (batch 1 fixed the v3/mcp + @swarmdo/shared copies; this @swarmdo/mcp
  one was missed) → randomBytes(6).toString('hex').

randomBytes(6) = 48 bits hex (12 chars), stronger than the old ~31-bit base36
slice. Added 'node:crypto' imports. Build clean; tests pass: cli session/
terminal-encryption (14) + mcp-tools-deep (107), mcp suite (65).

Versioning: cli was at 1.3.2 while umbrella advanced to 1.3.4 (batches 7-8
bumped the umbrella for other bundled packages but not cli) — resynced the
cli+umbrella+bridge lockstep to 1.3.5; mcp 3.0.0-alpha.11. 5 insecure-randomness
alerts; ~15 first-party remain (other ID generators, next).

Co-Authored-By: Swarmdo <maintainers@swarmdo.com>

Author: JannieP

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo-bridge",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "private": true,
   "description": "Swarmdo MCP-bridge + docker tooling (NOT published \u2014 the canonical `swarmdo` npm package is the repo root). Resolves the post-rename name collision where this wrapper and the root umbrella both became `swarmdo`.",
   "main": "bin/swarmdo.js",

swarmdo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.3.2",
+  "version": "1.3.5",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

v3/@swarmdo/cli/package.json

@@ -6,6 +6,7 @@
 
 import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
 import { type MCPTool, getProjectCwd } from './types.js';
 import {
   mkdirRestricted,
@@ -162,7 +163,7 @@ export const sessionTools: MCPTool[] = [
         if (!v.valid) return { success: false, error: v.error };
       }
 
-      const sessionId = `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      const sessionId = `session-${Date.now()}-${randomBytes(6).toString('hex')}`;
 
       // Load related data based on options
       const data = loadRelatedStores({
@@ -533,7 +534,7 @@ export const sessionTools: MCPTool[] = [
       let parsed: SessionRecord;
       try { parsed = JSON.parse(readFileSync(inputPath, 'utf-8')); }
       catch (e) { return { error: `Invalid session JSON: ${(e as Error).message}` }; }
-      const newId = `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      const newId = `session-${Date.now()}-${randomBytes(6).toString('hex')}`;
       const stats = parsed.stats || { tasks: 0, agents: 0, memoryEntries: 0, totalSize: 0 };
       const session: SessionRecord = {
         sessionId: newId,

v3/@swarmdo/cli/src/mcp-tools/session-tools.ts

@@ -6,6 +6,7 @@
 
 import { type MCPTool, getProjectCwd } from './types.js';
 import { existsSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import {
   mkdirRestricted,
   readFileMaybeEncrypted,
@@ -110,7 +111,7 @@ export const terminalTools: MCPTool[] = [
       if (!vEnv.valid) return { success: false, error: vEnv.error };
 
       const store = loadTerminalStore();
-      const id = `term-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      const id = `term-${Date.now()}-${randomBytes(6).toString('hex')}`;
 
       const session: TerminalSession = {
         id,
@@ -168,7 +169,7 @@ export const terminalTools: MCPTool[] = [
 
       if (!session) {
         // Create default session
-        const id = `term-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const id = `term-${Date.now()}-${randomBytes(6).toString('hex')}`;
         session = {
           id,
           name: 'Default Terminal',

v3/@swarmdo/cli/src/mcp-tools/terminal-tools.ts

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/mcp",
-  "version": "3.0.0-alpha.10",
+  "version": "3.0.0-alpha.11",
   "type": "module",
   "description": "Standalone MCP (Model Context Protocol) server - stdio/http/websocket transports, connection pooling, tool registry",
   "main": "dist/index.js",

v3/@swarmdo/mcp/package.json

@@ -5,6 +5,7 @@
  */
 
 import { EventEmitter } from 'events';
+import { randomBytes } from 'node:crypto';
 import type {
   MCPSession,
   SessionState,
@@ -313,7 +314,7 @@ export class SessionManager extends EventEmitter {
   }
 
   private generateSessionId(): string {
-    return `session-${++this.sessionCounter}-${Date.now()}-${Math.random().toString(36).substring(2, 8)}`;
+    return `session-${++this.sessionCounter}-${Date.now()}-${randomBytes(6).toString('hex')}`;
   }
 
   clearAll(): void {