[Bug][grounded-shop-assistant]: chat widget session ids come from Math.random() but act as a bearer secret for history #492

Affected Component

statewave-grounded-shop-assistant — packages/chat-widget/src/mount.ts

Bug Description

The widget generates the chat session id with Math.random():

// packages/chat-widget/src/mount.ts:127
const sessionId = `sess_${Math.random().toString(36).slice(2)}`;

The server trusts that id completely. sessions.get(sessionId, ...) returns whatever session has that key, and chat-core puts that session's history straight into the LLM prompt (packages/chat-core/src/index.ts:66). So the session id is effectively a bearer secret for a shopper's conversation. Anyone who sends another shopper's id gets that shopper's last 12 turns as context, and the model can repeat them back.

Math.random() isn't meant for secrets: it isn't cryptographically random, and the output length varies (toString(36) of a double gives roughly 10–11 chars).

Expected Behavior

Session ids are unguessable.

Suggested fix

const sessionId = `sess_${crypto.randomUUID()}`;

crypto.randomUUID() is available in every browser the widget targets and in Node ≥ 19 (and in Node 18 as globalThis.crypto with the webcrypto flag, which only matters for tests). Pairs well with capping sessionId length server-side (#477).

Environment

main @ d4f0ac0.

Severity

Low — demo app, but the pattern gets copied into real widgets.