security: resolve 17 CodeQL alerts (XSS / attribute-sanitization / insecure-randomness / shell-quote)

[tbitcs]

What

Closes the 17 open CodeQL code-scanning alerts on
BitConcepts/specsmith-vscode develop so we hit zero open alerts
across the org (CLI is already at zero). No user-visible behaviour
changes — this is a defence-in-depth pass.

Rule	Severity	Where	Fix
js/insecure-randomness ×2	warning	src/ChatStreamConsumer.ts:155, 232	generateSessionId() uses crypto.randomUUID() instead of Math.random().
js/xss ×5 (error)	error	media/session.js:20, 25, 78, 298, 510	Wrapped LLM-controlled values (customTs, lbl, args.path hint, addImg src, vcs additions/deletions) through esc() / numeric coercion.
js/incomplete-html-attribute-sanitization ×5	warning	media/session.js:104, 166, 172, 218, 299	esc() now escapes " and ' too. The Report Bug / View Full / Crash buttons no longer use inline onclick="rptTool(this,'X','Y')"; they switched to data-action/data-* attributes plus a single delegated click listener, removing the brittle JS-string smuggling.
js/identity-replacement ×1	warning	media/session.js:172	Same data-attribute refactor as above eliminates the cleanR.replace(/'/g,"\\'") pair the linter flagged.
js/incomplete-sanitization ×2	warning	src/extension.ts:584 (preflight), src/GovernancePanel.ts:528 (agent task)	Shell-quote helpers now escape \ before " so a trailing backslash can no longer escape the closing quote.
js/bad-tag-filter ×2	warning	src/test/session-logic.test.ts:238, 249	Build-output integrity tests use /<script\b[^>]*>...<\/script\s*>/gi instead of the lower-case-only literal regex.

Why

The 17 alerts came from CodeQL's default JS query suite. The XSS class
is the highest-priority subset — when the chat panel rendered an
agent-controlled customTs, args.path, image data URL, or vcs diff
counts, a hostile LLM response could in theory smuggle markup into the
webview. The shell-quote alerts in extension.ts and
GovernancePanel.ts could likewise be exploited by a hostile utterance
that ends in \. The insecure-randomness alerts on session ids are
mostly cosmetic (they're not used for auth) but crypto.randomUUID()
is a one-line drop-in.

How

• media/session.js

  • esc() now also escapes " and ' so it is safe in attribute
    context, not just element-text context.
  • addU / addA escape customTs (history-replay timestamps).
  • addTStart escapes lbl and the args.path hint branch.
  • addImg escapes the u (data:/file path) before <img src=…>.
  • vcs_state additions/deletions go through Number(x)|0 before
    HTML concatenation.
  • Report Bug / View Full / Crash buttons rebuilt with
    data-action="rptTool" / data-action="rptCrash" /
    data-action="viewFull" etc., wired through one
    document.addEventListener('click', …) handler at the bottom of
    the file. The brittle cleanR.replace(/'/g,"\\'") is gone.

• src/ChatStreamConsumer.ts — generateSessionId() now does
  'sess_' + crypto.randomUUID().replace(/-/g, '').slice(0, 12).

• src/extension.ts (specsmith.runPreflight) and
  src/GovernancePanel.ts (case 'agentTask') — escape
  backslashes before double quotes when building the shell argument.

• src/test/session-logic.test.ts — case-insensitive <script>
  regex with explicit \b and \s*> boundaries.

• CHANGELOG.md — added a ### Security bullet under
  [Unreleased] describing the fix.

Verification

• npm run lint (tsc --noEmit): clean.
• npm run build (esbuild): 290.9 KB bundle, no errors.
• npm test: 144 passing (no test changes, no regressions).
• After this lands, gh api /repos/BitConcepts/specsmith-vscode/code-scanning/alerts?state=open should re-scan and return length=0 once the CodeQL workflow finishes.

Risk

Low. The biggest behavioural delta is the strengthened esc() — it now
double-encodes " and ' in attribute strings, which the browser
decodes back transparently. The
data-attribute click handlers are wired via the same vscode.postMessage
calls as before.

---

Co-Authored-By: Oz oz-agent@warp.dev