From abd7c877aae2b06f938d8be7e05a9960bd0bcee8 Mon Sep 17 00:00:00 2001
From: zeroaltitude <zeroaltitude@gmail.com>
Date: Sun, 8 Mar 2026 23:08:27 -0700
Subject: [PATCH] fix: use padEnd for truly guaranteed 4-char random slug
 suffix

Previous approach ((random + '0000').slice(2,6)) still produced 3 chars
when Math.random() === 0 ('0'.toString(36) = '0', '00000'.slice(2,6) = '000').
padEnd(4, '0') guarantees exactly 4 characters for all inputs.
---
 src/hooks/bundled/session-memory/handler.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/hooks/bundled/session-memory/handler.ts b/src/hooks/bundled/session-memory/handler.ts
index ed70e42c9a7..f85450a16c9 100644
--- a/src/hooks/bundled/session-memory/handler.ts
+++ b/src/hooks/bundled/session-memory/handler.ts
@@ -332,7 +332,7 @@ const saveSessionToMemory: HookHandler = async (event) => {
     // one silently overwrites the earlier memory entry.
     if (!slug) {
       const timeSlug = now.toISOString().split("T")[1].split(".")[0].replace(/:/g, "");
-      const rand = (Math.random().toString(36) + "0000").slice(2, 6); // guaranteed 4-char
+      const rand = Math.random().toString(36).slice(2, 6).padEnd(4, "0");
       slug = `${timeSlug.slice(0, 6)}-${rand}`;
       log.debug("Using fallback timestamp slug", { slug });
     }