fix(security): replace insecure PRNG, harden JSON.parse, fix ESLint errors

src/core/factory.ts

@@ -5,7 +5,7 @@ import { PredictModule } from '../modules/predict';
 /**
  * Options for creating a module
  */
-export interface ModuleOptions<TInput extends Record<string, any>, TOutput extends Record<string, any>> {
+export interface ModuleOptions<TInput extends Record<string, any>> {
   name: string;
   signature: Signature;
   promptTemplate: (input: TInput) => string;
@@ -15,14 +15,14 @@ export interface ModuleOptions<TInput extends Record<string, any>, TOutput exten
 /**
  * Factory function to create modules based on strategy
  */
-export function defineModule<TInput extends Record<string, any>, TOutput extends Record<string, any>>(
-  options: ModuleOptions<TInput, TOutput>
-): Module<TInput, TOutput> {
+export function defineModule<TInput extends Record<string, any>, TResult extends Record<string, any>>(
+  options: ModuleOptions<TInput>
+): Module<TInput, TResult> {
   const strategy = options.strategy || 'Predict';
 
   switch (strategy) {
     case 'Predict':
-      return new PredictModule<TInput, TOutput>(options);
+      return new PredictModule<TInput, TResult>(options);
 
     case 'ChainOfThought':
     case 'ReAct':

src/core/module.ts

@@ -1,4 +1,4 @@
-import { Signature, FieldDefinition } from './signature';
+import { Signature } from './signature';
 
 /**
  * Base class for DSPy.ts modules.

src/lm/onnx.ts

@@ -107,7 +107,7 @@ export class ONNXModel implements LMDriver {
     // This will be expanded in future phases to handle actual tokenization
     this.tokenizer = {
       encode: (text: string) => new Float32Array([text.length]), // Dummy implementation
-      decode: (tokens: Float32Array) => 'Decoded text' // Dummy implementation
+      decode: (_tokens: Float32Array) => 'Decoded text' // Dummy implementation
     };
   }
 

src/lm/torch.ts

@@ -215,7 +215,7 @@ export class TorchModel implements LMDriver {
   /**
    * Process output tensor to text
    */
-  private processOutput(output: torch.Tensor, options?: GenerationOptions): string {
+  private processOutput(output: torch.Tensor, _options?: GenerationOptions): string {
     // For MVP, return a simple string based on the output tensor
     // This will be replaced with actual detokenization in future phases
     const shape = output.shape.join('x');

src/memory/agentdb/client.ts

@@ -8,6 +8,7 @@
  * environments without native deps.
  */
 
+import { randomBytes } from 'crypto';
 import pino from 'pino';
 import retry from 'async-retry';
 import { AgentDBConfig, mergeConfig } from './config';
@@ -461,7 +462,7 @@ export class AgentDBClient {
   }
 
   private generateId(): string {
-    return `${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
+    return `${Date.now()}-${randomBytes(5).toString('hex')}`;
   }
 
   private invalidateCache(): void {

src/memory/reasoning-bank/bank.ts

@@ -4,9 +4,10 @@
  * Persistent memory system for AI agents with self-learning capabilities
  */
 
+import { randomBytes } from 'crypto';
 import pino from 'pino';
 import { AgentDBClient } from '../agentdb/client';
-import { SAFLA, DEFAULT_SAFLA_CONFIG } from './safla';
+import { SAFLA } from './safla';
 import {
   KnowledgeUnit,
   Experience,
@@ -513,7 +514,7 @@ export class ReasoningBank {
    * Generate unique ID
    */
   private generateId(): string {
-    return `ku-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+    return `ku-${Date.now()}-${randomBytes(5).toString('hex')}`;
   }
 
   /**

src/modules/chain-of-thought.ts

@@ -169,7 +169,7 @@ export class ChainOfThought<
    */
   private parseCoTResponse(response: string): Record<string, any> {
     // Try to extract JSON from response
-    let jsonMatch = response.match(/\{[\s\S]*\}/);
+    const jsonMatch = response.match(/\{[\s\S]*\}/);
 
     if (jsonMatch) {
       try {
@@ -181,7 +181,7 @@ export class ChainOfThought<
         }
 
         return parsed;
-      } catch (error) {
+      } catch {
         // JSON parsing failed, fallback
       }
     }

src/modules/react.ts

@@ -422,7 +422,7 @@ export class ReAct<
    */
   private parseAnswer(
     answerText: string,
-    steps: ReActStep[]
+    _steps: ReActStep[]
   ): Record<string, any> {
     const result: Record<string, any> = {};
 
@@ -435,7 +435,7 @@ export class ReAct<
       const match = answerText.match(pattern);
 
       if (match) {
-        let value = match[1].trim().replace(/^["']|["']$/g, '');
+        const value = match[1].trim().replace(/^["']|["']$/g, '');
 
         // Type conversion
         if (field.type === 'number') {

src/optimize/bootstrap.ts

@@ -202,7 +202,12 @@ export class BootstrapFewShot<
 
   load(filePath: string): void {
     const safePath = safeResolvePath(filePath);
-    const data = JSON.parse(fs.readFileSync(safePath, 'utf8'));
+    let data: Record<string, any>;
+    try {
+      data = JSON.parse(fs.readFileSync(safePath, 'utf8'));
+    } catch (err) {
+      throw new Error(`Failed to parse saved state from ${safePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
     // Reconstructs with the fixed demo set (dynamic selection needs a live store, which isn't serialized).
     this.optimizedProgram = new BootstrapOptimizedModule(data.program.name, data.program.signature, data.program.demos ?? []);
     if (data.config) this.config = data.config;

src/optimize/gepa.ts

@@ -293,7 +293,12 @@ export class GEPA<TInput extends Record<string, any>, TOutput extends Record<str
 
   load(filePath: string): void {
     const safePath = safeResolvePath(filePath);
-    const data = JSON.parse(fs.readFileSync(safePath, 'utf8'));
+    let data: Record<string, any>;
+    try {
+      data = JSON.parse(fs.readFileSync(safePath, 'utf8'));
+    } catch (err) {
+      throw new Error(`Failed to parse saved state from ${safePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
     this.optimizedProgram = new OptimizedModule(data.program.name, data.program.signature, data.program.instruction, []);
     this.lastResult = data.result ?? null;
   }

src/optimize/miprov2.ts

@@ -387,7 +387,12 @@ export class MIPROv2<TInput extends Record<string, any>, TOutput extends Record<
 
   load(filePath: string): void {
     const safePath = safeResolvePath(filePath);
-    const data = JSON.parse(fs.readFileSync(safePath, 'utf8'));
+    let data: Record<string, any>;
+    try {
+      data = JSON.parse(fs.readFileSync(safePath, 'utf8'));
+    } catch (err) {
+      throw new Error(`Failed to parse saved state from ${safePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
     this.optimizedProgram = new OptimizedModule(data.program.name, data.program.signature, data.program.instruction, data.program.demos ?? []);
     this.lastResult = data.result ?? null;
     if (data.config) this.config = data.config;

src/types/js-pytorch.d.ts

@@ -21,18 +21,21 @@ declare module 'js-pytorch' {
   }
 
   interface Linear extends Module {
-    new(inputSize: number, outputSize: number): Linear;
     copy_: (value: any) => void;
   }
 
-  interface ReLU extends Module {
-    new(): ReLU;
+  interface LinearConstructor {
+    new(inputSize: number, outputSize: number): Linear;
+  }
+
+  interface ReLUConstructor {
+    new(): Module;
   }
 
   interface NN {
     Module: typeof Module;
-    Linear: Linear;
-    ReLU: ReLU;
+    Linear: LinearConstructor;
+    ReLU: ReLUConstructor;
   }
 
   // Mock support for testing