fix(mimo): add supportsVision flag to MiMo-V2.5, V2.5-Pro, and V2-Omni

src/lib/cloudAgent/baseAgent.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import type {
   CloudAgentTask,
   CloudAgentStatus,
@@ -86,10 +87,12 @@ export abstract class CloudAgentBase {
   }
 
   protected generateTaskId(): string {
-    return `task_${Date.now()}_${crypto.randomUUID().replace(/-/g, "").substring(0, 9)}`;
+    // Cryptographically secure suffix (not Math.random) — task IDs flow into
+    // session/external identifiers, so they must be unpredictable (CodeQL js/insecure-randomness).
+    return `task_${Date.now()}_${randomBytes(8).toString("hex")}`;
   }
 
   protected generateActivityId(): string {
-    return `act_${Date.now()}_${crypto.randomUUID().replace(/-/g, "").substring(0, 9)}`;
+    return `act_${Date.now()}_${randomBytes(8).toString("hex")}`;
   }
 }

tests/unit/antigravity-discovery-bootstrap.test.ts

@@ -152,6 +152,9 @@ describe("ensureAntigravityProjectAssigned", () => {
 
     const mockFetch = async (url: string, _init?: RequestInit): Promise<Response> => {
       hitUrls.push(url);
+      // Exact hostname match (not substring .includes) so the check can't be fooled by a
+      // look-alike host like daily-cloudcode-pa.googleapis.com.evil.com (CodeQL
+      // js/incomplete-url-substring-sanitization).
       if (new URL(url).hostname === "daily-cloudcode-pa.googleapis.com") {
         // First URL fails
         return new Response("not found", { status: 404 });

tests/unit/t31-t33-t34-t38-model-specs.test.ts

@@ -71,3 +71,10 @@ test("T38: modelSpecs exposes centralized helpers with alias and prefix lookup",
   assert.equal(getDefaultThinkingBudget("gemini-3.1-pro-high"), 24576);
   assert.equal(capThinkingBudget("gemini-3.1-pro-low", 50000), 16000);
 });
+
+test("T38: MiMo V2.5 and V2 Omni models support vision", () => {
+  assert.equal(MODEL_SPECS["mimo-v2.5-pro"].supportsVision, true);
+  assert.equal(MODEL_SPECS["mimo-v2.5"].supportsVision, true);
+  assert.equal(MODEL_SPECS["mimo-v2-omni"].supportsVision, true);
+  assert.equal(MODEL_SPECS["mimo-v2-flash"].supportsVision, undefined);
+});