[Bug report] 通过 http://<局域网IP>:3080 访问 Web UI 时，打开文件夹（选择工作区）报"无法打开文件夹"

[Lehmaning]

问题

通过 http://<局域网IP>:3080 访问 Web UI 时，打开文件夹（选择工作区）报"无法打开文件夹"，显示 error 文字：

TypeError: crypto.randomUUID is not a function

复现方法

1. 在本地3080端口启动
2. 将本地端口转发到局域网 IP，比如 192.168.0.1
3. 此时通过 192.168.0.1:3080 访问，创建工作区时报错 TypeError: crypto.randomUUID is not a function

根因

crypto.randomUUID() 只在所谓的安全上下文（HTTPS 或 localhost）可用。明文 HTTP + 非本机地址不是安全上下文，window.crypto.randomUUID 是 undefined。dsh 的客户端 RPC 层在每次调用时用它生成 rpcId：

• packages/host/apiproxy/src/fetch/client.ts — AbstractApiClient.mintRpcId() 调用 crypto.randomUUID()
• packages/client/ui-conversation/src/client/service.ts — browserDraftAttachment() 调用 crypto.randomUUID()

两点补充：

1. 仓库里其实已有浏览器安全的实现 packages/client/connection/src/client/random-uuid.ts（基于 crypto.getRandomValues，注释明确写了 insecure origins 可用），但上面两处没有复用它。
2. CLI 默认拒绝 --host 0.0.0.0（防远程代码执行暴露到网络），局域网访问需要改绑定配置。
3. CLI 的 host 参数只支持 0.0.0.0 和 127.0.0.1 两种 IP，这本身是不合理的设计，虽然在绝大多数开发和部署场景中，用户最终选择的确实是这两个地址，但强制硬编码只支持这两者会导致在许多实际网络环境中系统无法正常工作，应该允许用户输入任意格式的 Host 字符串，内部交由 node 的网络库去处理解析，除非你们没有实现 dsh 公网部署的计划。

修复

两处改用 crypto.getRandomValues 生成 v4 UUID（与 connection 包现有实现一致）。apiproxy 不能反向依赖 connection（会成环），ui-conversation 受插件间值导入的 bundle purity 约束，所以各自本地复制了这个 9 行的小函数。

完整分支：https://github.com/Lehmaning/deepseek-harness/tree/fix/randomuuid-secure-context

diff --git a/packages/client/ui-conversation/src/client/random-uuid.ts b/packages/client/ui-conversation/src/client/random-uuid.ts
new file mode 100644
index 0000000..f0b34d2
--- /dev/null
+++ b/packages/client/ui-conversation/src/client/random-uuid.ts
@@ -0,0 +1,9 @@
+/** RFC 4122 v4 UUID that works outside secure contexts; crypto.randomUUID is gated to HTTPS/localhost. */
+export function randomUuid(): string {
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+  view.setUint8(6, (view.getUint8(6) & 0x0f) | 0x40)
+  view.setUint8(8, (view.getUint8(8) & 0x3f) | 0x80)
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}
diff --git a/packages/client/ui-conversation/src/client/service.ts b/packages/client/ui-conversation/src/client/service.ts
index 198eee5..3a2f1f4 100644
--- a/packages/client/ui-conversation/src/client/service.ts
+++ b/packages/client/ui-conversation/src/client/service.ts
@@ -19,6 +19,7 @@ import type { QueueAction, QueueItemId } from './contract/queue.ts'
 import type { ComposerBlocks } from './input/blocks.ts'
 import type { DraftAttachmentId, SessionInputResolver } from './input/contract.ts'
 import type { InputSubmitMode } from './contract/composer-submission.ts'
+import { randomUuid } from './random-uuid.ts'
 
 /**
  * The outward conversation face (`ctx.conversation`): the scope-addressed
@@ -62,7 +63,7 @@ export interface IConversation {
 function browserDraftAttachment(file: File): ComposerAttachment {
   return {
     kind: 'image',
-    id: crypto.randomUUID() as DraftAttachmentId,
+    id: randomUuid() as DraftAttachmentId,
     previewUrl: URL.createObjectURL(file),
     file,
   }
diff --git a/packages/host/apiproxy/src/fetch/client.ts b/packages/host/apiproxy/src/fetch/client.ts
index 70e3ece..9721a0a 100644
--- a/packages/host/apiproxy/src/fetch/client.ts
+++ b/packages/host/apiproxy/src/fetch/client.ts
@@ -67,6 +67,7 @@ import {
   subagentListValueSchema,
   subagentPromptValueSchema,
 } from '../api/subagents.schema.ts'
+import { randomUuid } from './random-uuid.ts'
 
 /**
  * Client consumption face of the contract (shape a): same domain tree as ApiProxy, but unary
@@ -296,8 +297,7 @@ export abstract class AbstractApiClient implements IApiClient {
   }
 
   protected mintRpcId(): RpcId {
-    // crypto.randomUUID is a Web API (browser + Node ≥19): keeps this base platform-neutral.
-    return RpcId(crypto.randomUUID())
+    return RpcId(randomUuid())
   }
 
   /**
diff --git a/packages/host/apiproxy/src/fetch/random-uuid.ts b/packages/host/apiproxy/src/fetch/random-uuid.ts
new file mode 100644
index 0000000..f0b34d2
--- /dev/null
+++ b/packages/host/apiproxy/src/fetch/random-uuid.ts
@@ -0,0 +1,9 @@
+/** RFC 4122 v4 UUID that works outside secure contexts; crypto.randomUUID is gated to HTTPS/localhost. */
+export function randomUuid(): string {
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+  view.setUint8(6, (view.getUint8(6) & 0x0f) | 0x40)
+  view.setUint8(8, (view.getUint8(8) & 0x3f) | 0x80)
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}

临时绕过

• SSH 隧道访问 http://localhost:3080（localhost 是安全上下文，无需任何改动）
• 或安装 polyfill 插件：https://github.com/Lehmaning/dsh-randomuuid-polyfill