Web UI crashes over plain-HTTP LAN/VPN access: crypto.randomUUID is not a function (secure-context-only API)

[caozeal]

Summary

When the Web UI is served over plain HTTP on a LAN/VPN address (e.g. http://10.0.0.2:3080 via WireGuard, using --trusted-host), any code path that calls crypto.randomUUID() crashes with:

crypto.randomUUID is not a function.
(In 'crypto.randomUUID()', 'crypto.randomUUID' is undefined)

First visible symptom: Settings → 模型 (Models) fails to load the provider catalog with the above error.

Root cause

crypto.randomUUID() is only exposed in secure contexts (HTTPS, or localhost/127.0.0.1). Plain-HTTP access via a LAN IP is an insecure context, so the function is undefined — while crypto.getRandomValues() remains available there.

Local access via http://127.0.0.1:3080 works because loopback counts as a secure context, which is likely why this went unnoticed.

Why this is in scope

--trusted-host exists precisely to bless non-loopback serving (LAN/VPN deployments), and the /api browser-trust fence explicitly accepts "deployment-derived LAN IP literals, or a declared trustedHosts authority". So plain-HTTP remote serving is a supported deployment shape — the frontend just isn't robust in it yet.

Reproduction

1. Serve the Web UI: dsh web --trusted-host 10.0.0.2:3080 (with any loopback relay bound to the LAN/VPN interface)
2. From another device, open http://10.0.0.2:3080 (tested: iOS Safari over WireGuard)
3. Open Settings → Models → error above

Suggested fix

Polyfill at the web entry, keeping the native implementation wherever it exists. getRandomValues draws from the same CSPRNG, so randomness quality is unchanged:

if (typeof crypto !== 'undefined' && typeof crypto.randomUUID !== 'function') {
  ;(crypto as { randomUUID?: () => string }).randomUUID = () => {
    const b = crypto.getRandomValues(new Uint8Array(16))
    b[6] = ((b[6] ?? 0) & 0x0f) | 0x40 // version 4
    b[8] = ((b[8] ?? 0) & 0x3f) | 0x80 // variant 10
    const h = Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')
    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`
  }
}

A ready branch implementing this (passes the repo's lefthook gates, incl. noUncheckedIndexedAccess typecheck): https://github.com/caozeal/deepseek-harness/tree/fix/web-randomuuid-insecure-context

I understand external PRs are not accepted at this stage — sharing the branch as a reference patch; happy to adjust the approach (e.g. a shared util instead of an entry-level polyfill) if the team prefers.

Environment

• dsh 0.1.0-rc.5, built from source (master @ 47f9438)
• Client: iOS Safari, WireGuard tunnel to the host
• Host: macOS (Apple Silicon)

[billsargent]

I still get the same error even from your branch. But then again I'm trying to access it from another machine. I really don't like being gatekept from running this on my local lan openly and only on 127..0.0.1. I modified packages/bundle//web-app/src/startup.ts and removed the check for --host 0.0.0.0 but I think there likely needs to be more done.