Web UI features fail over non-localhost HTTP origins: crypto.randomUUID unavailable in insecure context (session delete, file attach)

Summary

Multiple Web UI features break when the Web UI is served over a non-localhost HTTP origin (e.g., a Tailscale hostname http://hostname:49374): the app calls crypto.randomUUID() directly, which is only available in secure contexts, so the calls throw TypeError: crypto.randomUUID is not a function and the action silently fails. Verified for (at least) file drag-drop attach and session delete. Everything works over http://localhost / http://127.0.0.1 (trusted origins).

Environment

• opencode version: 0.0.0-beta-18414 (v2/beta line)
• Interface: Web UI via background service http://0.0.0.0:49374
• Access: http://nico.tail194715.ts.net:49374 (Tailscale hostname, plain HTTP → isSecureContext: false)
• Browser: Chrome

Reproduction

1. Access the Web UI via a non-localhost HTTP hostname (e.g., Tailscale).
2. Session delete: open a session → "その他のオプション" menu → "削除..." → confirm "セッションを削除".
   • Nothing happens: the dialog stays open, no DELETE request is sent, and the console shows Uncaught (in promise):

     TypeError: crypto.randomUUID is not a function
         at Object.remove (runtime-…:651)
         at M (route-…:81)   // session delete click handler
     

3. File attach: drag a file onto the composer (the drop overlay appears) → the file is not added, nothing is uploaded; same crypto.randomUUID is not a function unhandled rejection.

Expected Behavior

• Session deletion should complete (dialog closes, session removed) regardless of the origin used, including Tailscale/remote hostnames over plain HTTP
• File attachments should be added to the composer on any origin

Actual Behavior

• Both actions throw on crypto.randomUUID (insecure context) and never reach the server API
• Verified successful on http://localhost:49374 (secure context) for both features — confirming the root cause is origin-dependent, not a server issue

Root Cause

The shipped (v2/beta) bundle calls crypto.randomUUID() directly in the affected code paths (delete mutation, attachment part id generation) without a fallback. crypto.randomUUID is defined only in secure contexts (HTTPS or explicitly trusted origins like localhost). The dev branch already has a guarded uuid() util with a fallback for insecure contexts (packages/app/src/utils/uuid.ts), which should be used in these paths.

Suggested fix direction

• Replace bare crypto.randomUUID() calls in the app bundle with the uuid() util (fallback for insecure contexts), or otherwise ensure IDs are generated without requiring a secure context
• Audit other crypto.randomUUID usages in the web UI for the same class of failure over remote HTTP origins

Notes

• Affects remote/network access patterns (Tailscale, LAN hostnames) which are common for the v2 preview
• Same-family failure observed previously for file drag-drop attachment