anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Web UI - attaching images over HTTP (non-secure context) does not work #8988

New Issue
Open
opened 2026-02-16 18:11:20 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:11:20 -05:00
Owner
Copy Link
Copy Source

Originally created by @selimerunkut on GitHub (Feb 10, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Bug Description

crypto.randomUUID() throws a DOMException when called in a non-secure browser context (plain HTTP, not HTTPS). This crashes the web UI when attaching images and in other spots that generate IDs.

Error

Uncaught TypeError: crypto.randomUUID is not a function

Root Cause

The existing code uses optional chaining:

id: crypto.randomUUID?.() ?? Math.random().toString(16).slice(2)

However, optional chaining doesn't help here — the randomUUID method exists on the crypto object, but it throws when the browser context isn't secure (e.g., accessing via HTTP instead of HTTPS, or in certain embedded contexts).

Affected Files

  • packages/app/src/components/prompt-input/attachments.ts — image attachment crash
  • packages/app/src/context/comments.tsx
  • packages/app/src/utils/perf.ts

Expected Behavior

The web UI should gracefully fall back to Math.random().toString(16).slice(2) when crypto.randomUUID() is unavailable or throws.

Environment

  • Accessing OpenCode web interface over HTTP (non-HTTPS)
  • Browser: Any modern browser in non-secure context

Additional Context

Server-side usages in packages/opencode and packages/enterprise are unaffected since Node/Bun always runs in a secure context.

Originally created by @selimerunkut on GitHub (Feb 10, 2026). Originally assigned to: @adamdotdevin on GitHub. ## Bug Description `crypto.randomUUID()` throws a `DOMException` when called in a non-secure browser context (plain HTTP, not HTTPS). This crashes the web UI when attaching images and in other spots that generate IDs. ## Error ``` Uncaught TypeError: crypto.randomUUID is not a function ``` ## Root Cause The existing code uses optional chaining: ```typescript id: crypto.randomUUID?.() ?? Math.random().toString(16).slice(2) ``` However, optional chaining doesn't help here — the `randomUUID` method *exists* on the `crypto` object, but it *throws* when the browser context isn't secure (e.g., accessing via HTTP instead of HTTPS, or in certain embedded contexts). ## Affected Files - `packages/app/src/components/prompt-input/attachments.ts` — image attachment crash - `packages/app/src/context/comments.tsx` - `packages/app/src/utils/perf.ts` ## Expected Behavior The web UI should gracefully fall back to `Math.random().toString(16).slice(2)` when `crypto.randomUUID()` is unavailable or throws. ## Environment - Accessing OpenCode web interface over HTTP (non-HTTPS) - Browser: Any modern browser in non-secure context ## Additional Context Server-side usages in `packages/opencode` and `packages/enterprise` are unaffected since Node/Bun always runs in a secure context.
yindo added the web label 2026-02-16 18:11:20 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label web
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8988
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?