fix: fall back to getRandomValues for UUIDs on insecure origins - #64
Merged
Conversation
crypto.randomUUID() is secure-context-gated, so it's undefined on plain-HTTP non-localhost desks (GALLEY_HOST/tailnet), and creating a comment threw. Add a uuid() helper that uses the native call when present and otherwise builds an RFC-4122 v4 UUID from crypto.getRandomValues(), which has no such gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ymansurozer
force-pushed
the
fix/0015-ui-uuid-fallback
branch
from
July 21, 2026 11:22
30c00dc to
312fa31
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
crypto.randomUUID()is secure-context-gated: browsers expose it only on HTTPS origins and onlocalhost/127.0.0.1. On a desk bound beyond loopback (GALLEY_HOST, the tailnet/devbox pattern) the UI loads from a plain-HTTP non-localhost origin likehttp://devbox:41443/, wherecrypto.randomUUIDisundefined— so the first comment attempt throws and the whole comment/change-request loop is broken. It never reproduces locally becauselocalhostcounts as a secure context.Fix
src/ui/uuid.ts:uuid()uses nativecrypto.randomUUID()when present, otherwiseuuidFallback()builds an RFC-4122 v4 UUID fromcrypto.getRandomValues()(available in insecure contexts) with the version (4) and variant (10xx) bits set, so the fallback is indistinguishable in shape from native ids that persist in review state.src/ui/main.ts: the comment-creation path (the only secure-context-gated call site insrc/ui/) now usesuuid().src/ui/uuid.test.ts: fallback matches the v4 format, successive calls differ,uuid()works withrandomUUIDabsent, and the native path is still used when available.Node-side
randomUUIDcall sites (src/state.ts,src/server.ts) are unconditional and untouched.Closes .desk issue 0015.
🤖 Generated with Claude Code