Merge pull request Stack-Cairn#130 from SinclairLin/fix/webui-random-uuid-fallback

fix(webui): add UUID fallback for legacy WebViews

Author: su-fen

crates/agent-gateway/test/webui/browser-uuid.test.mjs

@@ -0,0 +1,106 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createWebModuleLoader } from "../helpers/load-web-module.mjs";
+
+const loader = createWebModuleLoader();
+const { createUuid } = loader.loadModule("@/lib/shared/id.ts");
+const { createEmptyRequestDraft } = loader.loadModule("@/pages/settings/httpRequestEditor.tsx");
+const { normalizeAgentPromptTemplate, normalizeCustomProvider, normalizeSshSettings } =
+  loader.loadModule("@/lib/settings/index.ts");
+
+const UUID_V4_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+function withCrypto(value, run) {
+  const descriptor = Object.getOwnPropertyDescriptor(globalThis, "crypto");
+  if (value === undefined) {
+    delete globalThis.crypto;
+  } else {
+    Object.defineProperty(globalThis, "crypto", {
+      configurable: true,
+      value,
+    });
+  }
+  try {
+    return run();
+  } finally {
+    if (descriptor) {
+      Object.defineProperty(globalThis, "crypto", descriptor);
+    } else {
+      delete globalThis.crypto;
+    }
+  }
+}
+
+test("createUuid uses crypto.randomUUID when available", () => {
+  withCrypto({ randomUUID: () => "native-uuid" }, () => {
+    assert.equal(createUuid(), "native-uuid");
+  });
+});
+
+test("createUuid falls back to an RFC 4122 v4 UUID without randomUUID", () => {
+  withCrypto({}, () => {
+    assert.match(createUuid(), UUID_V4_PATTERN);
+  });
+});
+
+test("createUuid works when global crypto is unavailable", () => {
+  withCrypto(undefined, () => {
+    assert.match(createUuid(), UUID_V4_PATTERN);
+  });
+});
+
+test("createUuid falls back when browser crypto methods throw", () => {
+  withCrypto(
+    {
+      randomUUID() {
+        throw new Error("randomUUID unavailable");
+      },
+      getRandomValues() {
+        throw new Error("getRandomValues unavailable");
+      },
+    },
+    () => {
+      assert.match(createUuid(), UUID_V4_PATTERN);
+    },
+  );
+});
+
+test("createUuid fallback remains unique when time and randomness repeat", () => {
+  const originalNow = Date.now;
+  const originalRandom = Math.random;
+  Date.now = () => 123;
+  Math.random = () => 0;
+  try {
+    withCrypto({}, () => {
+      assert.notEqual(createUuid(), createUuid());
+    });
+  } finally {
+    Date.now = originalNow;
+    Math.random = originalRandom;
+  }
+});
+
+test("settings normalize generated IDs without crypto.randomUUID", () => {
+  withCrypto({}, () => {
+    const provider = normalizeCustomProvider({ name: "Provider", type: "codex" });
+    const agent = normalizeAgentPromptTemplate({ name: "Agent" });
+    const ssh = normalizeSshSettings({
+      hosts: [
+        { id: "duplicate", host: "first.example" },
+        { id: "duplicate", host: "second.example" },
+        { host: "third.example" },
+      ],
+    });
+
+    assert.match(provider.id, UUID_V4_PATTERN);
+    assert.match(agent.id, UUID_V4_PATTERN);
+    assert.equal(new Set(ssh.hosts.map((host) => host.id)).size, 3);
+  });
+});
+
+test("Hook/Cron HTTP request drafts work without crypto.randomUUID", () => {
+  withCrypto({}, () => {
+    assert.match(createEmptyRequestDraft().id, UUID_V4_PATTERN);
+  });
+});

crates/agent-gateway/web/src/app/GatewayApp.tsx

@@ -95,6 +95,7 @@ import {
   type WorkspaceProject,
   workspaceProjectPathKey,
 } from "@/lib/settings";
+import { createUuid } from "@/lib/shared/id";
 import { mergeAlwaysEnabledSkillNames } from "@/lib/skills";
 import { terminalSessionBelongsToProject } from "@/lib/terminal/sessionStore";
 import type { TerminalSession } from "@/lib/terminal/types";
@@ -110,7 +111,7 @@ import { SkillsHubPage } from "@/pages/skills-hub/SkillsHubPage";
 
 const LOCAL_DRAFT_PREFIX = "__local_draft__:";
 function createLocalDraftConversationId() {
-  return `${LOCAL_DRAFT_PREFIX}${crypto.randomUUID()}`;
+  return `${LOCAL_DRAFT_PREFIX}${createUuid()}`;
 }
 function isLocalDraftConversationId(id: string) {
   return id.trim().startsWith(LOCAL_DRAFT_PREFIX);
@@ -1867,7 +1868,7 @@ export default function GatewayApp() {
     }
     clearCachedComposerDraft(activeConversationId);
 
-    const clientRequestId = options?.clientRequestId?.trim() || crypto.randomUUID();
+    const clientRequestId = options?.clientRequestId?.trim() || createUuid();
     const startedAt = Date.now();
     const persistedConversationWorkdir = sidebarStore.peek(activeConversationId)?.cwd?.trim() || "";
     const runtimeConversationWorkdir =
@@ -2084,7 +2085,7 @@ export default function GatewayApp() {
           ),
           systemSettings: buildGatewaySystemSettings(settings, workdirForTurn),
           uploadedFiles: materialized.uploadedFiles,
-          clientRequestId: crypto.randomUUID(),
+          clientRequestId: createUuid(),
           runtimeControls: chatRuntimeControlsForCurrentProvider,
           queuePolicy,
         });

crates/agent-gateway/web/src/components/chat/MentionComposer.tsx

@@ -28,6 +28,7 @@ import {
   formatMarkdownReferenceDestination,
 } from "../../lib/chat/mentionReferences";
 import { extractClipboardFiles } from "../../lib/clipboardFiles";
+import { createUuid } from "../../lib/shared/id";
 import { cn } from "../../lib/shared/utils";
 import { invokeFs } from "../../lib/tools/fsBackend";
 import { Blend, SKILL_ICON_SVG_MARKUP } from "../icons";
@@ -1834,7 +1835,7 @@ export const MentionComposer = memo(
       const index = largePasteCounterRef.current + 1;
       largePasteCounterRef.current = index;
       return {
-        id: `large-paste-${Date.now()}-${crypto.randomUUID()}`,
+        id: `large-paste-${Date.now()}-${createUuid()}`,
         label: `Pasted text ${index}`,
         text,
         charCount: text.length,

crates/agent-gateway/web/src/lib/chat/uploadedFiles.ts

@@ -1,4 +1,5 @@
 import type { Message, UserMessage } from "../agentTypes";
+import { createUuid } from "../shared/id";
 
 export type UploadedReadableFileKind =
   | "text"
@@ -23,11 +24,7 @@ const DISPLAY_CONTENT_FIELD = "liveAgentDisplayContent";
 const ATTACHMENTS_FIELD = "liveAgentAttachments";
 
 function createUserMessageId() {
-  const id =
-    typeof globalThis.crypto?.randomUUID === "function"
-      ? globalThis.crypto.randomUUID()
-      : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
-  return `user-${id}`;
+  return `user-${createUuid()}`;
 }
 
 export type PendingUploadedFile = {

crates/agent-gateway/web/src/lib/chatUi.ts

@@ -8,6 +8,7 @@ import {
   getUserMessageDisplayText,
   type PendingUploadedFile,
 } from "@/lib/chat/uploadedFiles";
+import { createUuid } from "@/lib/shared/id";
 
 import type { ChatCheckpointPayload, ChatEvent, ConversationSummary } from "./gatewayTypes";
 
@@ -133,7 +134,7 @@ const LIVE_UPLOADED_FILE_KINDS = new Set<string>([
 ]);
 
 function randomId(prefix: string) {
-  return `${prefix}-${crypto.randomUUID()}`;
+  return `${prefix}-${createUuid()}`;
 }
 
 export function hashText(value: string) {

crates/agent-gateway/web/src/lib/gatewaySocket.ts

@@ -21,6 +21,7 @@ import type {
   SftpTransferEvent,
   SftpTransferResponse,
 } from "@/lib/sftp/types";
+import { createUuid } from "@/lib/shared/id";
 import { BrowserGatewayTerminalStreamClient } from "@/lib/terminal/gatewayTerminalStreamClient";
 import type {
   SshTerminalTab,
@@ -553,14 +554,10 @@ function buildWebSocketUrl() {
 function createChatClientRequestId(input: GatewayChatCommandInput) {
   const commandType = input.type.trim() || "chat.command";
   const conversationId = input.conversationId?.trim() || "new";
-  const randomPart =
-    typeof globalThis.crypto?.randomUUID === "function"
-      ? globalThis.crypto.randomUUID()
-      : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
   return `webui-${commandType.replace(/[^a-z0-9._-]/gi, "_")}-${conversationId.replace(
     /[^a-z0-9._-]/gi,
     "_",
-  )}-${randomPart}`;
+  )}-${createUuid()}`;
 }
 
 function buildChatCommandPayload(input: GatewayChatCommandInput) {

crates/agent-gateway/web/src/lib/settings/index.ts

@@ -2,6 +2,7 @@ import type { KnownProvider, ModelThinkingLevel } from "@earendil-works/pi-ai";
 import { getSupportedThinkingLevels } from "@earendil-works/pi-ai";
 import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
 import { DEFAULT_LOCALE, type Locale, normalizeLocale } from "../../i18n/config";
+import { createUuid } from "../shared/id";
 import { mergeAlwaysEnabledSkillNames } from "../skills/builtin";
 import { SYSTEM_TOOL_OPTIONS, type SystemToolId } from "../tools/systemToolOptions";
 import { normalizeApiKey, normalizeBaseUrl, normalizeModels } from "./normalize";
@@ -497,7 +498,7 @@ function normalizeWorkspaceProject(input: unknown): WorkspaceProject | null {
   const obj = (input && typeof input === "object" ? input : {}) as Record<string, unknown>;
   const path = normalizeWorkspaceProjectPath(obj.path);
   if (!path) return null;
-  const id = typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : crypto.randomUUID();
+  const id = typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : createUuid();
   const name =
     typeof obj.name === "string" && obj.name.trim()
       ? obj.name.trim()
@@ -549,7 +550,7 @@ function normalizeWorkspaceProjects(input: unknown): WorkspaceProject[] {
     seenPaths.add(pathKey);
     let id = project.id;
     if (seenIds.has(id)) {
-      id = crypto.randomUUID();
+      id = createUuid();
     }
     seenIds.add(id);
     out.push({ ...project, id });
@@ -635,7 +636,7 @@ export function resolveWorkspaceProjects(
     seenPaths.add(pathKey);
     let id = project.id;
     if (!id || id === DEFAULT_WORKSPACE_PROJECT_ID || seenIds.has(id)) {
-      id = crypto.randomUUID();
+      id = createUuid();
     }
     seenIds.add(id);
     projects.push({
@@ -1298,7 +1299,7 @@ export function normalizeCustomProvider(input: unknown): CustomProvider {
   const models = normalizeProviderModelConfigs(obj.models, type);
   const validModelIds = new Set(models.map((model) => model.id));
   const apiKey = normalizeApiKey(typeof obj.apiKey === "string" ? obj.apiKey : "");
-  const id = typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : crypto.randomUUID();
+  const id = typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : createUuid();
 
   return {
     id,
@@ -1324,7 +1325,7 @@ export function normalizeAgentPromptTemplate(input: unknown): AgentPromptTemplat
   const obj = (input && typeof input === "object" ? input : {}) as Record<string, unknown>;
 
   return {
-    id: typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : crypto.randomUUID(),
+    id: typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : createUuid(),
     name: typeof obj.name === "string" && obj.name.trim() ? obj.name.trim() : "未命名模板",
     description: normalizeOptionalText(obj.description),
     prompt: normalizeOptionalText(obj.prompt),
@@ -1396,7 +1397,7 @@ export function normalizeSshHostConfig(input: unknown): SshHostConfig {
     (privateKeyPassphrase.length > 0 || obj.privateKeyPassphraseConfigured === true);
 
   return {
-    id: typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : crypto.randomUUID(),
+    id: typeof obj.id === "string" && obj.id.trim() ? obj.id.trim() : createUuid(),
     name,
     description: normalizeOptionalText(obj.description),
     host,
@@ -1424,7 +1425,7 @@ export function normalizeSshSettings(input: unknown): SshSettings {
       seenIds.add(normalized.id);
       return normalized;
     }
-    const id = crypto.randomUUID();
+    const id = createUuid();
     seenIds.add(id);
     return { ...normalized, id };
   });
@@ -2216,11 +2217,7 @@ const RIGHT_DOCK_WRITER_ID_STORAGE_KEY = "liveagent.client-id";
 let cachedRightDockWriterId = "";
 
 function generateRightDockWriterId(): string {
-  const uuid =
-    typeof globalThis.crypto?.randomUUID === "function"
-      ? globalThis.crypto.randomUUID()
-      : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
-  return uuid.replace(/-/g, "").slice(0, 12);
+  return createUuid().replace(/-/g, "").slice(0, 12);
 }
 
 // Stable per-client id used to break stateVersion ties deterministically in

crates/agent-gateway/web/src/lib/shared/id.ts

@@ -0,0 +1,48 @@
+let fallbackSequence = 0;
+
+function fillFallbackBytes(bytes: Uint8Array) {
+  const timestamp = Date.now();
+  fallbackSequence = (fallbackSequence + 1) >>> 0;
+
+  for (let index = 0; index < bytes.length; index += 1) {
+    const timeByte = Math.floor(timestamp / 2 ** ((index % 6) * 8)) & 0xff;
+    const sequenceByte = (fallbackSequence >>> ((index % 4) * 8)) & 0xff;
+    bytes[index] = Math.floor(Math.random() * 256) ^ timeByte ^ sequenceByte;
+  }
+}
+
+/**
+ * UUID v4 with fallbacks for legacy/embedded WebViews where crypto.randomUUID
+ * is missing or throws when called. The last-resort path is Math.random-based
+ * and NOT cryptographically secure — use only for identifiers, never for
+ * security tokens or secrets.
+ */
+export function createUuid(): string {
+  const crypto = globalThis.crypto;
+  if (typeof crypto?.randomUUID === "function") {
+    try {
+      return crypto.randomUUID();
+    } catch {
+      // Some embedded WebViews expose the API but fail when it is called.
+    }
+  }
+
+  const bytes = new Uint8Array(16);
+  if (typeof crypto?.getRandomValues === "function") {
+    try {
+      crypto.getRandomValues(bytes);
+    } catch {
+      fillFallbackBytes(bytes);
+    }
+  } else {
+    fillFallbackBytes(bytes);
+  }
+
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+
+  const hex = Array.from(bytes, (value) => value.toString(16).padStart(2, "0"));
+  return `${hex.slice(0, 4).join("")}-${hex.slice(4, 6).join("")}-${hex
+    .slice(6, 8)
+    .join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10).join("")}`;
+}

crates/agent-gateway/web/src/pages/settings/AgentsSection.tsx

@@ -5,6 +5,7 @@ import { BookOpen, Eye, Pencil, Plus, Trash2, X } from "../../components/icons";
 import { Button } from "../../components/ui/button";
 import { useLocale } from "../../i18n";
 import { type AgentPromptTemplate, updateAgents } from "../../lib/settings";
+import { createUuid } from "../../lib/shared/id";
 import { useModalMotion } from "../../lib/shared/modalMotion";
 import { AgentPromptTemplateModal } from "./AgentPromptTemplateModal";
 import { AgentActivationSwitch, ConfirmDeletePopover } from "./shared";
@@ -44,7 +45,7 @@ export function AgentsSection(props: SettingsSectionProps) {
       }
 
       const newTemplate: AgentPromptTemplate = {
-        id: crypto.randomUUID(),
+        id: createUuid(),
         ...data,
         enabled: false,
       };

crates/agent-gateway/web/src/pages/settings/ProvidersSection.tsx

@@ -38,6 +38,7 @@ import {
   updateCustomProviders,
   updateCustomSettings,
 } from "../../lib/settings";
+import { createUuid } from "../../lib/shared/id";
 import { useModalMotion } from "../../lib/shared/modalMotion";
 import {
   createDraftModelConfig,
@@ -874,7 +875,7 @@ export function ProvidersSection(props: SettingsSectionProps) {
       }
 
       const newProvider: CustomProvider = {
-        id: crypto.randomUUID(),
+        id: createUuid(),
         ...data,
       };
       return updateCustomProviders(prev, [...prev.customProviders, newProvider]);