dsh-randomuuid-polyfill

A DeepSeek Harness client plugin that installs crypto.randomUUID when the page is not a secure context.

Why

crypto.randomUUID is gated to secure contexts (HTTPS, or localhost). When the dsh web UI is served over plain HTTP on a LAN address, every client RPC throws:

TypeError: crypto.randomUUID is not a function

The workspace picker ("open folder") is the first place most people hit it, because choosing a workspace issues a listDirectory RPC. The root cause is upstream: AbstractApiClient.mintRpcId() in packages/host/apiproxy/src/fetch/client.ts calls crypto.randomUUID() unconditionally, and the composer's browserDraftAttachment() in packages/client/ui-conversation/src/client/service.ts does the same.

This plugin restores the missing API at boot, backed by crypto.getRandomValues (available on insecure origins), so the UI works over plain HTTP without waiting for an upstream fix.

Install

Build and install the package into the harness environment, then start the web UI:

pnpm build
npm install <path-to-this-package>
npx @deepseek-ai/dsh web

The harness discovers the plugin from the dsh manifest field and injects the client bundle at boot (immediately: true).

Alternatives

• Open the UI at http://localhost:3080 (SSH tunnel into the host) — localhost is a secure context, so nothing is needed.
• The proper fix lives in the source: use a crypto.getRandomValues-based UUID in mintRpcId / browserDraftAttachment. A patched fork is available at Lehmaning/deepseek-harness on the fix/randomuuid-secure-context branch.

License

MIT