web: file attachments silently dropped on HTTP remote host — crypto.subtle undefined #47645

Activity

1. github-actions

   assigned

   Hona

   on Sep 6, 2026
2. supremest commented on Sep 8, 2026

   

   supremest

   on Sep 8, 2026

   More actions

   Reproduced on v1.18.29 (Linux arm64, opencode web bound to a Tailscale IP, opened from another machine as http://<magicdns-name>:4096). Same symptom: drop / paste / attach button all silently discard the file, no toast. Console: TypeError: Cannot read properties of undefined (reading 'digest') at putBlob → blobID (packages/app/src/utils/draft-store.ts).

   One detail that may explain why this keeps being re-reported: the fix merged for #41706 — #42706 (2026-08-15) — went into the v2 branch, not dev. dev and the v1.18.x tags still call crypto.subtle.digest unconditionally (draft-store.ts:25, and blobReference in packages/session-ui/src/v2/components/prompt-input/attachments.ts:225 for the V2 composer), so 1.18.27 / 1.18.29 still fail. The PRs open against dev (#41710, #44735, #45263, #46418) are the ones that would actually reach a release.

   Workaround that worked for us without touching the client: make the origin a secure context. tailscale serve --bg --https=443 http://<bind-ip>:4096 gives an https://<name>.ts.net URL (requires "Enable HTTPS" in the tailnet DNS settings). On that origin isSecureContext is true and attachments work end-to-end — verified with a headless-Chromium drop test against the real bundle; opencode run --attach https://… works through it as well. http://localhost works too, as noted above.
3. degomon commented on Sep 19, 2026

   

   degomon

   on Sep 19, 2026

   More actions

   Confirming this is still present on v1.18.31 (latest release, 2026-09-14), on macOS arm64 with opencode web --hostname 0.0.0.0, opened from another machine as http://192.168.x.x:4096.

   Repro and evidence from this instance:

   • Attach via the "+" button → no chip, no toast, nothing in the console UI; message sends text-only.
   • Server DB (~/.local/share/opencode/opencode.db) shows the user messages with text parts only, zero file parts. Network request to POST /session/{id}/prompt_async carries parts = [{type:"text"}] only, so the attachment never leaves the browser.
   • Bundle inspection of the served index-*.js matches the source: blobID() (packages/app/src/utils/draft-store.ts) calls crypto.subtle.digest("SHA-256", ...) unconditionally, and the hidden <input type=file> change handler calls addAttachments() without await/.catch, so the TypeError: Cannot read properties of undefined (reading 'digest') rejects unhandled — hence the fully silent drop.
   • Notably uuid() in the same app already guards with globalThis.isSecureContext; blobID() is the remaining unguarded call site (plus the V2 composer path noted above).

   Workaround confirmed working: tunnel the port and use http://localhost:4096 from the client (ssh -L 4096:localhost:4096 user@host), since localhost is a secure context. HTTPS origins work too.
4. iamironz commented on Sep 26, 2026

   

   iamironz

   on Sep 26, 2026

   More actions

   Same failure here on Firefox 156.0 (x86_64) with opencode v1.18.32 — web UI on a plain-HTTP origin accessed from another host over a WireGuard IP, so this isn't Chromium-specific. Firefox just words it differently:

   Uncaught (in promise) TypeError: can't access property "digest", crypto.subtle is undefined
       putBlob → addAttachments
   

   Attach button / drag-drop / paste: all silently discarded, message sends text-only.

   A workaround for people who can't switch to localhost or put TLS in front (WG/Tailscale/LAN access): Firefox can mark specific hosts as secure contexts. Create dom.securecontext.allowlist in about:config as a string pref, set it to the server IP/hostname (comma-separated; host only — no scheme, no port; parsed in dom/security/nsMixedContentBlocker.cpp), restart the browser. window.isSecureContext becomes true on the same http://<ip>:<port> origin, crypto.subtle is available again, and attachments work end-to-end. Verified on the setup above.

   Obviously still worth the client-side fallback (getRandomValues / pure-JS SHA-256) — the pref only helps Firefox users who control their own browser config.
5. ChristopheAwad commented on Oct 1, 2026

   

   ChristopheAwad

   on Oct 1, 2026

   More actions

   Fix is open against dev: #52529.

   It falls back to crypto.getRandomValues when crypto.subtle is missing or throws, in both the app and v2 composer paths, plus a catch around draftStore.putBlob.

   Tested over LAN on plain http from a second machine: the thumbnail appears and the model reads the text in the image back correctly.

   If you can, please test it on a dev build and leave a reaction.
6. thdxr commented on Oct 11, 2026

   

   thdxr

   on Oct 11, 2026

   Member

   More actions

   Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.

   — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊
7. thdxr

   closed this as not plannedon Oct 11, 2026