web: side-panel "Open file" is a silent no-op on insecure HTTP origins (v2.2.0 regression) #59791

Activity

1. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   More actions

   Thanks for the detailed report. I reproduced this on v2.2.0, and it still happens on the latest dev (86ce19d).

   1. Ran opencode serve --hostname 0.0.0.0 and opened the web UI in Chromium at the machine's LAN IP over plain HTTP (isSecureContext is false, crypto.randomUUID is undefined).
   2. Opened a session, toggled the side panel and clicked Open file in the new-tab view.
   3. The page threw TypeError: crypto.randomUUID is not a function, and the tab strip still showed only "New tab".

   The same steps on http://127.0.0.1 open the "Open file" tab with "Select a file to open". The screenshots below show both cases, and the script below reproduces it. The unguarded call in packages/gui-plugins/src/file/renderer.tsx is still there on dev.

   Related issues:

   • Web UI features fail over non-localhost HTTP origins: crypto.randomUUID unavailable in insecure context (session delete, file attach) #46168: other web UI actions that fail the same way on insecure origins
   • web: Failed to send command over insecure HTTP origin (crypto.randomUUID is not a function) #55777 (open fix in fix(gui-extensions): fall back when crypto.randomUUID is unavailable #55868): the btw command
   • web: session delete silently no-ops on insecure origins (unguarded crypto.randomUUID) #48144: session delete

   

   

   Reproduction script (repro.mjs)

   // Reproduces #59791: side-panel "Open file" does nothing on an insecure (non-localhost HTTP) origin.
   // Setup:
   //   cd <git project> && opencode serve --hostname 0.0.0.0 --port 4096   (note the printed server password)
   //   curl -u opencode:$PW -XPOST -H 'content-type: application/json' \
   //     "http://127.0.0.1:4096/api/session?directory=$PWD" -d '{}'
   //   npm i playwright-core && npx playwright-core install --with-deps chromium
   // Run: node repro.mjs http://<LAN-IP>:4096/ $PW      (insecure origin -> fails)
   //      node repro.mjs http://127.0.0.1:4096/ $PW     (secure origin -> works)
   import { chromium } from "playwright-core"
   const [url, pw, shot = "/workspace/repro/result.png"] = process.argv.slice(2)
   const b = await chromium.launch()
   const p = await b.newPage({ viewport: { width: 1400, height: 900 } })
   p.on("pageerror", (e) => console.log("pageerror:", e.message))
   await p.goto(url)
   await p.waitForTimeout(3000)
   if (await p.getByText("Use password").count()) {
     await p.getByText("Use password").click()
     await p.locator("#server-connect-url").fill(url)
     await p.locator("#server-connect-password").fill(pw)
     await p.keyboard.press("Enter")
     await p.waitForTimeout(4000)
   }
   console.log("context:", await p.evaluate(() => ({ isSecureContext, randomUUID: typeof crypto.randomUUID })))
   await p.getByText("New session").first().click()
   await p.waitForTimeout(3000)
   await p.getByLabel("Toggle review").click()
   await p.waitForTimeout(1500)
   const tabs = async () => (await p.locator("[role=tab]").allInnerTexts()).map((t) => t.split("\n")[0])
   console.log("tabs before:", await tabs())
   await p.getByRole("button", { name: /Open file/ }).or(p.getByText("Open file", { exact: true })).first().click()
   await p.waitForTimeout(2000)
   console.log("tabs after Open file:", await tabs())
   console.log("'Select a file to open' visible:", await p.getByText("Select a file to open").count() > 0)
   await p.screenshot({ path: shot })
   await b.close()

   Run it: bun repro.mjs
2. opencodejr

   added

   reproduced

   on Oct 28, 2026
3. Aeromtrich commented on Oct 28, 2026

   

   Aeromtrich

   on Oct 28, 2026

   More actions

   I'd like to work on this issue. Is anyone already working on a fix? If not, I'd be happy to take it. 🧐
4. Hona

   closed this as completedin #60462on Oct 30, 2026