Web UI over plain HTTP: sessions appear empty / missing because crypto.subtle and crypto.randomUUID are unavailable on insecure origins #46662

Summary

When opencode web is accessed over a plain http:// origin (e.g. http://<vps-ip>:4096 — a very common setup for self-hosted VPS users), multiple parts of the web UI silently fail:

1. Image/file attachments silently fail — crypto.subtle is undefined on insecure origins, so blob ID / digest generation throws and the attachment is never added to the prompt. No toast, no error, nothing. (Already partially reported in Web: image attachments fail on insecure origins; no client-side optimization #46419)
2. Sessions list appears empty or stale — the UI relies on crypto.randomUUID() / other crypto APIs in several code paths; on insecure origins these throw, and session listing/switching breaks silently. The user sees "0 sessions" or a fresh state even though sessions exist on the server (verified via GET /session over the API — sessions were there all along).

This is a class of bugs rather than a single issue: any web-platform API gated on secure context breaks when self-hosters access the web UI over http://<ip>, which is the default for anyone running opencode web --hostname 0.0.0.0 on a VPS without a domain/TLS setup.

Steps to reproduce

1. On a VPS: OPENCODE_SERVER_PASSWORD=xxx opencode web --port 4096 --hostname 0.0.0.0
2. Open http://<vps-ip>:4096 in Chrome/Firefox from a remote machine
3. Try attaching an image via + → nothing happens, no error
4. Create a session, refresh — session list may appear empty even though GET /session returns sessions
5. Repeat the same over http://localhost:4096 (or via an HTTPS reverse proxy / tunnel) — everything works

Expected

Either:

• Graceful fallbacks (crypto.getRandomValues instead of crypto.subtle.digest, Math.random-based UUID fallback) so the web UI fully works on insecure origins, or
• A visible warning banner: "You are accessing over an insecure origin; some features (attachments, session management) may not work"

Actual

Silent failure with zero user feedback. Users on VPS deployments think sessions are lost or uploads are broken, and there is no hint that the origin is the problem.

Environment

• opencode 1.18.25 (web UI, Linux VPS)
• accessed via http://<ip>:4096 from a remote desktop browser
• workaround verified: putting an HTTPS reverse proxy (Cloudflare tunnel) in front of the server makes everything work

Related

• Web: image attachments fail on insecure origins; no client-side optimization #46419 (image attachments on insecure origins — same root cause class)
• Web UI features fail over non-localhost HTTP origins: crypto.randomUUID unavailable in insecure context (session delete, file attach) #46168 (crypto.randomUUID in insecure context)

Thanks!