Fix "crypto.randomUUID is not a function" in DeepSeek Harness web

DeepSeek Harness's web UI failing with crypto.randomUUID is not a function — and several browsers all failing the same way — is not a browser problem: crypto.randomUUID() only exists in a secure context (https://, or http://localhost / http://127.0.0.1), and accessing via an IP address over plaintext HTTP (such as http://192.168.1.50:3080) does not qualify, so crypto.randomUUID is undefined on that page. Press F12 and type window.isSecureContext for a 10-second verdict, then pick SSH port forwarding, local access, or HTTPS.

What the crypto.randomUUID is not a function error looks like

The error is always crypto.randomUUID is not a function, it fires when opening the DSH web UI, and it has nothing to do with the browser version or the Linux distro. A reporter hit it in practice (discussion thread):

1. Environment: Linux 9; the web UI fails immediately after install;
2. The reporter switched through several browsers — all failed identically, which is expected, because the problem is not in the browser;
3. The named API, crypto.randomUUID (a UUID-generating Web API), is unavailable on the page, so the render flow dies.

Root cause: crypto.randomUUID only exists in a secure context

Browsers define a secure context in only two ways: https://, or http://localhost / http://127.0.0.1. Plaintext HTTP over an IP address (http://192.168.1.50:3080 and similar) is not a secure context, and crypto.randomUUID is undefined on such pages (source, MDN secure contexts).

This is unrelated to the browser version and unrelated to the Linux distro — so "switching browsers does not help" is the inevitable outcome. crypto.randomUUID is a secure-context-only Web API; browsers only expose it to pages that qualify.

10-second confirmation: window.isSecureContext

Open the console with F12 on the failing page, type window.isSecureContext, and branch on the result:

• false → this is the cause; pick any of the three fixes below;
• true → not the cause; the more likely culprit is an old Node version (globalThis.crypto is only available by default since Node 19) — paste the output of node -v to confirm.

This single command gives a definitive answer in 10 seconds — no guessing required.

Three fixes: from easiest to formal

The core idea is to make the page a secure context: make the browser see localhost/127.0.0.1, or put HTTPS on the page. In order:

1. SSH port forwarding (easiest, no config changes): on your own computer, run

ssh -L 3080:127.0.0.1:3080 your-user@server-address

then open http://localhost:3080 in your local browser — the browser sees localhost, the secure context holds, and the problem disappears. This is also the common posture for people running headless servers in this community, not a stopgap;

2. Access http://127.0.0.1:3080 directly on the server machine (if it has a desktop environment);
3. Set up HTTPS (the long-term formal option): put an Nginx / Caddy reverse proxy in front with a self-signed or Let's Encrypt certificate. Caddy needs one line, and afterward any machine can access it via https://.

Notes

1. Do not waste time switching browsers — the problem is in the access protocol, not the browser.
2. When other machines on the LAN need access, prefer option 1 (each with its own SSH forwarding) or option 3 (unified HTTPS) instead of continuing with plaintext HTTP over an IP.
3. If window.isSecureContext returns true and the error persists, check the Node version (≥19 for a default global crypto) and the dsh version.
4. Similar web UI issues are collected in the DeepSeek Harness plugin error collection: DSH plugin not loading, Web UI issues, and session cache repair.

Sources: Discussion #4653, MDN Secure contexts, MDN Crypto.randomUUID()