dsh-secure-context-fix

The DeepSeek Harness Web GUI uses crypto.randomUUID for RPC IDs, session keys, and image draft identifiers. Browsers only expose that API in secure contexts (HTTPS or localhost), so opening the GUI from a phone or another device over plain HTTP on your LAN makes every RPC crash: the workspace list never loads, the directory picker fails, and new sessions cannot be created — while the same URL on 127.0.0.1 works perfectly.

This plugin registers a webServer.tapIndex transform that injects a small inline script into index.html before any dsh bundle code runs. The script installs a crypto.randomUUID implementation backed by crypto.getRandomValues(), which browsers do expose on insecure origins. No official source changes, no polyfill library, no build step required. Install the plugin, restart your profile, and the GUI works from any LAN device.

It suits anyone who runs dsh from a phone or tablet over a home or office LAN without HTTPS. Binding the GUI to 0.0.0.0 exposes agent-level control to anyone who can reach the port, so use it only on a trusted network and restrict the firewall rule to your LAN subnet. This is a stop-gap for upstream issue #4209 — if you can patch the three randomUUID call sites directly, prefer that approach.