From 393713ed9384a4b28fe0cd4d4ab9e52d669f5124 Mon Sep 17 00:00:00 2001
From: Aeromtrich <aeromtrich@gmail.com>
Date: Wed, 28 Oct 2026 16:39:03 +0800
Subject: [PATCH] fix(gui-plugins): support insecure file picker

---
 packages/app/e2e/regression/review.spec.ts | 15 +++++++++++++++
 packages/gui-plugins/src/file/renderer.tsx |  5 ++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/packages/app/e2e/regression/review.spec.ts b/packages/app/e2e/regression/review.spec.ts
index a9e50668a6c0..ab67e6626605 100644
--- a/packages/app/e2e/regression/review.spec.ts
+++ b/packages/app/e2e/regression/review.spec.ts
@@ -124,6 +124,21 @@ test("a rejected Git init releases its session's button without showing an error
   await expect(init).toBeEnabled()
 })
 
+test("opens the file picker when randomUUID is unavailable", async ({ page }) => {
+  await page.addInitScript(() => {
+    // SAFETY: a non-localhost HTTP origin exposes crypto but not crypto.randomUUID.
+    Object.defineProperty(globalThis.crypto, "randomUUID", { configurable: true, value: undefined })
+  })
+
+  await openSession(page, { name: "ReviewOpenFileInsecure" })
+  await page.getByRole("button", { name: "Toggle review" }).click()
+
+  const panel = page.locator("#review-panel")
+  await openFileLauncher(panel)
+  await expect(panel.getByRole("tab", { name: "Open file", exact: true })).toHaveAttribute("aria-selected", "true")
+  await expect(panel.getByRole("combobox", { name: "Filter files" })).toBeVisible()
+})
+
 test("open file tab browses, searches, and tracks missing files", async ({ page }) => {
   const searches: { query: string; dirs?: string; limit?: number; directory: string }[] = []
   const directory = "C:/OpenCode/ReviewOpenFile"
diff --git a/packages/gui-plugins/src/file/renderer.tsx b/packages/gui-plugins/src/file/renderer.tsx
index 3a3da6869c6c..4dbfb0046b77 100644
--- a/packages/gui-plugins/src/file/renderer.tsx
+++ b/packages/gui-plugins/src/file/renderer.tsx
@@ -167,7 +167,10 @@ const setup: Plugin.Setup<typeof File> = (ctx) => {
 
       if (selected || layout.narrow())
         layout.open(`file:${selected ?? OPEN}`, session, { tab: "preview", background: options?.background })
-      else layout.open(`file:${OPEN}:${crypto.randomUUID()}`, session, { tab: "select" })
+      else
+        layout.open(`file:${OPEN}:${crypto.randomUUID?.() ?? Math.random().toString(16).slice(2)}`, session, {
+          tab: "select",
+        })
 
       if (!options?.background && layout.narrow() && !layout.side.opened(session)) layout.side.toggle(session)
     })