[BUG] VS Code extension: chat panel blank on non-secure (HTTP) origins — unguarded crypto.randomUUID() in webview bundle

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In browser-hosted VS Code (code-server) served over a plain-HTTP origin, the Claude Code panel renders completely blank. The extension host activates normally and the bundled claude CLI works fine in the integrated terminal — only the webview UI fails.

Root cause: extension/webview/index.js calls crypto.randomUUID() unguarded, at 8 sites. Crypto.randomUUID() is a secure-context-only API, so on an HTTP origin it is undefined. One of those sites is a class field initializer (internalId = crypto.randomUUID()), so it throws at module-evaluation time and the UI never mounts.

The same VSIX already ships a guarded fallback helper in the webview bundle:

var ZC = function () {
  if (typeof crypto === "object" && typeof crypto.randomUUID === "function")
    return crypto.randomUUID.bind(crypto);
  ...
};

and extension/extension.js guards it as well (let { crypto: e } = globalThis; if (e?.randomUUID) ...). The 8 webview call sites bypass it.

Serving the identical instance over HTTPS makes the panel render immediately, with no other change — same add-on, same extension build, same browser.

What Should Happen?

The panel renders on non-secure origins, with UUID generation falling back to a crypto.getRandomValues()-based v4 when crypto.randomUUID is unavailable — i.e. the webview call sites routed through the guarded helper the bundle already contains.

Error Messages/Logs

// Evaluated on the page origin (http://<host>:8123):
isSecureContext                 // false
typeof crypto.randomUUID        // "undefined"
typeof crypto.subtle            // "undefined"
typeof crypto.getRandomValues   // "function"

// Minimal repro on that same origin, mirroring the class field initializer
// in the webview bundle:
class T { internalId = crypto.randomUUID(); }
new T();
// TypeError: crypto.randomUUID is not a function

// Meanwhile the extension host activates normally:
[info] Claude code extension is now active
[info] MCP Server running on port 32483 (localhost only)

Steps to Reproduce

1. Serve VS Code in the browser over plain HTTP on a hostname other than localhost (any code-server instance). Mine: Home Assistant "Studio Code Server" add-on 6.0.1 — code-server 4.106.2 (VS Code 1.106), Debian 13, amd64, reached at http://<host>.local:8123.
2. Install Anthropic.claude-code 2.1.238 from Open VSX (the linux-x64 build).
3. Open the Claude Code panel.
4. The panel is blank.
5. Load the same instance through a TLS-terminating reverse proxy (https://...) and open the panel again — it renders correctly and is fully usable. Nothing else changed: same add-on, same extension version, same browser, same session.

Claude Model

_No response_

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.238 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

Affected surface: any browser-based VS Code reached over plain HTTP — code-server, self-hosted remote dev boxes, and the Home Assistant add-on, which is a common way to run VS Code on a home LAN where TLS is not configured by default. http://localhost is unaffected, since localhost is a secure context.

Two related secure-context-gated APIs the webview bundle also uses, worth auditing in the same pass:

• crypto.subtle — also undefined on these origins.
• navigator.clipboard — 9 references (writeText x5, readText x2, read, write). Unavailable in non-secure contexts, so copy/paste affordances would fail the same way once the panel renders.

All counts above are from the shipped Anthropic.claude-code 2.1.238 linux-x64 VSIX on Open VSX.