fix(web): secure-context-safe UUIDs + HTTPS compose overlay for LAN deployments

[Poytr1]

Problem

Browsers expose crypto.randomUUID() only in secure contexts (HTTPS or localhost). A console served over plain HTTP from a LAN host — a stack on a NAS opened by IP is the typical case — crashed on Playground send, cron creation, and the Telegram wizard. The rest of the console was already hardened for insecure contexts (clipboard calls are try/caught, the webhook HMAC snippet degrades to a placeholder); the unguarded randomUUID call sites were the remaining hard failures.

Changes

packages/web: secure-context-safe randomUUID() (lib/random-id.ts)

• Native crypto.randomUUID when available, otherwise a manual v4 UUID built from crypto.getRandomValues (not secure-context gated), with a Math.random last resort.
• The fallback emits spec-valid v4 UUIDs because webchat frames validate turnId with z.string().uuid().
• All six call sites now route through it (PlaygroundProvider ×3, Telegram wizard, AddCronModal, data-context); unit tests cover all three environments.

compose.https.yaml: opt-in TLS overlay for LAN deployments

• Caddy + its internal CA in front of web / control-plane / relay, one HTTPS port per service (3443/8443/9443), keyed on a single AGENTCONNECT_HTTPS_HOST variable.
• Overrides the browser-facing PUBLIC_* URLs, CORS origin, and setup-server passthroughs to the HTTPS origins. Daemons are Node processes and keep dialing the plain HTTP/WS ports unchanged.
• Works with already-published images — no rebuild needed to adopt it.
• README, compose.env.example, and the agentconnect-setup skill document the flow, including trusting the exported root certificate per device.

Verification

• Web: full vitest suite passes (1448 tests, including new random-id.test.ts), tsc --noEmit, eslint, prettier, and a production next build all clean.
• Overlay: docker compose config resolves the merged file with every URL override in place and fails with an actionable message when AGENTCONNECT_HTTPS_HOST is unset; the Caddyfile passes caddy validate.

🤖 Generated with Claude Code

[agentconnect-md-test]

The secure-context UUID helper is well scoped and all six browser call sites now use it. The HTTPS overlay also renders the expected browser-facing Web/API/Relay URLs. However, the overlay currently breaks the normal daemon onboarding path: PUBLIC_CP_URL is also used to generate daemon WebSocket commands, so the generated command dials Caddy's private-CA wss:// endpoint even though the daemon transport has no way to trust that CA by default. The documented root-certificate export command also cannot be run as written because the required host assignment was only scoped to the earlier up invocation.

Verification: git diff --check passed; docker compose config passed with AGENTCONNECT_HTTPS_HOST and confirmed the HTTPS environment values; the unset-host invocation failed as configured. Focused Vitest/typecheck/lint could not be rerun because dependencies are absent and the pinned pnpm download was unavailable from this environment.

_{sent by review-bot (Codex · gpt-5.6-sol) · open in session}

[agentconnect-md-test]

[P1] Keep daemon onboarding usable with the internal CA. PUBLIC_CP_URL is not browser-only: daemonWsUrl() derives every Add/Regenerate daemon command from it, so this override produces wss://<host>:8443/daemon/ws. The shared ClientTransport supplies no CA option to ws, and the required Node 24 runtime uses bundled roots by default, so trusting Caddy's root in the browser or OS does not make that generated npx ... run command trust it. The daemon therefore reconnects forever in the advertised LAN setup. Please provide a separate plain daemon dial URL, generate/document the required Node CA configuration, or otherwise ensure the generated command can authenticate this endpoint.

[agentconnect-md-test]

[P2] Carry the required host into the certificate-export command. The preceding AGENTCONNECT_HTTPS_HOST=... assignment applies only to the up process; it is not present for this later docker compose ... cp. Compose interpolates the overlay before running cp and aborts because AGENTCONNECT_HTTPS_HOST is required. Please repeat the assignment here or show a persistent --env-file workflow. The analogous command in compose.https.yaml also needs the overlay file set (and the host value).