[Aeromtrich]

Issue for this PR

Fixes #59791

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Opening a new file picker on a non-localhost HTTP origin could throw because crypto.randomUUID is unavailable outside a secure context. Use a non-cryptographic fallback only for the temporary side-panel tab ID, so the picker still opens.

How did you verify your code works?

• Added a built Playwright regression that removes crypto.randomUUID, opens the Review panel, and verifies that Open file opens the picker.
• bun run test:e2e:built -- e2e/regression/review.spec.ts -g "opens the file picker when randomUUID is unavailable"
• bun run lint:changed
• bun run typecheck:tsc in packages/gui-plugins

Visual

<svg xmlns="http://www.w3.org/2000/svg" width="240" height="72" viewBox="0 0 240 72" fill="none" stroke="currentColor" stroke-width="2">
  <style>@keyframes open{0%,20%{opacity:0;transform:translateX(-6px)}35%,80%{opacity:1;transform:translateX(0)}100%{opacity:0;transform:translateX(4px)}}@keyframes pulse{0%,100%{opacity:.35}50%{opacity:1}}</style>
  <rect x="14" y="12" width="212" height="48" rx="6" opacity=".35"/>
  <path d="M14 27h212" opacity=".35"/>
  <path d="M28 20h28" opacity=".7"/>
  <g style="animation:open 2.4s ease-in-out infinite">
    <rect x="73" y="18" width="104" height="36" rx="4" fill="currentColor" fill-opacity=".08"/>
    <path d="M87 30h9l3 4h62M87 42h66" opacity=".8"/>
    <circle cx="73" cy="18" r="4" fill="currentColor" style="animation:pulse 1.2s ease-in-out infinite"/>
  </g>
</svg>

Screenshots / recordings

The regression covers the user-visible picker opening in the insecure-context condition.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

---

Added by the opencode bot (AI-generated).

Related: #46168, #48144, #55777, #46419

[opencodejr]

Looks good. I reproduced the bug on the base by running the web UI from source on a LAN IP over plain HTTP: clicking Open file throws crypto.randomUUID is not a function and no tab opens. With this change, the Open file tab opens and shows the file picker. The new Playwright regression test passes here and fails on the base, and tsc -b in packages/gui-plugins passes.

Public API is unchanged.

The fallback key only has to be unique among the open tabs and keeps the open: prefix that isLauncher checks, so a short random ID is fine there. No blocking concerns.

Related: #46168, #48144, #55777, #46419