Thinking Path

• Paperclip is the open source app people use to manage AI agents for work.
• Operators use task composers to send comments and follow-up messages.
• Browsers hide crypto.randomUUID() on plain HTTP LAN origins.
• The composer calls that method before submitting and silently restores the draft when it throws.
• Paperclip already has a UUID helper that falls back to crypto.getRandomValues().
• This pull request routes the task send paths through that helper and makes the helper fail closed without secure randomness.
• The benefit is that messages can be sent from plain HTTP LAN origins while request IDs remain cryptographically random.

Linked Issues or Issue Description

• Refs Task chat: Send button and Ctrl+Enter do nothing on plain http:// origins (crypto.randomUUID has no fallback) #15846 — task Send fails on plain HTTP origins because crypto.randomUUID() is unavailable.
• Refs Task conversation Send button silently does nothing; Classic Task Interface Works #16090 — task conversation Send silently does nothing on Paperclip 2026.1012.0.
• Refs Message Send Button Doesn't Work #15495 — earlier report of a non-responsive task message Send button.
• Related prior fix: fix(ui): send task messages from plain-http origins #13428. This change applies the same fallback to the current upstream code and its current task composer paths.

What Changed

• Use the existing createUuid() helper in the task chat composer, classic task chat composer, and IssueDetail comment mutation.
• Use the helper for inline image upload IDs in the task composer.
• Remove the Math.random() fallback from createUuid(). Throw a clear error if Web Crypto has no secure random source.
• Add composer coverage for sending when crypto.randomUUID() is missing.
• Add UUID helper tests for the getRandomValues() fallback and the no-CSPRNG error.

Verification

• corepack pnpm --filter @paperclipai/ui exec vitest run src/lib/uuid.test.ts src/components/task-chat/TaskChatComposer.test.tsx src/components/IssueChatThread.test.tsx src/pages/IssueDetail.test.tsx — 4 files, 361 tests passed.
• corepack pnpm --filter @paperclipai/ui typecheck — passed.
• Regression case removes crypto.randomUUID(), sends a task message, checks its v4 UUID request ID, and checks that the draft clears.
• Manual LAN verification: open a task over plain HTTP on a LAN address and send a message. This environment did not provide a signed-in browser session for that check.

Risks

Low risk. Secure origins keep using the native crypto.randomUUID(). Plain HTTP origins use crypto.getRandomValues(), which is available in supported browsers. No server contract or database schema changes.

This is a focused bug fix. It does not add a roadmap feature.

Model Used

• OpenAI Codex, GPT-6, with repository inspection, GitHub tools, code execution, and tests. The exact model variant is not exposed.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have linked existing issues with Refs references
• I have not referenced internal or instance-local Paperclip issues or links
• My branch name describes the change and contains no internal ticket id
• I have run tests locally and they pass
• I have added regression tests
• I have updated relevant documentation; no user-facing documentation covers this browser-specific fallback
• I have considered and documented the risks
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s or follow-ups
• I will address all reviewer comments before requesting merge