The signalThe static page renders from a non-loopback HTTP URL, while the console reports crypto.randomUUID is not a function and every RPC-backed view stays empty.

The exception happens before the provider.

The browser client creates an identifier before sending each RPC request. At the verified revision, that path directly calls crypto.randomUUID(). If the browser does not expose the method, request construction throws before workspace, session, or provider code can answer.

That explains the deceptive split: static HTML, CSS, and JavaScript arrive successfully, but the first data request never leaves the browser.

Probe the browser, not your API key.

Run these two expressions in the failing browser console:

window.isSecureContext
typeof globalThis.crypto?.randomUUID

The affected path normally reports false and "undefined". Compare the same Harness process through its localhost URL on the host machine. If localhost works, rotating provider credentials or clearing sessions targets the wrong layer.

Recover without widening the wrong boundary.

  1. Prefer loopback. Use the printed localhost URL when remote access is unnecessary.
  2. For remote use, create a trusted HTTPS boundary. Restrict who can reach it and preserve streaming and WebSocket behavior.
  3. Verify the complete surface. Check secure context, UUID availability, workspace/provider RPC, one disposable read-only turn, and rejection of unauthorized clients.
  4. Treat a UUID polyfill as diagnosis. It may restore compatibility, but it does not add TLS, authentication, or an origin policy.

Compatibility is not deployment security.

The upstream server documentation says the Web carrier provides no TLS, authentication, or origin policy. The CLI separately rejects --host 0.0.0.0 because direct exposure can make remote code execution reachable from the network. Fixing one missing browser API does not change either fact.

Primary evidence.

Diagnose the right layer first

Keep the operator map close.

The open handbook separates browser, transport, provider, Agent loop, tool policy, sandbox, and session failures—with evidence for each boundary.

Read and star the handbook