fix(extension): support UUID generation on insecure origins

[dayi]

Summary

Fix recording initialization on ordinary HTTP intranet pages where
crypto.randomUUID() is unavailable.

Changes

• Add a UUID v4 helper using crypto.getRandomValues() as fallback.
• Replace all three extension-side crypto.randomUUID() call sites.
• Add tests for native and fallback UUID generation.

Validation

• 74 test files passed
• 800 tests passed
• TypeScript compilation passed
• WXT production build passed
• Biome check passed

[iuyo5678]

Add a regression test for RecordFrameAgent——simulate crypto.randomUUID being unavailable, then verify that recording can still start successfully.
This can prevent the fixed business failure path from reappearing?

[dayi]

Add a regression test for RecordFrameAgent——simulate crypto.randomUUID being unavailable, then verify that recording can still start successfully. This can prevent the fixed business failure path from reappearing?

BrowserSkill fails to start recording on enterprise intranet websites served over HTTP, for example:

http://10.x.x.x:9000/

Running bsk record start fails with:

failed to start recording in content script

The browser console shows the actual error:

TypeError: crypto.randomUUID is not a function at .../record-frame.js

The recording content script calls crypto.randomUUID() during initialization. This API may not be available when running on non-secure HTTP pages, causing the recording process to fail before it can start.

This is common in enterprise environments, where many internal OA, ERP, administration, and legacy systems are still deployed over HTTP.

Therefore, this issue prevents BrowserSkill from recording a significant class of enterprise intranet applications and should be addressed as a recording compatibility issue rather than a site-specific problem.

[iuyo5678]

Add a regression test for RecordFrameAgent——simulate crypto.randomUUID being unavailable, then verify that recording can still start successfully. This can prevent the fixed business failure path from reappearing?

BrowserSkill fails to start recording on enterprise intranet websites served over HTTP, for example:

http://10.x.x.x:9000/

Running bsk record start fails with:

failed to start recording in content script

The browser console shows the actual error:

TypeError: crypto.randomUUID is not a function at .../record-frame.js

The recording content script calls crypto.randomUUID() during initialization. This API may not be available when running on non-secure HTTP pages, causing the recording process to fail before it can start.

This is common in enterprise environments, where many internal OA, ERP, administration, and legacy systems are still deployed over HTTP.

Therefore, this issue prevents BrowserSkill from recording a significant class of enterprise intranet applications and should be addressed as a recording compatibility issue rather than a site-specific problem.

You misunderstood what I meant.
I agree with the problem context and the fallback direction.
The main focus here is the level of test coverage: the newly added tests currently only cover createRandomUuid(), and do not cover the RecordFrameAgent startup path where the actual failure occurred this time. I suggest simulating crypto.randomUUID being unavailable in the existing record-frame-agent.test.ts, and asserting that agent.start() returns { ok: true }. This is the only way to prevent the helper unit test from still passing if a direct call is reintroduced later.