[wieslawsoltes]

Problem and resulting behavior

WebScene implemented crypto.getRandomValues() with Math.random(), accepted unsupported views and oversized requests, filled wider integer elements with only eight useful bits, and omitted crypto.randomUUID(). VS Code OSS reaches these APIs for UUIDs, authentication nonces/verifiers, WebSocket material, and extension identifiers.

This change installs one native Web Crypto random boundary in window, iframe, and dedicated-worker realms. It uses only the operating-system CSPRNG: bounded getentropy() calls on Apple/BSD, retrying getrandom() on Linux, and BCryptGenRandom() with the system-preferred provider on Windows. It has no deterministic or userspace PRNG fallback.

getRandomValues() accepts every integer TypedArray including BigInt views, fills the view's exact byte range, preserves identity, enforces the 65,536-byte quota before mutation, and rejects DataView, floating-point views, non-views, detached storage, and illegal receivers with browser-shaped errors. randomUUID() uses the same source and emits canonical lower-case UUIDv4 values.

Scope

• Closes Replace Math.random Web Crypto with OS CSPRNG and add randomUUID #101.
• Reconstructed from the focused slice in consolidation-only PR Add OS-backed Web Crypto secure random #103 onto main at f8a0df56d89f67648e17e963febcf560f66ea775.
• Exact head: 30806c32788575c021dba7432719e6b79d8a9ff2.
• One commit, nine files; the removed compatibility document and unrelated consolidation history are excluded.
• crypto.subtle remains absent pending the provider and CryptoKey design in Provide crypto.subtle through a vetted cross-platform provider #102.

Correctness and failure coverage

• Deterministic UUID formatting matches the RFC 9562 Appendix A.3 UUIDv4 vector: 919108f7-52d1-4320-9bac-f847db4148a8.
• A source seam tests interrupted reads, bounded partial reads, explicit failure after a partial fill, and verifies that failure neither falls back nor writes beyond bytes returned by the source.
• Native V8 tests cover integer view families, byte offsets, exact and exceeded quota, non-mutation on quota rejection, DOMException/TypeError semantics, method names/arities, receiver checks, UUID shape, and window/iframe parity.
• The focused WPT-style document covers window, iframe, and dedicated-worker parity.

Performance and validation

• Release native/V8 build succeeds.
• Native CSPRNG gate: 5/5; 4,096 16-byte operating-system requests complete in 3.3-8.1 ms against a two-second ceiling.
• Focused hybrid V8 filter: 5/5; warm runs complete in 0.31 s.
• Focused WPT: 1/1 document and 25/25 subtests pass; final run 737 ms.
• Release compatibility architecture tests: 6/6.
• git diff --check and profile JSON validation pass.

The retained remote merge gates are the native document contract and precompiled/V8 contract because they compile and execute the changed operating-system/V8 behavior. Package and unrelated product matrices are outside this focused slice.