diff --git a/src/api/task.js b/src/api/task.js
index 9cd736d..df37b47 100644
--- a/src/api/task.js
+++ b/src/api/task.js
@@ -9,7 +9,15 @@ import { filterVisible } from '../pages/task/date.js'
 
 const db = () => getPowersyncDb()
 
-const uuid = () => crypto.randomUUID()
+// crypto.randomUUID 仅在安全上下文 (https / localhost) 可用; 部署站为 http 明文, 用 getRandomValues 兜底生成 v4
+const uuid = () => {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') return crypto.randomUUID()
+  const b = crypto.getRandomValues(new Uint8Array(16))
+  b[6] = (b[6] & 0x0f) | 0x40
+  b[8] = (b[8] & 0x3f) | 0x80
+  const h = [...b].map((x) => x.toString(16).padStart(2, '0')).join('')
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`
+}
 const now = () => new Date().toISOString()
 const parseJson = (v, fallback) => {
   if (v === null || v === undefined || v === '') return fallback