fix(byok): restore local runtime configuration

Return BYOK settings to the browser-local configuration path and pass credentials only to the active OpenCode child run.

Remove the unpublished secure-profile migration, credential backends, API, CLI, contracts, and MCP exposure while retaining raw-secret rejection on external MCP calls.

Validated with focused web and daemon suites, full web tests, workspace typecheck, guard, and diff checks.

Author: Cheems

apps/daemon/src/byok/credential-service.ts

@@ -12,7 +12,6 @@ import { DESIGN_SYSTEMS_USAGE, isDesignSystemsHelpArg } from './cli-help/index.j
 import { BRAND_USAGE, isBrandHelpArg } from './cli-help/index.js';
 import { parseDesignSystemRenameArgs } from './design-systems/rename-args.js';
 import { runLiveArtifactsToolCli } from './tools-live-artifacts-cli.js';
-import { runByokToolCli } from './tools-byok-cli.js';
 import { splitResearchSubcommand } from './research/cli-args.js';
 import { resolveDaemonUrl } from './daemon-url.js';
 import { requestJsonIpc } from '@open-design/sidecar';
@@ -334,7 +333,6 @@ const SUBCOMMAND_MAP = {
   artifacts: runArtifacts,
   media: runMedia,
   mcp: runMcp,
-  byok: runByok,
   amr: runAmr,
   'message-center': runMessageCenter,
   research: runResearch,
@@ -1472,15 +1470,6 @@ artifact / message body. The daemon writes the bytes into the project's
 files folder so the FileViewer can preview them immediately.`);
 }
 
-// ---------------------------------------------------------------------------
-// Subcommand: od byok
-// ---------------------------------------------------------------------------
-
-async function runByok(args) {
-  const result = await runByokToolCli(args);
-  if (result.exitCode !== 0) process.exit(result.exitCode);
-}
-
 // ---------------------------------------------------------------------------
 // Subcommand: od mcp
 // ---------------------------------------------------------------------------

apps/daemon/src/cli.ts

@@ -51,7 +51,7 @@ const BRIEF_COPY: Record<LocalMcpBriefLocale, LocalizedBriefCopy> = {
     artifactNames: ENGLISH_ARTIFACT_NAMES,
     title: (artifactName) => `Choose the ${artifactName} direction`,
     description:
-      'Choose one option for each decision. The same readable brief can be used with Open Design Cloud, Local Codex, or Secure BYOK.',
+      'Choose one option for each decision. The same readable brief can be used with Open Design Cloud or Local Codex.',
     submitLabel: 'Confirm brief',
     completeCard:
       'Complete the rendered Open Design brief card. The confirmation returns a readable summary; internal correlation values must remain hidden.',

apps/daemon/src/mcp-brief.ts

@@ -67,7 +67,7 @@ const OPEN_DESIGN_BRIEF_APP_RESOURCE =
   'ui://open-design/artifact-card-v6.html';
 
 export const MCP_SERVER_INSTRUCTIONS = [
-  'Use only these product names in user-facing replies: Open Design Cloud, Local Codex, and Secure BYOK.',
+  'Use only these product names in user-facing replies: Open Design Cloud and Local Codex.',
   'Tool names, runtime ids, endpoints, and correlation values are machine protocol. Never repeat them as product copy.',
 ].join('\n');
 
@@ -84,7 +84,7 @@ interface ProjectPayload { project?: ProjectSummary; id?: string; name?: string;
 interface ActiveContext { active?: boolean; projectId?: string; projectName?: string | null; fileName?: string | null; ageMs?: number | null }
 type ResolvedProject = { id: string; name: string; source: 'uuid' | 'id' | 'exact' | 'slug' | 'substring' };
 interface ProjectListCache { baseUrl: string; t: number; list: ProjectSummary[] }
-interface McpArgs extends JsonObject { project?: unknown; entry?: unknown; include?: unknown; maxBytes?: unknown; path?: unknown; offset?: unknown; limit?: unknown; since?: unknown; query?: unknown; pattern?: unknown; max?: unknown; name?: unknown; content?: unknown; encoding?: unknown; artifactManifest?: unknown; confirm?: unknown; prompt?: unknown; plugin?: unknown; inputs?: unknown; agent?: unknown; model?: unknown; serviceTier?: unknown; byokProfile?: unknown; apiKey?: unknown; requestId?: unknown; resume?: unknown; runId?: unknown; id?: unknown; designSystem?: unknown; skill?: unknown; includeUnavailable?: unknown; artifactType?: unknown; projectTitle?: unknown; locale?: unknown; knownAnswers?: unknown; skip?: unknown; briefDraftId?: unknown; nonce?: unknown; answers?: unknown; externalPluginContext?: unknown; pluginWorkflowId?: unknown }
+interface McpArgs extends JsonObject { project?: unknown; entry?: unknown; include?: unknown; maxBytes?: unknown; path?: unknown; offset?: unknown; limit?: unknown; since?: unknown; query?: unknown; pattern?: unknown; max?: unknown; name?: unknown; content?: unknown; encoding?: unknown; artifactManifest?: unknown; confirm?: unknown; prompt?: unknown; plugin?: unknown; inputs?: unknown; agent?: unknown; model?: unknown; serviceTier?: unknown; apiKey?: unknown; requestId?: unknown; resume?: unknown; runId?: unknown; id?: unknown; designSystem?: unknown; skill?: unknown; includeUnavailable?: unknown; artifactType?: unknown; projectTitle?: unknown; locale?: unknown; knownAnswers?: unknown; skip?: unknown; briefDraftId?: unknown; nonce?: unknown; answers?: unknown; externalPluginContext?: unknown; pluginWorkflowId?: unknown }
 interface ProjectFileBundleEntry { name: string; mime: string; size: number | null; content: string | null; binary: boolean }
 interface BundleInput { project: ProjectPayload | ProjectSummary; entry: string; files: ProjectFileBundleEntry[]; truncated: boolean; skippedFileCount?: number; active: ActiveContext | null; resolved?: ResolvedProject | null }
 interface ErrorWithCode { message?: string; code?: string; cause?: { code?: string } }
@@ -616,17 +616,6 @@ export const TOOL_DEFS = [
     },
     annotations: { ...READ_ANNOTATIONS, title: 'List Open Design plugins' },
   },
-  {
-    name: 'list_byok_profiles',
-    description:
-      'List secure local BYOK profile references available to start_run.byokProfile. Returns only non-secret metadata; API keys never cross MCP.',
-    inputSchema: {
-      type: 'object',
-      properties: { pluginWorkflowId: PLUGIN_WORKFLOW_ID_ARG },
-      additionalProperties: false,
-    },
-    annotations: { ...READ_ANNOTATIONS, title: 'List secure BYOK profiles' },
-  },
   {
     name: 'start_vela_login',
     description:
@@ -695,11 +684,6 @@ export const TOOL_DEFS = [
           type: 'string',
           description: "Service tier override for the selected model, e.g. 'priority' for Codex Fast. Optional.",
         },
-        byokProfile: {
-          type: 'string',
-          description:
-            'Secure profile id from list_byok_profiles. Selects the local BYOK OpenCode runtime; raw API keys are never accepted by MCP.',
-        },
         requestId: {
           type: 'string',
           description:
@@ -849,7 +833,7 @@ export function localMcpResourceDefinitions() {
       name: 'Open Design brief',
       title: 'Choose the artifact direction',
       description:
-        'Interactive local Open Design brief card shared by Open Design Cloud, Local Codex, and Secure BYOK modes.',
+        'Interactive local Open Design brief card shared by Open Design Cloud and Local Codex modes.',
       mimeType: 'text/html;profile=mcp-app',
       _meta: {
         ui: {
@@ -1271,7 +1255,7 @@ function mcpFailureFacts(
   const failureStage =
     name === 'collect_brief' || name === 'confirm_brief'
       ? 'brief'
-      : name.includes('vela_login') || name === 'list_byok_profiles'
+      : name.includes('vela_login')
         ? 'auth'
         : name.includes('project')
           ? 'project'
@@ -1622,12 +1606,9 @@ export async function runMcpStdio({ daemonUrl }: RunMcpOptions): Promise<void> {
         ' - collect_brief first for a new artifact unless the user explicitly',
         '    asks to skip questions. Let the user complete the rendered card;',
         '    confirm_brief returns the readable brief to reuse with Open Design',
-        '    Cloud, Local Codex, or Secure BYOK. Never print or ask the user to copy',
+        '    Cloud or Local Codex. Never print or ask the user to copy',
         '    briefDraftId, nonce, or any other internal correlation value.',
         ' - list_skills / list_plugins to see what you can ask OD to make.',
-        ' - list_byok_profiles returns secure local credential references when',
-        '    the user explicitly chooses Secure BYOK. Never request or pass a',
-        '    raw API key through MCP; pass only start_run.byokProfile.',
         ' - for Open Design Cloud, call the Cloud login-status tool first.',
         '    If signed out, call the Cloud sign-in tool once, show its activation',
         '    URL/code when present, and poll login status until loggedIn:true.',
@@ -2037,8 +2018,6 @@ async function handleMcpToolCall(
         return ok(await getJson<SkillsPayload>(`${baseUrl}/api/skills`));
       case 'list_plugins':
         return ok(await listPlugins(baseUrl));
-      case 'list_byok_profiles':
-        return ok(await listByokProfiles(baseUrl));
       case 'list_agents':
         return ok(await listAgents(baseUrl, args.includeUnavailable === true));
       case 'start_vela_login': {
@@ -2263,58 +2242,6 @@ async function listAgents(baseUrl: string, includeUnavailable: boolean): Promise
   return { agents };
 }
 
-async function listByokProfiles(baseUrl: string): Promise<JsonObject> {
-  const payload = await getJson<JsonObject>(`${baseUrl}/api/byok/profiles`);
-  const rawProfiles = Array.isArray(payload.profiles) ? payload.profiles : [];
-  const profiles = rawProfiles.flatMap((value) => {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return [];
-    const profile = value as JsonObject;
-    if (
-      typeof profile.id !== 'string'
-      || typeof profile.label !== 'string'
-      || typeof profile.protocol !== 'string'
-      || typeof profile.baseUrl !== 'string'
-      || typeof profile.model !== 'string'
-    ) {
-      return [];
-    }
-    try {
-      const parsed = new URL(profile.baseUrl);
-      if (
-        !['http:', 'https:'].includes(parsed.protocol)
-        || parsed.username.length > 0
-        || parsed.password.length > 0
-        || parsed.search.length > 0
-        || parsed.hash.length > 0
-      ) {
-        return [];
-      }
-    } catch {
-      return [];
-    }
-    return [{
-      id: profile.id,
-      label: profile.label,
-      protocol: profile.protocol,
-      baseUrl: profile.baseUrl,
-      model: profile.model,
-      ...(typeof profile.apiVersion === 'string'
-        ? { apiVersion: profile.apiVersion }
-        : {}),
-      requiresApiKey: profile.requiresApiKey === true,
-      configured: profile.configured === true,
-      ...(typeof profile.keyTail === 'string' ? { keyTail: profile.keyTail } : {}),
-      ...(typeof profile.createdAt === 'number' ? { createdAt: profile.createdAt } : {}),
-      ...(typeof profile.updatedAt === 'number' ? { updatedAt: profile.updatedAt } : {}),
-    }];
-  });
-  return {
-    available: payload.available === true,
-    backend: typeof payload.backend === 'string' ? payload.backend : 'unknown',
-    profiles,
-  };
-}
-
 // Derive a valid project id ([A-Za-z0-9._-], <=128) from a display name,
 // with a short random suffix so repeated creates with the same name
 // don't collide on the daemon's primary key.
@@ -2341,7 +2268,7 @@ async function startRun(
     || containsMcpCredentialField(args.inputs)
   ) {
     throw new Error(
-      'raw API keys are not accepted by Open Design MCP. Save the key through the Open Design UI or `od byok save --api-key-stdin`, then pass only byokProfile.',
+      'raw API keys are not accepted by Open Design MCP. Configure Local BYOK in the Open Design UI and start that run from the local product instead.',
     );
   }
   const { id, resolved, active } = await resolveProjectArg(baseUrl, args.project);
@@ -2397,18 +2324,6 @@ async function startRun(
   if (typeof args.serviceTier === 'string' && args.serviceTier.length > 0) {
     body.serviceTier = args.serviceTier;
   }
-  if (args.byokProfile !== undefined) {
-    requireString(args.byokProfile, 'byokProfile');
-    if (
-      typeof args.agent === 'string'
-      && args.agent.length > 0
-      && args.agent !== 'byok-opencode'
-    ) {
-      throw new Error('byokProfile can only be used with the byok-opencode agent.');
-    }
-    body.agentId = 'byok-opencode';
-    body.byokProfileId = args.byokProfile;
-  }
   if (args.inputs !== undefined) {
     if (args.inputs === null || typeof args.inputs !== 'object' || Array.isArray(args.inputs)) {
       throw new Error('inputs must be an object');