[Bug]: Legacy BYOK migration hides daemon validation errors

[open-design-crew]

What happened?

After upgrading to a build with secure BYOK profile migration, Open Design automatically posts legacy browser-stored credentials to /api/byok/profiles. When the daemon rejects an invalid legacy value with a structured HTTP 400 response, the web client discards the daemon's safe validation message and shows Local daemon may be offline with Failed to save BYOK credential (400). The daemon did respond, so the guidance is misleading and does not tell the user which legacy field must be corrected.

Steps to reproduce

1. Start with a pre-migration BYOK configuration stored by an older Open Design build, including an invalid value such as a non-absolute baseUrl.
2. Launch a build that includes the secure BYOK migration introduced by feat(integrations): add the local Open Design Cloud flow for Codex #6055.
3. Allow startup migration to POST the legacy credential to /api/byok/profiles.
4. Observe the daemon return HTTP 400 with a structured VALIDATION_FAILED message.
5. Observe the toast report that the local daemon may be offline and show only Failed to save BYOK credential (400).

Expected behavior

For daemon HTTP errors, show the safe structured validation reason returned by the daemon so the user can correct the legacy configuration. Reserve the offline message for transport failures where the daemon cannot be reached. Keep the legacy browser credential until migration succeeds.

Open Design version

main after #6055; release/v0.17.0 after #6262 (pre-tag)

Platform

• macOS (Apple Silicon)

Logs (optional)

The UI reports: `Local daemon may be offline.` and `Failed to save BYOK credential (400)`. The daemon response body contains `VALIDATION_FAILED` with the concrete field validation message.

Screenshots (optional)

None provided.

Additional context

The behavior was introduced by #6055 and is also present on the pre-tag release/v0.17.0 branch through backport #6262. The legacy secret remains in browser storage after the failed migration, which avoids data loss but leaves the user without actionable remediation.

[lefarcen]

Hey @open-design-crew[bot] — I traced this through the current BYOK migration path, and this looks confirmed.

What the code is doing today:

• the daemon POST route for /api/byok/profiles returns a structured VALIDATION_FAILED 400 with the safe validation message from apps/daemon/src/routes/byok-credentials.ts
• the web migration write path in apps/web/src/state/config.ts throws a generic Failed to save BYOK credential (${response.status}) on any non-OK HTTP response and never reads that response body
• apps/web/src/App.tsx then surfaces that error under the generic settings.autosaveError toast, which is the “local daemon may be offline” copy

So daemon validation failures and actual transport/offline failures are currently being collapsed into the same UI path, which matches the repro here. I could also confirm the non-lossy part: the legacy browser-stored secret is intentionally preserved until secure migration succeeds, so the bad UX is real but the credential is not being dropped on this failure path.

This looks like a real bug, not a duplicate. A clean fix should preserve the daemon’s safe validation message for HTTP error responses and keep the offline wording for fetch/transport failures only.

[lefarcen]

PR #6280 is up for this now.

It carries the fix described here: preserve the daemon's structured BYOK validation message for HTTP error responses, keep the generic offline copy only for transport failures, and keep the legacy browser-stored credential until migration succeeds. We'll keep this issue open until that PR lands.