fix(web): surface BYOK migration validation errors by open-design-crew[bot] · Pull Request #6280 · nexu-io/open-design

open-design-crew · 2026-07-30T09:39:40Z

Why

Use case: While validating the Codex plugin flow added in #6055, an existing legacy BYOK configuration failed its automatic secure-profile migration during startup.

Pain: The daemon returned a safe, actionable HTTP 400 validation reason, but the web client discarded it and told the user that the local daemon might be offline. That false diagnosis prevents the user from correcting the legacy field and leaves the credential in browser storage until migration can succeed. Because #6055 was backported by #6262, the same bug is present on the pre-tag release/v0.17.0 branch.

What users will see

When legacy BYOK migration receives an HTTP error from the daemon, the startup toast shows the daemon's concrete validation reason. The generic offline message is now reserved for network failures where the daemon could not be reached. Failed migrations continue to preserve the legacy browser credential until a later migration succeeds.

Surface area

UI — new page / dialog / panel / menu item / setting / empty state in apps/web or apps/desktop (including Electron menu bar)
Keyboard shortcut — new or changed
CLI / env var — new od subcommand or flag, new tools-dev / tools-pack flag, or new OD_* env var
API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
i18n keys — added new translation keys (see TRANSLATIONS.md for the locale workflow)
New top-level dependency — adding any new entry to the root package.json (dependencies or devDependencies); workspace-package package.json files are out of scope. Include a paragraph on what we get vs. what bytes we ship (see CONTRIBUTING.md → Code style)
Default behavior change — changes what existing users experience without opting in (default model, default setting, file/SQLite schema, auto-network on startup, auto-install)
None — internal refactor, docs, tests, or translation update only

Screenshots

Not applicable.

Bug fix verification

Test path that reproduces the bug: apps/web/tests/state/config.test.ts
Red on main: yes
Green on this branch: yes
Explanation: On clean main at 7d7c56a, the focused migration spec expected the daemon's BYOK baseUrl... validation message and received Failed to save BYOK credential (400). The same spec and the HTTP-fallback/network-classification coverage pass on this branch.

Validation

mise exec -- pnpm --filter @open-design/web exec vitest run -c vitest.config.ts tests/state/config.test.ts -t "surfaces the daemon validation reason|keeps the HTTP status fallback|classifies fetch rejection"
mise exec -- pnpm --filter @open-design/web exec vitest run -c vitest.config.ts tests/state/config.test.ts
mise exec -- pnpm --filter @open-design/web exec vitest run -c vitest.config.ts tests/components/App.project-create-race.test.tsx
mise exec -- pnpm --filter @open-design/web typecheck
mise exec -- pnpm guard
mise exec -- pnpm typecheck
git diff --check

Adjacent issues

powerformer/vela#961 is part of the broader headless Codex integration but does not read browser localStorage or call /api/byok/profiles; no Vela change is required for this bug.
Release follow-up: treat this as a release/v0.17.0 blocker because [backport release/v0.17.0] feat(integrations): add the local Open Design Cloud flow for Codex #6262 already backported the affected migration path before the tag.

Preserve structured daemon errors during legacy credential migration and reserve offline guidance for fetch failures. Keep legacy browser credentials until migration succeeds, and cover HTTP validation, malformed responses, and network failures. Validated with focused web tests, web typecheck, workspace guard, and workspace typecheck.

open-design-release-bot · 2026-07-30T09:39:53Z

ℹ️ The backport release/v0.17.0 label requires write permission or above (@open-design-crew[bot] currently has none), so it was removed automatically. Please ask a maintainer to confirm whether this should ship in the current release.

lefarcen · 2026-07-30T09:46:24Z

🧪 This PR has changes that need a manual QA pass before merge — please hold off self-merging for now; we'll loop QA in once it's merge-ready (and design/product have signed off, where applicable).

mrcfps

@app/open-design-crew I verified the legacy BYOK migration path now preserves the daemon’s structured validation message, reserves the offline guidance for fetch failures, and keeps browser-stored credentials intact until migration succeeds. The full config test file passes (71 tests), along with web typecheck, repository guard, full workspace typecheck, and diff checks. Thanks for the careful error classification and focused regression coverage—this is a solid, user-helpful fix. 🙌

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

github-actions · 2026-07-30T09:52:20Z

Visual regression review

Head: fcbfa54 · Base: 7d7c56a

5 changed · 48 unchanged · 0 new without baseline · 0 failed

Changed cases

Case	Main	PR	Diff
visual-settings-byok-model-dropdown _{9,737 px (0.75%)}
visual-settings-byok-openai _{9,918 px (0.77%)}
visual-topbar-byok-model-dropdown _{4,920 px (0.38%)}
visual-topbar-byok-switcher _{4,765 px (0.37%)}
visual-topbar-byok-switcher-popover _{522 px (0.42%)}

Unchanged cases

Case	Main	PR	Diff
visual-avatar-local-agent-list _{0 px (0.00%)}
visual-avatar-local-agent-list-panel _{0 px (0.00%)}
visual-avatar-menu _{0 px (0.00%)}
visual-avatar-menu-panel _{0 px (0.00%)}
visual-avatar-open-design-account _{0 px (0.00%)}
visual-critical-settings _{0 px (0.00%)}
visual-critical-workspace _{0 px (0.00%)}
visual-critical-workspace-preview _{0 px (0.00%)}
visual-design-system-detail _{0 px (0.00%)}
visual-design-systems _{0 px (0.00%)}
visual-home _{0 px (0.00%)}
visual-home-catalog _{0 px (0.00%)}
visual-home-context-picker _{0 px (0.00%)}
visual-home-context-picker-popover _{0 px (0.00%)}
visual-home-plugin-filter _{0 px (0.00%)}
visual-home-plugin-use-staged _{0 px (0.00%)}
visual-home-plugin-use-with-query _{0 px (0.00%)}
visual-home-staged-attachment _{0 px (0.00%)}
visual-integrations _{0 px (0.00%)}
visual-integrations-mcp _{0 px (0.00%)}

Visual diff is advisory only and does not block merging.

Map secure-profile HTTP and network failures to semantic error codes before emitting settings_byok_test_result, while preserving existing fallback behavior for unrelated connection-test errors. Validated with the complete web test suite, web typecheck, workspace typecheck, guard, and git diff --check.

AmyShang-alt · 2026-07-30T11:26:53Z

QA 验收通过

已在 PR head fcbfa546 的真实运行实例完成验证。

legacy BYOK 迁移请求实际命中 /api/byok/profiles
daemon 返回 HTTP 400 时，UI 展示结构化校验信息：
BYOK baseUrl must be an absolute HTTP(S) URL without credentials, query, or fragment.
未错误显示 Local daemon may be offline
相关 CI、Web 全量测试、targeted regression tests、typecheck、UI P0 均通过
自动化覆盖确认迁移失败时保留旧凭据

QA 结论：通过，可合并。

备注：本记录为 QA 验收结论，不代替 maintainer 的代码 review approval。

AmyShang-alt

QA verified on PR head fcbfa54. Legacy BYOK HTTP 400 errors surface the daemon validation message, offline guidance is reserved for network failures, and regression/CI checks are green.

open-design-release-bot · 2026-07-31T04:18:47Z

Successfully created backport PR for release/v0.17.0:

[backport release/v0.17.0] fix(web): surface BYOK migration validation errors #6297

* fix(web): surface BYOK migration validation errors Preserve structured daemon errors during legacy credential migration and reserve offline guidance for fetch failures. Keep legacy browser credentials until migration succeeds, and cover HTTP validation, malformed responses, and network failures. Validated with focused web tests, web typecheck, workspace guard, and workspace typecheck. * fix(web): stabilize BYOK persistence error telemetry Map secure-profile HTTP and network failures to semantic error codes before emitting settings_byok_test_result, while preserving existing fallback behavior for unrelated connection-test errors. Validated with the complete web test suite, web typecheck, workspace typecheck, guard, and git diff --check. --------- (cherry picked from commit 4a6c2da) Co-authored-by: open-design-crew[bot] <299007234+open-design-crew[bot]@users.noreply.github.com> Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>

open-design-crew Bot added the backport release/v0.17.0 Backport this fix to release/v0.17.0 label Jul 30, 2026

open-design-release-bot Bot removed the backport release/v0.17.0 Backport this fix to release/v0.17.0 label Jul 30, 2026

lefarcen requested a review from mrcfps July 30, 2026 09:44

lefarcen added size/M PR changes 100-300 lines risk/medium Medium risk: regular code changes type/bugfix Bug fix needs-validation Runtime change detected; needs human or /explore agent validation. labels Jul 30, 2026

lefarcen mentioned this pull request Jul 30, 2026

[Bug]: Legacy BYOK migration hides daemon validation errors #6279

Closed

mrcfps approved these changes Jul 30, 2026

View reviewed changes

lefarcen requested a review from AmyShang-alt July 30, 2026 09:58

open-design-crew Bot mentioned this pull request Jul 30, 2026

fix(byok): harden the Windows DPAPI worker lifecycle #6282

Closed

14 tasks

AmyShang-alt approved these changes Jul 30, 2026

View reviewed changes

lefarcen added validated Runtime change validated (via /explore Pass or manual QA). and removed needs-validation Runtime change detected; needs human or /explore agent validation. labels Jul 30, 2026

open-design-crew Bot mentioned this pull request Jul 30, 2026

[Bug]: Windows packaged BYOK CRUD times out during repeated DPAPI startup #6285

Open

2 tasks

AmyShang-alt added this pull request to the merge queue Jul 31, 2026

Merged via the queue into main with commit 4a6c2da Jul 31, 2026
22 checks passed

lefarcen added backport release/v0.17.0 Backport this fix to release/v0.17.0 and removed backport release/v0.17.0 Backport this fix to release/v0.17.0 labels Jul 31, 2026

open-design-release-bot Bot mentioned this pull request Jul 31, 2026

[backport release/v0.17.0] fix(web): surface BYOK migration validation errors #6297

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(web): surface BYOK migration validation errors - #6280

fix(web): surface BYOK migration validation errors#6280
AmyShang-alt merged 2 commits into
mainfrom
codex/fix-6279-byok-migration-error

open-design-crew Bot commented Jul 30, 2026

Uh oh!

open-design-release-bot Bot commented Jul 30, 2026

Uh oh!

lefarcen commented Jul 30, 2026

Uh oh!

mrcfps left a comment

Uh oh!

github-actions Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

AmyShang-alt commented Jul 30, 2026

Uh oh!

AmyShang-alt left a comment

Uh oh!

Uh oh!

open-design-release-bot Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

open-design-crew Bot commented Jul 30, 2026

Why

What users will see

Surface area

Screenshots

Bug fix verification

Validation

Adjacent issues

Uh oh!

open-design-release-bot Bot commented Jul 30, 2026

Uh oh!

lefarcen commented Jul 30, 2026

Uh oh!

mrcfps left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual regression review

Changed cases

Uh oh!

AmyShang-alt commented Jul 30, 2026

QA 验收通过

Uh oh!

AmyShang-alt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

open-design-release-bot Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jul 30, 2026 •

edited

Loading