fix(byok): restore local runtime configuration (#6356)

* fix(byok): restore local runtime configuration

Return BYOK settings to the browser-local configuration path and pass credentials only to the active OpenCode child run.

Remove the unpublished secure-profile migration, credential backends, API, CLI, contracts, and MCP exposure while retaining raw-secret rejection on external MCP calls.

Validated with focused web and daemon suites, full web tests, workspace typecheck, guard, and diff checks.

* test(e2e): align BYOK settings checks with local storage

Update the settings UI contract after rolling BYOK credentials back to local app config storage. Assert the entered key is persisted, keep incomplete BYOK drafts from activating, and seed the Local CLI isolation case with a usable BYOK key.

Validated with all seven P0 cases in settings-api-protocol.test.ts and the e2e TypeScript check.

* fix(daemon): validate plugin request ids explicitly

Use a field-specific canonical UUID/ULID validator for attributed request IDs and document that format in the MCP schema and server instructions. Invalid calls now identify requestId instead of incorrectly blaming pluginWorkflowId, while Codex can generate a valid ID on its first attempt.

Validated with a red/green MCP observability regression test, daemon typecheck, repository guard, and a real Local Codex plugin smoke that completed in one start_run attempt.

* test(pack): follow active PTY consumer in prebundle coverage

Point the macOS prebundle boundary test at the Terminal runtime after the retired BYOK credential service was removed. This keeps native node-pty externalization covered without restoring legacy credential code.

Validated with the focused mac-prebundle suite, the complete tools-pack suite, tools-pack typechecks, repository guard, and deleted-file reference scans.

---------

Co-authored-by: Cheems <94773058+itscheems@users.noreply.github.com>

e2e/ui/settings-api-protocol.test.ts

@@ -135,28 +135,6 @@ async function openExecutionSettingsWithAgents(
   await page.route('**/api/health', async (route) => {
     await route.fulfill({ status: 200, contentType: 'application/json', body: '{"ok":true}' });
   });
-  if (typeof config.byokProfileId === 'string') {
-    await page.route('**/api/byok/profiles', async (route) => {
-      await route.fulfill({
-        json: {
-          available: true,
-          backend: 'test',
-          profiles: [{
-            id: config.byokProfileId,
-            label: 'OpenAI',
-            protocol: config.apiProtocol ?? 'openai',
-            baseUrl: config.baseUrl ?? '',
-            model: config.model ?? '',
-            requiresApiKey: true,
-            configured: true,
-            keyTail: config.byokCredentialTail ?? 'test',
-            createdAt: 1,
-            updatedAt: 1,
-          }],
-        },
-      });
-    });
-  }
   await routeAgents(page, agents);
 
   await gotoEntryHome(page);
@@ -275,7 +253,7 @@ test('[P0] @critical BYOK quick fill provider updates fields and saved settings
     .toMatchObject({
       mode: 'api',
       apiProtocol: 'openai',
-      apiKey: '',
+      apiKey: 'sk-openai-test',
       baseUrl: 'https://api.deepseek.com',
       model: 'deepseek-v4-flash',
       apiProviderBaseUrl: 'https://api.deepseek.com',
@@ -288,7 +266,7 @@ test('[P0] @critical BYOK quick fill provider updates fields and saved settings
   expect(savedConfig).toMatchObject({
     mode: 'api',
     apiProtocol: 'openai',
-    apiKey: '',
+    apiKey: 'sk-openai-test',
     baseUrl: 'https://api.deepseek.com',
     model: 'deepseek-v4-flash',
     apiProviderBaseUrl: 'https://api.deepseek.com',
@@ -473,7 +451,7 @@ test('[P1] BYOK connection test surfaces NVIDIA degraded provider detail', async
   );
 });
 
-test('[P0] BYOK save stays disabled until required fields are valid', async ({ page }) => {
+test('[P0] BYOK autosave waits until required fields are valid', async ({ page }) => {
   await openExecutionSettings(page, {
     mode: 'api',
     apiKey: '',
@@ -496,7 +474,7 @@ test('[P0] BYOK save stays disabled until required fields are valid', async ({ p
   await expect(closeButton).toBeEnabled();
 
   await dialog.getByLabel('API key').fill('sk-openai-test');
-  await expect.poll(async () => readSavedConfig(page)).toMatchObject({ apiKey: '' });
+  await expect.poll(async () => readSavedConfig(page)).toMatchObject({ apiKey: 'sk-openai-test' });
 
   const baseUrlInput = dialog.getByLabel('Base URL');
   // A non-http scheme is still rejected client-side. (An internal-IP URL is no
@@ -507,7 +485,7 @@ test('[P0] BYOK save stays disabled until required fields are valid', async ({ p
 
   await baseUrlInput.fill('http://localhost:11434/v1');
   await expect.poll(async () => readSavedConfig(page)).toMatchObject({
-    apiKey: '',
+    apiKey: 'sk-openai-test',
     baseUrl: 'http://localhost:11434/v1',
   });
 });
@@ -681,7 +659,7 @@ test('[P0] @critical BYOK clearing the API key restores the suggested OpenAI mod
   await apiKeyInput.blur();
   await expect.poll(() => providerModelRequests.length).toBe(1);
   await expect.poll(async () => readSavedConfig(page)).toMatchObject({
-    apiKey: '',
+    apiKey: 'sk-openai-test',
   });
 
   await modelSelect.click();
@@ -1034,15 +1012,12 @@ test('[P0] @critical Settings keeps Local CLI and BYOK model choices isolated af
     page,
     {
       mode: 'api',
-      apiKey: '',
+      apiKey: 'sk-openai-test',
       apiProtocol: 'openai',
       apiVersion: '',
       baseUrl: 'https://api.openai.com/v1',
       model: 'gpt-4o-mini',
       apiProviderBaseUrl: 'https://api.openai.com/v1',
-      byokProfileId: 'byok-settings-model-isolation',
-      byokCredentialConfigured: true,
-      byokCredentialTail: 'test',
       agentId: null,
       skillId: null,
       designSystemId: null,