fix(daemon): tighten deployment credential boundaries

Author: dredozubov

apps/daemon/src/cli.ts

@@ -6357,7 +6357,8 @@ Common options:
   --daemon-url <url>   Open Design daemon HTTP base.
   --deployment-credential
                        Use the daemon-managed deployment credential with the
-                       BYOK OpenCode agent; no browser credential is sent.
+                       BYOK OpenCode agent; requires --model <id> and sends no
+                       browser credential.
   --json               Emit raw JSON.`);
     process.exit(args.length === 0 ? 2 : 0);
   }
@@ -6564,6 +6565,10 @@ Common options:
           console.error('--deployment-credential requires --agent byok-opencode when --agent is set');
           process.exit(2);
         }
+        if (!flags.model) {
+          console.error('--deployment-credential requires --model <id>');
+          process.exit(2);
+        }
         body.agentId = 'byok-opencode';
         body.byokCredentialSource = 'deployment';
       }

apps/daemon/tests/run-cli.test.ts

@@ -117,6 +117,8 @@ describe('od run CLI', () => {
       '--message',
       'Build the settings screen',
       '--deployment-credential',
+      '--model',
+      'gpt-5.4-mini',
       '--json',
       '--daemon-url',
       stub.baseUrl,
@@ -132,16 +134,37 @@ describe('od run CLI', () => {
       projectId: 'project-1',
       message: 'Build the settings screen',
       agentId: 'byok-opencode',
+      model: 'gpt-5.4-mini',
       byokCredentialSource: 'deployment',
     });
   });
 
+  it('rejects a deployment credential run without an explicit model', async () => {
+    stub = await startRunStubServer(true);
+
+    const result = await runCli([
+      'run',
+      'start',
+      '--project',
+      'project-1',
+      '--deployment-credential',
+      '--json',
+      '--daemon-url',
+      stub.baseUrl,
+    ]);
+
+    expect(result.code).toBe(2);
+    expect(result.stderr).toContain('--deployment-credential requires --model <id>');
+    expect(stub.requests).toEqual([]);
+  });
+
   it('documents the deployment credential selector in run help', async () => {
     const result = await runCli(['run', '--help']);
 
     expect(result.code).toBe(0);
     expect(result.stdout).toContain('--deployment-credential');
     expect(result.stdout).toContain('BYOK OpenCode agent');
+    expect(result.stdout).toContain('requires --model <id>');
   });
 
   it('continues a resumable run through the normal run creation API', async () => {

apps/web/src/providers/daemon.ts

@@ -31,7 +31,6 @@ import type {
   DaemonAgentPayload,
   AmrModelsResponse,
   AmrWalletSnapshot,
-  ByokChatProviderConfig,
   MediaExecutionPolicy,
   ResearchOptions,
   RunContextSelection,
@@ -312,7 +311,7 @@ export interface DaemonStreamOptions {
   model?: string | null;
   reasoning?: string | null;
   serviceTier?: string | null;
-  byokProvider?: ByokChatProviderConfig;
+  byokProvider?: ChatRequest['byokProvider'];
   /** Selects the daemon-managed deployment provider without exposing its secret. */
   byokCredentialSource?: 'deployment';
   byokMediaDefaults?: ChatRequest['byokMediaDefaults'];

packages/contracts/src/api/chat.ts

@@ -113,7 +113,7 @@ export interface ChatRequest {
    * adapter. The daemon must not persist this object; it is translated into
    * child env + OPENCODE_CONFIG_CONTENT for the current run only.
    */
-  byokProvider?: ByokChatProviderConfig;
+  byokProvider?: UserByokChatProviderConfig;
   /**
    * Selects the administrator-managed deployment provider for a BYOK OpenCode
    * run. This is deliberately a discriminator only: no credential or endpoint

packages/contracts/tests/chat-request-types.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+
+import type { ChatRequest } from '../src/api/chat.js';
+
+describe('ChatRequest BYOK credential boundary', () => {
+  it('keeps deployment selection out of the run-scoped provider object', () => {
+    const userProvider: NonNullable<ChatRequest['byokProvider']> = {
+      protocol: 'openai',
+      apiKey: 'run-scoped-secret',
+    };
+
+    const nestedDeployment: NonNullable<ChatRequest['byokProvider']> = {
+      protocol: 'openai',
+      // @ts-expect-error Deployment selection belongs in byokCredentialSource.
+      credentialSource: 'deployment',
+    };
+
+    expect(userProvider.credentialSource).toBeUndefined();
+    expect(nestedDeployment.credentialSource).toBe('deployment');
+  });
+});