Merge origin/main into feat/workspace-team

# Conflicts:
#	apps/daemon/src/routes/runs.ts
#	apps/daemon/tests/chat-route.test.ts
#	apps/packaged/src/index.ts
#	apps/packaged/src/protocol.ts
#	apps/packaged/tests/protocol.test.ts
#	apps/web/src/App.tsx
#	apps/web/src/components/SettingsDialog.tsx
#	apps/web/src/state/config.ts
#	apps/web/tests/components/SettingsDialog.execution.test.tsx
#	e2e/ui/project-management-flows.test.ts

Author: lefarcen

apps/daemon/src/byok/credential-service.ts

@@ -13,7 +13,6 @@ import { DESIGN_SYSTEMS_USAGE, isDesignSystemsHelpArg } from './cli-help/index.j
 import { BRAND_USAGE, isBrandHelpArg } from './cli-help/index.js';
 import { parseDesignSystemRenameArgs } from './design-systems/rename-args.js';
 import { runLiveArtifactsToolCli } from './tools-live-artifacts-cli.js';
-import { runByokToolCli } from './tools-byok-cli.js';
 import { splitResearchSubcommand } from './research/cli-args.js';
 import { resolveDaemonUrl } from './daemon-url.js';
 import { requestJsonIpc } from '@open-design/sidecar';
@@ -372,7 +371,6 @@ const SUBCOMMAND_MAP = {
   artifacts: runArtifacts,
   media: runMedia,
   mcp: runMcp,
-  byok: runByok,
   amr: runAmr,
   collab: runCollab,
   'message-center': runMessageCenter,
@@ -1844,15 +1842,6 @@ artifact / message body. The daemon writes the bytes into the project's
 files folder so the FileViewer can preview them immediately.`);
 }
 
-// ---------------------------------------------------------------------------
-// Subcommand: od byok
-// ---------------------------------------------------------------------------
-
-async function runByok(args) {
-  const result = await runByokToolCli(args);
-  if (result.exitCode !== 0) process.exit(result.exitCode);
-}
-
 // ---------------------------------------------------------------------------
 // Subcommand: od mcp
 // ---------------------------------------------------------------------------

apps/daemon/src/cli.ts

@@ -51,7 +51,7 @@ const BRIEF_COPY: Record<LocalMcpBriefLocale, LocalizedBriefCopy> = {
     artifactNames: ENGLISH_ARTIFACT_NAMES,
     title: (artifactName) => `Choose the ${artifactName} direction`,
     description:
-      'Choose one option for each decision. The same readable brief can be used with Open Design Cloud, Local Codex, or Secure BYOK.',
+      'Choose one option for each decision. The same readable brief can be used with Open Design Cloud or Local Codex.',
     submitLabel: 'Confirm brief',
     completeCard:
       'Complete the rendered Open Design brief card. The confirmation returns a readable summary; internal correlation values must remain hidden.',

apps/daemon/src/mcp-brief.ts

@@ -147,19 +147,30 @@ export function validateExternalPluginContext(
   };
 }
 
-export function validatePluginWorkflowId(value: unknown): string {
+function validateCanonicalPluginCorrelationId(
+  value: unknown,
+  fieldName: 'pluginWorkflowId' | 'requestId',
+): string {
   if (
     typeof value !== 'string'
     || value.length > 64
     || !WORKFLOW_ID_PATTERN.test(value)
   ) {
     throw pluginContractError(
-      'pluginWorkflowId must be a canonical UUID or ULID',
+      `${fieldName} must be a canonical UUID or ULID`,
     );
   }
   return value;
 }
 
+export function validatePluginWorkflowId(value: unknown): string {
+  return validateCanonicalPluginCorrelationId(value, 'pluginWorkflowId');
+}
+
+export function validatePluginRequestId(value: unknown): string {
+  return validateCanonicalPluginCorrelationId(value, 'requestId');
+}
+
 export function mapMcpHostProduct(
   clientInfo: { name?: unknown; version?: unknown } | null | undefined,
 ): AnalyticsHostProduct {