@shipfox/api-agent 12.0.0 → 13.1.0

package/src/core/resolve-runtime-credentials.ts

@@ -2,12 +2,15 @@ import type {
   AgentRuntimeCredentialsResponseDto,
   AgentThinking,
   Harness,
+  ManagedModelProvider,
+  ManagedProviderRuntimeConfig,
   ModelProviderRef,
   SupportedModelProviderId,
+  WorkspaceProvidersPolicy,
 } from '@shipfox/api-agent-dto';
 import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
 import {isInterModuleKnownError} from '@shipfox/inter-module';
-import {config} from '#config.js';
+import {config, workspaceProvidersPolicy} from '#config.js';
 import {getModelProviderConfig} from '#db/index.js';
 import {agentRuntimeConfigResolvedCount} from '#metrics/index.js';
 import {
@@ -16,12 +19,14 @@ import {
   storeValuesToRuntimeCredentials,
 } from './credential-fingerprints.js';
 import type {ModelProviderConfig} from './entities/model-provider-config.js';
-import {ModelProviderConfigNotFoundError} from './errors.js';
+import {ModelProviderConfigNotFoundError, WorkspaceProvidersDisabledError} from './errors.js';
 import {getModelProviderEntry, modelProviderCredentialKeysMatch} from './model-provider-policy.js';
 import {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';
 
 export interface ResolveRuntimeCredentialsParams {
   workspaceId: string;
+  runId: string;
+  stepAttemptId: string;
   harness: Harness;
   provider: ModelProviderRef;
   model: string;
@@ -29,13 +34,15 @@ export interface ResolveRuntimeCredentialsParams {
 }
 
 interface RuntimeCredentialsConfig {
-  AGENT_DEFAULT_PROVIDER?: SupportedModelProviderId | undefined;
+  AGENT_DEFAULT_PROVIDER?: ModelProviderRef | undefined;
   AGENT_DEFAULT_PROVIDER_API_KEY?: string | undefined;
 }
 
 interface ResolveRuntimeCredentialsOptions {
   runtimeConfig?: RuntimeCredentialsConfig | undefined;
+  workspaceProviders?: WorkspaceProvidersPolicy | undefined;
   secrets?: AgentSecretsClient | undefined;
+  managedProvider?: ManagedModelProvider | undefined;
   getCredentialBag?:
     | ((params: {workspaceId: string; namespace: string}) => Promise<Record<string, string>>)
     | undefined;
@@ -46,7 +53,34 @@ export async function resolveRuntimeCredentials(
   options?: ResolveRuntimeCredentialsOptions,
 ): Promise<AgentRuntimeCredentialsResponseDto> {
   const runtimeConfig = options?.runtimeConfig ?? config;
+  const configuredWorkspaceProviders = options?.workspaceProviders ?? workspaceProvidersPolicy;
   const secrets = options?.secrets;
+  const managedProvider = options?.managedProvider;
+  if (managedProvider?.id === params.provider) {
+    const managedRuntimeConfig = await managedProvider.resolveCredentials({
+      workspaceId: params.workspaceId,
+      runId: params.runId,
+      stepAttemptId: params.stepAttemptId,
+      model: params.model,
+    });
+    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});
+    return toResponse(params, managedRuntimeConfig.credentials, undefined, {
+      provider: managedProvider,
+      runtimeConfig: managedRuntimeConfig,
+    });
+  }
+
+  if (configuredWorkspaceProviders === 'disabled') {
+    agentRuntimeConfigResolvedCount.add(1, {
+      source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',
+      outcome: 'unavailable',
+    });
+    if (managedProvider !== undefined) {
+      throw new WorkspaceProvidersDisabledError(managedProvider.id);
+    }
+    throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);
+  }
+
   const providerConfig = await getModelProviderConfig({
     workspaceId: params.workspaceId,
     providerId: params.provider,
@@ -133,6 +167,12 @@ function toResponse(
   params: ResolveRuntimeCredentialsParams,
   credentials: Record<string, string>,
   providerConfig?: ModelProviderConfig | undefined,
+  managed?:
+    | {
+        provider: ManagedModelProvider;
+        runtimeConfig: ManagedProviderRuntimeConfig;
+      }
+    | undefined,
 ): AgentRuntimeCredentialsResponseDto {
   const response: AgentRuntimeCredentialsResponseDto = {
     harness: params.harness,
@@ -156,5 +196,30 @@ function toResponse(
     };
   }
 
+  if (managed !== undefined) {
+    const model = managed.provider.models.find((candidate) => candidate.id === params.model);
+    const modelDescriptor = {id: params.model, label: model?.label ?? params.model};
+
+    if (params.harness === 'pi') {
+      response.custom_provider = {
+        api: managed.runtimeConfig.api,
+        base_url: managed.runtimeConfig.baseUrl,
+        headers: [],
+        secret_header_names: [],
+        models: [modelDescriptor],
+        requires_api_key: true,
+      };
+    } else {
+      const authToken = managed.runtimeConfig.credentials.api_key;
+      if (authToken === undefined) {
+        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);
+      }
+      response.claude = {
+        base_url: managed.runtimeConfig.baseUrl,
+        auth_token: authToken,
+      };
+    }
+  }
+
   return response;
 }

package/src/core/validation-catalog.test.ts

@@ -1,3 +1,4 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
 import {getAgentValidationCatalog} from './validation-catalog.js';
 
 describe('getAgentValidationCatalog', () => {
@@ -13,4 +14,57 @@ describe('getAgentValidationCatalog', () => {
     expect(pi?.model_ids_by_provider?.openai).toContain('gpt-5.5-pro');
     expect(claude?.model_ids_by_provider?.anthropic).toContain('claude-opus-4-8');
   });
+
+  it('includes injected managed providers with harness-compatible models', () => {
+    const managedProvider = {
+      id: 'shipfox-managed',
+      label: 'Shipfox Managed',
+      models: [
+        {id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages' as const},
+        {id: 'managed-responses', label: 'Managed Responses', api: 'openai-responses' as const},
+      ],
+      defaultModel: 'managed-claude',
+      resolveCredentials: async () => ({
+        api: 'anthropic-messages' as const,
+        baseUrl: 'https://gateway.example.com',
+        credentials: {api_key: 'token'},
+      }),
+    } satisfies ManagedModelProvider;
+
+    const catalog = getAgentValidationCatalog(managedProvider);
+    const pi = catalog.harnesses.find((harness) => harness.id === 'pi');
+    const claude = catalog.harnesses.find((harness) => harness.id === 'claude');
+
+    expect(catalog.providers).toContainEqual({id: managedProvider.id, support_status: 'supported'});
+    expect(pi?.supported_provider_ids).toContain(managedProvider.id);
+    expect(pi?.model_ids_by_provider?.[managedProvider.id]).toEqual([
+      'managed-claude',
+      'managed-responses',
+    ]);
+    expect(claude?.supported_provider_ids).toContain(managedProvider.id);
+    expect(claude?.model_ids_by_provider?.[managedProvider.id]).toEqual(['managed-claude']);
+  });
+
+  it('exposes only the managed provider when workspace providers are disabled', () => {
+    const managedProvider = {
+      id: 'shipfox-managed',
+      label: 'Shipfox Managed',
+      models: [{id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages' as const}],
+      defaultModel: 'managed-claude',
+      resolveCredentials: async () => ({
+        api: 'anthropic-messages' as const,
+        baseUrl: 'https://gateway.example.com',
+        credentials: {api_key: 'token'},
+      }),
+    } satisfies ManagedModelProvider;
+
+    const catalog = getAgentValidationCatalog(managedProvider, 'disabled');
+
+    expect(catalog.providers).toEqual([{id: managedProvider.id, support_status: 'supported'}]);
+    expect(
+      catalog.harnesses.every((harness) =>
+        harness.supported_provider_ids.every((providerId) => providerId === managedProvider.id),
+      ),
+    ).toBe(true);
+  });
 });

package/src/core/validation-catalog.ts

@@ -1,3 +1,8 @@
+import type {
+  HarnessDescriptor,
+  ManagedModelProvider,
+  WorkspaceProvidersPolicy,
+} from '@shipfox/api-agent-dto';
 import {
   listEnabledHarnessTools,
   listHarnessDescriptors,
@@ -8,27 +13,127 @@ import {harnessToolDeploymentConfig} from '#config.js';
 import {listHarnessProviderModels} from './harness/index.js';
 import {getModelProviderEntry} from './model-provider-policy.js';
 
+type HarnessValidationCatalog = AgentValidationCatalog['harnesses'][number];
+
 /** Produces the versioned, JSON-safe policy snapshot consumed by Definitions. */
-export function getAgentValidationCatalog(): AgentValidationCatalog {
+export function getAgentValidationCatalog(
+  managedProvider?: ManagedModelProvider | undefined,
+  workspaceProviders: WorkspaceProvidersPolicy = 'enabled',
+): AgentValidationCatalog {
+  const managedOnly = workspaceProviders === 'disabled';
+
   return {
     version: 1,
-    providers: MODEL_PROVIDER_IDS.map((id) => ({
-      id,
-      support_status: getModelProviderEntry(id)?.support_status ?? 'unsupported',
-    })),
-    harnesses: listHarnessDescriptors().map((harness) => ({
-      id: harness.id,
-      supported_provider_ids: [...harness.supportedProviderIds],
-      model_ids_by_provider: Object.fromEntries(
-        harness.supportedProviderIds.map((providerId) => [
-          providerId,
-          listHarnessProviderModels(harness.id, providerId).map((model) => model.id),
-        ]),
-      ),
-      thinking_levels: [...harness.thinkingLevels],
-      effective_tools: listEnabledHarnessTools(harness.id, harnessToolDeploymentConfig).map(
-        (tool) => tool.name,
-      ),
-    })),
+    providers: buildValidationProviders(managedProvider, managedOnly),
+    harnesses: listHarnessDescriptors().map((harness) =>
+      buildHarnessValidationCatalog(harness, managedProvider, managedOnly),
+    ),
+  };
+}
+
+function buildValidationProviders(
+  managedProvider: ManagedModelProvider | undefined,
+  managedOnly: boolean,
+): AgentValidationCatalog['providers'] {
+  const providers: AgentValidationCatalog['providers'] = [];
+
+  if (!managedOnly) {
+    providers.push(
+      ...MODEL_PROVIDER_IDS.map((id) => ({
+        id,
+        support_status: getModelProviderEntry(id)?.support_status ?? 'unsupported',
+      })),
+    );
+  }
+
+  if (managedProvider !== undefined) {
+    providers.push({id: managedProvider.id, support_status: 'supported'});
+  }
+
+  return providers;
+}
+
+function buildHarnessValidationCatalog(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+  managedOnly: boolean,
+): HarnessValidationCatalog {
+  const managedModels = getManagedModelsForHarness(harness, managedProvider);
+
+  return {
+    id: harness.id,
+    supported_provider_ids: buildSupportedProviderIds(
+      harness,
+      managedProvider,
+      managedModels,
+      managedOnly,
+    ),
+    model_ids_by_provider: buildModelIdsByProvider(
+      harness,
+      managedProvider,
+      managedModels,
+      managedOnly,
+    ),
+    thinking_levels: [...harness.thinkingLevels],
+    effective_tools: listEnabledHarnessTools(harness.id, harnessToolDeploymentConfig).map(
+      (tool) => tool.name,
+    ),
   };
 }
+
+function buildSupportedProviderIds(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+  managedModels: ManagedModelProvider['models'],
+  managedOnly: boolean,
+): string[] {
+  if (managedOnly) {
+    if (managedProvider === undefined || managedModels.length === 0) return [];
+    return [managedProvider.id];
+  }
+
+  const providerIds = [...harness.supportedProviderIds];
+  if (managedProvider !== undefined && managedModels.length > 0) {
+    providerIds.push(managedProvider.id);
+  }
+  return providerIds;
+}
+
+function buildModelIdsByProvider(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+  managedModels: ManagedModelProvider['models'],
+  managedOnly: boolean,
+): Record<string, string[]> {
+  const modelIdsByProvider: Record<string, string[]> = {};
+
+  if (!managedOnly) {
+    for (const providerId of harness.supportedProviderIds) {
+      modelIdsByProvider[providerId] = listHarnessProviderModels(harness.id, providerId).map(
+        (model) => model.id,
+      );
+    }
+  }
+
+  if (managedProvider !== undefined) {
+    modelIdsByProvider[managedProvider.id] = managedModels.map((model) => model.id);
+  }
+
+  return modelIdsByProvider;
+}
+
+function getManagedModelsForHarness(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+): ManagedModelProvider['models'] {
+  if (managedProvider === undefined) return [];
+  return managedModelsForHarness(harness.id, managedProvider);
+}
+
+function managedModelsForHarness(
+  harness: 'pi' | 'claude',
+  managedProvider: ManagedModelProvider,
+): ManagedModelProvider['models'] {
+  if (harness === 'pi') return managedProvider.models;
+  return managedProvider.models.filter((model) => model.api === 'anthropic-messages');
+}

package/src/core/workspace-agent-defaults-resolver.ts

@@ -1,7 +1,8 @@
 import type {
   AgentThinking,
+  ManagedModelProvider,
   ModelProviderRef,
-  SupportedModelProviderId,
+  WorkspaceProvidersPolicy,
 } from '@shipfox/api-agent-dto';
 import {config} from '#config.js';
 import {getAgentWorkspaceDefaultsSnapshot} from '#db/index.js';
@@ -10,6 +11,8 @@ import {resolveAgentConfig} from './resolve-agent-config.js';
 
 export async function createWorkspaceAgentDefaultsResolver(
   workspaceId: string,
+  managedProvider?: ManagedModelProvider | undefined,
+  workspaceProviders?: WorkspaceProvidersPolicy | undefined,
 ): Promise<AgentDefaultsResolver> {
   const snapshot = await getAgentWorkspaceDefaultsSnapshot(workspaceId);
   const workspaceProviderConfigs = new Map<
@@ -33,9 +36,11 @@ export async function createWorkspaceAgentDefaultsResolver(
     workspaceDefaultHarnessId: snapshot.defaultHarnessId ?? null,
     workspaceDefaultProviderId: snapshot.defaultProviderId ?? null,
     workspaceProviderConfigs,
-    instanceDefaultProvider: config.AGENT_DEFAULT_PROVIDER as SupportedModelProviderId | undefined,
+    instanceDefaultProvider: config.AGENT_DEFAULT_PROVIDER,
     instanceDefaultModel: config.AGENT_DEFAULT_PROVIDER_MODEL,
     instanceDefaultThinking: config.AGENT_DEFAULT_PROVIDER_THINKING as AgentThinking | undefined,
+    managedProvider,
+    workspaceProviders,
   };
 
   return (step) => resolveAgentConfig(step, ctx);

package/src/core/workspace-provider-policy.ts

@@ -0,0 +1,19 @@
+import type {WorkspaceProvidersPolicy} from '@shipfox/api-agent-dto';
+import {WorkspaceProvidersDisabledError} from './errors.js';
+
+export interface WorkspaceProviderPolicyOptions {
+  readonly workspaceProviders: WorkspaceProvidersPolicy;
+  readonly managedProviderId?: string | undefined;
+}
+
+export function assertWorkspaceProviderConfigurationEnabled(
+  options: WorkspaceProviderPolicyOptions,
+): void {
+  if (options.workspaceProviders !== 'disabled') return;
+  if (options.managedProviderId === undefined) {
+    throw new Error(
+      'workspace provider configuration is disabled but no managed provider is registered',
+    );
+  }
+  throw new WorkspaceProvidersDisabledError(options.managedProviderId);
+}

package/src/index.ts

@@ -1,4 +1,6 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
 import type {ShipfoxModule} from '@shipfox/node-module';
+import {assertAgentConfig, workspaceProvidersPolicy} from '#config.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {db, migrationsPath} from '#db/index.js';
 import {createAgentE2eRoutes} from '#presentation/e2eRoutes/index.js';
@@ -33,6 +35,7 @@ export {
   testAndSaveModelProviderConfig,
   UnsupportedModelProviderError,
   updateCustomModelProviderConfig,
+  WorkspaceProvidersDisabledError,
 } from '#core/index.js';
 export {
   getAgentWorkspaceSettings,
@@ -42,12 +45,30 @@ export {
   upsertModelProviderConfig,
 } from '#db/index.js';
 
-export function createAgentModule(params: {secrets: AgentSecretsClient}): ShipfoxModule {
+export function createAgentModule(params: {
+  secrets: AgentSecretsClient;
+  managedProvider?: ManagedModelProvider | undefined;
+}): ShipfoxModule {
+  assertAgentConfig(params.managedProvider);
+
   return {
     name: 'agent',
     database: {db, migrationsPath, databaseNamespace: 'agent'},
-    routes: createAgentRoutes(params.secrets),
-    e2eRoutes: [createAgentE2eRoutes(params.secrets)],
-    interModulePresentations: [createAgentInterModulePresentation(params)],
+    routes: createAgentRoutes(params.secrets, {
+      managedProvider: params.managedProvider,
+      workspaceProviders: workspaceProvidersPolicy,
+    }),
+    e2eRoutes: [
+      createAgentE2eRoutes(params.secrets, {
+        managedProviderId: params.managedProvider?.id,
+        workspaceProviders: workspaceProvidersPolicy,
+      }),
+    ],
+    interModulePresentations: [
+      createAgentInterModulePresentation({
+        ...params,
+        workspaceProviders: workspaceProvidersPolicy,
+      }),
+    ],
   };
 }

package/src/presentation/e2eRoutes/create-model-provider.ts

@@ -3,9 +3,14 @@ import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {agentSystemNamespace} from '#core/credential-fingerprints.js';
 import {listHarnessProviderModels} from '#core/harness/registry.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  type WorkspaceProviderPolicyOptions,
+} from '#core/index.js';
 import {getModelProviderEntry} from '#core/model-provider-policy.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {upsertModelProviderConfig} from '#db/index.js';
+import {translateModelProviderRouteError} from '#presentation/routes/errors.js';
 
 const createE2eModelProviderBodySchema = z.object({
   workspace_id: z.string().uuid(),
@@ -19,7 +24,10 @@ const createE2eModelProviderResponseSchema = z.object({
   provider_id: z.literal('anthropic'),
 });
 
-export function createE2eModelProviderRoute(secrets: AgentSecretsClient) {
+export function createE2eModelProviderRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'POST',
     path: '/model-provider',
@@ -28,7 +36,9 @@ export function createE2eModelProviderRoute(secrets: AgentSecretsClient) {
       body: createE2eModelProviderBodySchema,
       response: {201: createE2eModelProviderResponseSchema},
     },
+    errorHandler: translateModelProviderRouteError,
     handler: async (request, reply) => {
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
       const entry = getModelProviderEntry(request.body.provider_id);
       if (entry === undefined || entry.default_model === null) {
         throw new ClientError('Unsupported E2E model provider', 'unsupported-model-provider', {

package/src/presentation/e2eRoutes/index.ts

@@ -1,9 +1,16 @@
 import type {RouteGroup} from '@shipfox/node-fastify';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {createE2eModelProviderRoute} from './create-model-provider.js';
 
-export function createAgentE2eRoutes(secrets: AgentSecretsClient): RouteGroup {
-  return {prefix: '/agent', routes: [createE2eModelProviderRoute(secrets)]};
+export function createAgentE2eRoutes(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+): RouteGroup {
+  return {
+    prefix: '/agent',
+    routes: [createE2eModelProviderRoute(secrets, workspaceProviderPolicy)],
+  };
 }
 
 export const agentE2eRoutes = createAgentE2eRoutes(undefined as unknown as AgentSecretsClient);

package/src/presentation/inter-module.test.ts

@@ -0,0 +1,51 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
+import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
+import {agentTestSecretsClient} from '#test/fixtures/secrets-client.js';
+import {createAgentInterModulePresentation} from './inter-module.js';
+
+describe('agent inter-module presentation', () => {
+  test('preserves managed provider policy details for runtime credentials', async () => {
+    const managedProvider: ManagedModelProvider = {
+      id: 'shipfox',
+      label: 'Shipfox',
+      models: [{id: 'managed-model', label: 'Managed model', api: 'openai-responses'}],
+      defaultModel: 'managed-model',
+      resolveCredentials: vi.fn(),
+    };
+    const presentation = createAgentInterModulePresentation({
+      secrets: agentTestSecretsClient,
+      managedProvider,
+      workspaceProviders: 'disabled',
+    });
+    const input = {
+      workspaceId: crypto.randomUUID(),
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
+      harness: 'pi' as const,
+      provider: 'anthropic' as const,
+      model: 'claude-opus-4-8',
+      thinking: 'high' as const,
+    };
+
+    const result = await Promise.resolve(
+      presentation.handlers.resolveRuntimeCredentials(input, {
+        signal: new AbortController().signal,
+      }),
+    ).catch((error: unknown) => error);
+
+    expect(
+      isInterModuleKnownError(agentInterModuleContract.methods.resolveRuntimeCredentials, result),
+    ).toBe(true);
+    if (
+      !isInterModuleKnownError(agentInterModuleContract.methods.resolveRuntimeCredentials, result)
+    ) {
+      throw new Error('Expected a managed provider policy error');
+    }
+    expect(result.code).toBe('workspace-providers-disabled');
+    expect(result.details).toEqual({
+      message: 'This instance only supports provider `shipfox`.',
+      managed_provider_id: 'shipfox',
+    });
+  });
+});

package/src/presentation/inter-module.ts

@@ -1,3 +1,4 @@
+import type {ManagedModelProvider, WorkspaceProvidersPolicy} from '@shipfox/api-agent-dto';
 import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
 import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
 import {
@@ -12,6 +13,7 @@ import {
   UnsupportedHarnessProviderError,
   UnsupportedHarnessThinkingError,
   UnsupportedModelProviderError,
+  WorkspaceProvidersDisabledError,
 } from '#core/errors.js';
 import {resolveAgentConfig} from '#core/resolve-agent-config.js';
 import {resolveRuntimeCredentials} from '#core/resolve-runtime-credentials.js';
@@ -21,15 +23,26 @@ import {createWorkspaceAgentDefaultsResolver} from '#core/workspace-agent-defaul
 
 export function createAgentInterModulePresentation(params: {
   secrets: AgentSecretsClient;
+  managedProvider?: ManagedModelProvider | undefined;
+  workspaceProviders?: WorkspaceProvidersPolicy | undefined;
 }): InterModulePresentation<typeof agentInterModuleContract> {
   return defineInterModulePresentation(agentInterModuleContract, {
-    getValidationCatalog: () => getAgentValidationCatalog(),
+    getValidationCatalog: () =>
+      getAgentValidationCatalog(params.managedProvider, params.workspaceProviders),
     resolveAgentConfig: async ({workspaceId, config}) => {
       try {
         const resolve =
           workspaceId === null
-            ? resolveAgentConfig
-            : await createWorkspaceAgentDefaultsResolver(workspaceId);
+            ? (step: Parameters<typeof resolveAgentConfig>[0]) =>
+                resolveAgentConfig(step, {
+                  managedProvider: params.managedProvider,
+                  workspaceProviders: params.workspaceProviders,
+                })
+            : await createWorkspaceAgentDefaultsResolver(
+                workspaceId,
+                params.managedProvider,
+                params.workspaceProviders,
+              );
         return await resolve(config);
       } catch (error) {
         throw toResolveAgentConfigKnownError(error);
@@ -37,7 +50,11 @@ export function createAgentInterModulePresentation(params: {
     },
     resolveRuntimeCredentials: async (input) => {
       try {
-        return await resolveRuntimeCredentials(input, {secrets: params.secrets});
+        return await resolveRuntimeCredentials(input, {
+          managedProvider: params.managedProvider,
+          secrets: params.secrets,
+          workspaceProviders: params.workspaceProviders,
+        });
       } catch (error) {
         throw toResolveRuntimeCredentialsKnownError(error);
       }
@@ -50,18 +67,33 @@ function toResolveAgentConfigKnownError(error: unknown): unknown {
     error instanceof InvalidAgentModelError ||
     error instanceof UnsupportedHarnessProviderError ||
     error instanceof UnsupportedHarnessThinkingError ||
-    error instanceof UnsupportedModelProviderError
+    error instanceof UnsupportedModelProviderError ||
+    error instanceof WorkspaceProvidersDisabledError
   ) {
     return createInterModuleKnownError(
       agentInterModuleContract.methods.resolveAgentConfig,
       'agent-config-invalid',
-      {},
+      {
+        ...(error instanceof WorkspaceProvidersDisabledError
+          ? {message: error.message, managed_provider_id: error.managedProviderId}
+          : {}),
+      },
     );
   }
   return error;
 }
 
 function toResolveRuntimeCredentialsKnownError(error: unknown): unknown {
+  if (error instanceof WorkspaceProvidersDisabledError) {
+    return createInterModuleKnownError(
+      agentInterModuleContract.methods.resolveRuntimeCredentials,
+      'workspace-providers-disabled',
+      {
+        message: error.message,
+        managed_provider_id: error.managedProviderId,
+      },
+    );
+  }
   if (error instanceof ModelProviderConfigNotFoundError) {
     return createInterModuleKnownError(
       agentInterModuleContract.methods.resolveRuntimeCredentials,

package/src/presentation/routes/create-custom-model-provider.ts

@@ -5,12 +5,19 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {createCustomModelProviderConfig} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  createCustomModelProviderConfig,
+} from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {toCustomModelProviderConfigDto} from '#presentation/dto/index.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export function createCustomModelProviderRoute(secrets: AgentSecretsClient) {
+export function createCustomModelProviderRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'POST',
     path: '/custom-model-providers',
@@ -35,6 +42,7 @@ export function createCustomModelProviderRoute(secrets: AgentSecretsClient) {
       });
 
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const config = await createCustomModelProviderConfig(
         {