@shipfox/api-agent 12.2.0 → 13.1.0

package/src/core/resolve-agent-config.ts

@@ -5,14 +5,17 @@ import {
   DEFAULT_HARNESS,
   getHarnessDescriptor,
   type Harness,
+  type ManagedModelEntry,
+  type ManagedModelProvider,
   type ModelProviderRef,
-  type SupportedModelProviderId,
+  type WorkspaceProvidersPolicy,
 } from '@shipfox/api-agent-dto';
 import {
   InvalidAgentModelError,
   UnsupportedHarnessProviderError,
   UnsupportedHarnessThinkingError,
   UnsupportedModelProviderError,
+  WorkspaceProvidersDisabledError,
 } from './errors.js';
 import {listHarnessProviderModels} from './harness/index.js';
 import {getModelProviderEntry} from './model-provider-policy.js';
@@ -38,9 +41,11 @@ export interface AgentConfigResolutionContext {
   readonly workspaceDefaultHarnessId?: Harness | null | undefined;
   readonly workspaceDefaultProviderId?: ModelProviderRef | null | undefined;
   readonly workspaceProviderConfigs?: ReadonlyMap<ModelProviderRef, WorkspaceProviderDefaults>;
-  readonly instanceDefaultProvider?: SupportedModelProviderId | undefined;
+  readonly instanceDefaultProvider?: ModelProviderRef | undefined;
   readonly instanceDefaultModel?: string | undefined;
   readonly instanceDefaultThinking?: AgentThinking | undefined;
+  readonly managedProvider?: ManagedModelProvider | undefined;
+  readonly workspaceProviders?: WorkspaceProvidersPolicy | undefined;
 }
 
 interface WorkspaceProviderDefaults {
@@ -50,6 +55,15 @@ interface WorkspaceProviderDefaults {
   readonly models?: readonly CustomAgentModelDto[] | null | undefined;
 }
 
+interface ManagedProviderDefaults {
+  readonly kind: 'managed';
+  readonly defaultModel: string;
+  readonly defaultThinking?: AgentThinking | undefined;
+  readonly models: readonly ManagedModelEntry[];
+}
+
+type ProviderDefaults = WorkspaceProviderDefaults | ManagedProviderDefaults;
+
 type ModelCandidateResolver = () => string | null | undefined;
 
 export function resolveAgentConfig(
@@ -58,15 +72,15 @@ export function resolveAgentConfig(
 ): ResolvedAgentConfig {
   const harness = step.harness ?? ctx.workspaceDefaultHarnessId ?? DEFAULT_HARNESS;
   const provider = resolveProvider(step, ctx, harness);
-  const workspaceProviderConfig = ctx.workspaceProviderConfigs?.get(provider);
+  const providerConfig = getProviderConfig(provider, ctx);
   const model = resolveModel({
     step,
     ctx,
     harness,
     provider,
-    workspaceProviderConfig,
+    providerConfig,
   });
-  const thinking = resolveThinking({step, ctx, harness, provider, workspaceProviderConfig});
+  const thinking = resolveThinking({step, ctx, harness, provider, providerConfig});
 
   return {harness, provider, model, thinking};
 }
@@ -80,13 +94,35 @@ function resolveProvider(
   harness: Harness,
 ): ModelProviderRef {
   const descriptor = getHarnessDescriptor(harness);
+  if (ctx.workspaceProviders === 'disabled') {
+    const managedProvider = ctx.managedProvider;
+    if (managedProvider === undefined) {
+      throw new Error(
+        'workspace provider configuration is disabled but no managed provider is registered',
+      );
+    }
+    if (step.provider !== undefined && step.provider !== managedProvider.id) {
+      throw new WorkspaceProvidersDisabledError(managedProvider.id);
+    }
+
+    const providerConfig = getProviderConfig(managedProvider.id, ctx);
+    if (!isHarnessCompatible(harness, managedProvider.id, providerConfig)) {
+      throw new UnsupportedHarnessProviderError(
+        harness,
+        managedProvider.id,
+        supportedProviderIds(harness, descriptor, ctx),
+      );
+    }
+    return managedProvider.id;
+  }
+
   if (step.provider !== undefined) {
     const provider = resolveSupportedProvider(step.provider, ctx);
-    if (!isHarnessCompatible(harness, provider, ctx.workspaceProviderConfigs?.get(provider))) {
+    if (!isHarnessCompatible(harness, provider, getProviderConfig(provider, ctx))) {
       throw new UnsupportedHarnessProviderError(
         harness,
         step.provider,
-        descriptor.supportedProviderIds,
+        supportedProviderIds(harness, descriptor, ctx),
       );
     }
     return provider;
@@ -100,8 +136,8 @@ function resolveProvider(
   for (const candidate of candidates) {
     if (candidate === undefined || candidate === null) continue;
 
-    const workspaceProviderConfig = ctx.workspaceProviderConfigs?.get(candidate);
-    if (!isHarnessCompatible(harness, candidate, workspaceProviderConfig)) continue;
+    const providerConfig = getProviderConfig(candidate, ctx);
+    if (!isHarnessCompatible(harness, candidate, providerConfig)) continue;
 
     return resolveSupportedProvider(candidate, ctx);
   }
@@ -113,6 +149,8 @@ function resolveSupportedProvider(
   provider: string,
   ctx: AgentConfigResolutionContext,
 ): ModelProviderRef {
+  if (ctx.managedProvider?.id === provider) return provider;
+
   const workspaceProviderConfig = ctx.workspaceProviderConfigs?.get(provider);
   if (workspaceProviderConfig?.kind === 'custom') return provider;
 
@@ -120,7 +158,7 @@ function resolveSupportedProvider(
   if (entry === undefined || entry.support_status !== 'supported') {
     throw new UnsupportedModelProviderError(provider);
   }
-  return provider as SupportedModelProviderId;
+  return provider;
 }
 
 function resolveModel(params: {
@@ -128,23 +166,30 @@ function resolveModel(params: {
   ctx: AgentConfigResolutionContext;
   harness: Harness;
   provider: ModelProviderRef;
-  workspaceProviderConfig: WorkspaceProviderDefaults | undefined;
+  providerConfig: ProviderDefaults | undefined;
 }): string {
+  const providerConfig = params.providerConfig;
+
   if (params.step.model !== undefined) {
-    validateModel(
-      params.harness,
-      params.provider,
-      params.step.model,
-      params.workspaceProviderConfig,
-    );
+    validateModel(params.harness, params.provider, params.step.model, params.providerConfig);
     return params.step.model;
   }
 
-  const candidates: ModelCandidateResolver[] = [() => params.workspaceProviderConfig?.defaultModel];
-  if (params.workspaceProviderConfig?.kind === 'custom') {
-    candidates.push(() => customDefaultModel(params.workspaceProviderConfig));
+  const candidates: ModelCandidateResolver[] = [];
+  if (providerConfig?.kind === 'custom') {
+    candidates.push(
+      () => providerConfig.defaultModel,
+      () => customDefaultModel(providerConfig),
+    );
+  } else if (providerConfig?.kind === 'managed') {
+    candidates.push(
+      () => instanceDefaultModel(params.provider, params.ctx),
+      () => providerConfig.defaultModel,
+      () => managedDefaultModel(params.harness, providerConfig),
+    );
   } else {
     candidates.push(
+      () => providerConfig?.defaultModel,
       () => instanceDefaultModel(params.provider, params.ctx),
       () => catalogDefaultModel(params.harness, params.provider),
     );
@@ -153,9 +198,7 @@ function resolveModel(params: {
   for (const resolveCandidate of candidates) {
     const candidate = resolveCandidate();
     if (candidate === undefined || candidate === null) continue;
-    if (
-      modelIsAvailable(params.harness, params.provider, candidate, params.workspaceProviderConfig)
-    ) {
+    if (modelIsAvailable(params.harness, params.provider, candidate, params.providerConfig)) {
       return candidate;
     }
   }
@@ -164,7 +207,7 @@ function resolveModel(params: {
 }
 
 function catalogDefaultModel(harness: Harness, provider: ModelProviderRef): string {
-  const catalogModels = listProviderModels(harness, provider);
+  const catalogModels = listProviderModels(harness, provider, undefined);
   const entry = getModelProviderEntry(provider);
   if (entry === undefined || entry.support_status !== 'supported') {
     throw new UnsupportedModelProviderError(provider);
@@ -195,20 +238,25 @@ function instanceDefaultThinking(
   return provider === ctx.instanceDefaultProvider ? ctx.instanceDefaultThinking : undefined;
 }
 
-function customDefaultModel(
-  workspaceProviderConfig: WorkspaceProviderDefaults | undefined,
+function customDefaultModel(providerConfig: ProviderDefaults | undefined): string | undefined {
+  if (providerConfig?.kind !== 'custom') return undefined;
+  return providerConfig.models?.[0]?.id;
+}
+
+function managedDefaultModel(
+  harness: Harness,
+  providerConfig: ManagedProviderDefaults,
 ): string | undefined {
-  if (workspaceProviderConfig?.kind !== 'custom') return undefined;
-  return workspaceProviderConfig.models?.[0]?.id;
+  return listManagedProviderModels(harness, providerConfig)[0]?.id;
 }
 
 function validateModel(
   harness: Harness,
   provider: ModelProviderRef,
   model: string,
-  workspaceProviderConfig: WorkspaceProviderDefaults | undefined,
+  providerConfig: ProviderDefaults | undefined,
 ): void {
-  if (modelIsAvailable(harness, provider, model, workspaceProviderConfig)) return;
+  if (modelIsAvailable(harness, provider, model, providerConfig)) return;
   throw new InvalidAgentModelError(harness, provider, model);
 }
 
@@ -216,25 +264,37 @@ function modelIsAvailable(
   harness: Harness,
   provider: ModelProviderRef,
   model: string,
-  workspaceProviderConfig: WorkspaceProviderDefaults | undefined,
+  providerConfig: ProviderDefaults | undefined,
 ): boolean {
-  if (workspaceProviderConfig?.kind === 'custom') {
-    return workspaceProviderConfig.models?.some((candidate) => candidate.id === model) ?? false;
+  if (providerConfig?.kind === 'custom') {
+    return providerConfig.models?.some((candidate) => candidate.id === model) ?? false;
   }
 
-  return listProviderModels(harness, provider).some((candidate) => candidate.id === model);
+  return listProviderModels(harness, provider, providerConfig).some(
+    (candidate) => candidate.id === model,
+  );
 }
 
-function listProviderModels(harness: Harness, provider: ModelProviderRef): readonly {id: string}[] {
+function listProviderModels(
+  harness: Harness,
+  provider: ModelProviderRef,
+  providerConfig: ProviderDefaults | undefined,
+): readonly {id: string}[] {
+  if (providerConfig?.kind === 'managed') {
+    return listManagedProviderModels(harness, providerConfig);
+  }
   return listHarnessProviderModels(harness, provider);
 }
 
 function isHarnessCompatible(
   harness: Harness,
   provider: ModelProviderRef,
-  workspaceProviderConfig: WorkspaceProviderDefaults | undefined,
+  providerConfig: ProviderDefaults | undefined,
 ): boolean {
-  if (workspaceProviderConfig?.kind === 'custom') return harness === 'pi';
+  if (providerConfig?.kind === 'custom') return harness === 'pi';
+  if (providerConfig?.kind === 'managed') {
+    return listManagedProviderModels(harness, providerConfig).length > 0;
+  }
 
   return getHarnessDescriptor(harness).supportedProviderIds.includes(provider);
 }
@@ -244,7 +304,7 @@ function resolveThinking(params: {
   ctx: AgentConfigResolutionContext;
   harness: Harness;
   provider: ModelProviderRef;
-  workspaceProviderConfig: WorkspaceProviderDefaults | undefined;
+  providerConfig: ProviderDefaults | undefined;
 }): AgentThinking {
   const thinkingSchema = agentThinkingByHarness[params.harness];
   const descriptor = getHarnessDescriptor(params.harness);
@@ -261,14 +321,63 @@ function resolveThinking(params: {
     return parsed.data;
   }
 
-  const candidates = [
-    params.workspaceProviderConfig?.defaultThinking,
-    instanceDefaultThinking(params.provider, params.ctx),
-    descriptor.defaultThinking,
-  ];
+  const candidates =
+    params.providerConfig?.kind === 'managed'
+      ? [
+          instanceDefaultThinking(params.provider, params.ctx),
+          params.providerConfig.defaultThinking,
+          descriptor.defaultThinking,
+        ]
+      : [
+          params.providerConfig?.defaultThinking,
+          instanceDefaultThinking(params.provider, params.ctx),
+          descriptor.defaultThinking,
+        ];
   for (const candidate of candidates) {
     if (candidate !== undefined && thinkingSchema.safeParse(candidate).success) return candidate;
   }
 
   return descriptor.defaultThinking;
 }
+
+function getProviderConfig(
+  provider: ModelProviderRef,
+  ctx: AgentConfigResolutionContext,
+): ProviderDefaults | undefined {
+  if (ctx.managedProvider?.id === provider) {
+    return {
+      kind: 'managed',
+      defaultModel: ctx.managedProvider.defaultModel,
+      defaultThinking: ctx.managedProvider.defaultThinking,
+      models: ctx.managedProvider.models,
+    };
+  }
+
+  return ctx.workspaceProviderConfigs?.get(provider);
+}
+
+function listManagedProviderModels(
+  harness: Harness,
+  providerConfig: ManagedProviderDefaults,
+): readonly ManagedModelEntry[] {
+  return providerConfig.models.filter((model) => managedModelSupportsHarness(harness, model));
+}
+
+function managedModelSupportsHarness(harness: Harness, model: ManagedModelEntry): boolean {
+  return harness === 'pi' || model.api === 'anthropic-messages';
+}
+
+function supportedProviderIds(
+  harness: Harness,
+  descriptor: ReturnType<typeof getHarnessDescriptor>,
+  ctx: AgentConfigResolutionContext,
+): readonly string[] {
+  if (
+    ctx.managedProvider === undefined ||
+    !ctx.managedProvider.models.some((model) => managedModelSupportsHarness(harness, model))
+  ) {
+    return descriptor.supportedProviderIds;
+  }
+
+  return [...descriptor.supportedProviderIds, ctx.managedProvider.id];
+}

package/src/core/resolve-runtime-credentials.test.ts

@@ -1,4 +1,4 @@
-import type {ModelProviderRef} from '@shipfox/api-agent-dto';
+import type {ManagedModelProvider, ModelProviderRef} from '@shipfox/api-agent-dto';
 import {deleteModelProviderConfig, upsertModelProviderConfig} from '#db/index.js';
 import {setSecrets} from '#test/fixtures/secrets-client.js';
 import {agentSystemNamespace, customCredentialsToStoreValues} from './credential-fingerprints.js';
@@ -21,6 +21,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = await resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -36,6 +38,86 @@ describe('resolveRuntimeCredentials', () => {
     });
   });
 
+  it('resolves managed provider credentials into the pi custom provider contract', async () => {
+    const runId = crypto.randomUUID();
+    const stepAttemptId = crypto.randomUUID();
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'openai-responses',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId,
+        stepAttemptId,
+        harness: 'pi',
+        provider: 'shipfox',
+        model: 'responses-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(resolveCredentials).toHaveBeenCalledWith({
+      workspaceId,
+      runId,
+      stepAttemptId,
+      model: 'responses-model',
+    });
+    expect(result).toEqual({
+      harness: 'pi',
+      provider_id: 'shipfox',
+      model: 'responses-model',
+      thinking: 'high',
+      credentials: {api_key: 'managed-token'},
+      custom_provider: {
+        api: 'openai-responses',
+        base_url: 'https://gateway.example.test',
+        headers: [],
+        secret_header_names: [],
+        models: [{id: 'responses-model', label: 'Responses model'}],
+        requires_api_key: true,
+      },
+    });
+  });
+
+  it('resolves managed provider credentials into the Claude per-step contract', async () => {
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'anthropic-messages',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'claude',
+        provider: 'shipfox',
+        model: 'claude-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(result).toEqual({
+      harness: 'claude',
+      provider_id: 'shipfox',
+      model: 'claude-model',
+      thinking: 'high',
+      credentials: {api_key: 'managed-token'},
+      claude: {
+        base_url: 'https://gateway.example.test',
+        auth_token: 'managed-token',
+      },
+    });
+  });
+
   it('prefers workspace credentials over the instance fallback', async () => {
     await saveProviderConfig({
       workspaceId,
@@ -45,6 +127,8 @@ describe('resolveRuntimeCredentials', () => {
     const result = await resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'anthropic',
         model: 'claude-opus-4-8',
@@ -60,6 +144,8 @@ describe('resolveRuntimeCredentials', () => {
     const matching = await resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'anthropic',
         model: 'claude-opus-4-8',
@@ -70,6 +156,8 @@ describe('resolveRuntimeCredentials', () => {
     const mismatched = resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'openai',
         model: 'gpt-5.5-pro',
@@ -82,6 +170,55 @@ describe('resolveRuntimeCredentials', () => {
     await expect(mismatched).rejects.toMatchObject({name: 'ModelProviderConfigNotFoundError'});
   });
 
+  it('refuses workspace credentials and instance fallback when workspace providers are disabled', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      credentials: {api_key: 'sk-workspace-secret'},
+    });
+
+    const result = resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {
+        workspaceProviders: 'disabled',
+        runtimeConfig: instanceConfig(),
+      },
+    );
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('reports the managed provider when a foreign runtime provider is requested', async () => {
+    const result = resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {
+        workspaceProviders: 'disabled',
+        managedProvider: managedProvider(vi.fn()),
+      },
+    );
+
+    await expect(result).rejects.toMatchObject({
+      name: 'WorkspaceProvidersDisabledError',
+      managedProviderId: 'shipfox',
+    });
+  });
+
   it('returns custom provider runtime descriptors for custom rows', async () => {
     await saveProviderConfig({
       workspaceId,
@@ -98,6 +235,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = await resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'local-vllm',
       model: 'llama-3.1',
@@ -137,6 +276,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = await resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'local-ollama',
       model: 'llama-3.1',
@@ -155,6 +296,8 @@ describe('resolveRuntimeCredentials', () => {
   it('throws when no workspace or instance credential is available', async () => {
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -174,6 +317,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -193,6 +338,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -217,6 +364,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'cloudflare-ai-gateway',
       model: '@cf/meta/llama-3.1-8b-instruct',
@@ -235,6 +384,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -256,6 +407,8 @@ describe('resolveRuntimeCredentials', () => {
     const result = resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'anthropic',
         model: 'claude-opus-4-8',
@@ -314,3 +467,18 @@ function instanceConfig() {
     AGENT_DEFAULT_PROVIDER_API_KEY: 'sk-instance-secret',
   };
 }
+
+function managedProvider(
+  resolveCredentials: ManagedModelProvider['resolveCredentials'],
+): ManagedModelProvider {
+  return {
+    id: 'shipfox',
+    label: 'Shipfox',
+    models: [
+      {id: 'claude-model', label: 'Claude model', api: 'anthropic-messages'},
+      {id: 'responses-model', label: 'Responses model', api: 'openai-responses'},
+    ],
+    defaultModel: 'responses-model',
+    resolveCredentials,
+  };
+}