@shipfox/api-agent 12.2.0 → 14.0.0

package/src/core/validation-catalog.ts

@@ -1,3 +1,8 @@
+import type {
+  HarnessDescriptor,
+  ManagedModelProvider,
+  WorkspaceProvidersPolicy,
+} from '@shipfox/api-agent-dto';
 import {
   listEnabledHarnessTools,
   listHarnessDescriptors,
@@ -8,27 +13,127 @@ import {harnessToolDeploymentConfig} from '#config.js';
 import {listHarnessProviderModels} from './harness/index.js';
 import {getModelProviderEntry} from './model-provider-policy.js';
 
+type HarnessValidationCatalog = AgentValidationCatalog['harnesses'][number];
+
 /** Produces the versioned, JSON-safe policy snapshot consumed by Definitions. */
-export function getAgentValidationCatalog(): AgentValidationCatalog {
+export function getAgentValidationCatalog(
+  managedProvider?: ManagedModelProvider | undefined,
+  workspaceProviders: WorkspaceProvidersPolicy = 'enabled',
+): AgentValidationCatalog {
+  const managedOnly = workspaceProviders === 'disabled';
+
   return {
     version: 1,
-    providers: MODEL_PROVIDER_IDS.map((id) => ({
-      id,
-      support_status: getModelProviderEntry(id)?.support_status ?? 'unsupported',
-    })),
-    harnesses: listHarnessDescriptors().map((harness) => ({
-      id: harness.id,
-      supported_provider_ids: [...harness.supportedProviderIds],
-      model_ids_by_provider: Object.fromEntries(
-        harness.supportedProviderIds.map((providerId) => [
-          providerId,
-          listHarnessProviderModels(harness.id, providerId).map((model) => model.id),
-        ]),
-      ),
-      thinking_levels: [...harness.thinkingLevels],
-      effective_tools: listEnabledHarnessTools(harness.id, harnessToolDeploymentConfig).map(
-        (tool) => tool.name,
-      ),
-    })),
+    providers: buildValidationProviders(managedProvider, managedOnly),
+    harnesses: listHarnessDescriptors().map((harness) =>
+      buildHarnessValidationCatalog(harness, managedProvider, managedOnly),
+    ),
+  };
+}
+
+function buildValidationProviders(
+  managedProvider: ManagedModelProvider | undefined,
+  managedOnly: boolean,
+): AgentValidationCatalog['providers'] {
+  const providers: AgentValidationCatalog['providers'] = [];
+
+  if (!managedOnly) {
+    providers.push(
+      ...MODEL_PROVIDER_IDS.map((id) => ({
+        id,
+        support_status: getModelProviderEntry(id)?.support_status ?? 'unsupported',
+      })),
+    );
+  }
+
+  if (managedProvider !== undefined) {
+    providers.push({id: managedProvider.id, support_status: 'supported'});
+  }
+
+  return providers;
+}
+
+function buildHarnessValidationCatalog(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+  managedOnly: boolean,
+): HarnessValidationCatalog {
+  const managedModels = getManagedModelsForHarness(harness, managedProvider);
+
+  return {
+    id: harness.id,
+    supported_provider_ids: buildSupportedProviderIds(
+      harness,
+      managedProvider,
+      managedModels,
+      managedOnly,
+    ),
+    model_ids_by_provider: buildModelIdsByProvider(
+      harness,
+      managedProvider,
+      managedModels,
+      managedOnly,
+    ),
+    thinking_levels: [...harness.thinkingLevels],
+    effective_tools: listEnabledHarnessTools(harness.id, harnessToolDeploymentConfig).map(
+      (tool) => tool.name,
+    ),
   };
 }
+
+function buildSupportedProviderIds(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+  managedModels: ManagedModelProvider['models'],
+  managedOnly: boolean,
+): string[] {
+  if (managedOnly) {
+    if (managedProvider === undefined || managedModels.length === 0) return [];
+    return [managedProvider.id];
+  }
+
+  const providerIds = [...harness.supportedProviderIds];
+  if (managedProvider !== undefined && managedModels.length > 0) {
+    providerIds.push(managedProvider.id);
+  }
+  return providerIds;
+}
+
+function buildModelIdsByProvider(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+  managedModels: ManagedModelProvider['models'],
+  managedOnly: boolean,
+): Record<string, string[]> {
+  const modelIdsByProvider: Record<string, string[]> = {};
+
+  if (!managedOnly) {
+    for (const providerId of harness.supportedProviderIds) {
+      modelIdsByProvider[providerId] = listHarnessProviderModels(harness.id, providerId).map(
+        (model) => model.id,
+      );
+    }
+  }
+
+  if (managedProvider !== undefined) {
+    modelIdsByProvider[managedProvider.id] = managedModels.map((model) => model.id);
+  }
+
+  return modelIdsByProvider;
+}
+
+function getManagedModelsForHarness(
+  harness: HarnessDescriptor,
+  managedProvider: ManagedModelProvider | undefined,
+): ManagedModelProvider['models'] {
+  if (managedProvider === undefined) return [];
+  return managedModelsForHarness(harness.id, managedProvider);
+}
+
+function managedModelsForHarness(
+  harness: 'pi' | 'claude',
+  managedProvider: ManagedModelProvider,
+): ManagedModelProvider['models'] {
+  if (harness === 'pi') return managedProvider.models;
+  return managedProvider.models.filter((model) => model.api === 'anthropic-messages');
+}

package/src/core/workspace-agent-defaults-resolver.ts

@@ -1,7 +1,8 @@
 import type {
   AgentThinking,
+  ManagedModelProvider,
   ModelProviderRef,
-  SupportedModelProviderId,
+  WorkspaceProvidersPolicy,
 } from '@shipfox/api-agent-dto';
 import {config} from '#config.js';
 import {getAgentWorkspaceDefaultsSnapshot} from '#db/index.js';
@@ -10,6 +11,8 @@ import {resolveAgentConfig} from './resolve-agent-config.js';
 
 export async function createWorkspaceAgentDefaultsResolver(
   workspaceId: string,
+  managedProvider?: ManagedModelProvider | undefined,
+  workspaceProviders?: WorkspaceProvidersPolicy | undefined,
 ): Promise<AgentDefaultsResolver> {
   const snapshot = await getAgentWorkspaceDefaultsSnapshot(workspaceId);
   const workspaceProviderConfigs = new Map<
@@ -33,9 +36,11 @@ export async function createWorkspaceAgentDefaultsResolver(
     workspaceDefaultHarnessId: snapshot.defaultHarnessId ?? null,
     workspaceDefaultProviderId: snapshot.defaultProviderId ?? null,
     workspaceProviderConfigs,
-    instanceDefaultProvider: config.AGENT_DEFAULT_PROVIDER as SupportedModelProviderId | undefined,
+    instanceDefaultProvider: config.AGENT_DEFAULT_PROVIDER,
     instanceDefaultModel: config.AGENT_DEFAULT_PROVIDER_MODEL,
     instanceDefaultThinking: config.AGENT_DEFAULT_PROVIDER_THINKING as AgentThinking | undefined,
+    managedProvider,
+    workspaceProviders,
   };
 
   return (step) => resolveAgentConfig(step, ctx);

package/src/core/workspace-provider-policy.ts

@@ -0,0 +1,19 @@
+import type {WorkspaceProvidersPolicy} from '@shipfox/api-agent-dto';
+import {WorkspaceProvidersDisabledError} from './errors.js';
+
+export interface WorkspaceProviderPolicyOptions {
+  readonly workspaceProviders: WorkspaceProvidersPolicy;
+  readonly managedProviderId?: string | undefined;
+}
+
+export function assertWorkspaceProviderConfigurationEnabled(
+  options: WorkspaceProviderPolicyOptions,
+): void {
+  if (options.workspaceProviders !== 'disabled') return;
+  if (options.managedProviderId === undefined) {
+    throw new Error(
+      'workspace provider configuration is disabled but no managed provider is registered',
+    );
+  }
+  throw new WorkspaceProvidersDisabledError(options.managedProviderId);
+}

package/src/index.ts

@@ -1,4 +1,6 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
 import type {ShipfoxModule} from '@shipfox/node-module';
+import {assertAgentConfig, workspaceProvidersPolicy} from '#config.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {db, migrationsPath} from '#db/index.js';
 import {createAgentE2eRoutes} from '#presentation/e2eRoutes/index.js';
@@ -33,6 +35,7 @@ export {
   testAndSaveModelProviderConfig,
   UnsupportedModelProviderError,
   updateCustomModelProviderConfig,
+  WorkspaceProvidersDisabledError,
 } from '#core/index.js';
 export {
   getAgentWorkspaceSettings,
@@ -42,12 +45,30 @@ export {
   upsertModelProviderConfig,
 } from '#db/index.js';
 
-export function createAgentModule(params: {secrets: AgentSecretsClient}): ShipfoxModule {
+export function createAgentModule(params: {
+  secrets: AgentSecretsClient;
+  managedProvider?: ManagedModelProvider | undefined;
+}): ShipfoxModule {
+  assertAgentConfig(params.managedProvider);
+
   return {
     name: 'agent',
     database: {db, migrationsPath, databaseNamespace: 'agent'},
-    routes: createAgentRoutes(params.secrets),
-    e2eRoutes: [createAgentE2eRoutes(params.secrets)],
-    interModulePresentations: [createAgentInterModulePresentation(params)],
+    routes: createAgentRoutes(params.secrets, {
+      managedProvider: params.managedProvider,
+      workspaceProviders: workspaceProvidersPolicy,
+    }),
+    e2eRoutes: [
+      createAgentE2eRoutes(params.secrets, {
+        managedProviderId: params.managedProvider?.id,
+        workspaceProviders: workspaceProvidersPolicy,
+      }),
+    ],
+    interModulePresentations: [
+      createAgentInterModulePresentation({
+        ...params,
+        workspaceProviders: workspaceProvidersPolicy,
+      }),
+    ],
   };
 }

package/src/presentation/e2eRoutes/create-model-provider.ts

@@ -3,9 +3,14 @@ import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {agentSystemNamespace} from '#core/credential-fingerprints.js';
 import {listHarnessProviderModels} from '#core/harness/registry.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  type WorkspaceProviderPolicyOptions,
+} from '#core/index.js';
 import {getModelProviderEntry} from '#core/model-provider-policy.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {upsertModelProviderConfig} from '#db/index.js';
+import {translateModelProviderRouteError} from '#presentation/routes/errors.js';
 
 const createE2eModelProviderBodySchema = z.object({
   workspace_id: z.string().uuid(),
@@ -19,7 +24,10 @@ const createE2eModelProviderResponseSchema = z.object({
   provider_id: z.literal('anthropic'),
 });
 
-export function createE2eModelProviderRoute(secrets: AgentSecretsClient) {
+export function createE2eModelProviderRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'POST',
     path: '/model-provider',
@@ -28,7 +36,9 @@ export function createE2eModelProviderRoute(secrets: AgentSecretsClient) {
       body: createE2eModelProviderBodySchema,
       response: {201: createE2eModelProviderResponseSchema},
     },
+    errorHandler: translateModelProviderRouteError,
     handler: async (request, reply) => {
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
       const entry = getModelProviderEntry(request.body.provider_id);
       if (entry === undefined || entry.default_model === null) {
         throw new ClientError('Unsupported E2E model provider', 'unsupported-model-provider', {

package/src/presentation/e2eRoutes/index.ts

@@ -1,9 +1,16 @@
 import type {RouteGroup} from '@shipfox/node-fastify';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {createE2eModelProviderRoute} from './create-model-provider.js';
 
-export function createAgentE2eRoutes(secrets: AgentSecretsClient): RouteGroup {
-  return {prefix: '/agent', routes: [createE2eModelProviderRoute(secrets)]};
+export function createAgentE2eRoutes(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+): RouteGroup {
+  return {
+    prefix: '/agent',
+    routes: [createE2eModelProviderRoute(secrets, workspaceProviderPolicy)],
+  };
 }
 
 export const agentE2eRoutes = createAgentE2eRoutes(undefined as unknown as AgentSecretsClient);

package/src/presentation/inter-module.test.ts

@@ -0,0 +1,51 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
+import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
+import {agentTestSecretsClient} from '#test/fixtures/secrets-client.js';
+import {createAgentInterModulePresentation} from './inter-module.js';
+
+describe('agent inter-module presentation', () => {
+  test('preserves managed provider policy details for runtime credentials', async () => {
+    const managedProvider: ManagedModelProvider = {
+      id: 'shipfox',
+      label: 'Shipfox',
+      models: [{id: 'managed-model', label: 'Managed model', api: 'openai-responses'}],
+      defaultModel: 'managed-model',
+      resolveCredentials: vi.fn(),
+    };
+    const presentation = createAgentInterModulePresentation({
+      secrets: agentTestSecretsClient,
+      managedProvider,
+      workspaceProviders: 'disabled',
+    });
+    const input = {
+      workspaceId: crypto.randomUUID(),
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
+      harness: 'pi' as const,
+      provider: 'anthropic' as const,
+      model: 'claude-opus-4-8',
+      thinking: 'high' as const,
+    };
+
+    const result = await Promise.resolve(
+      presentation.handlers.resolveRuntimeCredentials(input, {
+        signal: new AbortController().signal,
+      }),
+    ).catch((error: unknown) => error);
+
+    expect(
+      isInterModuleKnownError(agentInterModuleContract.methods.resolveRuntimeCredentials, result),
+    ).toBe(true);
+    if (
+      !isInterModuleKnownError(agentInterModuleContract.methods.resolveRuntimeCredentials, result)
+    ) {
+      throw new Error('Expected a managed provider policy error');
+    }
+    expect(result.code).toBe('workspace-providers-disabled');
+    expect(result.details).toEqual({
+      message: 'This instance only supports provider `shipfox`.',
+      managed_provider_id: 'shipfox',
+    });
+  });
+});

package/src/presentation/inter-module.ts

@@ -1,3 +1,4 @@
+import type {ManagedModelProvider, WorkspaceProvidersPolicy} from '@shipfox/api-agent-dto';
 import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
 import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
 import {
@@ -12,6 +13,7 @@ import {
   UnsupportedHarnessProviderError,
   UnsupportedHarnessThinkingError,
   UnsupportedModelProviderError,
+  WorkspaceProvidersDisabledError,
 } from '#core/errors.js';
 import {resolveAgentConfig} from '#core/resolve-agent-config.js';
 import {resolveRuntimeCredentials} from '#core/resolve-runtime-credentials.js';
@@ -21,15 +23,26 @@ import {createWorkspaceAgentDefaultsResolver} from '#core/workspace-agent-defaul
 
 export function createAgentInterModulePresentation(params: {
   secrets: AgentSecretsClient;
+  managedProvider?: ManagedModelProvider | undefined;
+  workspaceProviders?: WorkspaceProvidersPolicy | undefined;
 }): InterModulePresentation<typeof agentInterModuleContract> {
   return defineInterModulePresentation(agentInterModuleContract, {
-    getValidationCatalog: () => getAgentValidationCatalog(),
+    getValidationCatalog: () =>
+      getAgentValidationCatalog(params.managedProvider, params.workspaceProviders),
     resolveAgentConfig: async ({workspaceId, config}) => {
       try {
         const resolve =
           workspaceId === null
-            ? resolveAgentConfig
-            : await createWorkspaceAgentDefaultsResolver(workspaceId);
+            ? (step: Parameters<typeof resolveAgentConfig>[0]) =>
+                resolveAgentConfig(step, {
+                  managedProvider: params.managedProvider,
+                  workspaceProviders: params.workspaceProviders,
+                })
+            : await createWorkspaceAgentDefaultsResolver(
+                workspaceId,
+                params.managedProvider,
+                params.workspaceProviders,
+              );
         return await resolve(config);
       } catch (error) {
         throw toResolveAgentConfigKnownError(error);
@@ -37,7 +50,11 @@ export function createAgentInterModulePresentation(params: {
     },
     resolveRuntimeCredentials: async (input) => {
       try {
-        return await resolveRuntimeCredentials(input, {secrets: params.secrets});
+        return await resolveRuntimeCredentials(input, {
+          managedProvider: params.managedProvider,
+          secrets: params.secrets,
+          workspaceProviders: params.workspaceProviders,
+        });
       } catch (error) {
         throw toResolveRuntimeCredentialsKnownError(error);
       }
@@ -50,18 +67,33 @@ function toResolveAgentConfigKnownError(error: unknown): unknown {
     error instanceof InvalidAgentModelError ||
     error instanceof UnsupportedHarnessProviderError ||
     error instanceof UnsupportedHarnessThinkingError ||
-    error instanceof UnsupportedModelProviderError
+    error instanceof UnsupportedModelProviderError ||
+    error instanceof WorkspaceProvidersDisabledError
   ) {
     return createInterModuleKnownError(
       agentInterModuleContract.methods.resolveAgentConfig,
       'agent-config-invalid',
-      {},
+      {
+        ...(error instanceof WorkspaceProvidersDisabledError
+          ? {message: error.message, managed_provider_id: error.managedProviderId}
+          : {}),
+      },
     );
   }
   return error;
 }
 
 function toResolveRuntimeCredentialsKnownError(error: unknown): unknown {
+  if (error instanceof WorkspaceProvidersDisabledError) {
+    return createInterModuleKnownError(
+      agentInterModuleContract.methods.resolveRuntimeCredentials,
+      'workspace-providers-disabled',
+      {
+        message: error.message,
+        managed_provider_id: error.managedProviderId,
+      },
+    );
+  }
   if (error instanceof ModelProviderConfigNotFoundError) {
     return createInterModuleKnownError(
       agentInterModuleContract.methods.resolveRuntimeCredentials,

package/src/presentation/routes/create-custom-model-provider.ts

@@ -5,12 +5,19 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {createCustomModelProviderConfig} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  createCustomModelProviderConfig,
+} from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {toCustomModelProviderConfigDto} from '#presentation/dto/index.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export function createCustomModelProviderRoute(secrets: AgentSecretsClient) {
+export function createCustomModelProviderRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'POST',
     path: '/custom-model-providers',
@@ -35,6 +42,7 @@ export function createCustomModelProviderRoute(secrets: AgentSecretsClient) {
       });
 
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const config = await createCustomModelProviderConfig(
         {

package/src/presentation/routes/delete-model-provider-config.ts

@@ -2,10 +2,18 @@ import {modelProviderRefSchema} from '@shipfox/api-agent-dto';
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {deleteModelProviderConfig} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  deleteModelProviderConfig,
+} from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
+import {translateModelProviderRouteError} from './errors.js';
 
-export function createDeleteModelProviderConfigRoute(secrets: AgentSecretsClient) {
+export function createDeleteModelProviderConfigRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'DELETE',
     path: '/model-providers/:providerId',
@@ -19,9 +27,11 @@ export function createDeleteModelProviderConfigRoute(secrets: AgentSecretsClient
         204: z.void(),
       },
     },
+    errorHandler: translateModelProviderRouteError,
     handler: async (request, reply) => {
       const {workspaceId, providerId} = request.params;
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const deleted = await deleteModelProviderConfig({workspaceId, providerId}, {secrets});
       if (!deleted) {

package/src/presentation/routes/discover-custom-model-provider-models-by-slug.ts

@@ -7,13 +7,18 @@ import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
+  assertWorkspaceProviderConfigurationEnabled,
   discoverCustomModelProviderModels,
   resolveCustomModelProviderDiscoveryParams,
 } from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export function createDiscoverCustomModelProviderModelsBySlugRoute(secrets: AgentSecretsClient) {
+export function createDiscoverCustomModelProviderModelsBySlugRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'POST',
     path: '/custom-model-providers/:slug/discover-models',
@@ -32,6 +37,7 @@ export function createDiscoverCustomModelProviderModelsBySlugRoute(secrets: Agen
     handler: async (request) => {
       const {workspaceId, slug} = request.params;
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const discoveryParams = await resolveCustomModelProviderDiscoveryParams(
         {

package/src/presentation/routes/discover-custom-model-provider-models.ts

@@ -5,25 +5,37 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {discoverCustomModelProviderModels} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  discoverCustomModelProviderModels,
+} from '#core/index.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export const discoverCustomModelProviderModelsRoute = defineRoute({
-  method: 'POST',
-  path: '/custom-model-providers/discover-models',
-  description: 'Discover models exposed by a custom model provider endpoint',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    body: discoverCustomModelProviderModelsBodySchema,
-    response: {
-      200: discoverCustomModelProviderModelsResponseSchema,
+export function createDiscoverCustomModelProviderModelsRoute(
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
+  return defineRoute({
+    method: 'POST',
+    path: '/custom-model-providers/discover-models',
+    description: 'Discover models exposed by a custom model provider endpoint',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      body: discoverCustomModelProviderModelsBodySchema,
+      response: {
+        200: discoverCustomModelProviderModelsResponseSchema,
+      },
+    },
+    errorHandler: translateModelProviderRouteError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
+
+      return await discoverCustomModelProviderModels(request.body);
     },
-  },
-  errorHandler: translateModelProviderRouteError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    requireWorkspaceAccess({request, workspaceId});
+  });
+}
 
-    return await discoverCustomModelProviderModels(request.body);
-  },
-});
+export const discoverCustomModelProviderModelsRoute =
+  createDiscoverCustomModelProviderModelsRoute();

package/src/presentation/routes/errors.ts

@@ -12,6 +12,7 @@ import {
   ModelProviderConfigNotFoundError,
   ModelProviderValidationError,
   UnsupportedModelProviderError,
+  WorkspaceProvidersDisabledError,
 } from '#core/index.js';
 import {getModelProviderCredentialKeys} from '#core/model-provider-policy.js';
 
@@ -96,6 +97,16 @@ export function translateModelProviderRouteError(error: unknown): never {
     });
   }
 
+  if (error instanceof WorkspaceProvidersDisabledError) {
+    throw new ClientError(error.message, 'workspace-providers-disabled', {
+      status: 422,
+      details: {
+        managed_provider_id: error.managedProviderId,
+        message: error.message,
+      },
+    });
+  }
+
   if (error instanceof ModelProviderConfigNotFoundError) {
     throw new ClientError('Provider is not configured', 'provider-not-configured', {
       status: 422,