@shipfox/api-agent 12.2.0 → 14.0.0

package/src/core/resolve-runtime-credentials.test.ts

@@ -1,4 +1,4 @@
-import type {ModelProviderRef} from '@shipfox/api-agent-dto';
+import type {ManagedModelProvider, ModelProviderRef} from '@shipfox/api-agent-dto';
 import {deleteModelProviderConfig, upsertModelProviderConfig} from '#db/index.js';
 import {setSecrets} from '#test/fixtures/secrets-client.js';
 import {agentSystemNamespace, customCredentialsToStoreValues} from './credential-fingerprints.js';
@@ -21,6 +21,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = await resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -36,6 +38,189 @@ describe('resolveRuntimeCredentials', () => {
     });
   });
 
+  it('resolves managed provider credentials into the pi custom provider contract', async () => {
+    const runId = crypto.randomUUID();
+    const stepAttemptId = crypto.randomUUID();
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'openai-responses',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId,
+        stepAttemptId,
+        harness: 'pi',
+        provider: 'shipfox',
+        model: 'responses-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(resolveCredentials).toHaveBeenCalledWith({
+      workspaceId,
+      runId,
+      stepAttemptId,
+      model: 'responses-model',
+    });
+    expect(result).toEqual({
+      harness: 'pi',
+      provider_id: 'shipfox',
+      model: 'responses-model',
+      thinking: 'high',
+      credentials: {api_key: 'managed-token'},
+      custom_provider: {
+        api: 'openai-responses',
+        base_url: 'https://gateway.example.test',
+        headers: [],
+        secret_header_names: [],
+        models: [
+          {
+            id: 'responses-model',
+            label: 'Responses model',
+            context_window: 1_000_000,
+            max_output_tokens: 65_536,
+            reasoning: true,
+            input_image: true,
+          },
+        ],
+        requires_api_key: true,
+      },
+    });
+  });
+
+  it('omits optional model metadata when the managed model entry does not carry it', async () => {
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'openai-completions',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'shipfox',
+        model: 'plain-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(result).toEqual({
+      harness: 'pi',
+      provider_id: 'shipfox',
+      model: 'plain-model',
+      thinking: 'high',
+      credentials: {api_key: 'managed-token'},
+      custom_provider: {
+        api: 'openai-completions',
+        base_url: 'https://gateway.example.test',
+        headers: [],
+        secret_header_names: [],
+        models: [{id: 'plain-model', label: 'Plain model'}],
+        requires_api_key: true,
+      },
+    });
+  });
+
+  it('forwards partial managed model metadata, including false values', async () => {
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'openai-completions',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'shipfox',
+        model: 'partial-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(result.custom_provider?.models).toEqual([
+      {
+        id: 'partial-model',
+        label: 'Partial model',
+        max_output_tokens: 8_192,
+        reasoning: false,
+        input_image: false,
+      },
+    ]);
+  });
+
+  it('falls back to an unregistered managed model descriptor', async () => {
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'openai-completions',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'shipfox',
+        model: 'missing-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(result.custom_provider?.models).toEqual([{id: 'missing-model', label: 'missing-model'}]);
+  });
+
+  it('resolves managed provider credentials into the Claude per-step contract', async () => {
+    const resolveCredentials = vi.fn<ManagedModelProvider['resolveCredentials']>();
+    resolveCredentials.mockResolvedValue({
+      api: 'anthropic-messages',
+      baseUrl: 'https://gateway.example.test',
+      credentials: {api_key: 'managed-token'},
+    });
+
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'claude',
+        provider: 'shipfox',
+        model: 'claude-model',
+        thinking: 'high',
+      },
+      {managedProvider: managedProvider(resolveCredentials)},
+    );
+
+    expect(result).toEqual({
+      harness: 'claude',
+      provider_id: 'shipfox',
+      model: 'claude-model',
+      thinking: 'high',
+      credentials: {api_key: 'managed-token'},
+      claude: {
+        base_url: 'https://gateway.example.test',
+        auth_token: 'managed-token',
+      },
+    });
+  });
+
   it('prefers workspace credentials over the instance fallback', async () => {
     await saveProviderConfig({
       workspaceId,
@@ -45,6 +230,8 @@ describe('resolveRuntimeCredentials', () => {
     const result = await resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'anthropic',
         model: 'claude-opus-4-8',
@@ -60,6 +247,8 @@ describe('resolveRuntimeCredentials', () => {
     const matching = await resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'anthropic',
         model: 'claude-opus-4-8',
@@ -70,6 +259,8 @@ describe('resolveRuntimeCredentials', () => {
     const mismatched = resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'openai',
         model: 'gpt-5.5-pro',
@@ -82,6 +273,55 @@ describe('resolveRuntimeCredentials', () => {
     await expect(mismatched).rejects.toMatchObject({name: 'ModelProviderConfigNotFoundError'});
   });
 
+  it('refuses workspace credentials and instance fallback when workspace providers are disabled', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      credentials: {api_key: 'sk-workspace-secret'},
+    });
+
+    const result = resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {
+        workspaceProviders: 'disabled',
+        runtimeConfig: instanceConfig(),
+      },
+    );
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('reports the managed provider when a foreign runtime provider is requested', async () => {
+    const result = resolveRuntimeCredentials(
+      {
+        workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {
+        workspaceProviders: 'disabled',
+        managedProvider: managedProvider(vi.fn()),
+      },
+    );
+
+    await expect(result).rejects.toMatchObject({
+      name: 'WorkspaceProvidersDisabledError',
+      managedProviderId: 'shipfox',
+    });
+  });
+
   it('returns custom provider runtime descriptors for custom rows', async () => {
     await saveProviderConfig({
       workspaceId,
@@ -98,6 +338,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = await resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'local-vllm',
       model: 'llama-3.1',
@@ -137,6 +379,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = await resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'local-ollama',
       model: 'llama-3.1',
@@ -155,6 +399,8 @@ describe('resolveRuntimeCredentials', () => {
   it('throws when no workspace or instance credential is available', async () => {
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -174,6 +420,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -193,6 +441,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -217,6 +467,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'cloudflare-ai-gateway',
       model: '@cf/meta/llama-3.1-8b-instruct',
@@ -235,6 +487,8 @@ describe('resolveRuntimeCredentials', () => {
 
     const result = resolveRuntimeCredentials({
       workspaceId,
+      runId: crypto.randomUUID(),
+      stepAttemptId: crypto.randomUUID(),
       harness: 'pi',
       provider: 'anthropic',
       model: 'claude-opus-4-8',
@@ -256,6 +510,8 @@ describe('resolveRuntimeCredentials', () => {
     const result = resolveRuntimeCredentials(
       {
         workspaceId,
+        runId: crypto.randomUUID(),
+        stepAttemptId: crypto.randomUUID(),
         harness: 'pi',
         provider: 'anthropic',
         model: 'claude-opus-4-8',
@@ -314,3 +570,35 @@ function instanceConfig() {
     AGENT_DEFAULT_PROVIDER_API_KEY: 'sk-instance-secret',
   };
 }
+
+function managedProvider(
+  resolveCredentials: ManagedModelProvider['resolveCredentials'],
+): ManagedModelProvider {
+  return {
+    id: 'shipfox',
+    label: 'Shipfox',
+    models: [
+      {id: 'claude-model', label: 'Claude model', api: 'anthropic-messages'},
+      {
+        id: 'responses-model',
+        label: 'Responses model',
+        api: 'openai-responses',
+        context_window: 1_000_000,
+        max_output_tokens: 65_536,
+        reasoning: true,
+        input_image: true,
+      },
+      {
+        id: 'partial-model',
+        label: 'Partial model',
+        api: 'openai-completions',
+        max_output_tokens: 8_192,
+        reasoning: false,
+        input_image: false,
+      },
+      {id: 'plain-model', label: 'Plain model', api: 'openai-completions'},
+    ],
+    defaultModel: 'responses-model',
+    resolveCredentials,
+  };
+}

package/src/core/resolve-runtime-credentials.ts

@@ -2,12 +2,16 @@ import type {
   AgentRuntimeCredentialsResponseDto,
   AgentThinking,
   Harness,
+  ManagedModelProvider,
+  ManagedProviderRuntimeConfig,
   ModelProviderRef,
   SupportedModelProviderId,
+  WorkspaceProvidersPolicy,
 } from '@shipfox/api-agent-dto';
+import {toCustomAgentModelDto} from '@shipfox/api-agent-dto';
 import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
 import {isInterModuleKnownError} from '@shipfox/inter-module';
-import {config} from '#config.js';
+import {config, workspaceProvidersPolicy} from '#config.js';
 import {getModelProviderConfig} from '#db/index.js';
 import {agentRuntimeConfigResolvedCount} from '#metrics/index.js';
 import {
@@ -16,12 +20,14 @@ import {
   storeValuesToRuntimeCredentials,
 } from './credential-fingerprints.js';
 import type {ModelProviderConfig} from './entities/model-provider-config.js';
-import {ModelProviderConfigNotFoundError} from './errors.js';
+import {ModelProviderConfigNotFoundError, WorkspaceProvidersDisabledError} from './errors.js';
 import {getModelProviderEntry, modelProviderCredentialKeysMatch} from './model-provider-policy.js';
 import {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';
 
 export interface ResolveRuntimeCredentialsParams {
   workspaceId: string;
+  runId: string;
+  stepAttemptId: string;
   harness: Harness;
   provider: ModelProviderRef;
   model: string;
@@ -29,13 +35,15 @@ export interface ResolveRuntimeCredentialsParams {
 }
 
 interface RuntimeCredentialsConfig {
-  AGENT_DEFAULT_PROVIDER?: SupportedModelProviderId | undefined;
+  AGENT_DEFAULT_PROVIDER?: ModelProviderRef | undefined;
   AGENT_DEFAULT_PROVIDER_API_KEY?: string | undefined;
 }
 
 interface ResolveRuntimeCredentialsOptions {
   runtimeConfig?: RuntimeCredentialsConfig | undefined;
+  workspaceProviders?: WorkspaceProvidersPolicy | undefined;
   secrets?: AgentSecretsClient | undefined;
+  managedProvider?: ManagedModelProvider | undefined;
   getCredentialBag?:
     | ((params: {workspaceId: string; namespace: string}) => Promise<Record<string, string>>)
     | undefined;
@@ -46,7 +54,34 @@ export async function resolveRuntimeCredentials(
   options?: ResolveRuntimeCredentialsOptions,
 ): Promise<AgentRuntimeCredentialsResponseDto> {
   const runtimeConfig = options?.runtimeConfig ?? config;
+  const configuredWorkspaceProviders = options?.workspaceProviders ?? workspaceProvidersPolicy;
   const secrets = options?.secrets;
+  const managedProvider = options?.managedProvider;
+  if (managedProvider?.id === params.provider) {
+    const managedRuntimeConfig = await managedProvider.resolveCredentials({
+      workspaceId: params.workspaceId,
+      runId: params.runId,
+      stepAttemptId: params.stepAttemptId,
+      model: params.model,
+    });
+    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});
+    return toResponse(params, managedRuntimeConfig.credentials, undefined, {
+      provider: managedProvider,
+      runtimeConfig: managedRuntimeConfig,
+    });
+  }
+
+  if (configuredWorkspaceProviders === 'disabled') {
+    agentRuntimeConfigResolvedCount.add(1, {
+      source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',
+      outcome: 'unavailable',
+    });
+    if (managedProvider !== undefined) {
+      throw new WorkspaceProvidersDisabledError(managedProvider.id);
+    }
+    throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);
+  }
+
   const providerConfig = await getModelProviderConfig({
     workspaceId: params.workspaceId,
     providerId: params.provider,
@@ -133,6 +168,12 @@ function toResponse(
   params: ResolveRuntimeCredentialsParams,
   credentials: Record<string, string>,
   providerConfig?: ModelProviderConfig | undefined,
+  managed?:
+    | {
+        provider: ManagedModelProvider;
+        runtimeConfig: ManagedProviderRuntimeConfig;
+      }
+    | undefined,
 ): AgentRuntimeCredentialsResponseDto {
   const response: AgentRuntimeCredentialsResponseDto = {
     harness: params.harness,
@@ -156,5 +197,30 @@ function toResponse(
     };
   }
 
+  if (managed !== undefined) {
+    const model = managed.provider.models.find((candidate) => candidate.id === params.model);
+    const modelDescriptor = toCustomAgentModelDto(model ?? {id: params.model, label: params.model});
+
+    if (params.harness === 'pi') {
+      response.custom_provider = {
+        api: managed.runtimeConfig.api,
+        base_url: managed.runtimeConfig.baseUrl,
+        headers: [],
+        secret_header_names: [],
+        models: [modelDescriptor],
+        requires_api_key: true,
+      };
+    } else {
+      const authToken = managed.runtimeConfig.credentials.api_key;
+      if (authToken === undefined) {
+        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);
+      }
+      response.claude = {
+        base_url: managed.runtimeConfig.baseUrl,
+        auth_token: authToken,
+      };
+    }
+  }
+
   return response;
 }

package/src/core/validation-catalog.test.ts

@@ -1,3 +1,4 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
 import {getAgentValidationCatalog} from './validation-catalog.js';
 
 describe('getAgentValidationCatalog', () => {
@@ -13,4 +14,57 @@ describe('getAgentValidationCatalog', () => {
     expect(pi?.model_ids_by_provider?.openai).toContain('gpt-5.5-pro');
     expect(claude?.model_ids_by_provider?.anthropic).toContain('claude-opus-4-8');
   });
+
+  it('includes injected managed providers with harness-compatible models', () => {
+    const managedProvider = {
+      id: 'shipfox-managed',
+      label: 'Shipfox Managed',
+      models: [
+        {id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages' as const},
+        {id: 'managed-responses', label: 'Managed Responses', api: 'openai-responses' as const},
+      ],
+      defaultModel: 'managed-claude',
+      resolveCredentials: async () => ({
+        api: 'anthropic-messages' as const,
+        baseUrl: 'https://gateway.example.com',
+        credentials: {api_key: 'token'},
+      }),
+    } satisfies ManagedModelProvider;
+
+    const catalog = getAgentValidationCatalog(managedProvider);
+    const pi = catalog.harnesses.find((harness) => harness.id === 'pi');
+    const claude = catalog.harnesses.find((harness) => harness.id === 'claude');
+
+    expect(catalog.providers).toContainEqual({id: managedProvider.id, support_status: 'supported'});
+    expect(pi?.supported_provider_ids).toContain(managedProvider.id);
+    expect(pi?.model_ids_by_provider?.[managedProvider.id]).toEqual([
+      'managed-claude',
+      'managed-responses',
+    ]);
+    expect(claude?.supported_provider_ids).toContain(managedProvider.id);
+    expect(claude?.model_ids_by_provider?.[managedProvider.id]).toEqual(['managed-claude']);
+  });
+
+  it('exposes only the managed provider when workspace providers are disabled', () => {
+    const managedProvider = {
+      id: 'shipfox-managed',
+      label: 'Shipfox Managed',
+      models: [{id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages' as const}],
+      defaultModel: 'managed-claude',
+      resolveCredentials: async () => ({
+        api: 'anthropic-messages' as const,
+        baseUrl: 'https://gateway.example.com',
+        credentials: {api_key: 'token'},
+      }),
+    } satisfies ManagedModelProvider;
+
+    const catalog = getAgentValidationCatalog(managedProvider, 'disabled');
+
+    expect(catalog.providers).toEqual([{id: managedProvider.id, support_status: 'supported'}]);
+    expect(
+      catalog.harnesses.every((harness) =>
+        harness.supported_provider_ids.every((providerId) => providerId === managedProvider.id),
+      ),
+    ).toBe(true);
+  });
 });