@shipfox/api-agent 2.0.0

package/src/core/resolve-runtime-credentials.test.ts

@@ -0,0 +1,316 @@
+import type {ModelProviderRef} from '@shipfox/api-agent-dto';
+import {SecretDecryptionError, setSecrets} from '@shipfox/api-secrets';
+import {deleteModelProviderConfig, upsertModelProviderConfig} from '#db/index.js';
+import {agentSystemNamespace, customCredentialsToStoreValues} from './credential-fingerprints.js';
+import {ModelProviderConfigNotFoundError} from './errors.js';
+import {resolveRuntimeCredentials} from './resolve-runtime-credentials.js';
+
+describe('resolveRuntimeCredentials', () => {
+  let workspaceId: string;
+
+  beforeEach(() => {
+    workspaceId = crypto.randomUUID();
+  });
+
+  it('returns decrypted workspace credentials', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      credentials: {api_key: 'sk-workspace-secret'},
+    });
+
+    const result = await resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'anthropic',
+      model: 'claude-opus-4-8',
+      thinking: 'high',
+    });
+
+    expect(result).toEqual({
+      harness: 'pi',
+      provider_id: 'anthropic',
+      model: 'claude-opus-4-8',
+      thinking: 'high',
+      credentials: {api_key: 'sk-workspace-secret'},
+    });
+  });
+
+  it('prefers workspace credentials over the instance fallback', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      credentials: {api_key: 'sk-workspace-secret'},
+    });
+    const result = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {runtimeConfig: instanceConfig()},
+    );
+
+    expect(result.credentials).toEqual({api_key: 'sk-workspace-secret'});
+  });
+
+  it('returns the instance fallback only for the instance default model provider', async () => {
+    const matching = await resolveRuntimeCredentials(
+      {
+        workspaceId,
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {runtimeConfig: instanceConfig()},
+    );
+    const mismatched = resolveRuntimeCredentials(
+      {
+        workspaceId,
+        harness: 'pi',
+        provider: 'openai',
+        model: 'gpt-5.5-pro',
+        thinking: 'high',
+      },
+      {runtimeConfig: instanceConfig()},
+    );
+
+    expect(matching.credentials).toEqual({api_key: 'sk-instance-secret'});
+    await expect(mismatched).rejects.toMatchObject({name: 'ModelProviderConfigNotFoundError'});
+  });
+
+  it('returns custom provider runtime descriptors for custom rows', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'local-vllm',
+      kind: 'custom',
+      displayName: 'Local vLLM',
+      api: 'openai-responses',
+      baseUrl: 'http://127.0.0.1:11434/v1',
+      headers: [{name: 'x-region', value: 'local'}],
+      models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
+      requiresApiKey: true,
+      credentials: {api_key: 'sk-local-secret', 'header:authorization': 'Bearer local'},
+    });
+
+    const result = await resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'local-vllm',
+      model: 'llama-3.1',
+      thinking: 'high',
+    });
+
+    expect(result).toEqual({
+      harness: 'pi',
+      provider_id: 'local-vllm',
+      model: 'llama-3.1',
+      thinking: 'high',
+      credentials: {api_key: 'sk-local-secret', 'header:authorization': 'Bearer local'},
+      custom_provider: {
+        api: 'openai-responses',
+        base_url: 'http://127.0.0.1:11434/v1',
+        headers: [{name: 'x-region', value: 'local'}],
+        secret_header_names: ['authorization'],
+        models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
+        requires_api_key: true,
+      },
+    });
+  });
+
+  it('returns keyless custom provider runtime descriptors for keyless custom rows', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'local-ollama',
+      kind: 'custom',
+      displayName: 'Local Ollama',
+      api: 'openai-responses',
+      baseUrl: 'http://127.0.0.1:11434/v1',
+      headers: [],
+      models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
+      requiresApiKey: false,
+      credentials: {},
+    });
+
+    const result = await resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'local-ollama',
+      model: 'llama-3.1',
+      thinking: 'high',
+    });
+
+    expect(result).toMatchObject({
+      provider_id: 'local-ollama',
+      credentials: {},
+      custom_provider: {
+        requires_api_key: false,
+      },
+    });
+  });
+
+  it('throws when no workspace or instance credential is available', async () => {
+    const result = resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'anthropic',
+      model: 'claude-opus-4-8',
+      thinking: 'high',
+    });
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('throws after a workspace credential is deleted', async () => {
+    await saveProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      credentials: {api_key: 'sk-workspace-secret'},
+    });
+    await deleteModelProviderConfig({workspaceId, providerId: 'anthropic'});
+
+    const result = resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'anthropic',
+      model: 'claude-opus-4-8',
+      thinking: 'high',
+    });
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('throws when a configured row has no secret bag', async () => {
+    await upsertModelProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      defaultModel: null,
+      defaultThinking: 'high',
+    });
+
+    const result = resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'anthropic',
+      model: 'claude-opus-4-8',
+      thinking: 'high',
+    });
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('throws when a multi-field provider secret bag is incomplete', async () => {
+    await setSecrets({
+      workspaceId,
+      namespace: agentSystemNamespace('cloudflare-ai-gateway'),
+      values: {API_KEY: 'cf-secret'},
+    });
+    await upsertModelProviderConfig({
+      workspaceId,
+      providerId: 'cloudflare-ai-gateway',
+      defaultModel: null,
+      defaultThinking: 'high',
+    });
+
+    const result = resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'cloudflare-ai-gateway',
+      model: '@cf/meta/llama-3.1-8b-instruct',
+      thinking: 'high',
+    });
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('does not resolve an orphaned secret without a provider config row', async () => {
+    await setSecrets({
+      workspaceId,
+      namespace: agentSystemNamespace('anthropic'),
+      values: {API_KEY: 'sk-orphaned-secret'},
+    });
+
+    const result = resolveRuntimeCredentials({
+      workspaceId,
+      harness: 'pi',
+      provider: 'anthropic',
+      model: 'claude-opus-4-8',
+      thinking: 'high',
+    });
+
+    await expect(result).rejects.toThrow(ModelProviderConfigNotFoundError);
+  });
+
+  it('does not expose credential material on store decryption errors', async () => {
+    const error = new SecretDecryptionError();
+    await upsertModelProviderConfig({
+      workspaceId,
+      providerId: 'anthropic',
+      defaultModel: null,
+      defaultThinking: 'high',
+    });
+
+    const result = resolveRuntimeCredentials(
+      {
+        workspaceId,
+        harness: 'pi',
+        provider: 'anthropic',
+        model: 'claude-opus-4-8',
+        thinking: 'high',
+      },
+      {getCredentialBag: vi.fn().mockRejectedValue(error)},
+    );
+
+    await expect(result).rejects.toThrow(SecretDecryptionError);
+    try {
+      await result;
+    } catch (error) {
+      expect(String(error)).not.toContain('sk-workspace-secret');
+    }
+  });
+});
+
+async function saveProviderConfig(params: {
+  workspaceId: string;
+  providerId: ModelProviderRef;
+  kind?: 'builtin' | 'custom' | undefined;
+  displayName?: string | undefined;
+  api?: 'openai-responses' | undefined;
+  baseUrl?: string | undefined;
+  headers?: {name: string; value: string}[] | undefined;
+  models?: {id: string; label: string}[] | undefined;
+  requiresApiKey?: boolean | undefined;
+  credentials: Record<string, string>;
+}) {
+  await setSecrets({
+    workspaceId: params.workspaceId,
+    namespace: agentSystemNamespace(params.providerId),
+    values:
+      params.kind === 'custom'
+        ? customCredentialsToStoreValues(params.credentials)
+        : {API_KEY: params.credentials.api_key ?? ''},
+  });
+  return await upsertModelProviderConfig({
+    workspaceId: params.workspaceId,
+    providerId: params.providerId,
+    kind: params.kind,
+    displayName: params.displayName,
+    api: params.api,
+    baseUrl: params.baseUrl,
+    headers: params.headers,
+    models: params.models,
+    requiresApiKey: params.requiresApiKey,
+    defaultModel: null,
+    defaultThinking: 'high',
+  });
+}
+
+function instanceConfig() {
+  return {
+    AGENT_DEFAULT_PROVIDER: 'anthropic' as const,
+    AGENT_DEFAULT_PROVIDER_API_KEY: 'sk-instance-secret',
+  };
+}

package/src/core/resolve-runtime-credentials.ts

@@ -0,0 +1,147 @@
+import {
+  type AgentRuntimeCredentialsResponseDto,
+  type AgentThinking,
+  getModelProviderEntry,
+  type Harness,
+  type ModelProviderRef,
+  modelProviderCredentialKeysMatch,
+  type SupportedModelProviderId,
+} from '@shipfox/api-agent-dto';
+import {getSecretsByNamespace, SecretDecryptionError} from '@shipfox/api-secrets';
+import {config} from '#config.js';
+import {getModelProviderConfig} from '#db/index.js';
+import {agentRuntimeConfigResolvedCount} from '#metrics/index.js';
+import {
+  agentSystemNamespace,
+  storeValuesToCustomRuntimeCredentials,
+  storeValuesToRuntimeCredentials,
+} from './credential-fingerprints.js';
+import type {ModelProviderConfig} from './entities/model-provider-config.js';
+import {ModelProviderConfigNotFoundError} from './errors.js';
+
+export interface ResolveRuntimeCredentialsParams {
+  workspaceId: string;
+  harness: Harness;
+  provider: ModelProviderRef;
+  model: string;
+  thinking: AgentThinking;
+}
+
+interface RuntimeCredentialsConfig {
+  AGENT_DEFAULT_PROVIDER?: SupportedModelProviderId | undefined;
+  AGENT_DEFAULT_PROVIDER_API_KEY?: string | undefined;
+}
+
+interface ResolveRuntimeCredentialsOptions {
+  runtimeConfig?: RuntimeCredentialsConfig | undefined;
+  getCredentialBag?: typeof getSecretsByNamespace | undefined;
+}
+
+export async function resolveRuntimeCredentials(
+  params: ResolveRuntimeCredentialsParams,
+  options?: ResolveRuntimeCredentialsOptions,
+): Promise<AgentRuntimeCredentialsResponseDto> {
+  const runtimeConfig = options?.runtimeConfig ?? config;
+  const getCredentialBag = options?.getCredentialBag ?? getSecretsByNamespace;
+  const providerConfig = await getModelProviderConfig({
+    workspaceId: params.workspaceId,
+    providerId: params.provider,
+  });
+
+  if (providerConfig) {
+    try {
+      const values = await getCredentialBag({
+        workspaceId: params.workspaceId,
+        namespace: agentSystemNamespace(params.provider),
+      });
+      if (providerConfig.kind === 'custom') {
+        const credentials = storeValuesToCustomRuntimeCredentials(values);
+        agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});
+        return toResponse(params, credentials, providerConfig);
+      }
+
+      const providerId = params.provider as SupportedModelProviderId;
+      const credentials = storeValuesToRuntimeCredentials(providerId, values);
+      if (!modelProviderCredentialKeysMatch(providerId, credentials)) {
+        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);
+      }
+      agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});
+      return toResponse(params, credentials, providerConfig);
+    } catch (error) {
+      if (error instanceof SecretDecryptionError) {
+        agentRuntimeConfigResolvedCount.add(1, {
+          source: 'workspace',
+          outcome: 'decryption_failed',
+        });
+      }
+      throw error;
+    }
+  }
+
+  const instanceCredentials = instanceFallbackCredentials(params.provider, runtimeConfig);
+  if (instanceCredentials) {
+    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});
+    return toResponse(params, instanceCredentials);
+  }
+
+  agentRuntimeConfigResolvedCount.add(1, {
+    source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',
+    outcome: 'unavailable',
+  });
+  throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);
+}
+
+export function getInstanceDefaultModelProviderApiKeyField(
+  providerId: ModelProviderRef,
+): 'api_key' | undefined {
+  const credentialFields =
+    getModelProviderEntry(providerId as SupportedModelProviderId)?.credential_fields ?? [];
+  const field = credentialFields[0];
+  if (credentialFields.length !== 1 || field?.key !== 'api_key' || !field.secret) {
+    return undefined;
+  }
+  return 'api_key';
+}
+
+function instanceFallbackCredentials(
+  providerId: ModelProviderRef,
+  runtimeConfig: RuntimeCredentialsConfig,
+): Record<string, string> | undefined {
+  const instanceApiKey = runtimeConfig.AGENT_DEFAULT_PROVIDER_API_KEY;
+  if (providerId !== runtimeConfig.AGENT_DEFAULT_PROVIDER || !instanceApiKey) return undefined;
+
+  const fieldKey = getInstanceDefaultModelProviderApiKeyField(providerId);
+  if (!fieldKey) return undefined;
+
+  return {[fieldKey]: instanceApiKey};
+}
+
+function toResponse(
+  params: ResolveRuntimeCredentialsParams,
+  credentials: Record<string, string>,
+  providerConfig?: ModelProviderConfig | undefined,
+): AgentRuntimeCredentialsResponseDto {
+  const response: AgentRuntimeCredentialsResponseDto = {
+    harness: params.harness,
+    provider_id: params.provider,
+    model: params.model,
+    thinking: params.thinking,
+    credentials,
+  };
+
+  if (providerConfig?.kind === 'custom') {
+    response.custom_provider = {
+      api: providerConfig.api ?? 'openai-responses',
+      base_url: providerConfig.baseUrl ?? '',
+      headers: providerConfig.headers ?? [],
+      secret_header_names: Object.keys(credentials)
+        .filter((key) => key.startsWith('header:'))
+        .map((key) => key.slice('header:'.length))
+        .sort(),
+      models: providerConfig.models ?? [],
+      requires_api_key: providerConfig.requiresApiKey,
+    };
+  }
+
+  return response;
+}

package/src/core/workspace-agent-defaults-resolver.ts

@@ -0,0 +1,42 @@
+import type {
+  AgentThinking,
+  ModelProviderRef,
+  SupportedModelProviderId,
+} from '@shipfox/api-agent-dto';
+import {config} from '#config.js';
+import {getAgentWorkspaceDefaultsSnapshot} from '#db/index.js';
+import type {AgentConfigResolutionContext, AgentDefaultsResolver} from './resolve-agent-config.js';
+import {resolveAgentConfig} from './resolve-agent-config.js';
+
+export async function createWorkspaceAgentDefaultsResolver(
+  workspaceId: string,
+): Promise<AgentDefaultsResolver> {
+  const snapshot = await getAgentWorkspaceDefaultsSnapshot(workspaceId);
+  const workspaceProviderConfigs = new Map<
+    ModelProviderRef,
+    {
+      kind: 'builtin' | 'custom';
+      defaultModel: string | null;
+      defaultThinking: AgentThinking;
+      models: (typeof snapshot.providerConfigs)[number]['models'];
+    }
+  >();
+  for (const providerConfig of snapshot.providerConfigs) {
+    workspaceProviderConfigs.set(providerConfig.providerId, {
+      kind: providerConfig.kind,
+      defaultModel: providerConfig.defaultModel,
+      defaultThinking: providerConfig.defaultThinking,
+      models: providerConfig.models,
+    });
+  }
+  const ctx: AgentConfigResolutionContext = {
+    workspaceDefaultHarnessId: snapshot.defaultHarnessId ?? null,
+    workspaceDefaultProviderId: snapshot.defaultProviderId ?? null,
+    workspaceProviderConfigs,
+    instanceDefaultProvider: config.AGENT_DEFAULT_PROVIDER as SupportedModelProviderId | undefined,
+    instanceDefaultModel: config.AGENT_DEFAULT_PROVIDER_MODEL,
+    instanceDefaultThinking: config.AGENT_DEFAULT_PROVIDER_THINKING as AgentThinking | undefined,
+  };
+
+  return (step) => resolveAgentConfig(step, ctx);
+}

package/src/db/agent-defaults-snapshot.ts

@@ -0,0 +1,49 @@
+import {type Harness, harnessSchema, type ModelProviderRef} from '@shipfox/api-agent-dto';
+import {eq, or} from 'drizzle-orm';
+import type {ModelProviderConfig} from '#core/entities/model-provider-config.js';
+import {db} from './db.js';
+import {agentWorkspaceSettings} from './schema/agent-workspace-settings.js';
+import {modelProviderConfigs, toModelProviderConfig} from './schema/model-provider-configs.js';
+
+export interface AgentWorkspaceDefaultsSnapshot {
+  readonly defaultHarnessId?: Harness | null | undefined;
+  readonly defaultProviderId?: ModelProviderRef | null | undefined;
+  readonly providerConfigs: ModelProviderConfig[];
+}
+
+export async function getAgentWorkspaceDefaultsSnapshot(
+  workspaceId: string,
+): Promise<AgentWorkspaceDefaultsSnapshot> {
+  const rows = await db()
+    .select({
+      settingsWorkspaceId: agentWorkspaceSettings.workspaceId,
+      workspaceDefaultHarnessId: agentWorkspaceSettings.defaultHarnessId,
+      workspaceDefaultProviderId: agentWorkspaceSettings.defaultProviderId,
+      providerConfig: modelProviderConfigs,
+    })
+    .from(agentWorkspaceSettings)
+    .fullJoin(
+      modelProviderConfigs,
+      eq(modelProviderConfigs.workspaceId, agentWorkspaceSettings.workspaceId),
+    )
+    .where(
+      or(
+        eq(agentWorkspaceSettings.workspaceId, workspaceId),
+        eq(modelProviderConfigs.workspaceId, workspaceId),
+      ),
+    )
+    .orderBy(modelProviderConfigs.providerId);
+
+  const settingsRow = rows.find((row) => row.settingsWorkspaceId !== null);
+  const parsedHarness = harnessSchema.safeParse(settingsRow?.workspaceDefaultHarnessId);
+  return {
+    defaultHarnessId: parsedHarness.success ? parsedHarness.data : null,
+    defaultProviderId: settingsRow?.workspaceDefaultProviderId as
+      | ModelProviderRef
+      | null
+      | undefined,
+    providerConfigs: rows.flatMap((row) =>
+      row.providerConfig === null ? [] : [toModelProviderConfig(row.providerConfig)],
+    ),
+  };
+}

package/src/db/agent-workspace-settings.test.ts

@@ -0,0 +1,111 @@
+import crypto from 'node:crypto';
+import type {AgentThinking, SupportedModelProviderId} from '@shipfox/api-agent-dto';
+import {ModelProviderConfigNotFoundError} from '#core/index.js';
+import {getAgentWorkspaceSettings, setDefaultHarness, setDefaultModelProvider} from '#db/index.js';
+import {
+  type UpsertModelProviderConfigParams,
+  upsertModelProviderConfig,
+} from './model-provider-configs.js';
+
+describe('agent workspace settings', () => {
+  let workspaceId: string;
+
+  beforeEach(() => {
+    workspaceId = crypto.randomUUID();
+  });
+
+  it('persists the workspace default model provider', async () => {
+    await upsertModelProviderConfig(
+      createModelProviderConfigParams({workspaceId, providerId: 'anthropic'}),
+    );
+
+    const settings = await setDefaultModelProvider({workspaceId, providerId: 'anthropic'});
+
+    const found = await getAgentWorkspaceSettings(workspaceId);
+    expect(found).toEqual(settings);
+    expect(found).toMatchObject({
+      workspaceId,
+      defaultHarnessId: null,
+      defaultProviderId: 'anthropic',
+    });
+    expect(found?.createdAt).toBeInstanceOf(Date);
+    expect(found?.updatedAt).toBeInstanceOf(Date);
+  });
+
+  it('updates the workspace default model provider', async () => {
+    await upsertModelProviderConfig(
+      createModelProviderConfigParams({workspaceId, providerId: 'anthropic'}),
+    );
+    await upsertModelProviderConfig(
+      createModelProviderConfigParams({workspaceId, providerId: 'openai'}),
+    );
+    await setDefaultModelProvider({workspaceId, providerId: 'anthropic'});
+
+    const updated = await setDefaultModelProvider({workspaceId, providerId: 'openai'});
+
+    const found = await getAgentWorkspaceSettings(workspaceId);
+    expect(found).toEqual(updated);
+    expect(found?.defaultProviderId).toBe('openai');
+  });
+
+  it('clears the workspace default model provider', async () => {
+    await upsertModelProviderConfig(
+      createModelProviderConfigParams({workspaceId, providerId: 'anthropic'}),
+    );
+    await setDefaultModelProvider({workspaceId, providerId: 'anthropic'});
+
+    await setDefaultModelProvider({workspaceId, providerId: null});
+
+    const found = await getAgentWorkspaceSettings(workspaceId);
+    expect(found?.defaultProviderId).toBeNull();
+  });
+
+  it('returns undefined for a workspace without settings', async () => {
+    const found = await getAgentWorkspaceSettings(workspaceId);
+
+    expect(found).toBeUndefined();
+  });
+
+  it('persists the workspace default harness', async () => {
+    const settings = await setDefaultHarness({workspaceId, harnessId: 'claude'});
+
+    const found = await getAgentWorkspaceSettings(workspaceId);
+    expect(found).toEqual(settings);
+    expect(found).toMatchObject({
+      workspaceId,
+      defaultHarnessId: 'claude',
+      defaultProviderId: null,
+    });
+  });
+
+  it('updates the workspace default harness without clearing the model provider default', async () => {
+    await upsertModelProviderConfig(
+      createModelProviderConfigParams({workspaceId, providerId: 'anthropic'}),
+    );
+    await setDefaultModelProvider({workspaceId, providerId: 'anthropic'});
+
+    const updated = await setDefaultHarness({workspaceId, harnessId: 'claude'});
+
+    expect(updated.defaultHarnessId).toBe('claude');
+    expect(updated.defaultProviderId).toBe('anthropic');
+  });
+
+  it('rejects a default model provider without a matching config', async () => {
+    const result = setDefaultModelProvider({workspaceId, providerId: 'anthropic'});
+
+    await expect(result).rejects.toBeInstanceOf(ModelProviderConfigNotFoundError);
+  });
+});
+
+function createModelProviderConfigParams(params: {
+  workspaceId: string;
+  providerId: SupportedModelProviderId;
+  defaultThinking?: AgentThinking | undefined;
+}): UpsertModelProviderConfigParams {
+  return {
+    workspaceId: params.workspaceId,
+    providerId: params.providerId,
+    defaultModel: 'claude-opus-4-8',
+    defaultThinking: params.defaultThinking ?? 'high',
+  };
+}