@shipfox/api-workflows 13.0.0 → 13.1.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-workflows",
   "license": "MIT",
-  "version": "13.0.0",
+  "version": "13.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -25,14 +25,14 @@
     "zod": "^4.4.3",
     "@shipfox/api-auth-context": "12.2.0",
     "@shipfox/api-auth-dto": "12.0.0",
-    "@shipfox/api-agent-dto": "12.2.0",
+    "@shipfox/api-agent-dto": "13.1.0",
     "@shipfox/annotations-dto": "12.3.0",
     "@shipfox/api-definitions-dto": "12.3.0",
     "@shipfox/api-projects-dto": "12.2.0",
     "@shipfox/api-integration-core-dto": "12.2.0",
     "@shipfox/api-runners-dto": "13.0.0",
     "@shipfox/api-secrets-dto": "12.0.0",
-    "@shipfox/api-workflows-dto": "13.0.0",
+    "@shipfox/api-workflows-dto": "13.1.0",
     "@shipfox/api-workspaces-dto": "12.0.0",
     "@shipfox/config": "1.2.4",
     "@shipfox/inter-module": "0.2.3",

package/src/core/errors.ts

@@ -38,13 +38,28 @@ export class WorkspaceNotFoundError extends Error {
   }
 }
 
+export interface AgentConfigUnresolvableErrorOptions {
+  readonly cause?: unknown;
+  readonly message?: string;
+  readonly code?: string;
+  readonly managedProviderId?: string;
+}
+
 export class AgentConfigUnresolvableError extends Error {
+  readonly code?: string | undefined;
+  readonly managedProviderId?: string | undefined;
+
   constructor(
     readonly definitionId: string,
-    options?: ErrorOptions | undefined,
+    options?: AgentConfigUnresolvableErrorOptions | undefined,
   ) {
-    super(`Agent configuration cannot be resolved for definition ${definitionId}`, options);
+    super(
+      options?.message ?? `Agent configuration cannot be resolved for definition ${definitionId}`,
+      options?.cause === undefined ? undefined : {cause: options.cause},
+    );
     this.name = 'AgentConfigUnresolvableError';
+    this.code = options?.code;
+    this.managedProviderId = options?.managedProviderId;
   }
 }
 

package/src/core/job-execution.test.ts

@@ -1,3 +1,7 @@
+import {
+  type AgentInterModuleClient,
+  agentInterModuleContract,
+} from '@shipfox/api-agent-dto/inter-module';
 import {
   WORKFLOWS_JOB_STEPS_SETTLED,
   WORKFLOWS_STEP_ATTEMPT_TERMINATED,
@@ -10,6 +14,7 @@ import {
   parseWorkflowTemplate,
   planInterpolationField,
 } from '@shipfox/expression';
+import {createInterModuleKnownError} from '@shipfox/inter-module';
 import {and, eq, sql} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {workflowsOutbox} from '#db/schema/outbox.js';
@@ -322,6 +327,55 @@ describe('nextStepForJob', () => {
     });
   });
 
+  test('reports managed provider policy failures as agent config errors', async () => {
+    const {jobId, steps} = await arrangeJobWithSteps(1);
+    const pending = steps[0];
+    if (!pending) throw new Error('Expected pending step');
+    await db()
+      .update(stepsTable)
+      .set({
+        config: {},
+        configPlan: {
+          agent: {
+            prompt: {segments: [{kind: 'literal', value: 'Review the change.'}]},
+          },
+        },
+      })
+      .where(eq(stepsTable.id, pending.id));
+
+    const agent = {
+      getValidationCatalog: vi.fn(),
+      resolveAgentConfig: vi.fn().mockRejectedValue(
+        createInterModuleKnownError(
+          agentInterModuleContract.methods.resolveAgentConfig,
+          'agent-config-invalid',
+          {
+            message: 'This instance only supports provider `shipfox`.',
+            managed_provider_id: 'shipfox',
+          },
+        ),
+      ),
+      resolveRuntimeCredentials: vi.fn(),
+    } as unknown as AgentInterModuleClient;
+
+    const next = await nextStepForJob(jobId, agent);
+
+    expect(next).toEqual({kind: 'done', status: 'failed'});
+    const after = await getStepsByJobId(jobId);
+    expect(after[0]).toMatchObject({
+      status: 'failed',
+      error: {
+        message: 'This instance only supports provider `shipfox`.',
+        reason: 'agent_config_invalid',
+        field: 'agent',
+        source: 'agent',
+        code: 'workspace-providers-disabled',
+        managedProviderId: 'shipfox',
+        agentConfigIssue: 'provider_unsupported',
+      },
+    });
+  });
+
   test('all steps succeeded → {done, succeeded}', async () => {
     const {jobId, steps} = await arrangeJobWithSteps(2);
     for (const step of steps) {

package/src/core/job-execution.ts

@@ -339,11 +339,16 @@ function dispatchConfigError(error: DispatchConfigError): Record<string, unknown
     };
   }
 
+  const isManagedProviderPolicyFailure =
+    error.code === 'workspace-providers-disabled' && error.managedProviderId !== undefined;
   return {
     message: error.message,
-    reason: 'config_unresolvable',
+    reason: isManagedProviderPolicyFailure ? 'agent_config_invalid' : 'config_unresolvable',
     field: 'agent',
     source: 'agent',
+    ...(error.code === undefined ? {} : {code: error.code}),
+    ...(error.managedProviderId === undefined ? {} : {managedProviderId: error.managedProviderId}),
+    ...(isManagedProviderPolicyFailure ? {agentConfigIssue: 'provider_unsupported'} : {}),
   };
 }
 

package/src/core/step-config/agent.ts

@@ -185,7 +185,14 @@ export async function completeAgentDefaults(params: {
       isInterModuleKnownError(agentInterModuleContract.methods.resolveAgentConfig, error) &&
       error.code === 'agent-config-invalid'
     ) {
-      throw new AgentConfigUnresolvableError(params.definitionId, {cause: error});
+      const managedProviderId = error.details.managed_provider_id;
+      throw new AgentConfigUnresolvableError(params.definitionId, {
+        cause: error,
+        ...(error.details.message === undefined ? {} : {message: error.details.message}),
+        ...(managedProviderId === undefined
+          ? {}
+          : {code: 'workspace-providers-disabled', managedProviderId}),
+      });
     }
     throw error;
   }

package/src/core/step-config/complete-step-dispatch-config.test.ts

@@ -453,6 +453,43 @@ describe('completeStepDispatchConfig', () => {
     await expect(act()).rejects.toThrow(AgentConfigUnresolvableError);
   });
 
+  it('preserves managed provider policy details in unresolvable agent config errors', async () => {
+    const pending = step({
+      type: 'agent',
+      config: {},
+      configPlan: {
+        agent: {
+          prompt: plannedField('Review the change.'),
+        },
+      },
+    });
+    const failingResolver: AgentDefaultsResolver = () => {
+      throw createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveAgentConfig,
+        'agent-config-invalid',
+        {
+          message: 'This instance only supports provider `shipfox`.',
+          managed_provider_id: 'shipfox',
+        },
+      );
+    };
+
+    const act = () =>
+      completeStepDispatchConfig({
+        step: pending,
+        context,
+        resolveAgentDefaults: failingResolver,
+        definitionId: 'def-1',
+      });
+
+    await expect(act()).rejects.toMatchObject({
+      name: 'AgentConfigUnresolvableError',
+      message: 'This instance only supports provider `shipfox`.',
+      code: 'workspace-providers-disabled',
+      managedProviderId: 'shipfox',
+    });
+  });
+
   it('throws when a server-side segment still survives dispatch', async () => {
     const pending = step({
       config: {},

package/src/presentation/dto/step.test.ts

@@ -43,12 +43,16 @@ describe('fromStepErrorDto', () => {
   it('persists the machine-readable agent config issue in camelCase', () => {
     const persisted = fromStepErrorDto({
       message: 'Missing credentials',
+      code: 'workspace-providers-disabled',
+      managed_provider_id: 'shipfox',
       reason: 'agent_config_invalid',
       agent_config_issue: 'provider_not_configured',
     });
 
     expect(persisted).toEqual({
       message: 'Missing credentials',
+      code: 'workspace-providers-disabled',
+      managedProviderId: 'shipfox',
       reason: 'agent_config_invalid',
       agentConfigIssue: 'provider_not_configured',
     });
@@ -180,6 +184,8 @@ describe('toStepDto error category', () => {
         type: 'agent',
         error: {
           message: 'Unknown provider "foo" for agent step.',
+          code: 'workspace-providers-disabled',
+          managedProviderId: 'shipfox',
           reason: 'agent_config_invalid',
           agentConfigIssue: 'provider_unsupported',
         },
@@ -188,6 +194,8 @@ describe('toStepDto error category', () => {
 
     expect(dto.error).toEqual({
       message: 'Unknown provider "foo" for agent step.',
+      code: 'workspace-providers-disabled',
+      managed_provider_id: 'shipfox',
       reason: 'agent_config_invalid',
       agent_config_issue: 'provider_unsupported',
       category: 'user',

package/src/presentation/dto/step.ts

@@ -22,6 +22,9 @@ function toStepErrorDto(
 ): StepErrorDto {
   if (error === null) return null;
   const message = typeof error.message === 'string' ? error.message : '';
+  const code = typeof error.code === 'string' ? error.code : undefined;
+  const managedProviderId =
+    typeof error.managedProviderId === 'string' ? error.managedProviderId : undefined;
   const exitCode = error.exitCode;
   const signal = typeof error.signal === 'string' ? error.signal : undefined;
   const field = typeof error.field === 'string' ? error.field : undefined;
@@ -30,6 +33,8 @@ function toStepErrorDto(
   const agentConfigIssue = agentConfigIssueSchema.safeParse(error.agentConfigIssue);
   return {
     message,
+    ...(code === undefined ? {} : {code}),
+    ...(managedProviderId === undefined ? {} : {managed_provider_id: managedProviderId}),
     ...(exitCode === null || typeof exitCode === 'number' ? {exit_code: exitCode} : {}),
     ...(signal === undefined ? {} : {signal}),
     ...(reason.success ? {reason: reason.data} : {}),
@@ -48,6 +53,10 @@ export function fromStepErrorDto(error: StepErrorDto | undefined): Record<string
   if (!error) return null;
   return {
     message: error.message,
+    ...(error.code === undefined ? {} : {code: error.code}),
+    ...(error.managed_provider_id === undefined
+      ? {}
+      : {managedProviderId: error.managed_provider_id}),
     ...(error.exit_code === null || typeof error.exit_code === 'number'
       ? {exitCode: error.exit_code}
       : {}),

package/src/presentation/routes/agent-runtime-config.test.ts

@@ -8,10 +8,15 @@ import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
 import {eq} from 'drizzle-orm';
 import type {StepStatus} from '#core/entities/step.js';
-import {db} from '#db/db.js';
+import {db, withTransaction} from '#db/db.js';
 import {jobs} from '#db/schema/jobs.js';
 import {steps as stepsTable} from '#db/schema/steps.js';
-import {createWorkflowRun, getJobsByWorkflowRunId, getStepsByJobId} from '#db/workflow-runs.js';
+import {
+  createWorkflowRun,
+  getJobsByWorkflowRunId,
+  getStepsByJobId,
+  insertRunningStepAttempt,
+} from '#db/workflow-runs.js';
 import {workflowModel} from '#test/factories/workflow-model.js';
 import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
 import {resolveTestAgentDefaults} from '#test/fixtures/agent-inter-module.js';
@@ -115,6 +120,13 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
       thinking: 'xhigh',
       credentials: {api_key: 'sk-workspace-secret'},
     });
+    expect(resolveRuntimeCredentials).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceId: run.workspaceId,
+        runId: run.id,
+        stepAttemptId: expect.any(String),
+      }),
+    );
   });
 
   test('derives the credential workspace from the leased job instead of hostile lease claims', async () => {
@@ -288,6 +300,63 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
     expect(res.json().code).toBe('model-provider-not-configured');
   });
 
+  test('returns managed provider policy details when workspace providers are disabled', async () => {
+    const {job, step} = await createRunningAgentStep();
+    resolveRuntimeCredentials.mockRejectedValueOnce(
+      createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveRuntimeCredentials,
+        'workspace-providers-disabled',
+        {
+          message: 'This instance only supports provider `shipfox`.',
+          managed_provider_id: 'shipfox',
+        },
+      ),
+    );
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: runtimeConfigUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(422);
+    expect(res.json()).toMatchObject({
+      code: 'workspace-providers-disabled',
+      details: {
+        message: 'This instance only supports provider `shipfox`.',
+        managed_provider_id: 'shipfox',
+      },
+    });
+  });
+
+  test('includes a fallback message when managed provider details omit one', async () => {
+    const {job, step} = await createRunningAgentStep();
+    resolveRuntimeCredentials.mockRejectedValueOnce(
+      createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveRuntimeCredentials,
+        'workspace-providers-disabled',
+        {managed_provider_id: 'shipfox'},
+      ),
+    );
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: runtimeConfigUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(422);
+    expect(res.json()).toMatchObject({
+      code: 'workspace-providers-disabled',
+      details: {
+        message: 'Workspace provider configuration is disabled',
+        managed_provider_id: 'shipfox',
+      },
+    });
+  });
+
   test('returns 409 and reports when workspace credentials cannot be decrypted', async () => {
     const {job, step} = await createRunningAgentStep();
     resolveRuntimeCredentials.mockRejectedValueOnce(
@@ -420,6 +489,19 @@ async function createStep(params: {
   const step = stepRows.find((candidate) => candidate.type === params.targetType);
   if (!step) throw new Error(`createStep: ${params.targetType} step not found`);
   await db().update(stepsTable).set({status: params.status}).where(eq(stepsTable.id, step.id));
+  if (params.status === 'running') {
+    await withTransaction((tx) =>
+      insertRunningStepAttempt(
+        {
+          jobExecutionId: step.jobExecutionId,
+          stepId: step.id,
+          attempt: step.currentAttempt,
+          config: step.config,
+        },
+        tx,
+      ),
+    );
+  }
 
   return {
     run,

package/src/presentation/routes/agent-runtime-config.ts

@@ -13,6 +13,7 @@ import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {captureException} from '@shipfox/node-error-monitoring';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {ZodError} from 'zod';
+import {getStepAttemptDetail} from '#db/index.js';
 import {loadRunningLeasedStep} from './leased-step.js';
 
 export function createAgentRuntimeConfigRoute(params: {
@@ -63,6 +64,22 @@ export function createAgentRuntimeConfigRoute(params: {
           },
         );
       }
+      if (
+        isInterModuleKnownError(
+          agentInterModuleContract.methods.resolveRuntimeCredentials,
+          error,
+        ) &&
+        error.code === 'workspace-providers-disabled'
+      ) {
+        const message = error.details.message ?? 'Workspace provider configuration is disabled';
+        throw new ClientError(message, 'workspace-providers-disabled', {
+          status: 422,
+          details: {
+            managed_provider_id: error.details.managed_provider_id,
+            message,
+          },
+        });
+      }
       throw error;
     },
     handler: async (request, reply) => {
@@ -91,8 +108,15 @@ export function createAgentRuntimeConfigRoute(params: {
         throw error;
       }
 
+      const stepAttempt = await getStepAttemptDetail({stepId, attempt});
+      if (!stepAttempt) {
+        throw new ClientError('Step attempt not found', 'step-attempt-not-found', {status: 409});
+      }
+
       const runtimeConfig = await params.agent.resolveRuntimeCredentials({
         workspaceId,
+        runId: stepAttempt.workflowRunId,
+        stepAttemptId: stepAttempt.attempt.id,
         harness: agentConfig.harness,
         provider: agentConfig.provider,
         model: agentConfig.model,