@shipfox/api-workflows 13.0.0 → 14.0.0

package/src/core/run-workflow.ts

@@ -44,7 +44,7 @@ export async function runWorkflow(
   return createWorkflowRun({
     workspaceId: params.workspaceId,
     projectId: params.projectId,
-    definitionId: definition.id,
+    definitionId: definition.workflowId,
     name: definition.name,
     model,
     triggerPayload: params.triggerPayload,

package/src/core/step-config/agent.ts

@@ -185,7 +185,14 @@ export async function completeAgentDefaults(params: {
       isInterModuleKnownError(agentInterModuleContract.methods.resolveAgentConfig, error) &&
       error.code === 'agent-config-invalid'
     ) {
-      throw new AgentConfigUnresolvableError(params.definitionId, {cause: error});
+      const managedProviderId = error.details.managed_provider_id;
+      throw new AgentConfigUnresolvableError(params.definitionId, {
+        cause: error,
+        ...(error.details.message === undefined ? {} : {message: error.details.message}),
+        ...(managedProviderId === undefined
+          ? {}
+          : {code: 'workspace-providers-disabled', managedProviderId}),
+      });
     }
     throw error;
   }

package/src/core/step-config/complete-step-dispatch-config.test.ts

@@ -453,6 +453,43 @@ describe('completeStepDispatchConfig', () => {
     await expect(act()).rejects.toThrow(AgentConfigUnresolvableError);
   });
 
+  it('preserves managed provider policy details in unresolvable agent config errors', async () => {
+    const pending = step({
+      type: 'agent',
+      config: {},
+      configPlan: {
+        agent: {
+          prompt: plannedField('Review the change.'),
+        },
+      },
+    });
+    const failingResolver: AgentDefaultsResolver = () => {
+      throw createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveAgentConfig,
+        'agent-config-invalid',
+        {
+          message: 'This instance only supports provider `shipfox`.',
+          managed_provider_id: 'shipfox',
+        },
+      );
+    };
+
+    const act = () =>
+      completeStepDispatchConfig({
+        step: pending,
+        context,
+        resolveAgentDefaults: failingResolver,
+        definitionId: 'def-1',
+      });
+
+    await expect(act()).rejects.toMatchObject({
+      name: 'AgentConfigUnresolvableError',
+      message: 'This instance only supports provider `shipfox`.',
+      code: 'workspace-providers-disabled',
+      managedProviderId: 'shipfox',
+    });
+  });
+
   it('throws when a server-side segment still survives dispatch', async () => {
     const pending = step({
       config: {},

package/src/core/workflow-run-creation.test.ts

@@ -144,6 +144,8 @@ function workflowRun(params: {inputs?: Record<string, unknown> | null} = {}): Wo
     workflowName: 'Test workflow',
     nameOverride: null,
     status: 'pending',
+    origin: 'synced',
+    devSource: null,
     currentAttempt: 1,
     triggerProvider: null,
     triggerSource: triggerPayload.source,

package/src/db/job-listeners.test.ts

@@ -278,6 +278,23 @@ describe('activateJobListener', () => {
     expect(result.executionCount).toBe(2);
   });
 
+  it('projects matchers with the event omitted', async () => {
+    const job = await createInactiveListeningJobWithMatchers({
+      on: [{source: 'github_acme'}],
+      until: [{source: 'github_acme', filter: 'event.action == "closed"'}],
+    });
+
+    await activateJobListener({jobId: job.id, expectedVersion: job.version});
+
+    const payload = await activatedPayload(job.id);
+    expectListeningPayload(payload);
+    expect(payload.on[0]).toEqual({source: 'github_acme'});
+    expect(payload.until?.[0]).toEqual({
+      source: 'github_acme',
+      filter: 'event.action == "closed"',
+    });
+  });
+
   it('omits filter snapshots for matchers without non-event roots', async () => {
     const job = await createInactiveListeningJobWithMatchers({
       on: [{source: 'github', event: 'pull_request'}],

package/src/db/schema/workflow-runs.ts

@@ -16,6 +16,7 @@ import {
 import type {
   TriggerPayload,
   WorkflowRun,
+  WorkflowRunOriginState,
   WorkflowRunTriggerReference,
   WorkflowSourceSnapshot,
 } from '#core/entities/workflow-run.js';
@@ -31,6 +32,14 @@ export const workflowRunStatusEnum = pgEnum('workflows_run_status', [
 
 export const workflowRunRerunModeEnum = pgEnum('workflows_rerun_mode', ['all', 'failed']);
 
+export interface WorkflowRunDevSourceDb {
+  ref: string;
+  commit: string;
+  config_path: string;
+  initiated_by_user_id: string;
+  replay_of_event_id: string | null;
+}
+
 export const workflowRuns = pgTable(
   'workflow_runs',
   {
@@ -42,6 +51,8 @@ export const workflowRuns = pgTable(
     name: text('name'),
     workflowName: text('workflow_name').notNull(),
     status: workflowRunStatusEnum('status').notNull().default('pending'),
+    origin: text('origin').notNull().default('synced'),
+    devSource: jsonb('dev_source').$type<WorkflowRunDevSourceDb>(),
     currentAttempt: integer('current_attempt').notNull().default(1),
     triggerProvider: text('trigger_provider'),
     triggerSource: text('trigger_source').notNull(),
@@ -62,6 +73,12 @@ export const workflowRuns = pgTable(
     uniqueIndex('workflows_wr_trigger_idempotency_key_unique').on(table.triggerIdempotencyKey),
     uniqueIndex('workflows_wr_definition_number_unique').on(table.definitionId, table.number),
     index('workflows_wr_project_created_id_idx').on(table.projectId, table.createdAt, table.id),
+    index('workflows_wr_project_origin_created_id_idx').on(
+      table.projectId,
+      table.origin,
+      table.createdAt,
+      table.id,
+    ),
     index('workflows_wr_project_status_created_id_idx').on(
       table.projectId,
       table.status,
@@ -85,6 +102,18 @@ export const workflowRuns = pgTable(
     // historical table grows.
     index('workflows_wr_running_idx').on(table.status).where(sql`${table.status} = 'running'`),
     check('workflows_wr_current_attempt_positive_ck', sql`${table.currentAttempt} > 0`),
+    check('workflows_wr_origin_ck', sql`${table.origin} in ('synced', 'dev')`),
+    check(
+      'workflows_wr_dev_source_ck',
+      sql`(
+        (${table.origin} = 'synced' and ${table.devSource} is null)
+        or (
+          ${table.origin} = 'dev'
+          and ${table.devSource} is not null
+          and jsonb_typeof(${table.devSource}) = 'object'
+        )
+      )`,
+    ),
   ],
 );
 
@@ -92,6 +121,7 @@ export type WorkflowRunDb = typeof workflowRuns.$inferSelect;
 export type WorkflowRunCreateDb = typeof workflowRuns.$inferInsert;
 
 export function toWorkflowRun(row: WorkflowRunDb): WorkflowRun {
+  const originState = toWorkflowRunOriginState(row);
   return {
     id: row.id,
     workspaceId: row.workspaceId,
@@ -102,6 +132,7 @@ export function toWorkflowRun(row: WorkflowRunDb): WorkflowRun {
     workflowName: row.workflowName,
     nameOverride: row.name,
     status: row.status,
+    ...originState,
     currentAttempt: row.currentAttempt,
     triggerProvider: row.triggerProvider,
     triggerSource: row.triggerSource,
@@ -119,3 +150,30 @@ export function toWorkflowRun(row: WorkflowRunDb): WorkflowRun {
     finishedAt: row.finishedAt,
   };
 }
+
+export function toWorkflowRunOriginState(
+  row: Pick<WorkflowRunDb, 'origin' | 'devSource'>,
+): WorkflowRunOriginState {
+  if (row.origin === 'synced') {
+    if (row.devSource !== null) {
+      throw new Error(`Synced workflow run has unexpected dev source`);
+    }
+    return {origin: 'synced', devSource: null};
+  }
+  if (row.origin !== 'dev') {
+    throw new Error(`Unknown workflow run origin: ${row.origin}`);
+  }
+  if (!row.devSource) {
+    throw new Error('Dev workflow run is missing its source');
+  }
+  return {
+    origin: 'dev',
+    devSource: {
+      ref: row.devSource.ref,
+      commit: row.devSource.commit,
+      configPath: row.devSource.config_path,
+      initiatedByUserId: row.devSource.initiated_by_user_id,
+      replayOfEventId: row.devSource.replay_of_event_id,
+    },
+  };
+}

package/src/db/workflow-runs/jobs.ts

@@ -5,7 +5,10 @@ import {and, asc, desc, eq, inArray, notInArray, sql} from 'drizzle-orm';
 import {isJobTerminal, type Job, type JobStatus, type JobStatusReason} from '#core/entities/job.js';
 import type {JobExecution} from '#core/entities/job-execution.js';
 import type {PersistedEvaluationTraceEntry} from '#core/entities/step.js';
-import type {WorkflowRunTriggerReference} from '#core/entities/workflow-run.js';
+import type {
+  WorkflowRunOriginState,
+  WorkflowRunTriggerReference,
+} from '#core/entities/workflow-run.js';
 import {JobNotFoundError} from '#core/errors.js';
 import {
   type DeriveJobSuccessResult,
@@ -21,7 +24,7 @@ import {writeWorkflowsOutboxEvent} from '../outbox-writes.js';
 import {jobExecutions, toJobExecution} from '../schema/job-executions.js';
 import {jobs, toJob} from '../schema/jobs.js';
 import {workflowRunAttempts} from '../schema/workflow-run-attempts.js';
-import {toWorkflowRun, workflowRuns} from '../schema/workflow-runs.js';
+import {toWorkflowRun, toWorkflowRunOriginState, workflowRuns} from '../schema/workflow-runs.js';
 import {getWorkflowRunById} from './queries.js';
 import {getWorkflowContextForJob, optimisticLockRetry, TERMINAL_JOB_STATUSES} from './shared.js';
 
@@ -71,6 +74,8 @@ export interface JobScope {
   workspaceId: string;
   projectId: string;
   triggerReference: WorkflowRunTriggerReference | null;
+  /** The run's origin state, so checkout fallbacks can read the dev source. */
+  run: WorkflowRunOriginState;
 }
 
 export async function getJobScope(jobId: string): Promise<JobScope | undefined> {
@@ -79,13 +84,22 @@ export async function getJobScope(jobId: string): Promise<JobScope | undefined>
       workspaceId: workflowRuns.workspaceId,
       projectId: workflowRuns.projectId,
       triggerReference: workflowRuns.triggerReference,
+      origin: workflowRuns.origin,
+      devSource: workflowRuns.devSource,
     })
     .from(jobs)
     .innerJoin(workflowRunAttempts, eq(jobs.workflowRunAttemptId, workflowRunAttempts.id))
     .innerJoin(workflowRuns, eq(workflowRunAttempts.workflowRunId, workflowRuns.id))
     .where(eq(jobs.id, jobId))
     .limit(1);
-  return rows[0];
+  const row = rows[0];
+  if (!row) return undefined;
+  return {
+    workspaceId: row.workspaceId,
+    projectId: row.projectId,
+    triggerReference: row.triggerReference,
+    run: toWorkflowRunOriginState(row),
+  };
 }
 
 export async function getDirectDependencyJobContexts(

package/src/db/workflow-runs/queries.ts

@@ -13,6 +13,7 @@ import type {
   WorkflowJobDetail,
   WorkflowRun,
   WorkflowRunDetail,
+  WorkflowRunOrigin,
   WorkflowRunStatus,
 } from '#core/entities/workflow-run.js';
 import {db} from '../db.js';
@@ -29,6 +30,7 @@ export interface WorkflowRunFilters {
   status?: WorkflowRunStatus | undefined;
   definitionId?: string | undefined;
   triggerSource?: string | undefined;
+  origin?: WorkflowRunOrigin | undefined;
   createdFrom?: Date | undefined;
   createdTo?: Date | undefined;
 }
@@ -145,7 +147,7 @@ export function buildWorkflowRunListConditions(params: {
   projectId: string;
   filters?: WorkflowRunFilters | undefined;
   cursor?: WorkflowRunCursor | undefined;
-  omit?: 'status' | 'definitionId' | 'triggerSource' | undefined;
+  omit?: 'status' | 'definitionId' | 'triggerSource' | 'origin' | undefined;
 }): SQL[] {
   const filters = params.filters;
   const conditions: SQL[] = [eq(workflowRuns.projectId, params.projectId)];
@@ -164,6 +166,9 @@ export function buildWorkflowRunListConditions(params: {
   if (filters?.triggerSource && params.omit !== 'triggerSource') {
     conditions.push(eq(workflowRuns.triggerSource, filters.triggerSource));
   }
+  if (filters?.origin && params.omit !== 'origin') {
+    conditions.push(eq(workflowRuns.origin, filters.origin));
+  }
   if (filters?.createdFrom) {
     conditions.push(gte(workflowRuns.createdAt, filters.createdFrom));
   }

package/src/db/workflow-runs/run-create.test.ts

@@ -48,6 +48,45 @@ describe('workflow run queries', () => {
   });
 
   describe('createWorkflowRun', () => {
+    test('enforces the workflow run origin and dev source relationship at the database boundary', async () => {
+      const run = await createWorkflowRun({
+        workspaceId,
+        projectId,
+        definitionId,
+        model: buildModel(),
+        triggerPayload: {
+          source: 'manual',
+          event: 'fire',
+          subscriptionId: crypto.randomUUID(),
+          userId: crypto.randomUUID(),
+        },
+      });
+
+      await expect(
+        db().execute(
+          sql`UPDATE ${workflowRuns} SET origin = 'dev', dev_source = '{}'::jsonb WHERE ${workflowRuns.id} = ${run.id}`,
+        ),
+      ).resolves.toBeDefined();
+
+      await expect(
+        db().update(workflowRuns).set({origin: 'synced'}).where(eq(workflowRuns.id, run.id)),
+      ).rejects.toThrow();
+
+      await db()
+        .update(workflowRuns)
+        .set({
+          origin: 'dev',
+          devSource: {
+            ref: 'main',
+            commit: 'abc123',
+            config_path: '.shipfox/workflows.yml',
+            initiated_by_user_id: crypto.randomUUID(),
+            replay_of_event_id: null,
+          },
+        })
+        .where(eq(workflowRuns.id, run.id));
+    });
+
     test('persists normalized integration trigger facts alongside the payload', async () => {
       const triggerConnectionId = crypto.randomUUID();
       const integrations = {

package/src/presentation/dto/step.test.ts

@@ -43,12 +43,16 @@ describe('fromStepErrorDto', () => {
   it('persists the machine-readable agent config issue in camelCase', () => {
     const persisted = fromStepErrorDto({
       message: 'Missing credentials',
+      code: 'workspace-providers-disabled',
+      managed_provider_id: 'shipfox',
       reason: 'agent_config_invalid',
       agent_config_issue: 'provider_not_configured',
     });
 
     expect(persisted).toEqual({
       message: 'Missing credentials',
+      code: 'workspace-providers-disabled',
+      managedProviderId: 'shipfox',
       reason: 'agent_config_invalid',
       agentConfigIssue: 'provider_not_configured',
     });
@@ -180,6 +184,8 @@ describe('toStepDto error category', () => {
         type: 'agent',
         error: {
           message: 'Unknown provider "foo" for agent step.',
+          code: 'workspace-providers-disabled',
+          managedProviderId: 'shipfox',
           reason: 'agent_config_invalid',
           agentConfigIssue: 'provider_unsupported',
         },
@@ -188,6 +194,8 @@ describe('toStepDto error category', () => {
 
     expect(dto.error).toEqual({
       message: 'Unknown provider "foo" for agent step.',
+      code: 'workspace-providers-disabled',
+      managed_provider_id: 'shipfox',
       reason: 'agent_config_invalid',
       agent_config_issue: 'provider_unsupported',
       category: 'user',

package/src/presentation/dto/step.ts

@@ -22,6 +22,9 @@ function toStepErrorDto(
 ): StepErrorDto {
   if (error === null) return null;
   const message = typeof error.message === 'string' ? error.message : '';
+  const code = typeof error.code === 'string' ? error.code : undefined;
+  const managedProviderId =
+    typeof error.managedProviderId === 'string' ? error.managedProviderId : undefined;
   const exitCode = error.exitCode;
   const signal = typeof error.signal === 'string' ? error.signal : undefined;
   const field = typeof error.field === 'string' ? error.field : undefined;
@@ -30,6 +33,8 @@ function toStepErrorDto(
   const agentConfigIssue = agentConfigIssueSchema.safeParse(error.agentConfigIssue);
   return {
     message,
+    ...(code === undefined ? {} : {code}),
+    ...(managedProviderId === undefined ? {} : {managed_provider_id: managedProviderId}),
     ...(exitCode === null || typeof exitCode === 'number' ? {exit_code: exitCode} : {}),
     ...(signal === undefined ? {} : {signal}),
     ...(reason.success ? {reason: reason.data} : {}),
@@ -48,6 +53,10 @@ export function fromStepErrorDto(error: StepErrorDto | undefined): Record<string
   if (!error) return null;
   return {
     message: error.message,
+    ...(error.code === undefined ? {} : {code: error.code}),
+    ...(error.managed_provider_id === undefined
+      ? {}
+      : {managedProviderId: error.managed_provider_id}),
     ...(error.exit_code === null || typeof error.exit_code === 'number'
       ? {exitCode: error.exit_code}
       : {}),

package/src/presentation/dto/workflow-run.ts

@@ -1,10 +1,15 @@
 import type {
   WorkflowRunAttemptDto,
+  WorkflowRunDevSourceDto,
   WorkflowRunDto,
   WorkflowRunListItemDto,
   WorkflowRunTriggerReferenceDto,
 } from '@shipfox/api-workflows-dto';
-import type {WorkflowRun, WorkflowRunTriggerReference} from '#core/entities/workflow-run.js';
+import type {
+  WorkflowRun,
+  WorkflowRunDevSource,
+  WorkflowRunTriggerReference,
+} from '#core/entities/workflow-run.js';
 import type {WorkflowRunAttempt} from '#core/entities/workflow-run-attempt.js';
 import type {WorkflowRunJobsSummary} from '#db/index.js';
 
@@ -17,6 +22,8 @@ export function toRunDto(run: WorkflowRun, latestAttempt = run.currentAttempt):
     name: run.name,
     workflow_name: run.workflowName,
     status: run.status,
+    origin: run.origin,
+    dev_source: toDevSourceDto(run.devSource),
     current_attempt: run.currentAttempt,
     latest_attempt: latestAttempt,
     trigger_provider: run.triggerProvider,
@@ -76,6 +83,21 @@ function toTriggerReferenceDto(
   };
 }
 
+// The persisted dev source uses camelCase field names while the API contract is snake_case,
+// so each field is mapped explicitly rather than spread onto the response.
+function toDevSourceDto(
+  devSource: WorkflowRunDevSource | null | undefined,
+): WorkflowRunDevSourceDto | null {
+  if (!devSource) return null;
+  return {
+    ref: devSource.ref,
+    commit: devSource.commit,
+    config_path: devSource.configPath,
+    initiated_by_user_id: devSource.initiatedByUserId,
+    replay_of_event_id: devSource.replayOfEventId,
+  };
+}
+
 export function toRunAttemptDto(attempt: WorkflowRunAttempt): WorkflowRunAttemptDto {
   return {
     id: attempt.id,

package/src/presentation/routes/agent-runtime-config.test.ts

@@ -8,10 +8,15 @@ import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
 import {eq} from 'drizzle-orm';
 import type {StepStatus} from '#core/entities/step.js';
-import {db} from '#db/db.js';
+import {db, withTransaction} from '#db/db.js';
 import {jobs} from '#db/schema/jobs.js';
 import {steps as stepsTable} from '#db/schema/steps.js';
-import {createWorkflowRun, getJobsByWorkflowRunId, getStepsByJobId} from '#db/workflow-runs.js';
+import {
+  createWorkflowRun,
+  getJobsByWorkflowRunId,
+  getStepsByJobId,
+  insertRunningStepAttempt,
+} from '#db/workflow-runs.js';
 import {workflowModel} from '#test/factories/workflow-model.js';
 import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
 import {resolveTestAgentDefaults} from '#test/fixtures/agent-inter-module.js';
@@ -115,6 +120,13 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
       thinking: 'xhigh',
       credentials: {api_key: 'sk-workspace-secret'},
     });
+    expect(resolveRuntimeCredentials).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceId: run.workspaceId,
+        runId: run.id,
+        stepAttemptId: expect.any(String),
+      }),
+    );
   });
 
   test('derives the credential workspace from the leased job instead of hostile lease claims', async () => {
@@ -288,6 +300,63 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
     expect(res.json().code).toBe('model-provider-not-configured');
   });
 
+  test('returns managed provider policy details when workspace providers are disabled', async () => {
+    const {job, step} = await createRunningAgentStep();
+    resolveRuntimeCredentials.mockRejectedValueOnce(
+      createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveRuntimeCredentials,
+        'workspace-providers-disabled',
+        {
+          message: 'This instance only supports provider `shipfox`.',
+          managed_provider_id: 'shipfox',
+        },
+      ),
+    );
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: runtimeConfigUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(422);
+    expect(res.json()).toMatchObject({
+      code: 'workspace-providers-disabled',
+      details: {
+        message: 'This instance only supports provider `shipfox`.',
+        managed_provider_id: 'shipfox',
+      },
+    });
+  });
+
+  test('includes a fallback message when managed provider details omit one', async () => {
+    const {job, step} = await createRunningAgentStep();
+    resolveRuntimeCredentials.mockRejectedValueOnce(
+      createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveRuntimeCredentials,
+        'workspace-providers-disabled',
+        {managed_provider_id: 'shipfox'},
+      ),
+    );
+    const token = await mintActiveLeaseToken({jobId: job.id});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: runtimeConfigUrl(step.id, step.currentAttempt),
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(422);
+    expect(res.json()).toMatchObject({
+      code: 'workspace-providers-disabled',
+      details: {
+        message: 'Workspace provider configuration is disabled',
+        managed_provider_id: 'shipfox',
+      },
+    });
+  });
+
   test('returns 409 and reports when workspace credentials cannot be decrypted', async () => {
     const {job, step} = await createRunningAgentStep();
     resolveRuntimeCredentials.mockRejectedValueOnce(
@@ -420,6 +489,19 @@ async function createStep(params: {
   const step = stepRows.find((candidate) => candidate.type === params.targetType);
   if (!step) throw new Error(`createStep: ${params.targetType} step not found`);
   await db().update(stepsTable).set({status: params.status}).where(eq(stepsTable.id, step.id));
+  if (params.status === 'running') {
+    await withTransaction((tx) =>
+      insertRunningStepAttempt(
+        {
+          jobExecutionId: step.jobExecutionId,
+          stepId: step.id,
+          attempt: step.currentAttempt,
+          config: step.config,
+        },
+        tx,
+      ),
+    );
+  }
 
   return {
     run,

package/src/presentation/routes/agent-runtime-config.ts

@@ -13,6 +13,7 @@ import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {captureException} from '@shipfox/node-error-monitoring';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {ZodError} from 'zod';
+import {getStepAttemptDetail} from '#db/index.js';
 import {loadRunningLeasedStep} from './leased-step.js';
 
 export function createAgentRuntimeConfigRoute(params: {
@@ -63,6 +64,22 @@ export function createAgentRuntimeConfigRoute(params: {
           },
         );
       }
+      if (
+        isInterModuleKnownError(
+          agentInterModuleContract.methods.resolveRuntimeCredentials,
+          error,
+        ) &&
+        error.code === 'workspace-providers-disabled'
+      ) {
+        const message = error.details.message ?? 'Workspace provider configuration is disabled';
+        throw new ClientError(message, 'workspace-providers-disabled', {
+          status: 422,
+          details: {
+            managed_provider_id: error.details.managed_provider_id,
+            message,
+          },
+        });
+      }
       throw error;
     },
     handler: async (request, reply) => {
@@ -91,8 +108,15 @@ export function createAgentRuntimeConfigRoute(params: {
         throw error;
       }
 
+      const stepAttempt = await getStepAttemptDetail({stepId, attempt});
+      if (!stepAttempt) {
+        throw new ClientError('Step attempt not found', 'step-attempt-not-found', {status: 409});
+      }
+
       const runtimeConfig = await params.agent.resolveRuntimeCredentials({
         workspaceId,
+        runId: stepAttempt.workflowRunId,
+        stepAttemptId: stepAttempt.attempt.id,
         harness: agentConfig.harness,
         provider: agentConfig.provider,
         model: agentConfig.model,