@shipfox/api-workflows 4.0.0 → 6.0.0

package/src/db/workflow-runs/run-rerun.ts

@@ -1,3 +1,4 @@
+import {readPersistedWorkflowModel} from '@shipfox/api-definitions-dto';
 import {and, asc, eq, inArray, sql} from 'drizzle-orm';
 import {isWorkflowRunTerminal, type WorkflowRun} from '#core/entities/workflow-run.js';
 import {NoFailedJobsError, RunNotTerminalError, SourceRunNotFoundError} from '#core/errors.js';
@@ -175,9 +176,11 @@ function materializeRerunGraphJobs(params: {
   readonly sourceJobByJobExecutionId: ReadonlyMap<string, JobDb>;
   readonly sourceSteps: readonly StepDb[];
 }): readonly MaterializedRunGraphJob[] {
-  const sourceModelJobByKey = new Map(
-    (params.sourceAttempt.model?.jobs ?? []).map((job) => [job.key, job]),
-  );
+  const sourceModel =
+    params.sourceAttempt.model === null
+      ? null
+      : readPersistedWorkflowModel(params.sourceAttempt.model);
+  const sourceModelJobByKey = new Map((sourceModel?.jobs ?? []).map((job) => [job.key, job]));
   const sourceStepsByJobId = new Map<string, StepDb[]>();
   for (const step of params.sourceSteps) {
     const sourceJob = params.sourceJobByJobExecutionId.get(step.jobExecutionId);

package/src/index.ts

@@ -1,11 +1,19 @@
 import {dirname, resolve} from 'node:path';
 import {fileURLToPath} from 'node:url';
+import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
+import type {DefinitionsInterModuleClient} from '@shipfox/api-definitions-dto/inter-module';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {
   RUNNER_JOB_CLAIMED,
   RUNNER_JOB_LEASE_EXPIRED,
   RUNNER_JOB_QUEUED,
   type RunnersEventMap,
 } from '@shipfox/api-runners-dto';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import {
   WORKFLOWS_JOB_EVENT_DELIVERED,
   WORKFLOWS_JOB_STEPS_SETTLED,
@@ -18,6 +26,7 @@ import {type ShipfoxModule, subscriberFactory} from '@shipfox/node-module';
 import {db, migrationsPath, workflowsOutbox} from '#db/index.js';
 import {registerWorkflowsServiceMetrics} from '#metrics/index.js';
 import {
+  createWorkflowRoutes,
   onJobEventDelivered,
   onJobStepsSettled,
   onRunnerJobClaimed,
@@ -25,14 +34,10 @@ import {
   onRunnerJobQueued,
   onWorkflowRunAttemptCreated,
   onWorkflowRunCancelled,
-  routes,
 } from '#presentation/index.js';
+import {createWorkflowsInterModulePresentation} from '#presentation/inter-module.js';
 import {createOrchestrationActivities, WORKFLOWS_TASK_QUEUE} from '#temporal/index.js';
 
-export {
-  clearAgentToolMaterializationServices,
-  setAgentToolMaterializationServices,
-} from '#core/agent-tools.js';
 export type {
   Job,
   JobListenerEvent,
@@ -51,7 +56,6 @@ export {
   runWorkflow,
   WorkflowRunNotCancellableError,
 } from '#core/index.js';
-export {setSourceControl} from '#core/source-control.js';
 export {
   closeDb,
   type DeliverEventToListenerParams,
@@ -63,7 +67,6 @@ export {
   migrationsPath,
   workflowsOutbox,
 } from '#db/index.js';
-export {routes} from '#presentation/index.js';
 export {loadRunningLeasedStep} from '#presentation/routes/leased-step.js';
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -71,29 +74,68 @@ const workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');
 
 const subscriber = subscriberFactory<WorkflowsEventMapDto & RunnersEventMap>();
 
-export const workflowsModule: ShipfoxModule = {
-  name: 'workflows',
-  database: {db, migrationsPath},
-  routes,
-  metrics: registerWorkflowsServiceMetrics,
-  publishers: [
-    {name: 'workflows', table: workflowsOutbox, db, eventSchemas: workflowsEventSchemas},
-  ],
-  subscribers: [
-    subscriber(WORKFLOWS_WORKFLOW_RUN_ATTEMPT_CREATED, onWorkflowRunAttemptCreated),
-    subscriber(WORKFLOWS_WORKFLOW_RUN_CANCELLED, onWorkflowRunCancelled),
-    subscriber(WORKFLOWS_JOB_EVENT_DELIVERED, onJobEventDelivered),
-    subscriber(WORKFLOWS_JOB_STEPS_SETTLED, onJobStepsSettled),
-    subscriber(RUNNER_JOB_LEASE_EXPIRED, onRunnerJobLeaseExpired),
-    subscriber(RUNNER_JOB_QUEUED, onRunnerJobQueued),
-    subscriber(RUNNER_JOB_CLAIMED, onRunnerJobClaimed),
-  ],
-  workers: [
-    {
-      taskQueue: WORKFLOWS_TASK_QUEUE,
-      workflowsPath,
-      activities: createOrchestrationActivities,
-      workflows: [],
-    },
-  ],
-};
+export function createWorkflowsModule({
+  agent,
+  definitions,
+  annotations,
+  auth,
+  integrations,
+  projects,
+  runners,
+  secrets,
+}: {
+  agent: AgentInterModuleClient;
+  definitions: DefinitionsInterModuleClient;
+  annotations: AnnotationsInterModuleClient;
+  auth: AuthInterModuleClient;
+  integrations: IntegrationsModuleClient;
+  projects: ProjectsModuleClient;
+  runners: RunnersInterModuleClient;
+  secrets: SecretsInterModuleClient;
+}): ShipfoxModule {
+  return {
+    name: 'workflows',
+    database: {db, migrationsPath},
+    routes: createWorkflowRoutes({
+      agent,
+      annotations,
+      auth,
+      integrations,
+      projects,
+      runners,
+      secrets,
+    }),
+    metrics: registerWorkflowsServiceMetrics,
+    publishers: [
+      {name: 'workflows', table: workflowsOutbox, db, eventSchemas: workflowsEventSchemas},
+    ],
+    subscribers: [
+      subscriber(WORKFLOWS_WORKFLOW_RUN_ATTEMPT_CREATED, onWorkflowRunAttemptCreated),
+      subscriber(WORKFLOWS_WORKFLOW_RUN_CANCELLED, onWorkflowRunCancelled),
+      subscriber(WORKFLOWS_JOB_EVENT_DELIVERED, onJobEventDelivered),
+      subscriber(WORKFLOWS_JOB_STEPS_SETTLED, onJobStepsSettled),
+      subscriber(RUNNER_JOB_LEASE_EXPIRED, onRunnerJobLeaseExpired),
+      subscriber(RUNNER_JOB_QUEUED, onRunnerJobQueued),
+      subscriber(RUNNER_JOB_CLAIMED, onRunnerJobClaimed),
+    ],
+    workers: [
+      {
+        taskQueue: WORKFLOWS_TASK_QUEUE,
+        workflowsPath,
+        activities: () =>
+          createOrchestrationActivities({agent, integrations, projects, runners, secrets}),
+        workflows: [],
+      },
+    ],
+    interModulePresentations: [
+      createWorkflowsInterModulePresentation({
+        agent,
+        definitions,
+        integrations,
+        projects,
+        runners,
+        secrets,
+      }),
+    ],
+  };
+}

package/src/presentation/dto/checkout-token.ts

@@ -1,4 +1,10 @@
-import type {CheckoutSpec} from '@shipfox/api-integration-core';
+type CheckoutSpec = {
+  repositoryUrl: string;
+  ref: string;
+  credentials?: {username: string; token: string; expiresAt: Date} | undefined;
+  gitAuthor?: {name: string; email: string} | undefined;
+};
+
 import type {CheckoutTokenResponseDto} from '@shipfox/api-workflows-dto';
 
 const SCP_LIKE_HOST_RE = /^(?:[^@:/]+@)?([^:/]+):/;

package/src/presentation/index.ts

@@ -1,4 +1,4 @@
-export {workflowRoutes as routes} from './routes/index.js';
+export {createWorkflowRoutes} from './routes/index.js';
 export {
   onJobEventDelivered,
   onJobStepsSettled,

package/src/presentation/inter-module.test.ts

@@ -0,0 +1,149 @@
+import {workflowsInterModuleContract} from '@shipfox/api-workflows-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
+import {InvalidJobRunnerLabelsError} from '#core/errors.js';
+import {
+  AgentConfigUnresolvableError,
+  AgentIntegrationMaterializationError,
+  DefinitionNotFoundError,
+  InterpolationUnresolvableError,
+  ProjectMismatchError,
+} from '#core/index.js';
+import {createWorkflowsInterModulePresentation, toStartRunKnownError} from './inter-module.js';
+
+const mocks = vi.hoisted(() => ({
+  getJobScope: vi.fn(),
+  getStepById: vi.fn(),
+  getStepByIdForJobExecution: vi.fn(),
+}));
+
+vi.mock('#db/index.js', () => mocks);
+
+const input = {
+  workspaceId: '00000000-0000-4000-8000-000000000001',
+  projectId: '00000000-0000-4000-8000-000000000002',
+  definitionId: '00000000-0000-4000-8000-000000000003',
+  triggerPayload: {
+    provider: 'manual' as const,
+    source: 'manual' as const,
+    event: 'fire' as const,
+    subscriptionId: '00000000-0000-4000-8000-000000000004',
+    userId: '00000000-0000-4000-8000-000000000005',
+  },
+  idempotencyKey: 'manual-1',
+};
+
+describe('Workflows inter-module presentation', () => {
+  beforeEach(() => {
+    mocks.getJobScope.mockReset();
+    mocks.getStepById.mockReset();
+    mocks.getStepByIdForJobExecution.mockReset();
+  });
+
+  it('returns only the resolved harness for Logs', async () => {
+    mocks.getStepById.mockResolvedValue({config: {harness: 'claude'}});
+    const presentation = createWorkflowsInterModulePresentation({
+      agent: {} as never,
+      definitions: {} as never,
+      integrations: {} as never,
+      projects: {} as never,
+      runners: {} as never,
+      secrets: {} as never,
+    });
+
+    const result = await presentation.handlers.getStepLogContext(
+      {stepId: '00000000-0000-4000-8000-000000000006'},
+      {signal: new AbortController().signal},
+    );
+
+    expect(result).toEqual({harness: 'claude'});
+  });
+
+  it('returns materialized agent integrations for the active leased step', async () => {
+    const input = {
+      jobId: '00000000-0000-4000-8000-000000000006',
+      jobExecutionId: '00000000-0000-4000-8000-000000000007',
+      runnerSessionId: '00000000-0000-4000-8000-000000000008',
+      stepId: '00000000-0000-4000-8000-000000000009',
+      attempt: 1,
+    };
+    const integration = {
+      connectionId: 'connection-1',
+      connectionSlug: 'github',
+      provider: 'github',
+      requiredScope: [],
+      tools: [
+        {
+          id: 'files',
+          sensitivity: 'read' as const,
+          sensitive: false,
+          requiredScope: [],
+          inputSchema: {},
+        },
+      ],
+    };
+    mocks.getStepByIdForJobExecution.mockResolvedValue({
+      currentAttempt: input.attempt,
+      status: 'running',
+      type: 'agent',
+      config: {
+        harness: 'pi',
+        provider: 'openai',
+        model: 'gpt-5',
+        thinking: 'off',
+        prompt: 'Review the change.',
+        integrations: [integration],
+      },
+    });
+    mocks.getJobScope.mockResolvedValue({workspaceId: '00000000-0000-4000-8000-000000000010'});
+    const runners = {getLeaseState: vi.fn().mockResolvedValue({active: true})};
+    const presentation = createWorkflowsInterModulePresentation({
+      agent: {} as never,
+      definitions: {} as never,
+      integrations: {} as never,
+      projects: {} as never,
+      runners: runners as never,
+      secrets: {} as never,
+    });
+
+    const result = await presentation.handlers.getLeasedAgentToolContext(input, {
+      signal: new AbortController().signal,
+    });
+
+    expect(result).toEqual({
+      workspaceId: '00000000-0000-4000-8000-000000000010',
+      integrations: [integration],
+    });
+    expect(runners.getLeaseState).toHaveBeenCalledWith({
+      jobId: input.jobId,
+      jobExecutionId: input.jobExecutionId,
+      runnerSessionId: input.runnerSessionId,
+    });
+  });
+
+  test.each([
+    ['definition-not-found', () => new DefinitionNotFoundError(input.definitionId)],
+    ['project-mismatch', () => new ProjectMismatchError(input.projectId, input.definitionId)],
+    ['agent-config-unresolvable', () => new AgentConfigUnresolvableError(input.definitionId)],
+    [
+      'agent-integration-materialization-failed',
+      () => new AgentIntegrationMaterializationError('integration unavailable'),
+    ],
+    [
+      'interpolation-unresolvable',
+      () =>
+        new InterpolationUnresolvableError(input.definitionId, {
+          field: 'env',
+          source: 'event.ref',
+          envKey: 'REF',
+        }),
+    ],
+    ['invalid-job-runner-labels', () => new InvalidJobRunnerLabelsError(['gpu'])],
+  ] as const)('maps %s to the published contract error', (code, error) => {
+    const result = toStartRunKnownError(error(), input.definitionId);
+
+    expect(
+      isInterModuleKnownError(workflowsInterModuleContract.methods.startRunFromTrigger, result) &&
+        result.code,
+    ).toBe(code);
+  });
+});

package/src/presentation/inter-module.ts

@@ -0,0 +1,132 @@
+import {
+  DEFAULT_HARNESS,
+  harnessSchema,
+  materializedAgentStepConfigSchema,
+} from '@shipfox/api-agent-dto';
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import type {DefinitionsInterModuleClient} from '@shipfox/api-definitions-dto/inter-module';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
+import {workflowsInterModuleContract} from '@shipfox/api-workflows-dto/inter-module';
+import {
+  createInterModuleKnownError,
+  defineInterModulePresentation,
+  type InterModulePresentation,
+} from '@shipfox/inter-module';
+import {InvalidJobRunnerLabelsError} from '#core/errors.js';
+import {
+  AgentConfigUnresolvableError,
+  AgentIntegrationMaterializationError,
+  DefinitionNotFoundError,
+  InterpolationUnresolvableError,
+  ProjectMismatchError,
+  runWorkflow,
+} from '#core/index.js';
+import {getJobScope, getStepById, getStepByIdForJobExecution} from '#db/index.js';
+import {deliverEventToListener} from '#db/job-listener-events.js';
+
+export function createWorkflowsInterModulePresentation(params: {
+  agent: AgentInterModuleClient;
+  definitions: DefinitionsInterModuleClient;
+  secrets: Pick<SecretsInterModuleClient, 'getVariablesByNamespace'>;
+  runners: RunnersInterModuleClient;
+  integrations: IntegrationsModuleClient;
+  projects: ProjectsModuleClient;
+}): InterModulePresentation<typeof workflowsInterModuleContract> {
+  return defineInterModulePresentation(workflowsInterModuleContract, {
+    startRunFromTrigger: async (input) => {
+      try {
+        const run = await runWorkflow(
+          params.definitions,
+          {
+            agent: params.agent,
+            workspaceId: input.workspaceId,
+            projectId: input.projectId,
+            definitionId: input.definitionId,
+            triggerPayload: input.triggerPayload,
+            inputs: input.inputs,
+            triggerIdempotencyKey: input.idempotencyKey,
+            integrations: params.integrations,
+            projects: params.projects,
+          },
+          {secrets: params.secrets},
+        );
+        return {id: run.id, name: run.name};
+      } catch (error) {
+        throw toStartRunKnownError(error, input.definitionId);
+      }
+    },
+    deliverEventToJobListener: async (input) =>
+      await deliverEventToListener({...input, receivedAt: new Date(input.receivedAt)}),
+    getStepLogContext: async ({stepId}) => {
+      const step = await getStepById(stepId);
+      const parsed = harnessSchema.safeParse(step?.config.harness);
+      return {harness: parsed.success ? parsed.data : DEFAULT_HARNESS};
+    },
+    getLeasedAgentToolContext: async (input) => {
+      const method = workflowsInterModuleContract.methods.getLeasedAgentToolContext;
+      const {active: leaseIsActive} = await params.runners.getLeaseState({
+        jobId: input.jobId,
+        jobExecutionId: input.jobExecutionId,
+        runnerSessionId: input.runnerSessionId,
+      });
+      if (!leaseIsActive) throw createInterModuleKnownError(method, 'lease-not-active', {});
+
+      const step = await getStepByIdForJobExecution({
+        stepId: input.stepId,
+        jobExecutionId: input.jobExecutionId,
+      });
+      if (!step) throw createInterModuleKnownError(method, 'step-not-found', {});
+
+      const scope = await getJobScope(input.jobId);
+      if (!scope) throw createInterModuleKnownError(method, 'job-not-found', {});
+      if (step.currentAttempt !== input.attempt) {
+        throw createInterModuleKnownError(method, 'step-attempt-mismatch', {});
+      }
+      if (step.status !== 'running')
+        throw createInterModuleKnownError(method, 'step-not-running', {});
+      if (step.type !== 'agent')
+        throw createInterModuleKnownError(method, 'leased-step-not-agent', {});
+
+      const config = materializedAgentStepConfigSchema.safeParse(step.config);
+      if (!config.success) {
+        throw createInterModuleKnownError(method, 'agent-step-config-invalid', {});
+      }
+      return {workspaceId: scope.workspaceId, integrations: config.data.integrations ?? []};
+    },
+  });
+}
+
+export function toStartRunKnownError(error: unknown, definitionId: string): unknown {
+  const method = workflowsInterModuleContract.methods.startRunFromTrigger;
+  if (error instanceof DefinitionNotFoundError) {
+    return createInterModuleKnownError(method, 'definition-not-found', {definitionId});
+  }
+  if (error instanceof ProjectMismatchError) {
+    return createInterModuleKnownError(method, 'project-mismatch', {});
+  }
+  if (error instanceof AgentConfigUnresolvableError) {
+    return createInterModuleKnownError(method, 'agent-config-unresolvable', {
+      definitionId: error.definitionId,
+    });
+  }
+  if (error instanceof AgentIntegrationMaterializationError) {
+    return createInterModuleKnownError(method, 'agent-integration-materialization-failed', {});
+  }
+  if (error instanceof InterpolationUnresolvableError) {
+    return createInterModuleKnownError(method, 'interpolation-unresolvable', {
+      definitionId: error.definitionId,
+      field: error.field,
+      source: error.source,
+      ...(error.envKey === undefined ? {} : {envKey: error.envKey}),
+    });
+  }
+  if (error instanceof InvalidJobRunnerLabelsError) {
+    return createInterModuleKnownError(method, 'invalid-job-runner-labels', {
+      labels: [...error.labels],
+    });
+  }
+  return error;
+}

package/src/presentation/routes/agent-runtime-config.test.ts

@@ -1,10 +1,20 @@
-import {createCustomModelProviderConfig, testAndSaveModelProviderConfig} from '@shipfox/api-agent';
+import {
+  createAgentModule,
+  createCustomModelProviderConfig,
+  testAndSaveModelProviderConfig,
+} from '@shipfox/api-agent';
 import {resolveRuntimeCredentials} from '@shipfox/api-agent/core/resolve-runtime-credentials';
+import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
 import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
-import type {WorkflowModel} from '@shipfox/api-definitions';
-import {SecretDecryptionError} from '@shipfox/api-secrets';
+import type {WorkflowModel} from '@shipfox/api-definitions-dto';
+import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
+import {createInterModuleKnownError} from '@shipfox/inter-module';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
+import {
+  createInMemoryInterModuleTransport,
+  registerInterModulePresentations,
+} from '@shipfox/node-module/inter-module';
 import {eq} from 'drizzle-orm';
 import type {StepStatus} from '#core/entities/step.js';
 import {db} from '#db/db.js';
@@ -13,8 +23,14 @@ import {steps as stepsTable} from '#db/schema/steps.js';
 import {createWorkflowRun, getJobsByWorkflowRunId, getStepsByJobId} from '#db/workflow-runs.js';
 import {workflowModel} from '#test/factories/workflow-model.js';
 import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
+import {resolveTestAgentDefaults} from '#test/fixtures/agent-inter-module.js';
+import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
+import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {mintLeaseToken} from '#test/fixtures/lease-token.js';
-import {leaseTokenRouteGroup} from './index.js';
+import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
+import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
+import {createLeaseTokenRouteGroup} from './index.js';
 
 const {captureExceptionMock} = vi.hoisted(() => ({captureExceptionMock: vi.fn()}));
 vi.mock('@shipfox/api-agent/core/resolve-runtime-credentials', async (importOriginal) => {
@@ -25,6 +41,14 @@ vi.mock('@shipfox/api-agent/core/resolve-runtime-credentials', async (importOrig
 vi.mock('@shipfox/node-error-monitoring', () => ({captureException: captureExceptionMock}));
 
 const URL = '/runs/jobs/current/agent-runtime-config';
+const secrets = createTestSecretsClient();
+const agentTransport = createInMemoryInterModuleTransport();
+const agentTestClient = agentTransport.createClient(agentInterModuleContract);
+registerInterModulePresentations({
+  transport: agentTransport,
+  modules: [createAgentModule({secrets})],
+});
+agentTransport.seal();
 
 describe('GET /runs/jobs/current/agent-runtime-config', () => {
   let app: FastifyInstance;
@@ -33,7 +57,17 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
   beforeAll(async () => {
     app = await createApp({
       auth: [createLeaseTokenAuthMethod()],
-      routes: [leaseTokenRouteGroup],
+      routes: [
+        createLeaseTokenRouteGroup({
+          agent: agentTestClient,
+          annotations: annotationsTestClient,
+          auth: workflowsTestAuthClient,
+          integrations: {} as never,
+          projects: projectsTestClient,
+          runners: runnersTestClient,
+          secrets,
+        }),
+      ],
       swagger: false,
       fastifyOptions: {loggerInstance: logger},
     });
@@ -174,7 +208,7 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
           models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
         },
       },
-      {probe: async () => undefined},
+      {probe: async () => undefined, secrets},
     );
     const {job, step} = await createRunningAgentStep({
       workspaceId,
@@ -347,7 +381,13 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
 
   test('returns 409 and reports when workspace credentials cannot be decrypted', async () => {
     const {job, step} = await createRunningAgentStep();
-    vi.mocked(resolveRuntimeCredentials).mockRejectedValueOnce(new SecretDecryptionError());
+    vi.mocked(resolveRuntimeCredentials).mockRejectedValueOnce(
+      createInterModuleKnownError(
+        secretsInterModuleContract.methods.getSecretsByNamespace,
+        'secret-decryption-failed',
+        {},
+      ),
+    );
     const token = await mintActiveLeaseToken({jobId: job.id});
 
     const res = await app.inject({
@@ -359,7 +399,10 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
     expect(res.statusCode).toBe(409);
     expect(res.json().code).toBe('model-provider-credentials-invalid');
     expect(captureExceptionMock).toHaveBeenCalledWith(
-      expect.objectContaining({name: 'SecretDecryptionError'}),
+      expect.objectContaining({
+        name: 'InterModuleKnownError',
+        code: 'model-provider-credentials-invalid',
+      }),
     );
     expect(JSON.stringify(res.json())).not.toContain('sk-');
   });
@@ -394,7 +437,7 @@ async function saveWorkspaceCredential(workspaceId: string, apiKey: string) {
       providerId: 'anthropic',
       credentials: {api_key: apiKey},
     },
-    {probe: async () => undefined},
+    {probe: async () => undefined, secrets},
   );
 }
 
@@ -453,7 +496,7 @@ async function createStep(params: {
     projectId: crypto.randomUUID(),
     definitionId: crypto.randomUUID(),
     model: workflowModel({jobs: {build: {steps: params.steps}}}),
-    resolveAgentDefaults: params.resolveAgentDefaults,
+    resolveAgentDefaults: params.resolveAgentDefaults ?? resolveTestAgentDefaults,
     triggerPayload: {
       source: 'manual',
       event: 'fire',