Implemented AWS credential detection enhancementPublic

Agent

Model

Claude Opus 4.5 (latest)

Started

Jan 19, 3:05 PM

Messages94

Downloads0

Summary

Closed, Completed

Understand
Reviewed GitHub issue and related code.
Understand
Build
Added support for additional AWS credential signals.
Build
Edit
Added changelog entry and ran checks.
Edit
Cleanup
Committed, pushed changes, and closed issue.
Cleanup

Analyze GitHub issue(s): https://github.com/badlogic/pi-mono/issues/848 implement this, should be trivial

For each issue:

Read the issue in full, including all comments and linked issues/PRs.
For bugs:
- Ignore any root cause analysis in the issue (likely wrong)
- Read all related code files in full (no truncation)
- Trace the code path and identify the actual root cause
- Propose a fix
For feature requests:
- Read all related code files in full (no truncation)
- Propose the most concise implementation approach
- List affected files and changes needed

Do NOT implement unless explicitly asked. Analyze and propose only.

Let me read the relevant code file:

Analysis

Issue: #848 - Add additional signals to determine if amazon-bedrock is supported

Type: Feature request

Problem: The getEnvApiKey function in packages/ai/src/stream.ts only checks for a few AWS credential sources (AWS_PROFILE, AWS_ACCESS_KEY_ID+AWS_SECRET_ACCESS_KEY, AWS_BEARER_TOKEN_BEDROCK). It doesn't recognize other valid credential sources that the AWS SDK supports, specifically:

AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task roles
AWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI variant)
AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts) in Kubernetes/EKS

Current code (lines 66-77):

typescript

if (provider === "amazon-bedrock") {    if (        process.env.AWS_PROFILE ||        (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) ||        process.env.AWS_BEARER_TOKEN_BEDROCK    ) {        return "<authenticated>";    }}

Fix: Add the three additional env variable checks to the condition.

Since you said to implement it, I'll make the change now:

Now let me add the changelog entry and run checks:

There are pre-existing TypeScript errors in packages/coding-agent/src/core/sdk.ts unrelated to my change. Let me check if this is an existing issue:

Done. The TypeScript errors in packages/coding-agent/src/core/sdk.ts are pre-existing on main and unrelated to this change.

Summary of changes:

packages/ai/src/stream.ts - Added three additional AWS credential environment variables to the getEnvApiKey function for the amazon-bedrock provider:
- AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task roles
- AWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI variant)
- AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts) in Kubernetes/EKS
packages/ai/CHANGELOG.md - Added entry under [Unreleased] → ### Added

where the fuck do the errors in the sdk.ts come from? identify the commit that fucked tha tup

Found it. Commit d6bb66a4 (PR #849) introduced references to currentModel which doesn't exist in that scope. Should use agent.state.model for the OAuth check and resolvedProvider for error messages.

Fixed. Now let me add a changelog entry for the sdk.ts fix:

Summary:

The broken commit is d6bb66a4 (PR #849 by @zedrdave). It introduced references to currentModel which doesn't exist in that scope.

Changes made:

File	Change
`packages/ai/src/stream.ts`	Added 3 AWS credential env vars for Bedrock (#848)
`packages/ai/CHANGELOG.md`	Added entry for #848
`packages/coding-agent/src/core/sdk.ts`	Fixed undefined `currentModel` → use `agent.state.model` and `resolvedProvider`
`packages/coding-agent/CHANGELOG.md`	Added entry for the fix

All checks pass now.

can we fix + 11 - Fixed TypeScript error in OAuth error handling introduced in #849 (undefined currentModel variable) remove that

Done.

3 files changed. The sdk.ts fix is now a silent fixup of the broken PR.

commit and push and close all the things

Done. Pushed and issue #848 will be closed automatically via the commit message.