Implemented AWS credential detection enhancement
Public
Implemented AWS credential detection enhancement
Agent
Pi
Model
Claude Opus 4.5 (latest)
Started
Jan 19, 3:05 PM
Messages94
Downloads0
Reviewed GitHub issue and related code.
UnderstandAdded support for additional AWS credential signals.
BuildAdded changelog entry and ran checks.
EditCommitted, pushed changes, and closed issue.
Cleanup
Analyze GitHub issue(s): https://github.com/badlogic/pi-mono/issues/848 implement this, should be trivial
For each issue:
Read the issue in full, including all comments and linked issues/PRs.
For bugs:
For feature requests:
Do NOT implement unless explicitly asked. Analyze and propose only.
The user wants me to analyze a GitHub issue and implement it. Let me first fetch the issue details.
>gh issue view 848 --json title,body,comments,labels,state --repo badlogic/pi-mono{"body":"### What do you want to change?\n\nIn `packages/ai/src/stream.ts` modify `getEnvApiKey` for amazon bedrock to treat these additional env variables as authenticated: `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`, `AWS_CONTAINER_CREDENTIALS_FULL_URI`, `AWS_WEB_IDENTITY_TOKEN_FILE`. Alternatively just introduce also a `PI_ALLOW_BEDROCK` env which returns true if it is set.\n\n### Why?\n\nI want to run pi with instance profile/task profile credentials. pi will pick up already these credentials due to the aws sdk using the default credential chain but the check doesn't support these. Instead of adding all the different ones we could just short-circuit it and support an explicit I KNOW WHAT I AM DOING JUST USE BEDROCK env variable \n\n### How? (optional)\n\n_No response_","comments":[{"id":"IC_kwDOPbFNk87gos83","author":{"login":"badlogic"},"authorAssociation":"OWNER","body":"Let's add all the bedrock env vars. ","createdAt":"2026-01-19T15:03:52Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/badlogic/pi-mono/issues/848#issuecomment-3768766263","viewerDidAuthor":true},{"id":"IC_kwDOPbFNk87gotIC","author":{"login":"badlogic"},"authorAssociation":"OWNER","body":"lgtm","createdAt":"2026-01-19T15:04:01Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/badlogic/pi-mono/issues/848#issuecomment-3768766978","viewerDidAuthor":true},{"id":"IC_kwDOPbFNk87gotV9","author":{"login":"github-actions"},"authorAssociation":"CONTRIBUTOR","body":"@mrud has been added to the approved contributors list. You can now submit PRs. Thanks for contributing!","createdAt":"2026-01-19T15:04:13Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/badlogic/pi-mono/issues/848#issuecomment-3768767869","viewerDidAuthor":false}],"labels":[],"state":"OPEN","title":"Add additional signals to determine if amazon-bedrock is supported"}Let me read the relevant file to understand the current implementation of getEnvApiKey for Bedrock.
Let me read the relevant code file:
Now I understand the issue. The getEnvApiKey function for amazon-bedrock currently only checks for:
AWS_PROFILEAWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEYAWS_BEARER_TOKEN_BEDROCKThe issue requests adding support for additional AWS credential sources that the AWS SDK supports:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - Used by ECS task rolesAWS_CONTAINER_CREDENTIALS_FULL_URI - Used by ECS task roles (full URI variant)AWS_WEB_IDENTITY_TOKEN_FILE - Used by IRSA (IAM Roles for Service Accounts) in Kubernetes/EKSThese are all valid credential sources that the AWS SDK's default credential provider chain will use. The issue asks to add these checks so pi recognizes when these credentials are available.
The user said "implement this" so I should proceed with the implementation.
The fix is simple - just add these three additional env variable checks to the bedrock section in getEnvApiKey.
Issue: #848 - Add additional signals to determine if amazon-bedrock is supported
Type: Feature request
Problem: The getEnvApiKey function in packages/ai/src/stream.ts only checks for a few AWS credential sources (AWS_PROFILE, AWS_ACCESS_KEY_ID+AWS_SECRET_ACCESS_KEY, AWS_BEARER_TOKEN_BEDROCK). It doesn't recognize other valid credential sources that the AWS SDK supports, specifically:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task rolesAWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI variant)AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts) in Kubernetes/EKSCurrent code (lines 66-77):
if (provider === "amazon-bedrock") { if ( process.env.AWS_PROFILE || (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) || process.env.AWS_BEARER_TOKEN_BEDROCK ) { return "<authenticated>"; }}Fix: Add the three additional env variable checks to the condition.
Since you said to implement it, I'll make the change now:
Now I need to update the CHANGELOG and run npm run check to make sure everything is good.
Now I need to add a changelog entry and run npm run check. Let me add the entry under [Unreleased] in the ### Added section (since this is a new feature).
Now let me add the changelog entry and run checks:
Now let me run npm run check to verify everything is good.
>cd /Users/badlogic/workspaces/pi-mono && npm run check 2>&1> pi-monorepo@0.0.3 check
> biome check --write . && tsgo --noEmit && npm run check -w @mariozechner/pi-web-ui
Checked 408 files in 251ms. No fixes applied.
packages/coding-agent/src/core/sdk.ts(644,48): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(647,37): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(649,23): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(653,31): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(654,61): error TS2304: Cannot find name 'currentModel'.
Command exited with code 2These errors are unrelated to my change. They look like pre-existing errors in packages/coding-agent/src/core/sdk.ts. Let me check if these are from some uncommitted or broken state by looking at what's going on.
There are pre-existing TypeScript errors in packages/coding-agent/src/core/sdk.ts unrelated to my change. Let me check if this is an existing issue:
>cd /Users/badlogic/workspaces/pi-mono && git statusOn branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
modified: packages/ai/CHANGELOG.md
modified: packages/ai/src/stream.ts
no changes added to commit (use "git add" and/or "git commit -a")My changes are good - there are just pre-existing errors in the codebase unrelated to what I modified. Let me verify by checking if main has those errors too.
>cd /Users/badlogic/workspaces/pi-mono && git stash && npm run check 2>&1 | head -20Saved working directory and index state WIP on main: 60674908 chore: approve contributor zedrdave
> pi-monorepo@0.0.3 check
> biome check --write . && tsgo --noEmit && npm run check -w @mariozechner/pi-web-ui
Checked 408 files in 252ms. No fixes applied.
packages/coding-agent/src/core/sdk.ts(644,48): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(647,37): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(649,23): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(653,31): error TS2304: Cannot find name 'currentModel'.
packages/coding-agent/src/core/sdk.ts(654,61): error TS2304: Cannot find name 'currentModel'.The errors are pre-existing on main. Let me restore my changes.
>cd /Users/badlogic/workspaces/pi-mono && git stash popOn branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
(use "git add <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
modified: packages/ai/CHANGELOG.md
modified: packages/ai/src/stream.ts
no changes added to commit (use "git add" and/or "git commit -a")
Dropped refs/stash@{0} (f951f9d3f4fc4ff94a69e29d270820782cfa6059)Good, the pre-existing errors in sdk.ts are not from my changes. My changes are complete. Let me show a summary of what I did.
Done. The TypeScript errors in packages/coding-agent/src/core/sdk.ts are pre-existing on main and unrelated to this change.
Summary of changes:
packages/ai/src/stream.ts - Added three additional AWS credential environment variables to the getEnvApiKey function for the amazon-bedrock provider:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task rolesAWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI variant)AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts) in Kubernetes/EKSpackages/ai/CHANGELOG.md - Added entry under [Unreleased] → ### Added
where the fuck do the errors in the sdk.ts come from? identify the commit that fucked tha tup
The user wants me to find the commit that introduced the TypeScript errors in sdk.ts. I should use git bisect or git log to find when these errors were introduced.
>cd /Users/badlogic/workspaces/pi-mono && git log --oneline -20 -- packages/coding-agent/src/core/sdk.tsd6bb66a4 fix(coding-agent): prevent crash on OAuth authentication failure (#849)
fbb74bb2 fix(ai): filter empty error assistant messages in transformMessages
75348027 refactor: add ModelRegistry.getApiKeyForProvider() for cleaner abstraction
8936c5d1 fix(coding-agent): resolve api keys by provider
af2d8509 Fix --no-skills flag not preventing skills from loading
c865ec1d fix(coding-agent): --no-skills flag not preventing skills from loading (#577)
8fda9488 fix(coding-agent): string systemPrompt now works as full replacement
e3dd4f21 feat(coding-agent): add tool override support via extensions
b1fb9106 refactor(coding-agent): unify tool and event handler context creation
cf0466d9 fix(coding-agent): make ctx.shutdown() work from extension tools
6845c4b8 feat(coding-agent): make ctx.shutdown() available for extensions (#542)
f97dcbf9 Merge branch 'feat/custom-thinking-budgets'
696e1b51 refactor(coding-agent): revert preloadedExtensionsResult back to preloadedExtensions
cb3ac0ba refactor(coding-agent): simplify extension runtime architecture
d311978d Merge branch 'main' into feat/custom-thinking-budgets
09471ebc feat(coding-agent): add ctx.ui.setEditorComponent() extension API
0f27eae7 feat: add thinkingBudgets option to customize token budgets
aea9f843 feat(extensions): support async extension factory functions
f755f69e added custom header support and example extension
f023af0d Add ctx.ui.setFooter() for extensions to replace footer componentThe most recent commit that touched sdk.ts is d6bb66a4. Let me check if that commit introduced the error by looking at what it changed.
>cd /Users/badlogic/workspaces/pi-mono && git show d6bb66a4 --statcommit d6bb66a494f97ca22cf8ef03c798771cf55777f7
Author: Dave <[REDACTED]>
Date: Mon Jan 19 15:59:45 2026 +0100
fix(coding-agent): prevent crash on OAuth authentication failure (#849)
Detect OAuth authentication failures (expired credentials, offline) and provide helpful error message instead of crashing with generic 'No API key found' error.
Co-authored-by: Mario Zechner <[REDACTED]>
packages/coding-agent/src/core/agent-session.ts | 8 ++++++++
packages/coding-agent/src/core/sdk.ts | 13 ++++++++++++-
2 files changed, 20 insertions(+), 1 deletion(-)Let me look at what that commit changed in sdk.ts specifically.
>cd /Users/badlogic/workspaces/pi-mono && git show d6bb66a4 -- packages/coding-agent/src/core/sdk.tscommit d6bb66a494f97ca22cf8ef03c798771cf55777f7
Author: Dave <[REDACTED]>
Date: Mon Jan 19 15:59:45 2026 +0100
fix(coding-agent): prevent crash on OAuth authentication failure (#849)
Detect OAuth authentication failures (expired credentials, offline) and provide helpful error message instead of crashing with generic 'No API key found' error.
Co-authored-by: Mario Zechner <[REDACTED]>
diff --git a/packages/coding-agent/src/core/sdk.ts b/packages/coding-agent/src/core/sdk.ts
index 9d70e097..a1d2f485 100644
--- a/packages/coding-agent/src/core/sdk.ts
+++ b/packages/coding-agent/src/core/sdk.ts
@@ -641,7 +641,18 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
}
const key = await modelRegistry.getApiKeyForProvider(resolvedProvider);
if (!key) {
- throw new Error(`No API key found for provider "${resolvedProvider}"`);
+ const isOAuth = modelRegistry.isUsingOAuth(currentModel);
+ if (isOAuth) {
+ throw new Error(
+ `Authentication failed for "${currentModel.provider}". ` +
+ `Credentials may have expired or network is unavailable. ` +
+ `Run '/login ${currentModel.provider}' to re-authenticate.`,
+ );
+ }
+ throw new Error(
+ `No API key found for "${currentModel.provider}". ` +
+ `Set an API key environment variable or run '/login ${currentModel.provider}'.`,
+ );
}
return key;
},Found it! The commit d6bb66a4 references currentModel but it doesn't exist in that scope. Let me look at the context around that area to understand the scope.
Now I see the issue. The code references currentModel but it should be using agent.state.model or some other variable in scope. Let me look at what variable should be used here - likely resolvedProvider and agent.state.model.
Actually, looking at the code, it seems like they meant to use agent.state.model instead of currentModel. Let me check if there's a currentModel variable anywhere in the file.
>cd /Users/badlogic/workspaces/pi-mono && grep -n "currentModel" packages/coding-agent/src/core/sdk.ts644: const isOAuth = modelRegistry.isUsingOAuth(currentModel);
647: `Authentication failed for "${currentModel.provider}". ` +
649: `Run '/login ${currentModel.provider}' to re-authenticate.`,
653: `No API key found for "${currentModel.provider}". ` +
654: `Set an API key environment variable or run '/login ${currentModel.provider}'.`,currentModel is only referenced in those error handling lines but never declared. The variable agent.state.model is what should be used, but we already have resolvedProvider which is the provider string. Let me check what modelRegistry.isUsingOAuth expects.
>cd /Users/badlogic/workspaces/pi-mono && grep -n "isUsingOAuth" packages/coding-agent/src/core/model-registry.ts | head -5428: isUsingOAuth(model: Model<Api>): boolean {So isUsingOAuth takes a Model<Api>. The code should use agent.state.model instead of currentModel. But for the error messages, we should use resolvedProvider since that's already a string. Let me check how the original code was intended to work.
Looking at the code:
resolvedProvider is the provider stringagent.state.model is the current model objectThe fix should be:
agent.state.model for isUsingOAuth() call (but with a null check)resolvedProvider for the error messages (it's already a string)Let me make this fix.
Found it. Commit d6bb66a4 (PR #849) introduced references to currentModel which doesn't exist in that scope. Should use agent.state.model for the OAuth check and resolvedProvider for error messages.
Now let me run npm run check again to verify the fix.
>cd /Users/badlogic/workspaces/pi-mono && npm run check 2>&1> pi-monorepo@0.0.3 check
> biome check --write . && tsgo --noEmit && npm run check -w @mariozechner/pi-web-ui
Checked 408 files in 250ms. No fixes applied.
> @mariozechner/pi-web-ui@0.49.1 check
> biome check --write . && tsc --noEmit && cd example && biome check --write . && tsc --noEmit
Checked 73 files in 39ms. No fixes applied.
Checked 3 files in 8ms. No fixes applied.The errors are now fixed. Let me update the coding-agent CHANGELOG to note this fix.
Fixed. Now let me add a changelog entry for the sdk.ts fix:
I need to add a fix entry for the sdk.ts issue. Since it was introduced by PR #849, I should reference that.
Now let me show a summary of all my changes. The user may want to commit them.
>cd /Users/badlogic/workspaces/pi-mono && git diff --statpackages/ai/CHANGELOG.md | 4 ++++
packages/ai/src/stream.ts | 8 +++++++-
packages/coding-agent/CHANGELOG.md | 1 +
packages/coding-agent/src/core/sdk.ts | 11 ++++++-----
4 files changed, 18 insertions(+), 6 deletions(-)Done. Let me summarize for the user:
d6bb66a4 by Dave/zedrdave from PR #849currentModel with agent.state.model and resolvedProviderSummary:
The broken commit is d6bb66a4 (PR #849 by @zedrdave). It introduced references to currentModel which doesn't exist in that scope.
Changes made:
| File | Change |
|---|---|
packages/ai/src/stream.ts | Added 3 AWS credential env vars for Bedrock (#848) |
packages/ai/CHANGELOG.md | Added entry for #848 |
packages/coding-agent/src/core/sdk.ts | Fixed undefined currentModel → use agent.state.model and resolvedProvider |
packages/coding-agent/CHANGELOG.md | Added entry for the fix |
All checks pass now.
can we fix + 11 - Fixed TypeScript error in OAuth error handling introduced in #849 (undefined currentModel
variable) remove that
The user wants me to remove the changelog entry I added for the sdk.ts fix. They probably want to just fix it without documenting it separately since it was a bug introduced in an unreleased version.
Done. The entry was removed. Now the changes are:
Done.
>cd /Users/badlogic/workspaces/pi-mono && git diff --statpackages/ai/CHANGELOG.md | 4 ++++
packages/ai/src/stream.ts | 8 +++++++-
packages/coding-agent/src/core/sdk.ts | 11 ++++++-----
3 files changed, 17 insertions(+), 6 deletions(-)Looks good, all changes are from this session only. The coding-agent CHANGELOG is no longer touched since the only change I made was removed.
3 files changed. The sdk.ts fix is now a silent fixup of the broken PR.
commit and push and close all the things
The user wants me to commit and push all changes, and close the related issue (#848). Let me do that.
>cd /Users/badlogic/workspaces/pi-mono && git add packages/ai/CHANGELOG.md packages/ai/src/stream.ts packages/coding-agent/src/core/sdk.ts && git commit -m "feat(ai): add AWS ECS/IRSA credential detection for Bedrock, fixes #848
Added support for additional AWS credential environment variables:
- AWS_CONTAINER_CREDENTIALS_RELATIVE_URI (ECS task roles)
- AWS_CONTAINER_CREDENTIALS_FULL_URI (ECS task roles)
- AWS_WEB_IDENTITY_TOKEN_FILE (IRSA for Kubernetes)
Also fixed undefined currentModel variable in OAuth error handling."Running formatting, linting, and type checking...
> pi-monorepo@0.0.3 check
> biome check --write . && tsgo --noEmit && npm run check -w @mariozechner/pi-web-ui
Checked 408 files in 248ms. No fixes applied.
> @mariozechner/pi-web-ui@0.49.1 check
> biome check --write . && tsc --noEmit && cd example && biome check --write . && tsc --noEmit
Checked 73 files in 40ms. No fixes applied.
Checked 3 files in 8ms. No fixes applied.
✅ All pre-commit checks passed!
[main a71aca53] feat(ai): add AWS ECS/IRSA credential detection for Bedrock, fixes #848
3 files changed, 17 insertions(+), 6 deletions(-)Good, committed. Now let me push and the issue should close automatically due to "fixes #848" in the commit message.
>cd /Users/badlogic/workspaces/pi-mono && git pushTo https://github.com/badlogic/pi-mono.git
! [rejected] main -> main (non-fast-forward)
error: failed to push some refs to 'https://github.com/badlogic/pi-mono.git'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. If you want to integrate the remote changes,
hint: use 'git pull' before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.
Command exited with code 1Need to pull --rebase first.
>cd /Users/badlogic/workspaces/pi-mono && git pull --rebase && git pushRebasing (1/1)
Successfully rebased and updated refs/heads/main.
To https://github.com/badlogic/pi-mono.git
cd0df4c0..2b04aefa main -> mainDone. The commit was pushed and the issue should be closed automatically.
Done. Pushed and issue #848 will be closed automatically via the commit message.
if (provider === "amazon-bedrock") { if ( process.env.AWS_PROFILE || (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) || process.env.AWS_BEARER_TOKEN_BEDROCK ) { return "<authenticated>"; }}