Implemented AWS credential detection enhancement
Public
Implemented AWS credential detection enhancement
Agent
Pi
Model
Claude Opus 4.5 (latest)
Started
Jan 19, 3:05 PM
Messages94
Downloads0
Reviewed GitHub issue and related code.
UnderstandAdded support for additional AWS credential signals.
BuildAdded changelog entry and ran checks.
EditCommitted, pushed changes, and closed issue.
Cleanup
Analyze GitHub issue(s): https://github.com/badlogic/pi-mono/issues/848 implement this, should be trivial
For each issue:
Read the issue in full, including all comments and linked issues/PRs.
For bugs:
For feature requests:
Do NOT implement unless explicitly asked. Analyze and propose only.
The user wants me to analyze a GitHub issue and implement it. Let me first fetch the issue details.
>gh issue view 848 --json title,body,comments,labels,state --repo badlogic/pi-monoLet me read the relevant file to understand the current implementation of getEnvApiKey for Bedrock.
Let me read the relevant code file:
Now I understand the issue. The getEnvApiKey function for amazon-bedrock currently only checks for:
AWS_PROFILEAWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEYAWS_BEARER_TOKEN_BEDROCKThe issue requests adding support for additional AWS credential sources that the AWS SDK supports:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - Used by ECS task rolesAWS_CONTAINER_CREDENTIALS_FULL_URI - Used by ECS task roles (full URI variant)AWS_WEB_IDENTITY_TOKEN_FILE - Used by IRSA (IAM Roles for Service Accounts) in Kubernetes/EKSThese are all valid credential sources that the AWS SDK's default credential provider chain will use. The issue asks to add these checks so pi recognizes when these credentials are available.
The user said "implement this" so I should proceed with the implementation.
The fix is simple - just add these three additional env variable checks to the bedrock section in getEnvApiKey.
Issue: #848 - Add additional signals to determine if amazon-bedrock is supported
Type: Feature request
Problem: The getEnvApiKey function in packages/ai/src/stream.ts only checks for a few AWS credential sources (AWS_PROFILE, AWS_ACCESS_KEY_ID+AWS_SECRET_ACCESS_KEY, AWS_BEARER_TOKEN_BEDROCK). It doesn't recognize other valid credential sources that the AWS SDK supports, specifically:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task rolesAWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI variant)AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts) in Kubernetes/EKSCurrent code (lines 66-77):
if (provider === "amazon-bedrock") { if ( process.env.AWS_PROFILE || (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) || process.env.AWS_BEARER_TOKEN_BEDROCK ) { return "<authenticated>"; }}Fix: Add the three additional env variable checks to the condition.
Since you said to implement it, I'll make the change now:
Now I need to update the CHANGELOG and run npm run check to make sure everything is good.
Now I need to add a changelog entry and run npm run check. Let me add the entry under [Unreleased] in the ### Added section (since this is a new feature).
Now let me add the changelog entry and run checks:
Now let me run npm run check to verify everything is good.
>cd /Users/badlogic/workspaces/pi-mono && npm run check 2>&1These errors are unrelated to my change. They look like pre-existing errors in packages/coding-agent/src/core/sdk.ts. Let me check if these are from some uncommitted or broken state by looking at what's going on.
There are pre-existing TypeScript errors in packages/coding-agent/src/core/sdk.ts unrelated to my change. Let me check if this is an existing issue:
>cd /Users/badlogic/workspaces/pi-mono && git statusMy changes are good - there are just pre-existing errors in the codebase unrelated to what I modified. Let me verify by checking if main has those errors too.
>cd /Users/badlogic/workspaces/pi-mono && git stash && npm run check 2>&1 | head -20The errors are pre-existing on main. Let me restore my changes.
>cd /Users/badlogic/workspaces/pi-mono && git stash popGood, the pre-existing errors in sdk.ts are not from my changes. My changes are complete. Let me show a summary of what I did.
Done. The TypeScript errors in packages/coding-agent/src/core/sdk.ts are pre-existing on main and unrelated to this change.
Summary of changes:
packages/ai/src/stream.ts - Added three additional AWS credential environment variables to the getEnvApiKey function for the amazon-bedrock provider:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task rolesAWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI variant)AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts) in Kubernetes/EKSpackages/ai/CHANGELOG.md - Added entry under [Unreleased] → ### Added
where the fuck do the errors in the sdk.ts come from? identify the commit that fucked tha tup
The user wants me to find the commit that introduced the TypeScript errors in sdk.ts. I should use git bisect or git log to find when these errors were introduced.
>cd /Users/badlogic/workspaces/pi-mono && git log --oneline -20 -- packages/coding-agent/src/core/sdk.tsThe most recent commit that touched sdk.ts is d6bb66a4. Let me check if that commit introduced the error by looking at what it changed.
>cd /Users/badlogic/workspaces/pi-mono && git show d6bb66a4 --statLet me look at what that commit changed in sdk.ts specifically.
>cd /Users/badlogic/workspaces/pi-mono && git show d6bb66a4 -- packages/coding-agent/src/core/sdk.tsFound it! The commit d6bb66a4 references currentModel but it doesn't exist in that scope. Let me look at the context around that area to understand the scope.
Now I see the issue. The code references currentModel but it should be using agent.state.model or some other variable in scope. Let me look at what variable should be used here - likely resolvedProvider and agent.state.model.
Actually, looking at the code, it seems like they meant to use agent.state.model instead of currentModel. Let me check if there's a currentModel variable anywhere in the file.
>cd /Users/badlogic/workspaces/pi-mono && grep -n "currentModel" packages/coding-agent/src/core/sdk.tscurrentModel is only referenced in those error handling lines but never declared. The variable agent.state.model is what should be used, but we already have resolvedProvider which is the provider string. Let me check what modelRegistry.isUsingOAuth expects.
>cd /Users/badlogic/workspaces/pi-mono && grep -n "isUsingOAuth" packages/coding-agent/src/core/model-registry.ts | head -5So isUsingOAuth takes a Model<Api>. The code should use agent.state.model instead of currentModel. But for the error messages, we should use resolvedProvider since that's already a string. Let me check how the original code was intended to work.
Looking at the code:
resolvedProvider is the provider stringagent.state.model is the current model objectThe fix should be:
agent.state.model for isUsingOAuth() call (but with a null check)resolvedProvider for the error messages (it's already a string)Let me make this fix.
Found it. Commit d6bb66a4 (PR #849) introduced references to currentModel which doesn't exist in that scope. Should use agent.state.model for the OAuth check and resolvedProvider for error messages.
Now let me run npm run check again to verify the fix.
>cd /Users/badlogic/workspaces/pi-mono && npm run check 2>&1The errors are now fixed. Let me update the coding-agent CHANGELOG to note this fix.
Fixed. Now let me add a changelog entry for the sdk.ts fix:
I need to add a fix entry for the sdk.ts issue. Since it was introduced by PR #849, I should reference that.
Now let me show a summary of all my changes. The user may want to commit them.
>cd /Users/badlogic/workspaces/pi-mono && git diff --statDone. Let me summarize for the user:
d6bb66a4 by Dave/zedrdave from PR #849currentModel with agent.state.model and resolvedProviderSummary:
The broken commit is d6bb66a4 (PR #849 by @zedrdave). It introduced references to currentModel which doesn't exist in that scope.
Changes made:
| File | Change |
|---|---|
packages/ai/src/stream.ts | Added 3 AWS credential env vars for Bedrock (#848) |
packages/ai/CHANGELOG.md | Added entry for #848 |
packages/coding-agent/src/core/sdk.ts | Fixed undefined currentModel → use agent.state.model and resolvedProvider |
packages/coding-agent/CHANGELOG.md | Added entry for the fix |
All checks pass now.
can we fix + 11 - Fixed TypeScript error in OAuth error handling introduced in #849 (undefined currentModel
variable) remove that
The user wants me to remove the changelog entry I added for the sdk.ts fix. They probably want to just fix it without documenting it separately since it was a bug introduced in an unreleased version.
Done. The entry was removed. Now the changes are:
Done.
>cd /Users/badlogic/workspaces/pi-mono && git diff --statLooks good, all changes are from this session only. The coding-agent CHANGELOG is no longer touched since the only change I made was removed.
3 files changed. The sdk.ts fix is now a silent fixup of the broken PR.
commit and push and close all the things
The user wants me to commit and push all changes, and close the related issue (#848). Let me do that.
>cd /Users/badlogic/workspaces/pi-mono && git add packages/ai/CHANGELOG.md packages/ai/src/stream.ts packages/coding-agent/src/core/sdk.ts && git commit -m "feat(ai): add AWS ECS/IRSA credential detection for Bedrock, fixes #848
Added support for additional AWS credential environment variables:
- AWS_CONTAINER_CREDENTIALS_RELATIVE_URI (ECS task roles)
- AWS_CONTAINER_CREDENTIALS_FULL_URI (ECS task roles)
- AWS_WEB_IDENTITY_TOKEN_FILE (IRSA for Kubernetes)
Also fixed undefined currentModel variable in OAuth error handling."Good, committed. Now let me push and the issue should close automatically due to "fixes #848" in the commit message.
>cd /Users/badlogic/workspaces/pi-mono && git pushNeed to pull --rebase first.
>cd /Users/badlogic/workspaces/pi-mono && git pull --rebase && git pushDone. The commit was pushed and the issue should be closed automatically.
Done. Pushed and issue #848 will be closed automatically via the commit message.
if (provider === "amazon-bedrock") { if ( process.env.AWS_PROFILE || (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) || process.env.AWS_BEARER_TOKEN_BEDROCK ) { return "<authenticated>"; }}