shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ai): preserve env api key contract

Browse Source
This commit is contained in:
Armin Ronacher
2026-04-23 22:11:28 +02:00
parent f0cf8a59d2
commit 00cb947166
2 changed files with 21 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
packages/ai/src/env-api-keys.ts
View File

@@ -107,30 +107,6 @@ export function findEnvKeys(provider: string): string[] | undefined {
return found.length > 0 ? found : undefined; return found.length > 0 ? found : undefined;
} }
/**
* Check if a provider has environment-backed authentication available.
*
* This includes non-API-key credential sources such as AWS credentials for Bedrock.
*/
export function hasEnvAuth(provider: KnownProvider): boolean;
export function hasEnvAuth(provider: string): boolean;
export function hasEnvAuth(provider: string): boolean {
if (findEnvKeys(provider)) return true;
if (provider === "amazon-bedrock") {
return !!(
process.env.AWS_PROFILE ||
(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) ||
process.env.AWS_BEARER_TOKEN_BEDROCK ||
process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ||
process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI ||
process.env.AWS_WEB_IDENTITY_TOKEN_FILE
);
}
return false;
}
/** /**
* Get API key for provider from known environment variables, e.g. OPENAI_API_KEY. * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.
* *
@@ -154,5 +130,25 @@ export function getEnvApiKey(provider: string): string | undefined {
} }
} }
if (provider === "amazon-bedrock") {
// Amazon Bedrock supports multiple credential sources:
// 1. AWS_PROFILE - named profile from ~/.aws/credentials
// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys
// 3. AWS_BEARER_TOKEN_BEDROCK - Bedrock bearer token
// 4. AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task roles
// 5. AWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI)
// 6. AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts)
if (
process.env.AWS_PROFILE ||
(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) ||
process.env.AWS_BEARER_TOKEN_BEDROCK ||
process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ||
process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI ||
process.env.AWS_WEB_IDENTITY_TOKEN_FILE
) {
return "<authenticated>";
}
}
return undefined; return undefined;
} }

3
packages/coding-agent/src/core/auth-storage.ts
View File

@@ -9,7 +9,6 @@
import { import {
findEnvKeys, findEnvKeys,
getEnvApiKey, getEnvApiKey,
hasEnvAuth,
type OAuthCredentials, type OAuthCredentials,
type OAuthLoginCallbacks, type OAuthLoginCallbacks,
type OAuthProviderId, type OAuthProviderId,
@@ -332,7 +331,7 @@ export class AuthStorage {
hasAuth(provider: string): boolean { hasAuth(provider: string): boolean {
if (this.runtimeOverrides.has(provider)) return true; if (this.runtimeOverrides.has(provider)) return true;
if (this.data[provider]) return true; if (this.data[provider]) return true;
if (hasEnvAuth(provider)) return true; if (getEnvApiKey(provider)) return true;
if (this.fallbackResolver?.(provider)) return true; if (this.fallbackResolver?.(provider)) return true;
return false; return false;
} }