feat(cli): add AWS Bedrock as a supported provider#1015
Conversation
Add Bedrock to the CLI's supported providers with full AWS authentication stack support: - Bearer token / API key (AWS_BEDROCK_API_KEY or --api-key) - AWS Profile (AWS_PROFILE env var) - Direct credentials (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY) - Default credential chain fallthrough (IMDS, ECS task role, etc.) Also makes the --provider help text dynamically list all supported providers from the supportedProviders array instead of a hardcoded string. The existing AwsBedrockHandler in src/api/providers/bedrock.ts already handles all auth modes — the CLI just needed to populate the RooCodeSettings fields correctly and relax the API key requirement for Bedrock (which can auth without an explicit key). *(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)*
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe CLI adds Bedrock as a supported provider, configures AWS region, model, inference, and credential settings, validates Bedrock credentials separately, and derives provider help text from the supported provider list. ChangesBedrock CLI Support
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant CLI
participant getProviderSettings
participant AWSSDKCredentialChain
User->>CLI: Select bedrock provider
CLI->>getProviderSettings: Build Bedrock configuration
getProviderSettings->>AWSSDKCredentialChain: Resolve API key, profile, direct credentials, or default chain
AWSSDKCredentialChain-->>getProviderSettings: Credential configuration
getProviderSettings-->>CLI: Return region, model, inference, and credentials
Possibly related issues
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/cli/src/commands/cli/run.ts`:
- Around line 198-204: Remove the environment-only credential rejection in the
Bedrock preflight block guarded by !hasProfile && !hasDirectCreds. Allow
execution to continue so the downstream AWS credential resolver can use the
default credential chain, including IMDS, ECS task roles, IRSA, and
shared-profile defaults, and report failures only when resolution actually
fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 38fc5bee-2b83-4d28-87dd-099002397947
📒 Files selected for processing (4)
apps/cli/src/commands/cli/run.tsapps/cli/src/index.tsapps/cli/src/lib/utils/provider.tsapps/cli/src/types/types.ts
Address PR Zoo-Code-Org#1015 review feedback. FIX 1 (CodeRabbit): the Bedrock branch in run.ts previously hard-failed with process.exit(1) when neither AWS_PROFILE nor static AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY were set. That rejected the AWS SDK default credential chain (IMDS / EC2 instance profile, ECS task role, IRSA/web-identity, SSO, shared-config default) before the resolver ever ran, defeating advertised auth mode Zoo-Code-Org#4. Extract a providerRequiresApiKey() helper (false for bedrock, true otherwise) and gate the API-key requirement on it, so Bedrock proceeds and AwsBedrockHandler surfaces a real error only if credential resolution actually fails. Non-bedrock providers keep the identical missing-API-key error and exit. FIX 2 (codecov): add hermetic vitest coverage for getProviderSettings bedrock path (all 4 auth modes, priority ordering, region resolution, cross-region inference auto-enable) and providerRequiresApiKey. provider.test.ts goes from 4 to 27 tests. Also add JSDoc to providerRequiresApiKey and getProviderSettings describing the four Bedrock auth modes. *(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)*
There was a problem hiding this comment.
🧹 Nitpick comments (1)
apps/cli/src/lib/utils/__tests__/provider.test.ts (1)
5-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover
AWS_BEDROCK_API_KEYretrieval.The new environment variable is cleared but never exercised. Add a
getApiKeyFromEnv("bedrock")case after settingAWS_BEDROCK_API_KEY, so the advertised environment-based API-key path cannot regress unnoticed.Proposed test
+ it("should return API key from environment variable for bedrock", () => { + process.env.AWS_BEDROCK_API_KEY = "test-bedrock-key" + expect(getApiKeyFromEnv("bedrock")).toBe("test-bedrock-key") + })As per coding guidelines, use package-local unit tests for pure logic, parsing, state transitions, validation, serialization, request construction, retry decisions, and error handling.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/cli/src/lib/utils/__tests__/provider.test.ts` around lines 5 - 13, Add coverage in the provider environment-variable tests for AWS_BEDROCK_API_KEY: set the variable, call getApiKeyFromEnv("bedrock"), and assert the returned key, placing this case after the variable is configured while preserving the existing cleanup behavior.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apps/cli/src/lib/utils/__tests__/provider.test.ts`:
- Around line 5-13: Add coverage in the provider environment-variable tests for
AWS_BEDROCK_API_KEY: set the variable, call getApiKeyFromEnv("bedrock"), and
assert the returned key, placing this case after the variable is configured
while preserving the existing cleanup behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 90b582e8-73b2-498a-b5cb-6b9259a28f46
📒 Files selected for processing (3)
apps/cli/src/commands/cli/run.tsapps/cli/src/lib/utils/__tests__/provider.test.tsapps/cli/src/lib/utils/provider.ts
|
Both points addressed: AWS default credential chain (Major). Fixed in Patch coverage. Added hermetic unit tests for the Bedrock (Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.) |
github-actions
Bot
added
the
awaiting-review
1 participant
Related GitHub Issue
Refs: #635
Description
Adds AWS Bedrock as a supported provider in the ZooCode CLI, bringing it to parity
with the VS Code extension for the most common enterprise AWS use case.
Motivation: The CLI previously supported five providers (
anthropic,openai-native,gemini,openrouter,vercel-ai-gateway) but not Bedrock — the default choice forenterprise AWS users. The extension's
AwsBedrockHandler(src/api/providers/bedrock.ts)already implements the full Bedrock auth stack; the CLI only needed the plumbing to
resolve credentials from the environment and populate the corresponding
RooCodeSettingsfields.How (key implementation details):
apps/cli/src/types/types.ts"bedrock"to thesupportedProvidersarrayapps/cli/src/lib/utils/provider.tsbedrocktoenvVarMapand a fullcase "bedrock"ingetProviderSettings()(region resolution, cross-region inference auto-detect, and the four auth modes)apps/cli/src/commands/cli/run.tsapps/cli/src/index.ts--providerhelp text dynamic fromsupportedProvidersinstead of a hardcoded stringAuthentication modes (mirrors
AwsBedrockHandler):--api-keyorAWS_BEDROCK_API_KEY(LiteLLM proxy / Bedrock gateway) → setsawsUseApiKey+awsApiKey.AWS_PROFILE→ setsawsUseProfile+awsProfile.AWS_ACCESS_KEY_ID+AWS_SECRET_ACCESS_KEY(+ optionalAWS_SESSION_TOKEN).Region resolves from
AWS_REGION→AWS_DEFAULT_REGION→us-east-1. When the model IDcarries a regional inference-profile prefix (
us.,eu.,apac.),awsUseCrossRegionInferenceis enabled automatically.Usage:
Test Procedure
Verified locally on the CI-pinned toolchain (Node 20.20.2, pnpm 10.8.1):
pnpm turbo run test --filter=@roo-code/cli→ 529 passed / 1 skipped (37 test files passed, 1 skipped).pnpm turbo run lint --filter=@roo-code/cli→ clean (eslint src --ext .ts --max-warnings=0, 0 warnings).pnpm turbo run check-types --filter=@roo-code/cli→ clean (tsc --noEmit).pnpm turbo run build --filter=@roo-code/cli→ clean (tsup).--providerhelp now dynamically lists:API provider (anthropic, bedrock, openai-native, gemini, openrouter, vercel-ai-gateway).To reproduce:
pnpm install pnpm turbo run lint check-types test build --filter=@roo-code/cliPre-Submission Checklist
AwsBedrockHandler. Happy to add targetedgetProviderSettings("bedrock", …)cases if you'd like.Screenshots / Videos
N/A — no UI changes (CLI-only).
Documentation Updates
bedrockprovider and its four auth modes to the CLI docs / docs repository.Additional Notes
AwsBedrockHandlerin the core package; the CLI'stsupexternals already keep the Anthropic Bedrock SDK external."bedrock"is already a validProviderNamein@roo-code/types, and the default model followsbedrockDefaultModelId(anthropic.claude-sonnet-4-5-20250929-v1:0) when none is specified.Refs #635chosen overCloses #635so the broader "CLI version?" tracking issue can stay open for further parity work.Get in Touch
Discord username available on request.
(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)
Summary by CodeRabbit
--provideroption to display a dynamically generated list of supported providers.apiKeyis not provided.