ton/pi_harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ai): preserve ambient AWS auth for Bedrock

Browse Source 
Do not treat Pi’s internal ambient-auth marker as a Bedrock bearer token. This preserves SigV4 signing for AWS profiles, IAM credentials, and roles while retaining bearer authentication for real Bedrock API keys.\n\nFixes #6531
This commit is contained in:
Rafał Krzyważnia
2026-07-11 13:12:23 +02:00
committed by GitHub
parent 4c1861033b
commit 19fe0e01c5
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ai/src/api/bedrock-converse-stream.ts
+2 -1
View File
@@ -101,6 +101,7 @@ export interface BedrockOptions extends StreamOptions {
type Block = (TextContent | ThinkingContent | ToolCall) & { index?: number; partialJson?: string };
const EMPTY_TEXT_PLACEHOLDER = "<empty>";
const AMBIENT_AUTH_MARKER = "<authenticated>";
export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> = (
model: Model<"bedrock-converse-stream">,
@@ -153,7 +154,7 @@ export const stream: StreamFunction<"bedrock-converse-stream", BedrockOptions> =
const skipAuth = getProviderEnvValue("AWS_BEDROCK_SKIP_AUTH", options.env) === "1";
const bearerToken =
options.bearerToken ||
options.apiKey ||
(options.apiKey !== AMBIENT_AUTH_MARKER ? options.apiKey : undefined) ||
getProviderEnvValue("AWS_BEARER_TOKEN_BEDROCK", options.env) ||
undefined;
const useBearerToken = bearerToken !== undefined && !skipAuth;