fix(ai): preserve ambient AWS auth for Bedrock

Do not treat Pi’s internal ambient-auth marker as a Bedrock bearer token. This preserves SigV4 signing for AWS profiles, IAM credentials, and roles while retaining bearer authentication for real Bedrock API keys.\n\nFixes #6531
2026-07-11 13:12:23 +02:00
parent 4c1861033b
commit 19fe0e01c5
2 changed files with 11 additions and 1 deletions
@@ -190,4 +190,13 @@ describe("bedrock endpoint resolution", () => {
 		expect(config.token).toEqual({ token: "bedrock-api-key" });
 		expect(config.authSchemePreference).toEqual(["httpBearerAuth"]);
 	});
+
+	it("does not use the ambient AWS auth marker as a bearer token", async () => {
+		const model = getModel("amazon-bedrock", "us.anthropic.claude-opus-4-8");
+
+		const config = await captureClientConfig(model, { apiKey: "<authenticated>" });
+
+		expect(config.token).toBeUndefined();
+		expect(config.authSchemePreference).toBeUndefined();
+	});
 });