forked from farhoodlabs/paperclip
feat: add AWS Bedrock auth support on "claude-local" (#2793)
Closes #2412 Related: #2681, #498, #128 ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The Claude Code adapter spawns the `claude` CLI to run agent tasks > - The adapter detects auth mode by checking for `ANTHROPIC_API_KEY` — recognizing only "api" and "subscription" modes > - But users running Claude Code via **AWS Bedrock** (`CLAUDE_CODE_USE_BEDROCK=1`) fall through to the "subscription" path > - This causes a misleading "ANTHROPIC_API_KEY is not set; subscription-based auth can be used" message in the environment check > - Additionally, the hello probe passes `--model claude-opus-4-6` which is **not a valid Bedrock model identifier**, causing `400 The provided model identifier is invalid` and a probe failure > - This pull request adds Bedrock auth detection, skips the Anthropic-style `--model` flag for Bedrock, and returns the correct billing type > - The benefit is that Bedrock users get a working environment check and correct cost tracking out of the box --- ## Pain Point Many enterprise teams use **Claude Code through AWS Bedrock** rather than Anthropic's direct API — for compliance, billing consolidation, or VPC requirements. Currently, these users hit a **hard wall during onboarding**: | Problem | Impact | |---|---| | ❌ Adapter environment check **always fails** | Users cannot create their first agent — blocked at step 1 | | ❌ `--model claude-opus-4-6` is **invalid on Bedrock** (requires `us.anthropic.*` format) | Hello probe exits with code 1: `400 The provided model identifier is invalid` | | ❌ Auth shown as _"subscription-based"_ | Misleading — Bedrock is neither subscription nor API-key auth | | ❌ Quota polling hits Anthropic OAuth endpoint | Fails silently for Bedrock users who have no Anthropic subscription | > **Bottom line**: Paperclip is completely unusable for Bedrock users out of the box. ## Why Bedrock Matters AWS Bedrock is a major deployment path for Claude in enterprise environments: - **Enterprise compliance** — data stays within the customer's AWS account and VPC - **Unified billing** — Claude usage appears on the existing AWS invoice, no separate Anthropic billing - **IAM integration** — access controlled through AWS IAM roles and policies - **Regional deployment** — models run in the customer's preferred AWS region Supporting Bedrock unlocks Paperclip for organizations that **cannot** use Anthropic's direct API due to procurement, security, or regulatory constraints. --- ## What Changed - **`execute.ts`**: Added `isBedrockAuth()` helper that checks `CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_BEDROCK_BASE_URL` env vars. `resolveClaudeBillingType()` now returns `"metered_api"` for Bedrock. Biller set to `"aws_bedrock"`. Skips `--model` flag when Bedrock is active (Anthropic-style model IDs are invalid on Bedrock; the CLI uses its own configured model). - **`test.ts`**: Environment check now detects Bedrock env vars (from adapter config or server env) and shows `"AWS Bedrock auth detected. Claude will use Bedrock for inference."` instead of the misleading subscription message. Also skips `--model` in the hello probe for Bedrock. - **`quota.ts`**: Early return with `{ ok: true, windows: [] }` when Bedrock is active — Bedrock usage is billed through AWS, not Anthropic's subscription quota system. - **`ui/src/lib/utils.ts`**: Added `"aws_bedrock"` → `"AWS Bedrock"` to `providerDisplayName()` and `quotaSourceDisplayName()`. ## Verification 1. `pnpm -r typecheck` — all packages pass 2. Unit tests added and passing (6/6) 3. Environment check with Bedrock env vars: | | Before | After | |---|---|---| | **Status** | 🔴 Failed | ✅ Passed | | **Auth message** | `ANTHROPIC_API_KEY is not set; subscription-based auth can be used if Claude is logged in.` | `AWS Bedrock auth detected. Claude will use Bedrock for inference.` | | **Hello probe** | `ERROR · Claude hello probe failed.` (exit code 1 — `--model claude-opus-4-6` is invalid on Bedrock) | `INFO · Claude hello probe succeeded.` | | **Screenshot** | <img height="500" alt="Screenshot 2026-04-05 at 8 25 27 AM" src="https://github.com/user-attachments/assets/476431f6-6139-425a-8abc-97875d653657" /> | <img height="500" alt="Screenshot 2026-04-05 at 8 31 58 AM" src="https://github.com/user-attachments/assets/d388ce87-c5e6-4574-b8d2-fd8b86135299" /> | 4. Existing API key / subscription paths are completely untouched unless Bedrock env vars are present ## Risks - **Low risk.** All changes are additive — existing "api" and "subscription" code paths are only entered when Bedrock env vars are absent. - When Bedrock is active, the `--model` flag is skipped, so the Paperclip model dropdown selection is ignored in favor of the Claude CLI's own model config. This is intentional since Bedrock requires different model identifiers. ## Model Used - Claude Opus 4.6 (`claude-opus-4-6`, 1M context window) via Claude Code CLI ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
This commit is contained in:
Lucas Kim
@@ -102,8 +102,16 @@ function hasNonEmptyEnvValue(env: Record<string, string>, key: string): boolean
|
||||
return typeof raw === "string" && raw.trim().length > 0;
|
||||
}
|
||||
|
||||
function resolveClaudeBillingType(env: Record<string, string>): "api" | "subscription" {
|
||||
// Claude uses API-key auth when ANTHROPIC_API_KEY is present; otherwise rely on local login/session auth.
|
||||
function isBedrockAuth(env: Record<string, string>): boolean {
|
||||
return (
|
||||
env.CLAUDE_CODE_USE_BEDROCK === "1" ||
|
||||
env.CLAUDE_CODE_USE_BEDROCK === "true" ||
|
||||
hasNonEmptyEnvValue(env, "ANTHROPIC_BEDROCK_BASE_URL")
|
||||
);
|
||||
}
|
||||
|
||||
function resolveClaudeBillingType(env: Record<string, string>): "api" | "subscription" | "metered_api" {
|
||||
if (isBedrockAuth(env)) return "metered_api";
|
||||
return hasNonEmptyEnvValue(env, "ANTHROPIC_API_KEY") ? "api" : "subscription";
|
||||
}
|
||||
|
||||
@@ -431,7 +439,9 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
|
||||
if (resumeSessionId) args.push("--resume", resumeSessionId);
|
||||
if (dangerouslySkipPermissions) args.push("--dangerously-skip-permissions");
|
||||
if (chrome) args.push("--chrome");
|
||||
if (model) args.push("--model", model);
|
||||
// Skip --model for Bedrock: Anthropic-style model IDs (e.g. "claude-opus-4-6") are not
|
||||
// valid Bedrock model identifiers. Let the CLI use its own configured model instead.
|
||||
if (model && !isBedrockAuth(effectiveEnv)) args.push("--model", model);
|
||||
if (effort) args.push("--effort", effort);
|
||||
if (maxTurns > 0) args.push("--max-turns", String(maxTurns));
|
||||
if (effectiveInstructionsFilePath) {
|
||||
@@ -578,7 +588,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
|
||||
sessionParams: resolvedSessionParams,
|
||||
sessionDisplayId: resolvedSessionId,
|
||||
provider: "anthropic",
|
||||
biller: "anthropic",
|
||||
biller: isBedrockAuth(effectiveEnv) ? "aws_bedrock" : "anthropic",
|
||||
model: parsedStream.model || asString(parsed.model, model),
|
||||
billingType,
|
||||
costUsd: parsedStream.costUsd ?? asNumber(parsed.total_cost_usd, 0),
|
||||
|
||||
@@ -477,6 +477,14 @@ function formatProviderError(source: string, error: unknown): string {
|
||||
}
|
||||
|
||||
export async function getQuotaWindows(): Promise<ProviderQuotaResult> {
|
||||
if (
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK === "1" ||
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK === "true" ||
|
||||
hasNonEmptyProcessEnv("ANTHROPIC_BEDROCK_BASE_URL")
|
||||
) {
|
||||
return { provider: "anthropic", source: "bedrock", ok: true, windows: [] };
|
||||
}
|
||||
|
||||
const authStatus = await readClaudeAuthStatus();
|
||||
const authDescription = describeClaudeSubscriptionAuth(authStatus);
|
||||
const token = await readClaudeToken();
|
||||
|
||||
@@ -95,9 +95,31 @@ export async function testEnvironment(
|
||||
});
|
||||
}
|
||||
|
||||
const hasBedrock =
|
||||
env.CLAUDE_CODE_USE_BEDROCK === "1" ||
|
||||
env.CLAUDE_CODE_USE_BEDROCK === "true" ||
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK === "1" ||
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK === "true" ||
|
||||
isNonEmpty(env.ANTHROPIC_BEDROCK_BASE_URL) ||
|
||||
isNonEmpty(process.env.ANTHROPIC_BEDROCK_BASE_URL);
|
||||
|
||||
const configApiKey = env.ANTHROPIC_API_KEY;
|
||||
const hostApiKey = process.env.ANTHROPIC_API_KEY;
|
||||
if (isNonEmpty(configApiKey) || isNonEmpty(hostApiKey)) {
|
||||
if (hasBedrock) {
|
||||
const source =
|
||||
env.CLAUDE_CODE_USE_BEDROCK === "1" ||
|
||||
env.CLAUDE_CODE_USE_BEDROCK === "true" ||
|
||||
isNonEmpty(env.ANTHROPIC_BEDROCK_BASE_URL)
|
||||
? "adapter config env"
|
||||
: "server environment";
|
||||
checks.push({
|
||||
code: "claude_bedrock_auth",
|
||||
level: "info",
|
||||
message: "AWS Bedrock auth detected. Claude will use Bedrock for inference.",
|
||||
detail: `Detected in ${source}.`,
|
||||
hint: "Ensure AWS credentials (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE) and AWS_REGION are configured.",
|
||||
});
|
||||
} else if (isNonEmpty(configApiKey) || isNonEmpty(hostApiKey)) {
|
||||
const source = isNonEmpty(configApiKey) ? "adapter config env" : "server environment";
|
||||
checks.push({
|
||||
code: "claude_anthropic_api_key_overrides_subscription",
|
||||
@@ -141,7 +163,10 @@ export async function testEnvironment(
|
||||
const args = ["--print", "-", "--output-format", "stream-json", "--verbose"];
|
||||
if (dangerouslySkipPermissions) args.push("--dangerously-skip-permissions");
|
||||
if (chrome) args.push("--chrome");
|
||||
if (model) args.push("--model", model);
|
||||
// Skip --model for Bedrock: Anthropic-style model IDs (e.g. "claude-opus-4-6") are not
|
||||
// valid Bedrock model identifiers. Let the CLI use whatever model is configured in its
|
||||
// own settings when Bedrock auth is active.
|
||||
if (model && !hasBedrock) args.push("--model", model);
|
||||
if (effort) args.push("--effort", effort);
|
||||
if (maxTurns > 0) args.push("--max-turns", String(maxTurns));
|
||||
if (extraArgs.length > 0) args.push(...extraArgs);
|
||||
|
||||
@@ -5,6 +5,8 @@ import path from "node:path";
|
||||
import { testEnvironment } from "@paperclipai/adapter-claude-local/server";
|
||||
|
||||
const ORIGINAL_ANTHROPIC = process.env.ANTHROPIC_API_KEY;
|
||||
const ORIGINAL_BEDROCK = process.env.CLAUDE_CODE_USE_BEDROCK;
|
||||
const ORIGINAL_BEDROCK_URL = process.env.ANTHROPIC_BEDROCK_BASE_URL;
|
||||
|
||||
afterEach(() => {
|
||||
if (ORIGINAL_ANTHROPIC === undefined) {
|
||||
@@ -12,10 +14,22 @@ afterEach(() => {
|
||||
} else {
|
||||
process.env.ANTHROPIC_API_KEY = ORIGINAL_ANTHROPIC;
|
||||
}
|
||||
if (ORIGINAL_BEDROCK === undefined) {
|
||||
delete process.env.CLAUDE_CODE_USE_BEDROCK;
|
||||
} else {
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK = ORIGINAL_BEDROCK;
|
||||
}
|
||||
if (ORIGINAL_BEDROCK_URL === undefined) {
|
||||
delete process.env.ANTHROPIC_BEDROCK_BASE_URL;
|
||||
} else {
|
||||
process.env.ANTHROPIC_BEDROCK_BASE_URL = ORIGINAL_BEDROCK_URL;
|
||||
}
|
||||
});
|
||||
|
||||
describe("claude_local environment diagnostics", () => {
|
||||
it("returns a warning (not an error) when ANTHROPIC_API_KEY is set in host environment", async () => {
|
||||
delete process.env.CLAUDE_CODE_USE_BEDROCK;
|
||||
delete process.env.ANTHROPIC_BEDROCK_BASE_URL;
|
||||
process.env.ANTHROPIC_API_KEY = "sk-test-host";
|
||||
|
||||
const result = await testEnvironment({
|
||||
@@ -40,6 +54,8 @@ describe("claude_local environment diagnostics", () => {
|
||||
|
||||
it("returns a warning (not an error) when ANTHROPIC_API_KEY is set in adapter env", async () => {
|
||||
delete process.env.ANTHROPIC_API_KEY;
|
||||
delete process.env.CLAUDE_CODE_USE_BEDROCK;
|
||||
delete process.env.ANTHROPIC_BEDROCK_BASE_URL;
|
||||
|
||||
const result = await testEnvironment({
|
||||
companyId: "company-1",
|
||||
@@ -64,6 +80,82 @@ describe("claude_local environment diagnostics", () => {
|
||||
expect(result.checks.some((check) => check.level === "error")).toBe(false);
|
||||
});
|
||||
|
||||
it("returns bedrock auth info when CLAUDE_CODE_USE_BEDROCK is set in host environment", async () => {
|
||||
delete process.env.ANTHROPIC_API_KEY;
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK = "1";
|
||||
|
||||
const result = await testEnvironment({
|
||||
companyId: "company-1",
|
||||
adapterType: "claude_local",
|
||||
config: {
|
||||
command: process.execPath,
|
||||
cwd: process.cwd(),
|
||||
},
|
||||
});
|
||||
|
||||
expect(
|
||||
result.checks.some(
|
||||
(check) =>
|
||||
check.code === "claude_bedrock_auth" && check.level === "info",
|
||||
),
|
||||
).toBe(true);
|
||||
expect(
|
||||
result.checks.some(
|
||||
(check) => check.code === "claude_subscription_mode_possible",
|
||||
),
|
||||
).toBe(false);
|
||||
expect(result.checks.some((check) => check.level === "error")).toBe(false);
|
||||
});
|
||||
|
||||
it("returns bedrock auth info when CLAUDE_CODE_USE_BEDROCK is set in adapter env", async () => {
|
||||
delete process.env.ANTHROPIC_API_KEY;
|
||||
delete process.env.CLAUDE_CODE_USE_BEDROCK;
|
||||
|
||||
const result = await testEnvironment({
|
||||
companyId: "company-1",
|
||||
adapterType: "claude_local",
|
||||
config: {
|
||||
command: process.execPath,
|
||||
cwd: process.cwd(),
|
||||
env: {
|
||||
CLAUDE_CODE_USE_BEDROCK: "1",
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
expect(
|
||||
result.checks.some(
|
||||
(check) =>
|
||||
check.code === "claude_bedrock_auth" && check.level === "info",
|
||||
),
|
||||
).toBe(true);
|
||||
expect(
|
||||
result.checks.some(
|
||||
(check) => check.code === "claude_subscription_mode_possible",
|
||||
),
|
||||
).toBe(false);
|
||||
expect(result.checks.some((check) => check.level === "error")).toBe(false);
|
||||
});
|
||||
|
||||
it("bedrock auth takes precedence over missing ANTHROPIC_API_KEY", async () => {
|
||||
delete process.env.ANTHROPIC_API_KEY;
|
||||
process.env.CLAUDE_CODE_USE_BEDROCK = "1";
|
||||
|
||||
const result = await testEnvironment({
|
||||
companyId: "company-1",
|
||||
adapterType: "claude_local",
|
||||
config: {
|
||||
command: process.execPath,
|
||||
cwd: process.cwd(),
|
||||
},
|
||||
});
|
||||
|
||||
const codes = result.checks.map((c) => c.code);
|
||||
expect(codes).toContain("claude_bedrock_auth");
|
||||
expect(codes).not.toContain("claude_subscription_mode_possible");
|
||||
expect(codes).not.toContain("claude_anthropic_api_key_overrides_subscription");
|
||||
});
|
||||
|
||||
it("creates a missing working directory when cwd is absolute", async () => {
|
||||
const cwd = path.join(
|
||||
os.tmpdir(),
|
||||
|
||||
@@ -53,6 +53,7 @@ export function formatTokens(n: number): string {
|
||||
export function providerDisplayName(provider: string): string {
|
||||
const map: Record<string, string> = {
|
||||
anthropic: "Anthropic",
|
||||
aws_bedrock: "AWS Bedrock",
|
||||
openai: "OpenAI",
|
||||
openrouter: "OpenRouter",
|
||||
chatgpt: "ChatGPT",
|
||||
@@ -79,6 +80,7 @@ export function quotaSourceDisplayName(source: string): string {
|
||||
const map: Record<string, string> = {
|
||||
"anthropic-oauth": "Anthropic OAuth",
|
||||
"claude-cli": "Claude CLI",
|
||||
"bedrock": "AWS Bedrock",
|
||||
"codex-rpc": "Codex app server",
|
||||
"codex-wham": "ChatGPT WHAM",
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user