From b6e40fec54db17d94392b855b483cba6c9c5e37c Mon Sep 17 00:00:00 2001 From: Lucas Kim <41357160+kimnamu@users.noreply.github.com> Date: Tue, 7 Apr 2026 05:15:18 +0900 Subject: [PATCH] feat: add AWS Bedrock auth support on "claude-local" (#2793) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #2412 Related: #2681, #498, #128 ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The Claude Code adapter spawns the `claude` CLI to run agent tasks > - The adapter detects auth mode by checking for `ANTHROPIC_API_KEY` — recognizing only "api" and "subscription" modes > - But users running Claude Code via **AWS Bedrock** (`CLAUDE_CODE_USE_BEDROCK=1`) fall through to the "subscription" path > - This causes a misleading "ANTHROPIC_API_KEY is not set; subscription-based auth can be used" message in the environment check > - Additionally, the hello probe passes `--model claude-opus-4-6` which is **not a valid Bedrock model identifier**, causing `400 The provided model identifier is invalid` and a probe failure > - This pull request adds Bedrock auth detection, skips the Anthropic-style `--model` flag for Bedrock, and returns the correct billing type > - The benefit is that Bedrock users get a working environment check and correct cost tracking out of the box --- ## Pain Point Many enterprise teams use **Claude Code through AWS Bedrock** rather than Anthropic's direct API — for compliance, billing consolidation, or VPC requirements. Currently, these users hit a **hard wall during onboarding**: | Problem | Impact | |---|---| | :x: Adapter environment check **always fails** | Users cannot create their first agent — blocked at step 1 | | :x: `--model claude-opus-4-6` is **invalid on Bedrock** (requires `us.anthropic.*` format) | Hello probe exits with code 1: `400 The provided model identifier is invalid` | | :x: Auth shown as _"subscription-based"_ | Misleading — Bedrock is neither subscription nor API-key auth | | :x: Quota polling hits Anthropic OAuth endpoint | Fails silently for Bedrock users who have no Anthropic subscription | > **Bottom line**: Paperclip is completely unusable for Bedrock users out of the box. ## Why Bedrock Matters AWS Bedrock is a major deployment path for Claude in enterprise environments: - **Enterprise compliance** — data stays within the customer's AWS account and VPC - **Unified billing** — Claude usage appears on the existing AWS invoice, no separate Anthropic billing - **IAM integration** — access controlled through AWS IAM roles and policies - **Regional deployment** — models run in the customer's preferred AWS region Supporting Bedrock unlocks Paperclip for organizations that **cannot** use Anthropic's direct API due to procurement, security, or regulatory constraints. --- ## What Changed - **`execute.ts`**: Added `isBedrockAuth()` helper that checks `CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_BEDROCK_BASE_URL` env vars. `resolveClaudeBillingType()` now returns `"metered_api"` for Bedrock. Biller set to `"aws_bedrock"`. Skips `--model` flag when Bedrock is active (Anthropic-style model IDs are invalid on Bedrock; the CLI uses its own configured model). - **`test.ts`**: Environment check now detects Bedrock env vars (from adapter config or server env) and shows `"AWS Bedrock auth detected. Claude will use Bedrock for inference."` instead of the misleading subscription message. Also skips `--model` in the hello probe for Bedrock. - **`quota.ts`**: Early return with `{ ok: true, windows: [] }` when Bedrock is active — Bedrock usage is billed through AWS, not Anthropic's subscription quota system. - **`ui/src/lib/utils.ts`**: Added `"aws_bedrock"` → `"AWS Bedrock"` to `providerDisplayName()` and `quotaSourceDisplayName()`. ## Verification 1. `pnpm -r typecheck` — all packages pass 2. Unit tests added and passing (6/6) 3. Environment check with Bedrock env vars: | | Before | After | |---|---|---| | **Status** | :red_circle: Failed | :white_check_mark: Passed | | **Auth message** | `ANTHROPIC_API_KEY is not set; subscription-based auth can be used if Claude is logged in.` | `AWS Bedrock auth detected. Claude will use Bedrock for inference.` | | **Hello probe** | `ERROR · Claude hello probe failed.` (exit code 1 — `--model claude-opus-4-6` is invalid on Bedrock) | `INFO · Claude hello probe succeeded.` | | **Screenshot** | Screenshot 2026-04-05 at 8 25 27 AM | Screenshot 2026-04-05 at 8 31 58 AM | 4. Existing API key / subscription paths are completely untouched unless Bedrock env vars are present ## Risks - **Low risk.** All changes are additive — existing "api" and "subscription" code paths are only entered when Bedrock env vars are absent. - When Bedrock is active, the `--model` flag is skipped, so the Paperclip model dropdown selection is ignored in favor of the Claude CLI's own model config. This is intentional since Bedrock requires different model identifiers. ## Model Used - Claude Opus 4.6 (`claude-opus-4-6`, 1M context window) via Claude Code CLI ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Claude Opus 4.6 (1M context) Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- .../claude-local/src/server/execute.ts | 18 +++- .../adapters/claude-local/src/server/quota.ts | 8 ++ .../adapters/claude-local/src/server/test.ts | 29 +++++- .../claude-local-adapter-environment.test.ts | 92 +++++++++++++++++++ ui/src/lib/utils.ts | 2 + 5 files changed, 143 insertions(+), 6 deletions(-) diff --git a/packages/adapters/claude-local/src/server/execute.ts b/packages/adapters/claude-local/src/server/execute.ts index eca82b50..04153410 100644 --- a/packages/adapters/claude-local/src/server/execute.ts +++ b/packages/adapters/claude-local/src/server/execute.ts @@ -102,8 +102,16 @@ function hasNonEmptyEnvValue(env: Record, key: string): boolean return typeof raw === "string" && raw.trim().length > 0; } -function resolveClaudeBillingType(env: Record): "api" | "subscription" { - // Claude uses API-key auth when ANTHROPIC_API_KEY is present; otherwise rely on local login/session auth. +function isBedrockAuth(env: Record): boolean { + return ( + env.CLAUDE_CODE_USE_BEDROCK === "1" || + env.CLAUDE_CODE_USE_BEDROCK === "true" || + hasNonEmptyEnvValue(env, "ANTHROPIC_BEDROCK_BASE_URL") + ); +} + +function resolveClaudeBillingType(env: Record): "api" | "subscription" | "metered_api" { + if (isBedrockAuth(env)) return "metered_api"; return hasNonEmptyEnvValue(env, "ANTHROPIC_API_KEY") ? "api" : "subscription"; } @@ -431,7 +439,9 @@ export async function execute(ctx: AdapterExecutionContext): Promise 0) args.push("--max-turns", String(maxTurns)); if (effectiveInstructionsFilePath) { @@ -578,7 +588,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise { + if ( + process.env.CLAUDE_CODE_USE_BEDROCK === "1" || + process.env.CLAUDE_CODE_USE_BEDROCK === "true" || + hasNonEmptyProcessEnv("ANTHROPIC_BEDROCK_BASE_URL") + ) { + return { provider: "anthropic", source: "bedrock", ok: true, windows: [] }; + } + const authStatus = await readClaudeAuthStatus(); const authDescription = describeClaudeSubscriptionAuth(authStatus); const token = await readClaudeToken(); diff --git a/packages/adapters/claude-local/src/server/test.ts b/packages/adapters/claude-local/src/server/test.ts index 04865dd0..31b8f3c0 100644 --- a/packages/adapters/claude-local/src/server/test.ts +++ b/packages/adapters/claude-local/src/server/test.ts @@ -95,9 +95,31 @@ export async function testEnvironment( }); } + const hasBedrock = + env.CLAUDE_CODE_USE_BEDROCK === "1" || + env.CLAUDE_CODE_USE_BEDROCK === "true" || + process.env.CLAUDE_CODE_USE_BEDROCK === "1" || + process.env.CLAUDE_CODE_USE_BEDROCK === "true" || + isNonEmpty(env.ANTHROPIC_BEDROCK_BASE_URL) || + isNonEmpty(process.env.ANTHROPIC_BEDROCK_BASE_URL); + const configApiKey = env.ANTHROPIC_API_KEY; const hostApiKey = process.env.ANTHROPIC_API_KEY; - if (isNonEmpty(configApiKey) || isNonEmpty(hostApiKey)) { + if (hasBedrock) { + const source = + env.CLAUDE_CODE_USE_BEDROCK === "1" || + env.CLAUDE_CODE_USE_BEDROCK === "true" || + isNonEmpty(env.ANTHROPIC_BEDROCK_BASE_URL) + ? "adapter config env" + : "server environment"; + checks.push({ + code: "claude_bedrock_auth", + level: "info", + message: "AWS Bedrock auth detected. Claude will use Bedrock for inference.", + detail: `Detected in ${source}.`, + hint: "Ensure AWS credentials (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE) and AWS_REGION are configured.", + }); + } else if (isNonEmpty(configApiKey) || isNonEmpty(hostApiKey)) { const source = isNonEmpty(configApiKey) ? "adapter config env" : "server environment"; checks.push({ code: "claude_anthropic_api_key_overrides_subscription", @@ -141,7 +163,10 @@ export async function testEnvironment( const args = ["--print", "-", "--output-format", "stream-json", "--verbose"]; if (dangerouslySkipPermissions) args.push("--dangerously-skip-permissions"); if (chrome) args.push("--chrome"); - if (model) args.push("--model", model); + // Skip --model for Bedrock: Anthropic-style model IDs (e.g. "claude-opus-4-6") are not + // valid Bedrock model identifiers. Let the CLI use whatever model is configured in its + // own settings when Bedrock auth is active. + if (model && !hasBedrock) args.push("--model", model); if (effort) args.push("--effort", effort); if (maxTurns > 0) args.push("--max-turns", String(maxTurns)); if (extraArgs.length > 0) args.push(...extraArgs); diff --git a/server/src/__tests__/claude-local-adapter-environment.test.ts b/server/src/__tests__/claude-local-adapter-environment.test.ts index 7fd96824..8aa4313b 100644 --- a/server/src/__tests__/claude-local-adapter-environment.test.ts +++ b/server/src/__tests__/claude-local-adapter-environment.test.ts @@ -5,6 +5,8 @@ import path from "node:path"; import { testEnvironment } from "@paperclipai/adapter-claude-local/server"; const ORIGINAL_ANTHROPIC = process.env.ANTHROPIC_API_KEY; +const ORIGINAL_BEDROCK = process.env.CLAUDE_CODE_USE_BEDROCK; +const ORIGINAL_BEDROCK_URL = process.env.ANTHROPIC_BEDROCK_BASE_URL; afterEach(() => { if (ORIGINAL_ANTHROPIC === undefined) { @@ -12,10 +14,22 @@ afterEach(() => { } else { process.env.ANTHROPIC_API_KEY = ORIGINAL_ANTHROPIC; } + if (ORIGINAL_BEDROCK === undefined) { + delete process.env.CLAUDE_CODE_USE_BEDROCK; + } else { + process.env.CLAUDE_CODE_USE_BEDROCK = ORIGINAL_BEDROCK; + } + if (ORIGINAL_BEDROCK_URL === undefined) { + delete process.env.ANTHROPIC_BEDROCK_BASE_URL; + } else { + process.env.ANTHROPIC_BEDROCK_BASE_URL = ORIGINAL_BEDROCK_URL; + } }); describe("claude_local environment diagnostics", () => { it("returns a warning (not an error) when ANTHROPIC_API_KEY is set in host environment", async () => { + delete process.env.CLAUDE_CODE_USE_BEDROCK; + delete process.env.ANTHROPIC_BEDROCK_BASE_URL; process.env.ANTHROPIC_API_KEY = "sk-test-host"; const result = await testEnvironment({ @@ -40,6 +54,8 @@ describe("claude_local environment diagnostics", () => { it("returns a warning (not an error) when ANTHROPIC_API_KEY is set in adapter env", async () => { delete process.env.ANTHROPIC_API_KEY; + delete process.env.CLAUDE_CODE_USE_BEDROCK; + delete process.env.ANTHROPIC_BEDROCK_BASE_URL; const result = await testEnvironment({ companyId: "company-1", @@ -64,6 +80,82 @@ describe("claude_local environment diagnostics", () => { expect(result.checks.some((check) => check.level === "error")).toBe(false); }); + it("returns bedrock auth info when CLAUDE_CODE_USE_BEDROCK is set in host environment", async () => { + delete process.env.ANTHROPIC_API_KEY; + process.env.CLAUDE_CODE_USE_BEDROCK = "1"; + + const result = await testEnvironment({ + companyId: "company-1", + adapterType: "claude_local", + config: { + command: process.execPath, + cwd: process.cwd(), + }, + }); + + expect( + result.checks.some( + (check) => + check.code === "claude_bedrock_auth" && check.level === "info", + ), + ).toBe(true); + expect( + result.checks.some( + (check) => check.code === "claude_subscription_mode_possible", + ), + ).toBe(false); + expect(result.checks.some((check) => check.level === "error")).toBe(false); + }); + + it("returns bedrock auth info when CLAUDE_CODE_USE_BEDROCK is set in adapter env", async () => { + delete process.env.ANTHROPIC_API_KEY; + delete process.env.CLAUDE_CODE_USE_BEDROCK; + + const result = await testEnvironment({ + companyId: "company-1", + adapterType: "claude_local", + config: { + command: process.execPath, + cwd: process.cwd(), + env: { + CLAUDE_CODE_USE_BEDROCK: "1", + }, + }, + }); + + expect( + result.checks.some( + (check) => + check.code === "claude_bedrock_auth" && check.level === "info", + ), + ).toBe(true); + expect( + result.checks.some( + (check) => check.code === "claude_subscription_mode_possible", + ), + ).toBe(false); + expect(result.checks.some((check) => check.level === "error")).toBe(false); + }); + + it("bedrock auth takes precedence over missing ANTHROPIC_API_KEY", async () => { + delete process.env.ANTHROPIC_API_KEY; + process.env.CLAUDE_CODE_USE_BEDROCK = "1"; + + const result = await testEnvironment({ + companyId: "company-1", + adapterType: "claude_local", + config: { + command: process.execPath, + cwd: process.cwd(), + }, + }); + + const codes = result.checks.map((c) => c.code); + expect(codes).toContain("claude_bedrock_auth"); + expect(codes).not.toContain("claude_subscription_mode_possible"); + expect(codes).not.toContain("claude_anthropic_api_key_overrides_subscription"); + }); + it("creates a missing working directory when cwd is absolute", async () => { const cwd = path.join( os.tmpdir(), diff --git a/ui/src/lib/utils.ts b/ui/src/lib/utils.ts index bf33606d..6fc61585 100644 --- a/ui/src/lib/utils.ts +++ b/ui/src/lib/utils.ts @@ -53,6 +53,7 @@ export function formatTokens(n: number): string { export function providerDisplayName(provider: string): string { const map: Record = { anthropic: "Anthropic", + aws_bedrock: "AWS Bedrock", openai: "OpenAI", openrouter: "OpenRouter", chatgpt: "ChatGPT", @@ -79,6 +80,7 @@ export function quotaSourceDisplayName(source: string): string { const map: Record = { "anthropic-oauth": "Anthropic OAuth", "claude-cli": "Claude CLI", + "bedrock": "AWS Bedrock", "codex-rpc": "Codex app server", "codex-wham": "ChatGPT WHAM", };