Skip to content

Comments

fix(bedrock): validate AWS credentials in isProviderConfigured and filter failover chains#8

Merged
dgarson merged 301 commits intomainfrom
fix/bedrock-auth-filtering
Feb 4, 2026
Merged

fix(bedrock): validate AWS credentials in isProviderConfigured and filter failover chains#8
dgarson merged 301 commits intomainfrom
fix/bedrock-auth-filtering

Conversation

@dgarson
Copy link
Owner

@dgarson dgarson commented Feb 2, 2026

Summary

Fixes the amazon-bedrock provider authentication checking and failover chain filtering to prevent spurious "No API key found for amazon-bedrock" errors when AWS credentials are not configured.

Root Cause

The isProviderConfigured() function was unconditionally returning true for amazon-bedrock without validating that AWS credentials are actually available. This caused bedrock to be included in model failover chains even when unauthenticated, leading to confusing error messages.

Changes

  1. Fixed isProviderConfigured() for amazon-bedrock (src/agents/model-auth.ts)

    • Now checks for AWS credentials using resolveAwsSdkEnvVarName() instead of always returning true
    • Only reports bedrock as configured when AWS environment variables are detected
  2. Added failover chain authentication filtering (src/agents/model-fallback.ts)

    • Filters unauthenticated providers from failover candidates at resolution time
    • Provides clearer error messages when no authenticated providers are available
    • Prevents execution-time failures with better upfront validation
  3. Updated tests (src/agents/model-auth.test.ts)

    • Fixed test expectation: bedrock without credentials now correctly returns false
    • Added test case for bedrock with AWS credentials returning true
  4. Added debug logging (src/agents/models-config.providers.ts)

    • Logs when bedrock discovery skips due to missing credentials
    • Warns when discovery is explicitly enabled but credentials are missing
  5. Updated documentation (docs/bedrock.md)

    • Added comprehensive "Credential Detection" section
    • Clarifies environment variable detection vs runtime AWS SDK chain
    • Documents IAM role workaround requirement (AWS_PROFILE=default)

Test Plan

  • Unit tests pass (src/agents/model-auth.test.ts - 16 tests)
  • No lint errors in modified files
  • Build succeeds without type errors
  • Bedrock shows as unavailable when no AWS credentials present
  • Bedrock shows as available when AWS credentials are set
  • Failover chains filter unauthenticated providers
  • Clear error messages when no authenticated providers available

Breaking Changes

For IAM role-based authentication users (EC2/ECS): You must now set AWS_PROFILE=default to signal that credentials are available, as Clawdbrain cannot detect runtime IAM credentials during availability checks. This is already documented in the bedrock docs.

🤖 Generated with Claude Code

dgarson and others added 30 commits January 26, 2026 01:01
…ive tests

- Extract fuzzyScorePart, scoreCommand, filterByFuzzy from command-palette.ts
  into a new fuzzy-search.ts module with full exports for reuse
- Add 38 unit tests covering:
  - fuzzyScorePart: exact/prefix/substring/fuzzy matching, case insensitivity,
    word boundary bonuses, consecutive character rewards, length penalties
  - scoreCommand: label/category/id matching, multi-term queries, weight hierarchy
  - filterByFuzzy: filtering, sorting by relevance, tie-breaking, edge cases
- Update command-palette.ts to import from fuzzy-search module
- Mark backlog item as in-progress

Backlog: P3 → Command Palette Enhancement → Implement fuzzy search
- Add command-history.ts: localStorage-backed store for recently used commands
  - Tracks last 20 commands with use count and timestamps
  - Deduplicates on repeat use (moves to top, increments count)
  - Gracefully handles corrupt data and localStorage unavailability
- Update command-palette.ts: integrate history
  - Show 'Recent' category when palette opens with no query
  - Record command usage on selection (click or Enter)
  - Recent commands appear at top, followed by all commands in original categories
- Add 10 comprehensive tests for the history store
- Add command-history.ts: localStorage-backed recents tracking
  - recordCommandUsage(id) — records usage, deduplicates, caps at 10
  - getRecentCommandIds(limit?) — returns MRU command IDs
  - clearCommandHistory() — clears all history
  - Graceful degradation when localStorage is unavailable
  - Resilient to corrupted/non-array/non-string localStorage data

- Update command-palette.ts to integrate recents:
  - Show 'Recents' group at top when no query is entered
  - Deduplicate recents from the main command list
  - Record command usage on every selection
  - Keyboard navigation works across recents + regular groups

- Add 13 unit tests for command-history.ts:
  - Recording, ordering, deduplication, cap enforcement
  - Limit parameter, empty state, clear behavior
  - Resilience: corrupted JSON, non-array data, non-string entries

Backlog: P3 → Command Palette Enhancement → Add command history and recents
- Overseer: shimmer skeleton with header, stats cards, controls, graph
  area, and activity feed placeholders during initial data load
- Cron: shimmer skeleton with status card, job list placeholders
- Both use the existing skeleton() utility from design-utils
- BACKLOG.md: mark completed P2 Goal Lifecycle items (PR #14),
  update skeleton screens status
feat(ui): add skeleton loading screens for overseer and cron views
- Add command-history.ts: localStorage-backed store for recently used commands
  - Tracks last 20 commands with use count and timestamps
  - Deduplicates on repeat use (moves to top, increments count)
  - Gracefully handles corrupt data and localStorage unavailability
- Update command-palette.ts: integrate history
  - Show 'Recent' category when palette opens with no query
  - Record command usage on selection (click or Enter)
  - Recent commands appear at top, followed by all commands in original categories
- Add 10 comprehensive tests for the history store
feat(ui): add command history & recents to command palette
feat(landing): mobile navigation, back-to-top, accessibility improvements
- Add createContextCommands() that returns view-specific commands based on
  the currently active tab (e.g., Chat: New/Clear/Abort, Cron: Add/Refresh,
  Overseer: Create Goal/Refresh, Config: Save, etc.)
- Context commands appear in a 'Current View' category at the top of the palette
- Wire context commands in app-render.ts with actual app state callbacks
- Only show commands when relevant callbacks are available
  (e.g., Abort only when streaming)
- Add 12 tests for createContextCommands + createDefaultCommands
feat(ui): extract fuzzy search into standalone module with comprehensive tests
- Shows an illustrative empty state with CTA to create first goal
- Replaces blank graph panel area when no goals are configured
- Includes descriptive text explaining what goals are and how they work
- 'Create Your First Goal' button wired to the existing create modal
- Falls back to 'Connect to gateway' message when not connected
- Only shown when not loading and goals list is empty
feat(ui): add empty state for overseer view when no goals exist
feat(ui): add command palette history with localStorage persistence
feat(ui): add context-aware commands to command palette
- Add command-favorites.ts: localStorage-backed favorites storage
  - addFavorite/removeFavorite/toggleFavorite/isFavorite/getFavoriteIds/clearFavorites
  - Graceful degradation when localStorage is unavailable
  - Resilient to corrupted/non-array/non-string localStorage data

- Update command-palette.ts to integrate favorites:
  - Show '★ Favorites' section at top when no query is entered
  - Deduplicate favorites from the main command list
  - Show ★ indicator on favorited commands (clickable to unfavorite)
  - Ctrl/Cmd+D keyboard shortcut to toggle favorite on selected item
  - Keyboard navigation works across favorites + regular groups

- Wire favorites into app state:
  - Add commandPaletteFavVersion counter to AppViewState for re-render
  - Add bumpCommandPaletteFavVersion() method to app
  - Pass onFavoritesChange callback from app-render

- Add 18 unit tests for command-favorites.ts:
  - addFavorite: basic, dedup, insertion order
  - removeFavorite: basic, no-op, order preservation
  - toggleFavorite: add/remove/round-trip
  - isFavorite: unknown/known commands
  - getFavoriteIds: empty, insertion order
  - clearFavorites: basic, empty safety
  - Resilience: corrupted JSON, non-array, non-string entries

Backlog: P3 → Command Palette Enhancement → Add favorites system
feat(ui): add favorites system to command palette
- Add category pills/tabs between search input and command list
  - 'All' (default) shows all commands; other pills filter by category
  - Active pill highlighted with accent color
  - Horizontal scroll with hidden scrollbar for overflow
  - CSS: rounded pill buttons with hover/active states

- Keyboard navigation for categories:
  - Tab / Shift+Tab cycles through category filters
  - Backspace on empty query resets category to 'All'
  - Selection index resets to 0 on category change

- State management:
  - Add activeCategory to CommandPaletteState
  - Add commandPaletteCategory + setCommandPaletteCategory to app state
  - Category resets to 'All' on open/close
  - Wired through app-render.ts

- Categories extracted dynamically from commands (no hardcoded list)
- Recents section only shows when category is 'All' and no query
- Category filter applied before fuzzy search for combined filtering

Backlog: P3 → Command Palette Enhancement → Add category filtering in search
…ategories

feat(ui): add category filtering to command palette
A detailed architectural document covering the transformation of
Clawdbot from a single-user personal AI assistant to a multi-tenant
SaaS platform, including:

- Multi-tenant architecture with Kubernetes execution plane
- PostgreSQL data model with Row-Level Security
- Cloud Overseer containers with sandboxed subagent workers
- Security model with gVisor, Seccomp, and network policies
- Technology stack recommendations (AWS EKS, pgvector, Redis)
- Tiered pricing model (Free/Pro/Team/Enterprise)
- Plugin marketplace with 70/30 revenue split
- Detailed implementation roadmap (4 phases)
- Risk analysis and mitigations

Addresses Slack thread: https://secondbrain-yag3652.slack.com/archives/C0AAYGJ1BB6/p1769366459804469
…ion-boiUu

docs: add comprehensive SaaS transformation plan
dgarson and others added 26 commits February 1, 2026 18:27
Architecture:
- Drop-in replacement for gateway chat backend
- Runtime switchable via feature flag (no rebuild)
- Zero modifications to existing SessionChat components
- Complete isolation (separate stores, adapters, state)

Completed:
✅ Vercel AI agent package extracted from fork (packages/vercel-ai-agent)
✅ Integration adapter with gateway-compatible interface
✅ Dedicated Zustand stores (Vercel AI + preferences)
✅ Unified chat backend hook (useChatBackend)
✅ UI toggle component in SessionHeader
✅ Updated session route to use unified hook

Architecture Benefits:
- Existing gateway implementation completely intact
- Both backends can coexist and be A/B tested
- Easy to add more backends in future
- Clean separation of concerns

Blocked:
⚠️  Vercel AI agent package has TypeScript compilation errors
   (API incompatibilities with newer SDK versions v2/v3)
   Package needs updates to build successfully

Files Created:
- apps/web/src/integrations/vercel-ai/vercel-agent-adapter.ts
- apps/web/src/stores/useVercelSessionStore.ts
- apps/web/src/stores/usePreferencesStore.ts
- apps/web/src/hooks/useChatBackend.ts
- apps/web/src/components/domain/session/ChatBackendToggle.tsx
- VERCEL-AI-INTEGRATION-STATUS.md (detailed status doc)

Files Modified:
- apps/web/src/routes/agents/$agentId/session/$sessionKey.tsx
- apps/web/src/components/domain/session/SessionHeader.tsx
- apps/web/src/components/domain/session/index.ts
- packages/vercel-ai-agent/package.json (updated deps)

See VERCEL-AI-INTEGRATION-STATUS.md for complete details
Complete rewrite of @clawdbrain/vercel-ai-agent to use Vercel AI SDK v5:

- Updated dependencies to v5 (ai@^5.0.0, provider SDKs @^3.0.0)
- Rewrote agent.ts using stable streamText/generateText APIs
- Implemented custom multi-step tool calling loop
- Updated tool definitions to use v5 tool() helper with inputSchema
- Fixed v5 property names: textDelta, input, output, inputTokens, outputTokens
- Removed experimental Agent class (incompatible types)
- Updated types to use UIMessage instead of CoreMessage
- Simplified ToolRegistry for v5 native tools

The package now builds successfully and is ready for adapter integration.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
Updated VercelAgentAdapter to work with v5 agent package:

- Changed getModelProvider to return v5 ModelConfig structure
- Updated runStream call to use AgentRunInput format
- Fixed stream chunk processing for v5 property names (textDelta, toolCall)
- Removed unused provider SDK imports
- Added comprehensive unit tests with streaming simulation
- Tests cover initialization, streaming, tool calls, errors, and session management

The adapter now fully integrates with the v5 agent package.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
Comprehensive documentation for Vercel AI SDK v5 backend integration:

- API endpoint structure (OpenAI-compatible)
- Clawdbrain AI API Key management schema
- Dual-mode routing (proxy vs agent mode)
- Request flow and processing pipeline
- Pi Agent integration strategies
- Frontend integration examples
- Configuration UI mockups

Provides complete blueprint for backend implementation to support
both simple proxy mode and full agentic mode via unified API.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
… operations

Implements complete Worktree RPC system with 6 core methods:
- worktree.list: List files/directories with recursive support
- worktree.read: Read file contents (UTF-8/base64)
- worktree.write: Create/update files
- worktree.delete: Delete files/directories
- worktree.move: Move/rename files
- worktree.mkdir: Create directories

Security features:
- Path traversal prevention
- Workspace boundary enforcement
- Permission-based authorization (operator.read/write scopes)

Testing:
- 7 new worktree handler tests
- All 200 tests passing
- Build successful

Deferred to Phase 2: Secret redaction, rate limiting, UI components

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
feat(gateway): implement worktree RPC system for agent workspace file operations
…rdization

chore: ccsdk->claude runtime name cleanup; web-fetch tool result/erro…
…-fork

feat: merge the UX development branch from the fork and resolve confl…
…lter failover chains

- Fix isProviderConfigured() to check for AWS credentials instead of always returning true for amazon-bedrock
- Add failover chain filtering to exclude unauthenticated providers at candidate resolution time
- Update tests to match new behavior (bedrock without creds = false)
- Add debug logging when bedrock discovery skips due to missing credentials
- Update bedrock docs with credential detection section
- Provide clearer error messages when no authenticated providers are available for failover
@dgarson dgarson merged commit 56d83f0 into main Feb 4, 2026
10 of 41 checks passed
dgarson added a commit that referenced this pull request Feb 4, 2026
feat(ui): add Overseer simulator for end-to-end testing
dgarson added a commit that referenced this pull request Feb 7, 2026
…#208)

* feat: added work-queue workflow workers and a worker manager, integrate w/cron

* fix: address 12 logic flaws in workflow engine, adapter, phases, and cron types

- engine: capture phase before clobbering in catch handler (#1)
- engine: remove dead `state.plan ?? plan` fallback (#2)
- engine: mark workflow failed when all execution nodes fail (#6)
- adapter: fix retry count off-by-one (attemptNumber vs retryCount) (#3)
- adapter: clean up abort listener in sleep on timeout (#10)
- discover: fix batch/entries index mismatch when spawns fail (#4)
- execute: add cycle detection to topological sort (#5)
- review: add autoApproved flag to distinguish fallback approvals (#7)
- plan: add comment clarifying sessionKey reuse across repair attempts (#8)
- decompose: remove unused model/maxPhases/maxTasksPerPhase/maxSubtasksPerTask opts (#9)
- types: add autoApproved to ReviewIteration (#7)
- cron/state: use discriminated union for CronEvent (CronJobEvent | CronHealthEvent) (#12)
- tests: add WorkflowWorkerAdapter test suite (8 tests) (#11)

https://claude.ai/code/session_01L8kquwpmUh5zmU9S4MHgPu

---------

Co-authored-by: Claude <[email protected]>
dgarson added a commit that referenced this pull request Feb 7, 2026
…cron types (openclaw#217)

- engine: capture phase before clobbering in catch handler (#1)
- engine: remove dead `state.plan ?? plan` fallback (#2)
- engine: mark workflow failed when all execution nodes fail (#6)
- adapter: fix retry count off-by-one (attemptNumber vs retryCount) (#3)
- adapter: clean up abort listener in sleep on timeout (#10)
- discover: fix batch/entries index mismatch when spawns fail (#4)
- execute: add cycle detection to topological sort (#5)
- review: add autoApproved flag to distinguish fallback approvals (#7)
- plan: add comment clarifying sessionKey reuse across repair attempts (#8)
- decompose: remove unused model/maxPhases/maxTasksPerPhase/maxSubtasksPerTask opts (#9)
- types: add autoApproved to ReviewIteration (#7)
- cron/state: use discriminated union for CronEvent (CronJobEvent | CronHealthEvent) (#12)
- tests: add WorkflowWorkerAdapter test suite (8 tests) (#11)

https://claude.ai/code/session_01L8kquwpmUh5zmU9S4MHgPu

Co-authored-by: Claude <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.