paperclip/packages/adapters/claude-local/src/server/test.ts

250 lines
8.9 KiB
TypeScript
Raw Normal View History

import type {
AdapterEnvironmentCheck,
AdapterEnvironmentTestContext,
AdapterEnvironmentTestResult,
} from "@paperclipai/adapter-utils";
import {
asString,
asBoolean,
asNumber,
asStringArray,
parseObject,
ensureAbsoluteDirectory,
ensureCommandResolvable,
ensurePathInEnv,
runChildProcess,
} from "@paperclipai/adapter-utils/server-utils";
import path from "node:path";
import { detectClaudeLoginRequired, parseClaudeStreamJson } from "./parse.js";
import { isBedrockModelId } from "./models.js";
function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
if (checks.some((check) => check.level === "error")) return "fail";
if (checks.some((check) => check.level === "warn")) return "warn";
return "pass";
}
function isNonEmpty(value: unknown): value is string {
return typeof value === "string" && value.trim().length > 0;
}
function firstNonEmptyLine(text: string): string {
return (
text
.split(/\r?\n/)
.map((line) => line.trim())
.find(Boolean) ?? ""
);
}
function commandLooksLike(command: string, expected: string): boolean {
const base = path.basename(command).toLowerCase();
return base === expected || base === `${expected}.cmd` || base === `${expected}.exe`;
}
function summarizeProbeDetail(stdout: string, stderr: string): string | null {
const raw = firstNonEmptyLine(stderr) || firstNonEmptyLine(stdout);
if (!raw) return null;
const clean = raw.replace(/\s+/g, " ").trim();
const max = 240;
return clean.length > max ? `${clean.slice(0, max - 1)}` : clean;
}
export async function testEnvironment(
ctx: AdapterEnvironmentTestContext,
): Promise<AdapterEnvironmentTestResult> {
const checks: AdapterEnvironmentCheck[] = [];
const config = parseObject(ctx.config);
const command = asString(config.command, "claude");
const cwd = asString(config.cwd, process.cwd());
try {
await ensureAbsoluteDirectory(cwd, { createIfMissing: true });
checks.push({
code: "claude_cwd_valid",
level: "info",
message: `Working directory is valid: ${cwd}`,
});
} catch (err) {
checks.push({
code: "claude_cwd_invalid",
level: "error",
message: err instanceof Error ? err.message : "Invalid working directory",
detail: cwd,
});
}
const envConfig = parseObject(config.env);
const env: Record<string, string> = {};
for (const [key, value] of Object.entries(envConfig)) {
if (typeof value === "string") env[key] = value;
}
const runtimeEnv = ensurePathInEnv({ ...process.env, ...env });
try {
await ensureCommandResolvable(command, cwd, runtimeEnv);
checks.push({
code: "claude_command_resolvable",
level: "info",
message: `Command is executable: ${command}`,
});
} catch (err) {
checks.push({
code: "claude_command_unresolvable",
level: "error",
message: err instanceof Error ? err.message : "Command is not executable",
detail: command,
});
}
feat: add AWS Bedrock auth support on "claude-local" (#2793) Closes #2412 Related: #2681, #498, #128 ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The Claude Code adapter spawns the `claude` CLI to run agent tasks > - The adapter detects auth mode by checking for `ANTHROPIC_API_KEY` — recognizing only "api" and "subscription" modes > - But users running Claude Code via **AWS Bedrock** (`CLAUDE_CODE_USE_BEDROCK=1`) fall through to the "subscription" path > - This causes a misleading "ANTHROPIC_API_KEY is not set; subscription-based auth can be used" message in the environment check > - Additionally, the hello probe passes `--model claude-opus-4-6` which is **not a valid Bedrock model identifier**, causing `400 The provided model identifier is invalid` and a probe failure > - This pull request adds Bedrock auth detection, skips the Anthropic-style `--model` flag for Bedrock, and returns the correct billing type > - The benefit is that Bedrock users get a working environment check and correct cost tracking out of the box --- ## Pain Point Many enterprise teams use **Claude Code through AWS Bedrock** rather than Anthropic's direct API — for compliance, billing consolidation, or VPC requirements. Currently, these users hit a **hard wall during onboarding**: | Problem | Impact | |---|---| | :x: Adapter environment check **always fails** | Users cannot create their first agent — blocked at step 1 | | :x: `--model claude-opus-4-6` is **invalid on Bedrock** (requires `us.anthropic.*` format) | Hello probe exits with code 1: `400 The provided model identifier is invalid` | | :x: Auth shown as _"subscription-based"_ | Misleading — Bedrock is neither subscription nor API-key auth | | :x: Quota polling hits Anthropic OAuth endpoint | Fails silently for Bedrock users who have no Anthropic subscription | > **Bottom line**: Paperclip is completely unusable for Bedrock users out of the box. ## Why Bedrock Matters AWS Bedrock is a major deployment path for Claude in enterprise environments: - **Enterprise compliance** — data stays within the customer's AWS account and VPC - **Unified billing** — Claude usage appears on the existing AWS invoice, no separate Anthropic billing - **IAM integration** — access controlled through AWS IAM roles and policies - **Regional deployment** — models run in the customer's preferred AWS region Supporting Bedrock unlocks Paperclip for organizations that **cannot** use Anthropic's direct API due to procurement, security, or regulatory constraints. --- ## What Changed - **`execute.ts`**: Added `isBedrockAuth()` helper that checks `CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_BEDROCK_BASE_URL` env vars. `resolveClaudeBillingType()` now returns `"metered_api"` for Bedrock. Biller set to `"aws_bedrock"`. Skips `--model` flag when Bedrock is active (Anthropic-style model IDs are invalid on Bedrock; the CLI uses its own configured model). - **`test.ts`**: Environment check now detects Bedrock env vars (from adapter config or server env) and shows `"AWS Bedrock auth detected. Claude will use Bedrock for inference."` instead of the misleading subscription message. Also skips `--model` in the hello probe for Bedrock. - **`quota.ts`**: Early return with `{ ok: true, windows: [] }` when Bedrock is active — Bedrock usage is billed through AWS, not Anthropic's subscription quota system. - **`ui/src/lib/utils.ts`**: Added `"aws_bedrock"` → `"AWS Bedrock"` to `providerDisplayName()` and `quotaSourceDisplayName()`. ## Verification 1. `pnpm -r typecheck` — all packages pass 2. Unit tests added and passing (6/6) 3. Environment check with Bedrock env vars: | | Before | After | |---|---|---| | **Status** | :red_circle: Failed | :white_check_mark: Passed | | **Auth message** | `ANTHROPIC_API_KEY is not set; subscription-based auth can be used if Claude is logged in.` | `AWS Bedrock auth detected. Claude will use Bedrock for inference.` | | **Hello probe** | `ERROR · Claude hello probe failed.` (exit code 1 — `--model claude-opus-4-6` is invalid on Bedrock) | `INFO · Claude hello probe succeeded.` | | **Screenshot** | <img height="500" alt="Screenshot 2026-04-05 at 8 25 27 AM" src="https://github.com/user-attachments/assets/476431f6-6139-425a-8abc-97875d653657" /> | <img height="500" alt="Screenshot 2026-04-05 at 8 31 58 AM" src="https://github.com/user-attachments/assets/d388ce87-c5e6-4574-b8d2-fd8b86135299" /> | 4. Existing API key / subscription paths are completely untouched unless Bedrock env vars are present ## Risks - **Low risk.** All changes are additive — existing "api" and "subscription" code paths are only entered when Bedrock env vars are absent. - When Bedrock is active, the `--model` flag is skipped, so the Paperclip model dropdown selection is ignored in favor of the Claude CLI's own model config. This is intentional since Bedrock requires different model identifiers. ## Model Used - Claude Opus 4.6 (`claude-opus-4-6`, 1M context window) via Claude Code CLI ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-04-07 05:15:18 +09:00
const hasBedrock =
env.CLAUDE_CODE_USE_BEDROCK === "1" ||
env.CLAUDE_CODE_USE_BEDROCK === "true" ||
process.env.CLAUDE_CODE_USE_BEDROCK === "1" ||
process.env.CLAUDE_CODE_USE_BEDROCK === "true" ||
isNonEmpty(env.ANTHROPIC_BEDROCK_BASE_URL) ||
isNonEmpty(process.env.ANTHROPIC_BEDROCK_BASE_URL);
const configApiKey = env.ANTHROPIC_API_KEY;
const hostApiKey = process.env.ANTHROPIC_API_KEY;
feat: add AWS Bedrock auth support on "claude-local" (#2793) Closes #2412 Related: #2681, #498, #128 ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The Claude Code adapter spawns the `claude` CLI to run agent tasks > - The adapter detects auth mode by checking for `ANTHROPIC_API_KEY` — recognizing only "api" and "subscription" modes > - But users running Claude Code via **AWS Bedrock** (`CLAUDE_CODE_USE_BEDROCK=1`) fall through to the "subscription" path > - This causes a misleading "ANTHROPIC_API_KEY is not set; subscription-based auth can be used" message in the environment check > - Additionally, the hello probe passes `--model claude-opus-4-6` which is **not a valid Bedrock model identifier**, causing `400 The provided model identifier is invalid` and a probe failure > - This pull request adds Bedrock auth detection, skips the Anthropic-style `--model` flag for Bedrock, and returns the correct billing type > - The benefit is that Bedrock users get a working environment check and correct cost tracking out of the box --- ## Pain Point Many enterprise teams use **Claude Code through AWS Bedrock** rather than Anthropic's direct API — for compliance, billing consolidation, or VPC requirements. Currently, these users hit a **hard wall during onboarding**: | Problem | Impact | |---|---| | :x: Adapter environment check **always fails** | Users cannot create their first agent — blocked at step 1 | | :x: `--model claude-opus-4-6` is **invalid on Bedrock** (requires `us.anthropic.*` format) | Hello probe exits with code 1: `400 The provided model identifier is invalid` | | :x: Auth shown as _"subscription-based"_ | Misleading — Bedrock is neither subscription nor API-key auth | | :x: Quota polling hits Anthropic OAuth endpoint | Fails silently for Bedrock users who have no Anthropic subscription | > **Bottom line**: Paperclip is completely unusable for Bedrock users out of the box. ## Why Bedrock Matters AWS Bedrock is a major deployment path for Claude in enterprise environments: - **Enterprise compliance** — data stays within the customer's AWS account and VPC - **Unified billing** — Claude usage appears on the existing AWS invoice, no separate Anthropic billing - **IAM integration** — access controlled through AWS IAM roles and policies - **Regional deployment** — models run in the customer's preferred AWS region Supporting Bedrock unlocks Paperclip for organizations that **cannot** use Anthropic's direct API due to procurement, security, or regulatory constraints. --- ## What Changed - **`execute.ts`**: Added `isBedrockAuth()` helper that checks `CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_BEDROCK_BASE_URL` env vars. `resolveClaudeBillingType()` now returns `"metered_api"` for Bedrock. Biller set to `"aws_bedrock"`. Skips `--model` flag when Bedrock is active (Anthropic-style model IDs are invalid on Bedrock; the CLI uses its own configured model). - **`test.ts`**: Environment check now detects Bedrock env vars (from adapter config or server env) and shows `"AWS Bedrock auth detected. Claude will use Bedrock for inference."` instead of the misleading subscription message. Also skips `--model` in the hello probe for Bedrock. - **`quota.ts`**: Early return with `{ ok: true, windows: [] }` when Bedrock is active — Bedrock usage is billed through AWS, not Anthropic's subscription quota system. - **`ui/src/lib/utils.ts`**: Added `"aws_bedrock"` → `"AWS Bedrock"` to `providerDisplayName()` and `quotaSourceDisplayName()`. ## Verification 1. `pnpm -r typecheck` — all packages pass 2. Unit tests added and passing (6/6) 3. Environment check with Bedrock env vars: | | Before | After | |---|---|---| | **Status** | :red_circle: Failed | :white_check_mark: Passed | | **Auth message** | `ANTHROPIC_API_KEY is not set; subscription-based auth can be used if Claude is logged in.` | `AWS Bedrock auth detected. Claude will use Bedrock for inference.` | | **Hello probe** | `ERROR · Claude hello probe failed.` (exit code 1 — `--model claude-opus-4-6` is invalid on Bedrock) | `INFO · Claude hello probe succeeded.` | | **Screenshot** | <img height="500" alt="Screenshot 2026-04-05 at 8 25 27 AM" src="https://github.com/user-attachments/assets/476431f6-6139-425a-8abc-97875d653657" /> | <img height="500" alt="Screenshot 2026-04-05 at 8 31 58 AM" src="https://github.com/user-attachments/assets/d388ce87-c5e6-4574-b8d2-fd8b86135299" /> | 4. Existing API key / subscription paths are completely untouched unless Bedrock env vars are present ## Risks - **Low risk.** All changes are additive — existing "api" and "subscription" code paths are only entered when Bedrock env vars are absent. - When Bedrock is active, the `--model` flag is skipped, so the Paperclip model dropdown selection is ignored in favor of the Claude CLI's own model config. This is intentional since Bedrock requires different model identifiers. ## Model Used - Claude Opus 4.6 (`claude-opus-4-6`, 1M context window) via Claude Code CLI ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-04-07 05:15:18 +09:00
if (hasBedrock) {
const source =
env.CLAUDE_CODE_USE_BEDROCK === "1" ||
env.CLAUDE_CODE_USE_BEDROCK === "true" ||
isNonEmpty(env.ANTHROPIC_BEDROCK_BASE_URL)
? "adapter config env"
: "server environment";
checks.push({
code: "claude_bedrock_auth",
level: "info",
message: "AWS Bedrock auth detected. Claude will use Bedrock for inference.",
detail: `Detected in ${source}.`,
hint: "Ensure AWS credentials (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or AWS_PROFILE) and AWS_REGION are configured.",
});
} else if (isNonEmpty(configApiKey) || isNonEmpty(hostApiKey)) {
const source = isNonEmpty(configApiKey) ? "adapter config env" : "server environment";
checks.push({
code: "claude_anthropic_api_key_overrides_subscription",
level: "warn",
message:
"ANTHROPIC_API_KEY is set. Claude will use API-key auth instead of subscription credentials.",
detail: `Detected in ${source}.`,
hint: "Unset ANTHROPIC_API_KEY if you want subscription-based Claude login behavior.",
});
} else {
checks.push({
code: "claude_subscription_mode_possible",
level: "info",
message: "ANTHROPIC_API_KEY is not set; subscription-based auth can be used if Claude is logged in.",
});
}
const canRunProbe =
checks.every((check) => check.code !== "claude_cwd_invalid" && check.code !== "claude_command_unresolvable");
if (canRunProbe) {
if (!commandLooksLike(command, "claude")) {
checks.push({
code: "claude_hello_probe_skipped_custom_command",
level: "info",
message: "Skipped hello probe because command is not `claude`.",
detail: command,
hint: "Use the `claude` CLI command to run the automatic login and installation probe.",
});
} else {
const model = asString(config.model, "").trim();
const effort = asString(config.effort, "").trim();
const chrome = asBoolean(config.chrome, false);
const maxTurns = asNumber(config.maxTurnsPerRun, 0);
const dangerouslySkipPermissions = asBoolean(config.dangerouslySkipPermissions, true);
const extraArgs = (() => {
const fromExtraArgs = asStringArray(config.extraArgs);
if (fromExtraArgs.length > 0) return fromExtraArgs;
return asStringArray(config.args);
})();
const args = ["--print", "-", "--output-format", "stream-json", "--verbose"];
if (dangerouslySkipPermissions) args.push("--dangerously-skip-permissions");
if (chrome) args.push("--chrome");
// For Bedrock: only pass --model when the ID is a Bedrock-native identifier.
if (model && (!hasBedrock || isBedrockModelId(model))) {
args.push("--model", model);
}
if (effort) args.push("--effort", effort);
if (maxTurns > 0) args.push("--max-turns", String(maxTurns));
if (extraArgs.length > 0) args.push(...extraArgs);
const probe = await runChildProcess(
`claude-envtest-${Date.now()}-${Math.random().toString(16).slice(2)}`,
command,
args,
{
cwd,
env,
timeoutSec: 45,
graceSec: 5,
stdin: "Respond with hello.",
onLog: async () => {},
},
);
const parsedStream = parseClaudeStreamJson(probe.stdout);
const parsed = parsedStream.resultJson;
const loginMeta = detectClaudeLoginRequired({
parsed,
stdout: probe.stdout,
stderr: probe.stderr,
});
const detail = summarizeProbeDetail(probe.stdout, probe.stderr);
if (probe.timedOut) {
checks.push({
code: "claude_hello_probe_timed_out",
level: "warn",
message: "Claude hello probe timed out.",
hint: "Retry the probe. If this persists, verify Claude can run `Respond with hello` from this directory manually.",
});
} else if (loginMeta.requiresLogin) {
checks.push({
code: "claude_hello_probe_auth_required",
level: "warn",
message: "Claude CLI is installed, but login is required.",
...(detail ? { detail } : {}),
hint: loginMeta.loginUrl
? `Run \`claude login\` and complete sign-in at ${loginMeta.loginUrl}, then retry.`
: "Run `claude login` in this environment, then retry the probe.",
});
} else if ((probe.exitCode ?? 1) === 0) {
const summary = parsedStream.summary.trim();
const hasHello = /\bhello\b/i.test(summary);
checks.push({
code: hasHello ? "claude_hello_probe_passed" : "claude_hello_probe_unexpected_output",
level: hasHello ? "info" : "warn",
message: hasHello
? "Claude hello probe succeeded."
: "Claude probe ran but did not return `hello` as expected.",
...(summary ? { detail: summary.replace(/\s+/g, " ").trim().slice(0, 240) } : {}),
...(hasHello
? {}
: {
hint: "Try the probe manually (`claude --print - --output-format stream-json --verbose`) and prompt `Respond with hello`.",
}),
});
} else {
checks.push({
code: "claude_hello_probe_failed",
level: "error",
message: "Claude hello probe failed.",
...(detail ? { detail } : {}),
hint: "Run `claude --print - --output-format stream-json --verbose` manually in this directory and prompt `Respond with hello` to debug.",
});
}
}
}
return {
adapterType: ctx.adapterType,
status: summarizeStatus(checks),
checks,
testedAt: new Date().toISOString(),
};
}