Bug/ai assistant config (#939)
* revert(agent): restore plain AWS_* Bedrock credential handling
Undoes the credential-name change from #937 (ae489cfd) in both Bedrock
clients (lib/agent/composer/client.ts and the invoice-inbox extractor).
The BEDROCK_AWS_* rename assumed Vercel/Lambda shadows AWS_*, but the
plain AWS_* client ran on prod for six weeks (since #584), so it was
never shadowed. The current assistant outage predates #937 and is
environmental (prod AWS credentials / Bedrock access), not this code.
Leaves the unrelated JournalEntryForm.tsx change from #937 intact.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(agent): log real Bedrock failure + credential-load diagnostics
When someone uses the agent, surface why it fails on prod instead of the
opaque "request ended without sending any chunks":
- client.ts getAnthropic(): on cold start, log the resolved region and
whether the AWS key/secret loaded from env (error-level if missing),
plus the 4-char access-key-id prefix (AKIA = our IAM key, ASIA = a
platform/STS credential) and whether a session token is present. No
secret is logged.
- run-turn.ts: on a stream failure, extract err.status / err.code /
err.cause / err.stack explicitly. The logger keeps only name+message
from an Error and drops the stack in production, so the true failure
(auth 403 vs bad region/model 400 vs throttle 429 vs transport cut)
was invisible until now.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5
Claude Fable 5
parent
ae489cfdcb
commit
3a3c4adbc6
@@ -246,18 +246,7 @@ export async function extractInvoiceFields(
|
||||
return { data: emptyResult(), rawText: null }
|
||||
}
|
||||
|
||||
// Prefer BEDROCK_AWS_* over the plain AWS_* names: on Vercel/Lambda the
|
||||
// platform injects its own reserved AWS_* execution-role vars that shadow
|
||||
// whatever is configured, so a hosted deploy must use the BEDROCK_AWS_* names
|
||||
// (see lib/agent/composer/client.ts for the full explanation).
|
||||
const awsRegion =
|
||||
process.env.BEDROCK_AWS_REGION || process.env.AWS_REGION || 'eu-north-1'
|
||||
const awsAccessKey =
|
||||
process.env.BEDROCK_AWS_ACCESS_KEY_ID || process.env.AWS_ACCESS_KEY_ID
|
||||
const awsSecretKey =
|
||||
process.env.BEDROCK_AWS_SECRET_ACCESS_KEY || process.env.AWS_SECRET_ACCESS_KEY
|
||||
|
||||
if (!awsAccessKey || !awsSecretKey) {
|
||||
if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
|
||||
log.warn('AWS Bedrock credentials missing: returning empty extraction', {
|
||||
file_name_hash: createHash('sha256').update(input.fileName).digest('hex').slice(0, 12),
|
||||
})
|
||||
@@ -265,9 +254,9 @@ export async function extractInvoiceFields(
|
||||
}
|
||||
|
||||
const client = new AnthropicBedrock({
|
||||
awsRegion,
|
||||
awsAccessKey,
|
||||
awsSecretKey,
|
||||
awsRegion: process.env.AWS_REGION || 'eu-north-1',
|
||||
awsAccessKey: process.env.AWS_ACCESS_KEY_ID,
|
||||
awsSecretKey: process.env.AWS_SECRET_ACCESS_KEY,
|
||||
})
|
||||
|
||||
let rawText: string | null = null
|
||||
|
||||
@@ -301,11 +301,42 @@ export async function runChatTurn(args: RunTurnArgs): Promise<void> {
|
||||
// Surface as a chat error so the UI clears its streaming state. Re-throw
|
||||
// to let the route's outer try/catch persist the failure if needed.
|
||||
// Normalize Bedrock throttling/timeout/5xx into a friendly Swedish line.
|
||||
//
|
||||
// Extract status/code/cause/stack explicitly: the logger keeps only
|
||||
// name/message/code from an Error and drops the stack in production, so
|
||||
// the real failure was invisible (every prod log just said "request ended
|
||||
// without sending any chunks"). These fields tell us whether the empty
|
||||
// stream is auth (403), bad model/region (400), throttling (429), or a
|
||||
// genuine transport cut. No secrets: AWS/SDK errors carry none, and the
|
||||
// logger still redacts personnummer/UUIDs from any string.
|
||||
const bedrockErr = err as {
|
||||
status?: number
|
||||
code?: string
|
||||
cause?: unknown
|
||||
stack?: string
|
||||
}
|
||||
let errCause: string | undefined
|
||||
try {
|
||||
errCause =
|
||||
bedrockErr?.cause != null
|
||||
? String(
|
||||
bedrockErr.cause instanceof Error
|
||||
? `${bedrockErr.cause.name}: ${bedrockErr.cause.message}`
|
||||
: bedrockErr.cause,
|
||||
).slice(0, 300)
|
||||
: undefined
|
||||
} catch {
|
||||
errCause = '[uninspectable cause]'
|
||||
}
|
||||
log.error('Bedrock stream failed', err, {
|
||||
conversationId,
|
||||
companyId,
|
||||
model,
|
||||
iterations,
|
||||
errStatus: typeof bedrockErr?.status === 'number' ? bedrockErr.status : undefined,
|
||||
errCode: typeof bedrockErr?.code === 'string' ? bedrockErr.code : undefined,
|
||||
errCause,
|
||||
errStack: typeof bedrockErr?.stack === 'string' ? bedrockErr.stack.slice(0, 1200) : undefined,
|
||||
})
|
||||
emit({ kind: 'error', message: friendlyModelError(err) })
|
||||
throw err
|
||||
|
||||
@@ -1,4 +1,7 @@
|
||||
import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
|
||||
import { createLogger } from '@/lib/logger'
|
||||
|
||||
const log = createLogger('agent-bedrock-client')
|
||||
|
||||
let cached: AnthropicBedrock | null = null
|
||||
|
||||
@@ -20,19 +23,32 @@ let cached: AnthropicBedrock | null = null
|
||||
// API.
|
||||
export function getAnthropic(): AnthropicBedrock {
|
||||
if (cached) return cached
|
||||
// Read Bedrock creds from BEDROCK_AWS_* first, falling back to the plain
|
||||
// AWS_* names for local dev. On Vercel the functions run on AWS Lambda, whose
|
||||
// runtime injects its OWN reserved AWS_REGION / AWS_ACCESS_KEY_ID /
|
||||
// AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN for the platform execution role
|
||||
// (wrong account, wrong region, no Bedrock access). Those shadow anything set
|
||||
// in the dashboard, so a hosted deploy MUST use the BEDROCK_AWS_* names or the
|
||||
// stream comes back empty ("request ended without sending any chunks").
|
||||
const awsRegion =
|
||||
process.env.BEDROCK_AWS_REGION || process.env.AWS_REGION || 'eu-north-1'
|
||||
const awsAccessKey =
|
||||
process.env.BEDROCK_AWS_ACCESS_KEY_ID || process.env.AWS_ACCESS_KEY_ID
|
||||
const awsSecretKey =
|
||||
process.env.BEDROCK_AWS_SECRET_ACCESS_KEY || process.env.AWS_SECRET_ACCESS_KEY
|
||||
const awsRegion = process.env.AWS_REGION || 'eu-north-1'
|
||||
const awsAccessKey = process.env.AWS_ACCESS_KEY_ID
|
||||
const awsSecretKey = process.env.AWS_SECRET_ACCESS_KEY
|
||||
|
||||
// Startup diagnostic: make a hosted misconfiguration visible in the logs
|
||||
// instead of it surfacing only as an opaque "request ended without sending
|
||||
// any chunks" at stream time. Runs once per cold start (the client is cached).
|
||||
// Never logs a secret: only the region, presence booleans, and the 4-char
|
||||
// access-key-id PREFIX (AKIA = long-term IAM user key; ASIA = STS/temporary
|
||||
// role credential, i.e. a platform-injected one rather than ours).
|
||||
if (!awsAccessKey || !awsSecretKey) {
|
||||
log.error('agent Bedrock credentials not loaded from env', undefined, {
|
||||
region: awsRegion,
|
||||
hasAccessKeyId: !!awsAccessKey,
|
||||
hasSecretAccessKey: !!awsSecretKey,
|
||||
regionFromEnv: !!process.env.AWS_REGION,
|
||||
})
|
||||
} else {
|
||||
log.info('agent Bedrock client init', {
|
||||
region: awsRegion,
|
||||
keyPrefix: awsAccessKey.slice(0, 4),
|
||||
hasSessionToken: !!process.env.AWS_SESSION_TOKEN,
|
||||
regionFromEnv: !!process.env.AWS_REGION,
|
||||
})
|
||||
}
|
||||
|
||||
// When both static keys are present, pass them. Otherwise omit them so the
|
||||
// SDK falls back to the AWS credential provider chain (instance profile,
|
||||
// IRSA, EKS pod identity, ...). The two-overload SDK refuses a mix.
|
||||
|
||||
Reference in New Issue
Block a user