* revert(agent): restore plain AWS_* Bedrock credential handling
Undoes the credential-name change from #937 (ae489cfd) in both Bedrock
clients (lib/agent/composer/client.ts and the invoice-inbox extractor).
The BEDROCK_AWS_* rename assumed Vercel/Lambda shadows AWS_*, but the
plain AWS_* client ran on prod for six weeks (since #584), so it was
never shadowed. The current assistant outage predates #937 and is
environmental (prod AWS credentials / Bedrock access), not this code.
Leaves the unrelated JournalEntryForm.tsx change from #937 intact.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(agent): log real Bedrock failure + credential-load diagnostics
When someone uses the agent, surface why it fails on prod instead of the
opaque "request ended without sending any chunks":
- client.ts getAnthropic(): on cold start, log the resolved region and
whether the AWS key/secret loaded from env (error-level if missing),
plus the 4-char access-key-id prefix (AKIA = our IAM key, ASIA = a
platform/STS credential) and whether a session token is present. No
secret is logged.
- run-turn.ts: on a stream failure, extract err.status / err.code /
err.cause / err.stack explicitly. The logger keeps only name+message
from an Error and drops the stack in production, so the true failure
(auth 403 vs bad region/model 400 vs throttle 429 vs transport cut)
was invisible until now.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
3a3c4adbc6