{"record":{"id":"38dfcabd2694204e","repo":"warpdotdev/warp","slug":"bedrock-secrets-require-bedrock-api-key-and-re","errorCode":null,"errorMessage":"Bedrock secrets require --bedrock-api-key and --region in non-interactive mode","messagePattern":"Bedrock secrets require --bedrock-api-key and --region in non-interactive mode","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/secret.rs","lineNumber":678,"sourceCode":"                    Err(err) => return Err(err.into()),\n                }\n            }\n        }\n    };\n\n    Ok(Some(ManagedSecretValue::openai_api_key(api_key, base_url)))\n}\n\n/// Read a Bedrock API key secret from dedicated CLI flags or interactive prompts.\nfn read_bedrock_secret_value(\n    bedrock_api_key: Option<String>,\n    region: Option<String>,\n) -> Result<Option<ManagedSecretValue>> {\n    let api_key = match bedrock_api_key {\n        Some(k) if !k.is_empty() => k,\n        _ => {\n            if !io::stdin().is_terminal() {\n                return Err(anyhow::anyhow!(\n                    \"Bedrock secrets require --bedrock-api-key and --region in non-interactive mode\"\n                ));\n            }\n            let result = Password::new(\"Bedrock API key:\")\n                .with_display_toggle_enabled()\n                .without_confirmation()\n                .prompt();\n            match result {\n                Ok(value) if !value.is_empty() => value,\n                Ok(_) => return Ok(None),\n                Err(InquireError::OperationCanceled | InquireError::OperationInterrupted) => {\n                    return Ok(None);\n                }\n                Err(err) => return Err(err.into()),\n            }\n        }\n    };\n","sourceCodeStart":660,"sourceCodeEnd":696,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/secret.rs#L660-L696","documentation":"read_bedrock_secret_value reads the Bedrock API key from --bedrock-api-key, falling back to an interactive password prompt when the flag is absent or empty. If stdin is not a terminal (no prompt possible) and the flag was not supplied, it errors listing the flags required for non-interactive use. Cancellation of the interactive prompt is not an error; only the missing-flag non-interactive case is.","triggerScenarios":"Creating a Bedrock API-key secret in CI, a pipe, or any non-TTY context without a non-empty --bedrock-api-key flag.","commonSituations":"CI provisioning of Bedrock secrets; scripts run with redirected stdin; empty-string flag values (e.g. unset env var expanded to '').","solutions":["Pass --bedrock-api-key (non-empty) and --region on the command line","Run the command in an interactive terminal to be prompted for the key","Guard scripts: fail fast if the key env var is empty before invoking the CLI"],"exampleFix":"# before (CI)\noz secret create bw --bedrock-api-key \"$BW_KEY\" --region us-east-1\n# with BW_KEY unset -> Error: Bedrock secrets require --bedrock-api-key and --region in non-interactive mode\n\n# after\n: \"${BW_KEY:?BW_KEY must be set}\"\noz secret create bw --bedrock-api-key \"$BW_KEY\" --region us-east-1","handlingStrategy":"validation","validationCode":"fn noninteractive() -> bool { !std::io::stdin().is_terminal() }\nif noninteractive() && (bedrock_api_key.as_deref().unwrap_or_default().is_empty()\n    || region.as_deref().unwrap_or_default().is_empty()) {\n    anyhow::bail!(\"non-interactive Bedrock create requires --bedrock-api-key and --region\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat empty-string flags as missing in wrappers","Export and check key/region env vars before CI calls","Reserve interactive prompts for local terminals only"],"tags":["agent-sdk","secrets","bedrock","non-interactive","validation"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}