{"record":{"id":"dc63bea415b44e95","repo":"alibaba/open-code-review","slug":"llm-protocol-cannot-be-q-bedrock-derives-its-hos","errorCode":null,"errorMessage":"llm.protocol cannot be %q: bedrock derives its host from aws_region and signs with the AWS credential chain, so it has no use for llm.url or llm.auth_token; run `ocr config set provider bedrock` instead","messagePattern":"llm\\.protocol cannot be %q: bedrock derives its host from aws_region and signs with the AWS credential chain, so it has no use for llm\\.url or llm\\.auth_token; run `ocr config set provider bedrock` instead","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/opencodereview/config_cmd.go","lineNumber":539,"sourceCode":"\t\tcfg.Llm.AuthHeader = normalized\n\tcase \"llm.extra_headers\", \"llm.ExtraHeaders\":\n\t\tparsed, err := llm.ParseExtraHeaders(value)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tcfg.Llm.ExtraHeaders = parsed\n\tcase \"llm.model\", \"llm.Model\":\n\t\tcfg.Llm.Model = value\n\tcase \"llm.protocol\", \"llm.Protocol\":\n\t\tnormalized := llm.NormalizeProtocol(value)\n\t\tif err := llm.ValidateProtocol(normalized); err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// The llm block is a single url + token endpoint. Bedrock needs neither\n\t\t// and has nowhere here to put a region or a profile, so it is refused at\n\t\t// the point of setting rather than accepted and ignored at resolve time.\n\t\tif normalized == llm.ProtocolAnthropicBedrock {\n\t\t\treturn fmt.Errorf(\"llm.protocol cannot be %q: bedrock derives its host from aws_region and signs with the AWS credential chain, so it has no use for llm.url or llm.auth_token; run `ocr config set provider bedrock` instead\", normalized)\n\t\t}\n\t\tcfg.Llm.Protocol = normalized\n\t\t// Mirror use_anthropic so older binaries that predate llm.protocol\n\t\t// still pick the right protocol family: anthropic -> true, the OpenAI\n\t\t// family (including openai-responses) -> false.\n\t\tif normalized == llm.ProtocolAnthropic {\n\t\t\tt := true\n\t\t\tcfg.Llm.UseAnthropic = &t\n\t\t} else {\n\t\t\tf := false\n\t\t\tcfg.Llm.UseAnthropic = &f\n\t\t}\n\tcase \"llm.use_anthropic\", \"llm.UseAnthropic\":\n\t\tb, err := strconv.ParseBool(value)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"invalid boolean for llm.use_anthropic: %w\", err)\n\t\t}\n\t\tcfg.Llm.UseAnthropic = &b","sourceCodeStart":521,"sourceCodeEnd":557,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/cmd/opencodereview/config_cmd.go#L521-L557","documentation":"Setting llm.protocol to anthropic-bedrock is explicitly refused: the shared llm block is a single url+auth_token endpoint, while Bedrock derives its host from aws_region and authenticates via the AWS credential chain, so the llm.* fields have nowhere to hold region/profile. The code rejects the value at set-time instead of silently ignoring it at resolve-time.","triggerScenarios":"`ocr config set llm.protocol anthropic-bedrock` (in any casing that normalizes to bedrock) while the key is accepted in the provider-level `protocol` field.","commonSituations":"Migrating a generic llm.* endpoint config to Bedrock; following outdated docs that put bedrock under llm.protocol; scripting config generation that mirrors provider fields into the llm block.","solutions":["Run `ocr config set provider bedrock` instead of setting llm.protocol","Set the region with `ocr config set providers.bedrock.aws_region <region>` (and optionally aws_profile)","If you need a custom Bedrock-compatible endpoint, configure it as a provider entry, not the llm block","Check `ocr config get` to confirm the current provider and protocol"],"exampleFix":"// before\nocr config set llm.protocol anthropic-bedrock\n// after\nocr config set provider bedrock\nocr config set providers.bedrock.aws_region us-east-1","handlingStrategy":"validation","validationCode":"if strings.EqualFold(strings.TrimSpace(protocol), \"anthropic-bedrock\") {\n    // route through provider config instead of llm.protocol\n    return runConfigSet(\"provider\", \"bedrock\")\n}\nreturn runConfigSet(\"llm.protocol\", protocol)","typeGuard":null,"tryCatchPattern":"if err := runConfigSet(\"llm.protocol\", p); err != nil {\n    if strings.Contains(err.Error(), \"cannot be\") && strings.Contains(err.Error(), \"bedrock\") {\n        return runConfigSet(\"provider\", \"bedrock\") // auto-fallback\n    }\n    return err\n}","preventionTips":["Never put anthropic-bedrock in llm.protocol; it belongs only in providers.<name>.protocol","Configure Bedrock via `ocr config set provider bedrock` plus aws_region/aws_profile","Keep provisioning scripts aligned with current docs for llm.* vs provider fields","Note the llm block is a single url+token endpoint and cannot express AWS regions"],"tags":["config","bedrock","aws","cli"],"backgroundTag":"unsupported-protocol-value","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}