feat(cli): add AWS Bedrock as a supported provider

Add Bedrock to the CLI's supported providers with full AWS authentication
stack support:

- Bearer token / API key (AWS_BEDROCK_API_KEY or --api-key)
- AWS Profile (AWS_PROFILE env var)
- Direct credentials (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)
- Default credential chain fallthrough (IMDS, ECS task role, etc.)

Also makes the --provider help text dynamically list all supported
providers from the supportedProviders array instead of a hardcoded string.

The existing AwsBedrockHandler in src/api/providers/bedrock.ts already
handles all auth modes — the CLI just needed to populate the RooCodeSettings
fields correctly and relax the API key requirement for Bedrock (which can
auth without an explicit key).

*(Content added by Kenzie, LLM-based artificial assistant, on behalf of Rowena Day.)*

Author: rutgoff

apps/cli/src/commands/cli/run.ts

@@ -190,10 +190,28 @@ export async function run(promptArg: string | undefined, flagOptions: FlagOption
 	extensionHostOptions.apiKey = flagOptions.apiKey || getApiKeyFromEnv(extensionHostOptions.provider)
 
 	if (!extensionHostOptions.apiKey) {
-		console.error(`[CLI] Error: No API key provided. Use --api-key or set the appropriate environment variable.`)
-		console.error(`[CLI] For ${extensionHostOptions.provider}, set ${getEnvVarName(extensionHostOptions.provider)}`)
-
-		process.exit(1)
+		if (extensionHostOptions.provider === "bedrock") {
+			// Bedrock can authenticate via AWS credential chain without an explicit API key.
+			// Validate that at least one credential source is available.
+			const hasProfile = !!process.env.AWS_PROFILE
+			const hasDirectCreds = !!(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY)
+			if (!hasProfile && !hasDirectCreds) {
+				console.error(`[CLI] Error: No credentials found for Bedrock. Provide one of:`)
+				console.error(`  --api-key or AWS_BEDROCK_API_KEY (bearer token / API key mode)`)
+				console.error(`  AWS_PROFILE (profile-based auth)`)
+				console.error(`  AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY (direct credentials)`)
+				console.error(`  Or ensure a default credential chain is available (IMDS, ECS task role, etc.)`)
+				process.exit(1)
+			}
+		} else {
+			console.error(
+				`[CLI] Error: No API key provided. Use --api-key or set the appropriate environment variable.`,
+			)
+			console.error(
+				`[CLI] For ${extensionHostOptions.provider}, set ${getEnvVarName(extensionHostOptions.provider)}`,
+			)
+			process.exit(1)
+		}
 	}
 
 	if (!fs.existsSync(extensionHostOptions.workspacePath)) {

apps/cli/src/index.ts

@@ -1,6 +1,7 @@
 import { Command } from "commander"
 
 import { DEFAULT_FLAGS } from "@/types/constants.js"
+import { supportedProviders } from "@/types/index.js"
 import { VERSION } from "@/lib/utils/version.js"
 import { run, logout, status, listCommands, listModes, listModels, listSessions, upgrade } from "@/commands/index.js"
 
@@ -35,7 +36,7 @@ program
 	.option("-d, --debug", "Enable debug output (includes detailed debug information)", false)
 	.option("-a, --require-approval", "Require manual approval for actions", false)
 	.option("-k, --api-key <key>", "API key for the LLM provider")
-	.option("--provider <provider>", "API provider (anthropic, openai-native, gemini, openrouter, etc.)")
+	.option("--provider <provider>", `API provider (${supportedProviders.join(", ")})`)
 	.option("-m, --model <model>", "Model to use", DEFAULT_FLAGS.model)
 	.option("--mode <mode>", "Mode to start in (code, architect, ask, debug, etc.)", DEFAULT_FLAGS.mode)
 	.option("--terminal-shell <path>", "Absolute path to shell executable for inline terminal commands")

apps/cli/src/lib/utils/provider.ts

@@ -4,6 +4,7 @@ import type { SupportedProvider } from "@/types/index.js"
 
 const envVarMap: Record<SupportedProvider, string> = {
 	anthropic: "ANTHROPIC_API_KEY",
+	bedrock: "AWS_BEDROCK_API_KEY",
 	"openai-native": "OPENAI_API_KEY",
 	gemini: "GOOGLE_API_KEY",
 	openrouter: "OPENROUTER_API_KEY",
@@ -31,6 +32,36 @@ export function getProviderSettings(
 			if (apiKey) config.apiKey = apiKey
 			if (model) config.apiModelId = model
 			break
+		case "bedrock":
+			config.awsRegion = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || "us-east-1"
+			if (model) {
+				config.apiModelId = model
+				// Auto-enable cross-region inference when model ID has a regional prefix
+				// (e.g. "us.", "eu.", "apac.") — these are cross-region inference profiles
+				// that require awsUseCrossRegionInference to be set.
+				if (/^(us|eu|apac)\./.test(model)) {
+					config.awsUseCrossRegionInference = true
+				}
+			}
+
+			if (apiKey) {
+				// Bearer token / API key mode (LiteLLM proxy, Bedrock gateway)
+				config.awsUseApiKey = true
+				config.awsApiKey = apiKey
+			} else if (process.env.AWS_PROFILE) {
+				// Profile-based auth
+				config.awsUseProfile = true
+				config.awsProfile = process.env.AWS_PROFILE
+			} else if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+				// Direct credentials from env
+				config.awsAccessKey = process.env.AWS_ACCESS_KEY_ID
+				config.awsSecretKey = process.env.AWS_SECRET_ACCESS_KEY
+				if (process.env.AWS_SESSION_TOKEN) {
+					config.awsSessionToken = process.env.AWS_SESSION_TOKEN
+				}
+			}
+			// else: fall through to default credential chain (SDK handles IMDS, ECS task role, etc.)
+			break
 		case "openai-native":
 			if (apiKey) config.openAiNativeApiKey = apiKey
 			if (model) config.apiModelId = model

apps/cli/src/types/types.ts

@@ -3,6 +3,7 @@ import type { OutputFormat } from "./json-events.js"
 
 export const supportedProviders = [
 	"anthropic",
+	"bedrock",
 	"openai-native",
 	"gemini",
 	"openrouter",