refactor: add aws-sdk auth mode and tighten provider auth

src/media-understanding/apply.test.ts

@@ -13,7 +13,12 @@ vi.mock("../agents/model-auth.js", () => ({
   resolveApiKeyForProvider: vi.fn(async () => ({
     apiKey: "test-key",
     source: "test",
+    mode: "api-key",
   })),
+  requireApiKey: (auth: { apiKey?: string; mode?: string }, provider: string) => {
+    if (auth?.apiKey) return auth.apiKey;
+    throw new Error(`No API key resolved for provider "${provider}" (auth mode: ${auth?.mode}).`);
+  },
 }));
 
 vi.mock("../media/fetch.js", () => ({

src/media-understanding/providers/image.ts

@@ -2,7 +2,7 @@ import type { Api, AssistantMessage, Context, Model } from "@mariozechner/pi-ai"
 import { complete } from "@mariozechner/pi-ai";
 import { discoverAuthStorage, discoverModels } from "@mariozechner/pi-coding-agent";
 
-import { getApiKeyForModel } from "../../agents/model-auth.js";
+import { getApiKeyForModel, requireApiKey } from "../../agents/model-auth.js";
 import { ensureClawdbotModelsJson } from "../../agents/models-config.js";
 import { minimaxUnderstandImage } from "../../agents/minimax-vlm.js";
 import { coerceImageAssistantText } from "../../agents/tools/image-tool.helpers.js";
@@ -28,12 +28,13 @@ export async function describeImageWithModel(
     profileId: params.profile,
     preferredProfile: params.preferredProfile,
   });
-  authStorage.setRuntimeApiKey(model.provider, apiKeyInfo.apiKey);
+  const apiKey = requireApiKey(apiKeyInfo, model.provider);
+  authStorage.setRuntimeApiKey(model.provider, apiKey);
 
   const base64 = params.buffer.toString("base64");
   if (model.provider === "minimax") {
     const text = await minimaxUnderstandImage({
-      apiKey: apiKeyInfo.apiKey,
+      apiKey,
       prompt: params.prompt ?? "Describe the image.",
       imageDataUrl: `data:${params.mime ?? "image/jpeg"};base64,${base64}`,
       modelBaseUrl: model.baseUrl,
@@ -54,7 +55,7 @@ export async function describeImageWithModel(
     ],
   };
   const message = (await complete(model, context, {
-    apiKey: apiKeyInfo.apiKey,
+    apiKey,
     maxTokens: params.maxTokens ?? 512,
   })) as AssistantMessage;
   const text = coerceImageAssistantText({

src/media-understanding/runner.ts

@@ -1,7 +1,7 @@
 import type { ClawdbotConfig } from "../config/config.js";
 import type { MsgContext } from "../auto-reply/templating.js";
 import { applyTemplate } from "../auto-reply/templating.js";
-import { resolveApiKeyForProvider } from "../agents/model-auth.js";
+import { requireApiKey, resolveApiKeyForProvider } from "../agents/model-auth.js";
 import { logVerbose, shouldLogVerbose } from "../globals.js";
 import { runExec } from "../process/exec.js";
 import type {
@@ -300,13 +300,14 @@ async function runProviderEntry(params: {
       maxBytes,
       timeoutMs,
     });
-    const key = await resolveApiKeyForProvider({
+    const auth = await resolveApiKeyForProvider({
       provider: providerId,
       cfg,
       profileId: entry.profile,
       preferredProfile: entry.preferredProfile,
       agentDir: params.agentDir,
     });
+    const apiKey = requireApiKey(auth, providerId);
     const providerConfig = cfg.models?.providers?.[providerId];
     const baseUrl = entry.baseUrl ?? params.config?.baseUrl ?? providerConfig?.baseUrl;
     const mergedHeaders = {
@@ -325,7 +326,7 @@ async function runProviderEntry(params: {
       buffer: media.buffer,
       fileName: media.fileName,
       mime: media.mime,
-      apiKey: key.apiKey,
+      apiKey,
       baseUrl,
       headers,
       model,
@@ -359,19 +360,20 @@ async function runProviderEntry(params: {
       `Video attachment ${params.attachmentIndex + 1} base64 payload ${estimatedBase64Bytes} exceeds ${maxBase64Bytes}`,
     );
   }
-  const key = await resolveApiKeyForProvider({
+  const auth = await resolveApiKeyForProvider({
     provider: providerId,
     cfg,
     profileId: entry.profile,
     preferredProfile: entry.preferredProfile,
     agentDir: params.agentDir,
   });
+  const apiKey = requireApiKey(auth, providerId);
   const providerConfig = cfg.models?.providers?.[providerId];
   const result = await provider.describeVideo({
     buffer: media.buffer,
     fileName: media.fileName,
     mime: media.mime,
-    apiKey: key.apiKey,
+    apiKey,
     baseUrl: providerConfig?.baseUrl,
     headers: providerConfig?.headers,
     model: entry.model,