Paging Dr. Bedrock...

cline --version 2>/dev/null || npx cline --version 2>/dev/null || true
node --version 2>/dev/null || true
aws --version 2>/dev/null || true
pwd

CLINE_DATA_DIR="${CLINE_DATA_DIR:-$HOME/.cline/data}"
PROVIDERS="$CLINE_DATA_DIR/settings/providers.json"

if [ -f "$PROVIDERS" ] && command -v jq >/dev/null 2>&1; then
  jq '
    def redact:
      if type == "object" then
        with_entries(if (.key|test("(?i)(key|secret|token|password|credential)")) then .value="<redacted>" else .value=(.value|redact) end)
      elif type == "array" then map(redact)
      else . end;
    .providers.bedrock.settings? | redact
  ' "$PROVIDERS"
elif [ -f "$PROVIDERS" ]; then
  node -e '
    const fs=require("fs"); const p=process.argv[1];
    const v=JSON.parse(fs.readFileSync(p,"utf8"));
    const r=(x)=>Array.isArray(x)?x.map(r):x&&typeof x==="object"?Object.fromEntries(Object.entries(x).map(([k,v])=>[k,/(key|secret|token|password|credential)/i.test(k)?"<redacted>":r(v)])):x;
    console.log(JSON.stringify(r(v.providers?.bedrock?.settings), null, 2));
  ' "$PROVIDERS"
else
  echo "No providers.json at $PROVIDERS"
fi

LEGACY="$CLINE_DATA_DIR/globalState.json"
SECRETS="$CLINE_DATA_DIR/secrets.json"
[ -f "$LEGACY" ] && jq '{awsRegion, awsAuthentication, awsUseProfile, awsProfile, awsUseCrossRegionInference, awsUseGlobalInference, awsBedrockUsePromptCache}' "$LEGACY" 2>/dev/null || true
[ -f "$SECRETS" ] && jq 'keys | map(select(test("(?i)(aws|bedrock)")))' "$SECRETS" 2>/dev/null || true

python3 - <<'PY'
import os, re
safe = ["AWS_PROFILE","AWS_REGION","AWS_DEFAULT_REGION","AWS_CONFIG_FILE","AWS_SHARED_CREDENTIALS_FILE","AWS_SDK_LOAD_CONFIG"]
secretish = ["AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_SECURITY_TOKEN"]
for k in safe:
    if k in os.environ:
        print(f"{k}={os.environ[k]}")
for k in secretish:
    if k in os.environ:
        print(f"{k}=<set redacted>")
for k in ["AWS_ROLE_ARN","AWS_WEB_IDENTITY_TOKEN_FILE","AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_CREDENTIALS_FULL_URI"]:
    if k in os.environ:
        v = os.environ[k]
        if k == "AWS_ROLE_ARN": v = re.sub(r"arn:aws[a-z-]*:iam::\d{12}:", "arn:aws:iam::<account>:", v)
        print(f"{k}={v}")
PY

AWS_CONFIG_FILE="${AWS_CONFIG_FILE:-$HOME/.aws/config}"
AWS_SHARED_CREDENTIALS_FILE="${AWS_SHARED_CREDENTIALS_FILE:-$HOME/.aws/credentials}"

for f in "$AWS_CONFIG_FILE" "$AWS_SHARED_CREDENTIALS_FILE"; do
  echo "--- $f ---"
  [ -f "$f" ] || { echo "missing"; continue; }
  awk '
    /^\[/ { section=$0; print section; next }
    /^[[:space:]]*(aws_access_key_id|aws_secret_access_key|aws_session_token)[[:space:]]*=/ { print "  " $1 "=<redacted>"; next }
    /^[[:space:]]*(region|sso_session|sso_start_url|sso_region|sso_account_id|sso_role_name|role_arn|source_profile|credential_source|web_identity_token_file|credential_process)[[:space:]]*=/ {
      key=$1; sub(/[[:space:]]*=.*/, "", key)
      if (key ~ /role_arn/) print "  " key "=<present redacted>";
      else if (key ~ /credential_process/) print "  " key "=<present redacted>";
      else print "  " $0
    }
  ' "$f"
done

PROFILE_ARG="--profile <profile>"   # replace or leave empty for default chain
REGION_ARG="--region <region>"      # replace with Cline/AWS region

aws sts get-caller-identity $PROFILE_ARG --output json
aws configure list $PROFILE_ARG

aws bedrock list-foundation-models $PROFILE_ARG $REGION_ARG --by-output-modality TEXT --output table

aws bedrock get-foundation-model $PROFILE_ARG $REGION_ARG --model-identifier '<model-id>' --output json