feat: aws support (vscode aws sso login, options.profile) (#1493)

Fixes three issues:

- AWS_PROFILE is only supported through `aws_config::default_provider`
right now, aka when the user provides no cues about aws creds in the
baml client options
- options.profile is not respected by baml-runtime in python/ts
- options.profile is not respected by the vscode extension (aka wasm)

Some chores:

- fix unused code/imports warnings and crank those warnings up to build
errors
- rename WebPanelView to WebviewPanelHost

Implementation notes:

- vscode extensions are somewhat limited in what files they're allowed
to access through the vscode API
- technically, they're only allowed to open files available in the
repository/workspace
- although apparently the roo-code extension [doesn't have this
issue](https://github.com/RooVetGit/Roo-Code/blob/bfd50240270fe01a34d37fa9c933dc26e4330b07/src/core/Cline.ts#L964)?
seems some experimentation is required here to determine what is/isn't
allowed (but i definitely remember testing this when i implemented file
ref support for images)
- upon further investigation, this is only if you request through the
vscode API. extension sandboxing is nonexistent therefore node processes
in the extension can do whatever the heck they want.
- the baml playground (since it's a webview) currently has to request
files from vscode by RPCing through the extension
- the language server _does_ have filesystem access, so we could go
through that (i don't love the idea of pushing the aws config files and
cached credentials through the LSP stdin/stdio channel)
- better approach is to probably re-purpose the request proxy for this
(vbv's work around enabling/disabling the proxy will conflict with this,
unfortunately), and use that to bypass vscode filesystem limitations
- we need this filesystem access for the playground (this is complicated
b/c the rust->wasm code doesn't have filesystem access (since WASI is
not yet a standard): `AWS_PROFILE` can be backed by either IAM role
profiles or SSO exchanges
    - IAM role profile creds are cached in `~/.aws/credentials`
- SSO profiles are stored in `~/.aws/sso/` (I'm unclear on how exactly
the Rust SDK hooks into this yet, nor if an override point exists here)
- so there's a number of files that we need to support; at a minimum we
should support aws sso, and we should also look into what other files
are needed to implement a reasonable level of support for
- alternatively: if instead of providing a shim for `std::fs::read` in
wasm, we instead just implement `ProvideCredentials` in wasm and force
it to delegate to `npm:@aws-sdk/credential-providers` in the proxy, that
feels a lot more doable. however, protocol will also need to support
forwarding env vars over (and shimming them on the node side). we may
also need some shenanigans to make sure bedrock works on promptfiddle if
we do this.
 
fixes #1488 

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> This pull request adds support for AWS profile configuration in the
BAML runtime and VSCode extension, including new commands for loading
AWS credentials and environment variables, and updates test cases to
validate these changes.
> 
>   - **AWS Profile Support**:
> - Added support for `options.profile` in `baml-runtime` and `vscode`
extension.
> - Implemented `LOAD_AWS_CREDS` command in `vscode-rpc.ts` to load AWS
credentials based on profile.
>     - Updated `WebviewPanelHost` to handle AWS credentials loading.
>   - **Environment Variables**:
> - Added `LOAD_ENV` command in `vscode-rpc.ts` to load environment
variables from `.env` file or command.
> - Implemented environment variable loading logic in
`WebviewPanelHost`.
>   - **Testing**:
> - Updated `aws.test.ts` to include tests for AWS profile configuration
and invalid profile handling.
>   - **Miscellaneous**:
> - Updated `package.json` and `uv.lock` to reflect new dependencies and
configurations.
> - Minor refactoring and logging improvements in `vscode` extension
files.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=BoundaryML%2Fbaml&utm_source=github&utm_medium=referral)<sup>
for 803e9f8. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

Author: sxlijin

engine/Cargo.lock

@@ -94,6 +94,7 @@ serde_yaml = "0.9.34"
 static_assertions = "1.1.0"
 strum = { version = "0.26.2", features = ["derive"] }
 strum_macros = "0.26.2"
+thiserror = "2.0.12"
 time = { version = "0.3.36", features = ["formatting"] }
 tracing-core = { version = "0.1.31" }
 pin-project-lite = "0.2.14"

engine/Cargo.toml

@@ -6,6 +6,12 @@ authors.workspace = true
 license-file.workspace = true
 description = "Logging library for BAML for end user logging"
 
+[lints.rust]
+dead_code = "deny"
+elided_named_lifetimes = "deny"
+unused_imports = "deny"
+unused_variables = "deny"
+
 [dependencies]
 serde = { version = "1.0", features = ["derive"] }
 serde_json.workspace = true

engine/baml-lib/baml-log/Cargo.toml

@@ -1,49 +1,3 @@
-use crate::logger::Loggable;
-use crate::Level;
-use serde_json::Value;
-
-/// Creates a JSON-serializable event for structured logging
-pub struct Event<'a, T>
-where
-    T: Loggable,
-{
-    /// Log level
-    pub level: Level,
-    /// Event name
-    pub name: &'a str,
-    /// Event payload
-    pub payload: T,
-    /// Module path
-    pub module_path: Option<&'a str>,
-    /// File
-    pub file: Option<&'a str>,
-    /// Line
-    pub line: Option<u32>,
-}
-
-impl<'a, T> Event<'a, T>
-where
-    T: Loggable,
-{
-    pub fn new(
-        level: Level,
-        name: &'a str,
-        payload: T,
-        module_path: Option<&'a str>,
-        file: Option<&'a str>,
-        line: Option<u32>,
-    ) -> Self {
-        Self {
-            level,
-            name,
-            payload,
-            module_path,
-            file,
-            line,
-        }
-    }
-}
-
 /// Logs a structured event at the specified level
 ///
 /// This can be used for structured logging that works with both regular and JSON formats.

engine/baml-lib/baml-log/src/event.rs

@@ -1,6 +1,5 @@
 use colored::*;
 use lazy_static::lazy_static;
-use serde::Serialize;
 use std::collections::HashMap;
 use std::env;
 use std::fmt::{self, Display};
@@ -191,7 +190,7 @@ impl ConfigValue for LogLevelConfig {
         "BAML_LOG"
     }
 
-    fn parse_value(value: &str) -> Option<Self> {
+    fn parse_value(_: &str) -> Option<Self> {
         Some(LogLevelConfig)
     }
 
@@ -215,7 +214,7 @@ impl ConfigValue for JsonModeConfig {
         "BAML_LOG_JSON"
     }
 
-    fn parse_value(value: &str) -> Option<Self> {
+    fn parse_value(_: &str) -> Option<Self> {
         Some(JsonModeConfig)
     }
 
@@ -238,7 +237,7 @@ impl ConfigValue for ColorModeConfig {
         "BAML_LOG_COLOR_MODE"
     }
 
-    fn parse_value(value: &str) -> Option<Self> {
+    fn parse_value(_: &str) -> Option<Self> {
         Some(ColorModeConfig)
     }
 
@@ -262,7 +261,7 @@ impl ConfigValue for MaxMessageLengthConfig {
         "BAML_LOG_MAX_MESSAGE_LENGTH"
     }
 
-    fn parse_value(value: &str) -> Option<Self> {
+    fn parse_value(_: &str) -> Option<Self> {
         Some(MaxMessageLengthConfig)
     }
 
@@ -376,24 +375,24 @@ pub enum LogError {
 }
 
 /// JSON-serializable log entry
-#[derive(Serialize)]
-struct LogEntry<'a> {
-    /// Timestamp in ISO 8601 format
-    timestamp: String,
-    /// Log level as a string
-    level: &'a str,
-    /// Log message
-    message: String,
-    /// Optional module path
-    #[serde(skip_serializing_if = "Option::is_none")]
-    module_path: Option<&'a str>,
-    /// Optional file name
-    #[serde(skip_serializing_if = "Option::is_none")]
-    file: Option<&'a str>,
-    /// Optional line number
-    #[serde(skip_serializing_if = "Option::is_none")]
-    line: Option<u32>,
-}
+// #[derive(Serialize)]
+// struct LogEntry<'a> {
+//     /// Timestamp in ISO 8601 format
+//     timestamp: String,
+//     /// Log level as a string
+//     level: &'a str,
+//     /// Log message
+//     message: String,
+//     /// Optional module path
+//     #[serde(skip_serializing_if = "Option::is_none")]
+//     module_path: Option<&'a str>,
+//     /// Optional file name
+//     #[serde(skip_serializing_if = "Option::is_none")]
+//     file: Option<&'a str>,
+//     /// Optional line number
+//     #[serde(skip_serializing_if = "Option::is_none")]
+//     line: Option<u32>,
+// }
 
 /// Logger instance that can be customized
 pub struct Logger {
@@ -603,9 +602,9 @@ impl Logger {
         now: String,
         level: Level,
         message: &str,
-        module_path: Option<&str>,
-        file: Option<&str>,
-        line: Option<u32>,
+        _module_path: Option<&str>,
+        _file: Option<&str>,
+        _line: Option<u32>,
     ) {
         // Configure color control based on mode
         match self.color_mode {
@@ -628,9 +627,9 @@ impl Logger {
 pub fn log_event_internal<T: Loggable>(
     level: Level,
     payload: &T,
-    module_path: Option<&str>,
-    file: Option<&str>,
-    line: Option<u32>,
+    _module_path: Option<&str>,
+    _file: Option<&str>,
+    _line: Option<u32>,
 ) {
     // Ensure the logger is initialized
     let _ = INIT.call_once(|| {

engine/baml-lib/baml-log/src/logger.rs

@@ -477,13 +477,23 @@ impl crate::BamlMedia {
     }
 }
 
+#[derive(Clone)]
 pub struct ApiKeyWithProvenance {
     /// The key itself.
     pub api_key: SecretString,
     /// The name of the environment variable from which the key was read.
     pub provenance: Option<String>,
 }
 
+impl std::fmt::Debug for ApiKeyWithProvenance {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ApiKeyWithProvenance")
+            .field("api_key", &"<no-repr-available>")
+            .field("provenance", &self.provenance)
+            .finish()
+    }
+}
+
 impl ApiKeyWithProvenance {
     /// Print the api_key if exposing the secret is allowed.
     /// Otherwise, render the provenance as an environment variable