Auth helpers in src/auth/helpers.ts: envApiKeyAuth() (stored key wins,
then env vars in order, with secret-prompt login) and lazyOAuth()
(flow loads on first use through bundler-opaque dynamic imports in
utils/oauth/load.ts; the OAuthAuth flow exports land in phase 4).
There is no OAuth factory toggle: providers that support OAuth always
attach it, advertising costs nothing until login/refresh runs.
createProvider() in models.ts builds providers from parts: single API
implementation or a map dispatched on model.api (mixed-API providers
like opencode and github-copilot); unknown api yields a stream error.
generate-models.ts now emits one providers/<id>.models.ts catalog per
provider (35 files, biome-excluded like models.generated.ts) and
models.generated.ts becomes a generated aggregator, so importing one
provider factory pulls one catalog. Typed getModel globals unchanged.
One factory per built-in provider under src/providers/: envApiKeyAuth
for standard providers, OAuth for anthropic/openai-codex/github-copilot,
ambient ApiKeyAuth for amazon-bedrock (AWS env/profile/IAM) and
google-vertex (explicit key or ADC+project+location).
providers/all.ts: builtinProviders(), builtinModels(), getBuiltin*
re-exports. fauxProvider() factory returns a real Provider for tests;
legacy registerFauxProvider() unchanged.
Stream implementations move from src/providers/ to src/api/, renamed by
API id (anthropic.ts -> anthropic-messages.ts, google.ts ->
google-generative-ai.ts, mistral.ts -> mistral-conversations.ts,
amazon-bedrock.ts -> bedrock-converse-stream.ts). Every module now
exports exactly stream/streamSimple; shared helpers move alongside.
New ProviderStreams dispatch contract in types.ts, lazyApi() wrapper in
api/lazy.ts, and one .lazy.ts wrapper per API. Bedrock's wrapper keeps
the node-only variable-specifier import and setBedrockProviderModule()
(now taking ProviderStreams).
providers/register-builtins.ts deleted; interim until the compat
entrypoint lands, builtin api-registry registration lives in stream.ts
and lazy wrappers are exported from the root barrel. Old per-API lazy
exports (streamAnthropic, ...) are gone; package.json subpaths retarget
to dist/api/.
When Bedrock rejects a request with "data retention mode '<mode>' is not
available for this model", append a pointer to the AWS data retention
documentation so users can configure a supported mode.
Application inference profile ARNs encode the region
(arn:aws:bedrock:<region>:<account>:...) but the provider ignored it,
falling through to AWS_REGION which may point to a different region.
Extract the region from the ARN when present, taking priority over
environment variables.
Fixes#4860
Honour StreamOptions.headers in the Bedrock provider by attaching a
Smithy build-step middleware that merges caller headers into the
request before SigV4 signing. Reserved headers (x-amz-*, authorization,
host) are silently skipped to preserve signing and the bearer-token
auth path. No-op when no headers are supplied. Updates the
StreamOptions.headers JSDoc to drop the Bedrock caveat.
supportsPromptCaching, supportsAdaptiveThinking, supportsThinkingSignature,
and the Claude detection in streamSimpleBedrock/buildAdditionalModelRequestFields
all check model.id for Claude model name patterns. Application inference profile
ARNs are opaque and do not contain the model name, so these checks silently fail.
Fix by also checking model.name (user-controlled via models.json or
registerProvider) as a fallback in all affected functions. Added a shared
isAnthropicClaudeModel helper for the common Claude detection pattern.
Fixes#2925
Co-authored-by: Your Name <you@example.com>
* fix(typebox): migrate to v1 with extension compat
Replace AJV-based validation with TypeBox-native validation, keep legacy extension imports working (including @sinclair/typebox/compiler), and restore coercion for serialized/plain JSON schemas.
This change closes#3112.
* fix(typebox): use canonical imports and harden coercion
Switch first-party code to canonical typebox imports while retaining legacy extension aliases in the loader.
Remove obsolete runtime codegen guards, expand serialized JSON-schema coercion coverage, and update related tests and fixtures.
Fixes#3112.
---------
Co-authored-by: Mario Zechner <badlogicgames@gmail.com>
When model.maxTokens is 0 (unset/unknown), omit maxTokens from the
Bedrock ConverseStream inferenceConfig instead of sending 0.
Bedrock's inferenceConfig.maxTokens is optional — when omitted, the
model uses its own internal default. This is optimal for Bedrock's
token quota management:
- At request start, Bedrock reserves input_tokens + max_tokens from
your TPM quota
- For Claude 3.7+ models, output tokens have a 5x burndown rate
- Sending an unnecessarily high maxTokens wastes TPM capacity during
the reservation window, reducing concurrent request throughput
- Omitting it lets Bedrock use the model default (~4096 for Claude),
matching expected output sizes and maximizing quota utilization
Also applies the same conditional pattern to temperature — only
include it in inferenceConfig when explicitly set.
Changes:
- simple-options.ts: Use ?? instead of || so explicit 0 is preserved;
return undefined when model.maxTokens is 0 (unset)
- amazon-bedrock.ts: Spread maxTokens and temperature into
inferenceConfig only when defined
Fixes#3399
BedrockRuntimeClient was constructed without the endpoint option,
causing model.baseUrl to be silently ignored. This meant custom
Bedrock endpoints (VPC endpoints, proxy setups, custom routing)
were never used — requests always went to the default regional
endpoint.
Pass model.baseUrl as the endpoint config when set. When not set
(the default), the SDK falls back to the standard regional endpoint
constructed from the region config, preserving existing behavior.
Fixesopenclaw/openclaw#47899
Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.
When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
header with `Bearer <token>` and removes SigV4-specific headers
This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.
Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.
Required IAM permission on the token's identity:
bedrock:CallWithBearerToken
Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.
Exposes the new ThinkingConfig.display field on Anthropic and Bedrock
Claude providers. Defaults to 'summarized' so Claude Opus 4.7 and Mythos
Preview keep returning thinking text despite Anthropic's silent default
change to 'omitted'. Set to 'omitted' explicitly to skip thinking
streaming for faster time-to-first-text-token.
Mutate persisted tool-call blocks in place on function_call completion,
remove partialJson, and emit the same reference on toolcall_end.
Add regression coverage for persisted block cleanup and event identity.
fixes#3078
- Add NON_OVERFLOW_PATTERNS to explicitly exclude known non-overflow errors
- Consolidate Cerebras 400/413 no-body check into OVERFLOW_PATTERNS
- Format Bedrock errors as ${error.name}: ${error.message} for pattern matching
Add an optional requestMetadata field to BedrockOptions that forwards
key-value pairs to the Bedrock Converse API ConverseStreamCommand. Tags
appear in AWS Cost Explorer split cost allocation data, enabling callers
to attribute inference costs to specific applications or contexts.
Changes:
- Add requestMetadata?: Record<string, string> to BedrockOptions with
JSDoc documenting AWS constraints (max 50 pairs, key 64 chars, value
256 chars, no aws: prefix)
- Pass requestMetadata to commandInput via conditional spread to avoid
sending undefined when omitted
- Export BedrockOptions from package root (consistent with other
provider option types)
- Add E2E tests: metadata forwarded to SDK payload, and omitted when
not provided
closes#2510
Add AWS_BEDROCK_FORCE_CACHE=1 environment variable support. When the
model ID doesn't contain a recognizable Claude model name, users can
set this variable to force cache point injection.
* extend interleaved thinking test to Anthropic first-party provider
* switch back to global Bedrock model identifier
* set retry to 3 for both
* enable bedrock claude interleaved thinking by default and use completeSimple in test
The process.env access was outside the typeof process check, which
would throw in browser environments. Moved inside the Node.js/Bun
block for consistency with other env var access.
Also added changelog entry for #1320 and improved docs clarity.
* Add Amazon Bedrock models test suite for agent package
Tests basic prompts, multi-turn conversations with thinking, and
synthetic thinking signatures across all Bedrock models.
Known issues are categorized and skipped:
- Models requiring inference profile (5)
- Invalid model IDs for us-east-1 region (6)
- Max tokens config exceeds model limit (2)
- No signature support in reasoningContent (10)
- Rejects reasoning content in user messages (25)
- Validates signature format - Anthropic newer models (7)
* Fix Bedrock signature support for non-Anthropic models
Only include the signature field in reasoningContent.reasoningText for
Anthropic Claude models. Other models (OpenAI, Qwen, Minimax, Moonshot,
etc.) reject this field with:
"This model doesn't support the reasoningContent.reasoningText.signature field"
This fix enables multi-turn conversations with thinking content for
10 additional Bedrock models that previously failed.
https://buildwithpi.ai/session?7e39c05f66ea358da3f993c267fe3e29
* Add a CHANGELOG entry
- Add minimax to KnownProvider and Api types
- Add MINIMAX_API_KEY to getEnvApiKey()
- Generate MiniMax-M2 and MiniMax-M2.1 models
- Add context overflow detection pattern
- Add tests to all required test files
- Update README and CHANGELOG with attribution
Also fixes:
- Bedrock duplicate toolResult ID when content has multiple blocks
- Sandbox extension unused parameter lint warning
Adds cache points to system prompt and last user message for:
- Claude 3.5 Haiku
- Claude 3.7 Sonnet
- Claude 4.x models (Opus, Sonnet, Haiku)
Uses Bedrock's cachePoint blocks with 5-minute TTL.
Armin Ronacher