fix(bedrock): route auxiliary tasks through AnthropicBedrock SDK

[denysgaievskyi]

Summary

Auxiliary tasks (compression, memory flush, session search, vision, web extract) share a separate client resolver from the main inference path at agent/auxiliary_client.py. That resolver handles auth_type of api_key, external_process, and oauth_device_code — but not aws_sdk. Bedrock is the only provider registered with auth_type=\"aws_sdk\", so users who set provider: bedrock on their auxiliary.* blocks hit:

WARNING agent.auxiliary_client: resolve_provider_client: unhandled auth_type aws_sdk for bedrock
WARNING agent.auxiliary_client: Auxiliary auto-detect: no provider available (tried: openrouter, nous, local/custom, openai-codex, api-key). Compression, summarization, and memory flush will not work.

#10745 quiets the first warning but explicitly returns (None, None) (diff) because there is no OpenAI-compatible endpoint on Bedrock — so the functional gap remains. The second warning still fires, auxiliary tasks still break, and context_compressor still drops middle turns without summary.

The existing AnthropicAuxiliaryClient already exposes .chat.completions.create() by delegating to a native Anthropic client's .messages.create(). anthropic.AnthropicBedrock has the same messages surface, so the wrapper works unchanged — all we need is a builder that constructs it via boto3 credentials plus a preserve_dots flag so cross-region inference profile IDs like us.anthropic.claude-haiku-4-5-20251001-v1:0 are not mangled by normalize_model_name().

Root cause

• hermes_cli/auth.py registers Bedrock with auth_type=\"aws_sdk\"
• agent/auxiliary_client.py:resolve_provider_client has no aws_sdk branch → falls through to auto-detect
• Auto-detect tries openrouter → nous → local/custom → openai-codex → api-key — all OpenAI-compat, none of them Bedrock → (None, None)

Fix

• _try_bedrock() builder: resolves region (config.yaml bedrock.region → AWS_REGION → AWS_DEFAULT_REGION → us-east-1, mirroring hermes_cli/runtime_provider.py resolve_bedrock_runtime), checks has_aws_credentials(), builds AnthropicBedrock via build_anthropic_bedrock_client(), wraps with AnthropicAuxiliaryClient(preserve_dots=True, api_key=\"aws-sdk\")
• resolve_provider_client() gains an aws_sdk branch ahead of the api_key branch — returns (None, None) with a warning when AWS creds or the SDK are unavailable, so callers surface a real error instead of silent auto-detect fallthrough
• _AnthropicCompletionsAdapter + AnthropicAuxiliaryClient take a preserve_dots kwarg; defaults to False (unchanged for direct Anthropic) and flows through to build_anthropic_kwargs()
• _API_KEY_PROVIDER_AUX_MODELS[\"bedrock\"] defaults to Haiku 4.5 cross-region inference profile

Verification

Local pytest (5 new tests + 52 existing in test_auxiliary_client.py): 57/57 passing.

Live-verified against AWS Bedrock (eu-central-1) in a separate deployment — auxiliary requests route through the AnthropicBedrock SDK, no unhandled auth_type aws_sdk warning, no no provider available warning, compression actually runs.

Tests added

tests/agent/test_auxiliary_client.py::TestBedrockAuxiliary:

• test_try_bedrock_builds_wrapped_client — parametrized (empty config vs bedrock.region override) to verify region resolution, wrapper construction, preserve_dots=True, api_key=\"aws-sdk\", and base URL pointing at bedrock-runtime.<region>.amazonaws.com
• test_resolve_provider_client_bedrock_happy_path — verifies provider=\"bedrock\" routes through the new aws_sdk branch
• test_resolve_provider_client_bedrock_missing_credentials — verifies clean (None, None) return when AWS credentials are absent (no silent fall-through)

Related

• Covers the functional gap left open by #10745 (which silences the log noise but returns (None, None) with a comment that Bedrock has no OpenAI-compat path — this PR wires up the native-path alternative)
• Companion to #11502 (prompt caching enablement for Bedrock+Claude on the inference path)

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)

[alt-glitch]

Related to #12365 (BedrockAuxiliaryClient), #12979 (full Converse API), and #15196 (non-Anthropic Bedrock routing). Multiple competing PRs for Bedrock auxiliary support.

[teknium1]

Thanks for the detailed PR and live verification, @denysgaievskyi! The core fix here — adding an aws_sdk branch to resolve_provider_client() — was independently merged to main in commit 7dc6eb9 ("fix(agent): handle aws_sdk auth type in resolve_provider_client"), which closed #13919.

This is an automated hermes-sweeper review.

Evidence:

• agent/auxiliary_client.py lines 2039–2069 now has the aws_sdk branch that builds AnthropicAuxiliaryClient via build_anthropic_bedrock_client(), checks has_aws_credentials(), resolves region, and sets api_key="aws-sdk" — exactly the fix this PR implements.
• normalize_model_name(preserve_dots=...) at agent/anthropic_adapter.py:1009 and _is_bedrock_model_id() at line 1027 already handle cross-region inference profile IDs.
• Commit 7dc6eb9fb landed after the v2026.4.23 release tag and is present in current main.

One residual gap: the merged implementation does not thread preserve_dots=True through AnthropicAuxiliaryClient the way this PR proposed, so cross-region inference profile IDs with dots may still be mangled on the aux path. If you're hitting that specifically, a narrow follow-up targeting only that kwarg wiring would be welcome.