fix(bedrock): add 1M context for Opus 4.6/4.7 + Sonnet 4.6, bump anthropic SDK for bearer-token auth

[bcwilsondotcom]

Summary

Bedrock natively supports 1M context windows for Claude Opus 4.6, Opus 4.7, and Sonnet 4.6 via the Converse API — no beta header needed. The context-1m-2025-08-07 beta is only required on Anthropic's direct API, not on Bedrock.

The current BEDROCK_CONTEXT_LENGTHS table caps these models at 200k, which silently truncates user sessions even when running on Bedrock with plenty of headroom available. This PR fixes the table and adds the missing entry for Opus 4.7.

Also bumps the pinned anthropic SDK from 0.86.0 → 0.102.0 in tools/lazy_deps.py. The 0.86 release predates AWS_BEARER_TOKEN_BEDROCK support (the long-term API-key auth method AWS shipped in late 2025) and raises could not resolve credentials from session whenever bearer-token auth is configured. 0.102+ honors the env var. The two changes are coupled — without the SDK bump, Bedrock + bearer-token users can't reach the model at all to benefit from the larger context window.

Changes

agent/bedrock_adapter.py

• Add anthropic.claude-opus-4-7 → 1_000_000
• anthropic.claude-opus-4-6: 200_000 → 1_000_000
• anthropic.claude-sonnet-4-6: 200_000 → 1_000_000
• Comment explains that no beta header is required on Bedrock

tests/agent/test_bedrock_adapter.py

• test_claude_opus_4_6: assert 1_000_000
• test_claude_opus_4_7: new — covers the us.anthropic.claude-opus-4-7 cross-region inference profile
• test_claude_sonnet_versioned: assert 1_000_000
• test_inference_profile_resolves: assert 1_000_000

tools/lazy_deps.py

• provider.anthropic: anthropic==0.86.0 → anthropic==0.102.0

Reproduction (before this PR)

export AWS_BEARER_TOKEN_BEDROCK=...
hermes -m us.anthropic.claude-opus-4-7 --provider bedrock
# → "could not resolve credentials from session"  (anthropic SDK too old)

After SDK bump:

hermes -m us.anthropic.claude-opus-4-7 --provider bedrock
# Connects, but compaction kicks in at ~160k tokens because the table caps at 200k
# instead of 1M, costing ~800k of usable context.

After both fixes: full 1M context active, bearer-token auth works.

Tests

tests/agent/test_bedrock_adapter.py::TestBedrockContextLength
8 passed in 1.12s

Notes

• Verified against a working production Bedrock + Opus 4.7 deployment (1M context confirmed in the wild).
• The context-1m-2025-08-07 beta header path is unchanged; this PR only corrects the Bedrock side, which is independent.
• No model-ID format change — cross-region inference profiles like us.anthropic.claude-opus-4-7 already resolve correctly via the existing longest-prefix matcher.

[alt-glitch]

Overlaps with #24059 (same BEDROCK_CONTEXT_LENGTHS table update). This PR adds the anthropic SDK bump (0.86→0.102) for bearer-token auth support, which #24059 does not include. The context-length fix portion is a duplicate.

[Skeptomenos]

+1 — this PR unblocks our deployment. Currently configured with:

• AWS_BEARER_TOKEN_BEDROCK env var (short-term API key auth, no IAM creds)
• model.default: us.anthropic.claude-sonnet-4-6 on Bedrock

Failure mode pre-this-PR matches your "Reproduction (before this PR)" exactly: RuntimeError: could not resolve credentials from session from anthropic/lib/bedrock/_auth.py. Reproduces both via hermes -z and via the gateway daemon.

Also affects the auxiliary path independently (cross-link: #29309). The SDK bump in this PR fixes both surfaces in one change.

The PR has been open for a week with the only blocker being the #24059 overlap noted by @alt-glitch (which is the context-length-table piece, not the SDK bump). The SDK bump is the load-bearing change for the bearer-token-auth case and is independent of #24059. Could the SDK-bump-only portion be split out and merged ahead, with the context-length corrections deferred to #24059? That would unblock everyone in the bearer-token-auth bucket without waiting on the duplicate-PR resolution.

[RamsAI-bot]

For anyone tracking bearer-token Bedrock support: the two PRs that look closest to a complete fix are #24507 (main-loop Converse routing + AWS_BEARER_TOKEN_BEDROCK → AWS_BEARER_TOKEN promotion) and #28085 (auxiliary dual-path Converse client). They were verified to compose cleanly (cherry-pick, 0 conflicts) and together cover both the main loop and auxiliary tasks (title generation / compression; vision still has a separate gap).

Relative to this PR: it fixes bearer auth by bumping the anthropic SDK (0.86 → 0.102), which re-opens CVE-2026-34450 / CVE-2026-34452 — the reason anthropic==0.87.0 is pinned. #24507 + #28085 achieve bearer support via Converse routing without an SDK bump, which is safer for security-sensitive installs. The 1M-context-table change in this PR is orthogonal to bearer auth and could stand alone as its own PR.

[RamsAI-bot]

Update — the aux vision gap noted in my comment above is now resolved by #28085's second commit (acd5de2da), verified working against real bearer-token Bedrock. So #24507 + #28085 (in full) now cover the main loop and all aux tasks — title generation, compression, and vision — under AWS_BEARER_TOKEN_BEDROCK.

[teknium1]

Thanks for identifying the stale Bedrock context metadata. The context-table premise remains valid on current main: agent/model_metadata.py:2189-2196 delegates Bedrock models to get_bedrock_context_length(), while agent/bedrock_adapter.py:1298-1342 still reports 200K for Opus 4.6/Sonnet 4.6 and lacks Opus 4.7.

Problems

• The tools/lazy_deps.py change to anthropic==0.102.0 leaves pyproject.toml:146 at 0.87.0. tests/test_packaging_metadata.py:358-378 requires exact pins in those two surfaces to match, so this cannot merge as written.
• The new table comment conflicts with the current Bedrock implementation: Claude Bedrock models route through AnthropicBedrock (hermes_cli/runtime_provider.py:1975-1990), and that client sends context-1m-2025-08-07 to unlock 1M (agent/anthropic_adapter.py:833-869).
• The published test diff covers only metadata; it does not exercise the bearer-token claim.

Suggested changes

• Salvage the focused context-table/test update, with documentation aligned to the existing header path.
• Split and independently validate bearer auth. Any SDK upgrade must update the matching pyproject pin and lockfile, plus a bearer-vs-IAM regression test.

Automated hermes-sweeper review.

[teknium1]

Resolved via PR #67977, which lands the same context-table flip (Opus 4.6/4.7 + Sonnet 4.6 → 1M) salvaged from the earliest submission in this cluster (#24059, May 11) plus Opus 4.8 from #54918. Your PR arrived five days after #24059 with the same table half, so that one was used as the base — but credit to you for the identical diagnosis. The SDK-bump / bearer-token half of your PR is tracked separately (overlaps #63650, still open). Thanks!

#67977