fix(bedrock): bearer-token auth (anthropic 0.88) + 1M context for Mythos Claude models

[vinayshah1998]

Two related fixes for Anthropic Claude models on AWS Bedrock. Happy to split into two PRs if preferred.

---

1. Bump anthropic 0.87.0 → 0.88.0 — Bedrock bearer-token auth

Why. 0.88.0 is the first release whose AnthropicBedrock client reads the AWS_BEARER_TOKEN_BEDROCK bearer token. On 0.87.0, AnthropicBedrock is SigV4-only, so bring-your-own-key bearer-token auth to Bedrock (short-term ABSK… keys) fails at request time with:

RuntimeError: could not resolve credentials from session

Hermes routes Claude-on-Bedrock through AnthropicBedrock (agent/anthropic_adapter.py::build_anthropic_bedrock_client, constructed with no explicit api_key, relying on the SDK's env/credential chain), so on 0.87.0 the entire bearer-token Bedrock path for Claude is unusable. 0.88.0's AnthropicBedrock.__init__ adds api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK"), so the existing call site works with zero code changes.

Safety. Minimal (single minor), additive (0.88 adds Bedrock bearer auth + stop_details; no breaking Messages/Bedrock API changes), and security-preserving (0.88 ≥ 0.87, so CVE-2026-34450 / CVE-2026-34452 fixes are retained).

Pins moved in lockstep (a mismatch makes the runtime lazy-installer in tools/lazy_deps.py silently downgrade a manually-upgraded install back to 0.87.0):

• pyproject.toml — [anthropic] extra
• tools/lazy_deps.py — provider.anthropic
• uv.lock — anthropic package + specifier (uv lock --check passes)

Tested. Against Bedrock us-east-1 with a bearer token, AnthropicBedrock (0.88.0) picks up AWS_BEARER_TOKEN_BEDROCK and both us.anthropic.claude-fable-5 and us.anthropic.claude-sonnet-5 return successful completions. New regression tests in tests/agent/test_bedrock_bearer_auth.py exercise the real installed SDK through build_anthropic_bedrock_client: bearer env var is picked up as api_key, absence falls back to the SigV4/boto3 chain, and the installed anthropic version is asserted >= 0.88.0 so a future pin downgrade fails in CI rather than at request time.

---

2. 1M context window for Mythos-class Claude on Bedrock

What. Add anthropic.claude-fable-5, anthropic.claude-sonnet-5, anthropic.claude-opus-4-8, anthropic.claude-opus-4-7 to BEDROCK_CONTEXT_LENGTHS (agent/bedrock_adapter.py) at 1_000_000.

Why. For provider: bedrock, get_model_context_length() short-circuits to the static BEDROCK_CONTEXT_LENGTHS table. These newer models are absent, so they fall through to BEDROCK_DEFAULT_CONTEXT_LENGTH (128K) — capping their usable window far below the documented ceiling.

Basis for 1M (verified against the AWS Bedrock model cards). Each model's official Bedrock model card documents Context window: 1M tokens as the model default (not beta-gated):

• Claude Fable 5
• Claude Sonnet 5
• Claude Opus 4.8
• Claude Opus 4.7

The in-code comment now cites these model cards instead of generalizing the context-1m-2025-08-07 beta-header behavior (whose documented scope in agent/anthropic_adapter.py is Opus 4.6/4.7 and Sonnet 4.6).

Tests. tests/agent/test_bedrock_adapter.py::TestBedrockContextLength now covers all four bare IDs, their geo/global inference-profile forms (us./eu./jp./au./global. per the model cards), and non-shadowing checks that sonnet-5 / opus-4-8 entries do not disturb the existing 200K sonnet-4-6 / opus-4-6 resolutions.

[alt-glitch]

This was generated by AI during triage.

Competing/overlapping with the anthropic-SDK-bump cluster for the same Bedrock bearer-token root cause (#29309): #54431 bumps to 0.112.0 (broadest), #26769 bumps the SDK and adds 1M context. This PR is the minimal 0.87.0 → 0.88.0 bump. Same three-pin surface (pyproject extra + tools/lazy_deps.py + uv.lock) — a maintainer should pick one target version.

[vinayshah1998]

Sure I'm okay with just going with #26769 since it's broader and adds support for the 1M context window

[vinayshah1998]

I updated this in case you wanted a narrower update to the SDK along with the support for the 1M context windows.

[teknium1]

Thanks for keeping the SDK pin, lazy-installer pin, and lockfile synchronized. The bearer-token premise remains live on current main: Claude Bedrock models route through AnthropicBedrock (hermes_cli/runtime_provider.py:1975-1988), while the SDK remains pinned to 0.87.0 (pyproject.toml:146, tools/lazy_deps.py:99). The context-table premise is also live because Bedrock resolution uses the static table first (agent/model_metadata.py:2208-2224).

Problems

• The four new 1M table entries have no regression coverage. Existing table tests in tests/agent/test_bedrock_adapter.py:1165-1196 do not cover any added ID.
• The new comment generalizes the beta-header guarantee beyond current code's documented Opus 4.6/4.7 and Sonnet 4.6 scope (agent/anthropic_adapter.py:840-845). The PR does not provide repository-backed validation for the added Fable 5, Sonnet 5, and Opus 4.8 ceilings.
• No test exercises bearer-token behavior through the AnthropicBedrock client path.

Suggested changes

• Add targeted context-resolution tests for the added IDs and inference-profile variants.
• Verify the Bedrock ceilings per model before retaining the 1M mappings.
• Add a bearer-vs-SigV4 regression test for the upgraded SDK path.

Automated hermes-sweeper review.

[teknium1]

Please add table-resolution coverage for these new IDs (including a regional inference-profile form). Bedrock bypasses generic model metadata and always uses this static table, while the current Bedrock table tests do not cover any of these entries.

[vinayshah1998]

Added in 047dce9: TestBedrockContextLength now covers all four new IDs at 1M, plus their geo/global inference-profile forms (us./eu./jp./au./global., matching the ID tables on the AWS Bedrock model cards), and non-shadowing checks that the new sonnet-5 / opus-4-8 keys leave the existing 200K sonnet-4-6 / opus-4-6 resolutions untouched.

[vinayshah1998]

Addressed all three review points in 047dce9:

1. Regression coverage for the four new 1M table entries. TestBedrockContextLength (tests/agent/test_bedrock_adapter.py) now covers each added ID (fable-5, sonnet-5, opus-4-8, opus-4-7) at 1M, their geo/global inference-profile forms (us./eu./jp./au./global., matching the ID tables on the AWS model cards), and non-shadowing checks that the new keys do not disturb the existing 200K sonnet-4-6 / opus-4-6 resolutions under longest-key matching.

2. Ceiling verification + comment scope. The 1M values are now anchored on the official AWS Bedrock model cards, each of which documents "Context window: 1M tokens" as the model default (not beta-gated): Fable 5, Sonnet 5, Opus 4.8, Opus 4.7. The in-code comment was rewritten to cite these cards and no longer generalizes the context-1m-2025-08-07 beta beyond its documented Opus 4.6/4.7 + Sonnet 4.6 scope in agent/anthropic_adapter.py. The earlier "maintainers please confirm ceilings" caveat is resolved and removed from the PR body.

3. Bearer-token regression test through the AnthropicBedrock path. New tests/agent/test_bedrock_bearer_auth.py exercises the real installed SDK (no mocks) via build_anthropic_bedrock_client: with AWS_BEARER_TOKEN_BEDROCK set the client picks it up as api_key; without it the client leaves api_key unset so the SigV4/boto3 credential chain is used (no regression for IAM/SSO users); and the installed anthropic version is asserted >= 0.88.0, so a future pin drift back to 0.87.x fails in CI instead of at request time with "could not resolve credentials from session". The file pytest.importorskips anthropic for environments without the extra installed.

Full tests/agent/test_bedrock_adapter.py + tests/agent/test_anthropic_adapter.py suites pass locally (313 passed). PR body updated accordingly.

[vinayshah1998]

Gentle ping @teknium1 - all three review points were addressed in 047dce9 (regression coverage for the 1M table entries, the bearer-token fallback ordering, and the version-gate test). No rush, just flagging it's ready for another look whenever you have a moment.

[vinayshah1998]

@teknium1 Checking in on this one as well - all three review points from July 16 remain addressed in 047dce9 (regression coverage for the four 1M table entries including geo/global inference-profile forms, bearer-token fallback ordering, and the version-gate test). The branch is still green and I am happy to rebase if main has moved. Ready for another look whenever convenient.