fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) - #64628
Merged
Conversation
alt-glitch
added
type/bug
…e + bearer token routing Three fixes for the Bedrock Claude path: 1. Streaming fallback: When AnthropicBedrock SDK raises 'Unexpected event order' (SDK misparses Bedrock error events as message_start), auto-switch to native Converse API for the rest of the session instead of failing after 3 retries. 2. Image base64 decode (#33317): data URL payloads were passed as base64 strings to source.bytes, but boto3 re-encodes at the wire layer. Now decoded to raw bytes before passing to Converse API. 3. Bearer token routing (#28156): Users with AWS_BEARER_TOKEN_BEDROCK are now routed through Converse API regardless of model, since the AnthropicBedrock SDK only supports SigV4 signing. 3 new tests. 121 bedrock_adapter tests passing.
Rewrites the cherry-picked test to import os locally and monkeypatch the resolver seams instead of patching bedrock_adapter internals; adds the inverse assertion (no bearer -> AnthropicBedrock SDK path preserved).
…28156) Bug 2 of #28156: the picker offered us./global. inference profiles to EU-region endpoints (unroutable — AWS rejects them regardless of credentials) and _RECOMMENDED hardcoded us.anthropic.* ids, so non-US pickers pinned profiles their endpoint can't invoke. - bedrock_model_routable_from_region(): geo-prefixed profiles are only offered in their own geography (full AWS prefix set incl. apac./jp./ ca./sa./me./af.); bare ids and global.* pass everywhere; unknown region shapes hide nothing. - Recommendations match geo-agnostically on the base model id, so an EU picker pins eu.anthropic.claude-sonnet-4-6; in-region geo profiles sort above global.* for the same model (addresses the global.*-first ordering complaint from the issue thread). - Dedup generalized from (us., global.) to all profile prefixes.
teknium1
force-pushed
the
salvage/34742-bedrock-bearer
branch
from
July 15, 2026 16:49
1d81b62 to
8ea29fd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Both #28156 bugs fixed: bearer-token Bedrock users no longer crash at runtime (Claude routes through the Converse API instead of the SigV4-only AnthropicBedrock SDK), and the model picker is region-scoped (an EU picker no longer offers
us.*/unroutable inference profiles or pinsus.anthropic.*recommendations).Root causes:
resolve_runtime_providerunconditionally forcedapi_mode="anthropic_messages"(→ AnthropicBedrock SDK → SigV4 chain →could not resolve credentials from session) for any Claude model even when the only credential wasAWS_BEARER_TOKEN_BEDROCK; and_model_flow_bedrock's dedup/sort only knewus./global.prefixes with a hardcodedus.anthropic.*_RECOMMENDEDlist.Changes
bedrock_converse; streaming falls back toconverse()on IAM streaming-action denial; image data-URLs decoded to raw bytes before the Converse wire layer (boto3 re-encodes — double-encoding was rejected).hermes_cli/model_setup_flows.py(ours):bedrock_model_routable_from_region()with the full AWS geo-prefix set (us./eu./ap./apac./jp./ca./sa./me./af./global.); picker filters unroutable profiles; recommendations match geo-agnostically on base model id so each region pins its own profile; in-region profiles sort aboveglobal.*(the issue thread's ordering complaint); dedup generalized to all profile prefixes.Validation
bedrock_converse(SigV4 setups keep the AnthropicBedrock SDK path)us.*/global.*offered + us.* recommendedeu.*/global.*/bare ids; eu.* recommended, in-region above globalSalvages #34742 by @JiaDe-Wu (authorship preserved) + our region-scoping half. Fixes #28156. Credit also to @pgregg88 (prefix-set completeness + ordering analysis) and @aleck31 (SigV4 trap confirmation).
Infographic