fix(bedrock): honor api_mode=bedrock_converse so bearer-token auth works for Claude

[taoxee]

Problem

Claude models on Bedrock are hardcoded to api_mode=anthropic_messages in resolve_runtime_provider() (hermes_cli/runtime_provider.py), which routes them through the AnthropicBedrock SDK. That SDK signs requests with SigV4 and resolves credentials via boto3's session.get_credentials() — it never reads AWS_BEARER_TOKEN_BEDROCK.

For users authenticated with a Bedrock bearer token only (no IAM access key, no ~/.aws), every Claude call fails:

RuntimeError: could not resolve credentials from session
API call failed after 3 retries: could not resolve credentials from session

The retries can't recover a missing credential, so it always exhausts them. Non-Claude Bedrock models already use the Converse API, which does honor the bearer token.

Fix

• resolve_runtime_provider(): honor an explicit model.api_mode: bedrock_converse in config so Claude-on-Bedrock can route through the Converse API too. Default behavior is unchanged — without that config, Claude still uses the AnthropicBedrock path.
• build_converse_kwargs(): inject the 1M-context beta via additionalModelRequestFields so the Converse path keeps the 1M context window (the AnthropicBedrock client attaches it as a client-level anthropic-beta header). Bedrock ignores the beta for models that don't support it, so it's safe to send unconditionally — matching build_anthropic_bedrock_client().

Testing

Verified on us-east-1 with a bearer-token-only setup (no IAM):

• resolve_runtime_provider() returns bedrock_converse when configured.
• Real Converse calls to claude-sonnet-5 and claude-opus-4-8 succeed (end_turn, real content) using only AWS_BEARER_TOKEN_BEDROCK.
• The 1M beta is accepted by Bedrock (HTTP 200) and is a harmless no-op on models that don't support it.

[teknium1]

Thanks for the focused Bedrock fix. Current main already addresses the bearer-token-only failure by routing AWS_BEARER_TOKEN_BEDROCK users to Converse in hermes_cli/runtime_provider.py:1979-2008 (commit 5e6a0d9ee). The remaining explicit override and Converse 1M-context behavior are still worth evaluating.

Problems

• The routing hunk conflicts with current behavior: the current Claude condition is is_anthropic_bedrock_model(...) and not _has_bearer_token at hermes_cli/runtime_provider.py:1985-1986. Integrate the explicit bedrock_converse override with that condition so bearer-token routing remains intact.
• The PR adds no tests. Main's bearer routing is covered in tests/agent/test_bedrock_adapter.py:1756-1796; add coverage for the explicit override and for the additionalModelRequestFields generated by build_converse_kwargs().

Suggested changes

• Preserve main's automatic bearer-token route and add the explicit-config route as an additional Converse selector.
• Add focused resolver and request-shaping tests for the two new paths.

Automated hermes-sweeper review.

[teknium1]

Current main now selects Converse for AWS_BEARER_TOKEN_BEDROCK at runtime_provider.py:1979-2008. Please integrate this override with that bearer-token condition rather than replacing the current routing logic, so both selectors retain the Converse path.

[taoxee]

Rebased onto current main and addressed the review:

• Integrated with main's bearer-token routing (not clobbered): the Claude→AnthropicBedrock branch is now gated on not _forces_converse, where _forces_converse = _has_bearer_token or api_mode == bedrock_converse. Either signal routes Claude to Converse; the default (no bearer token, no override) still uses the AnthropicBedrock SDK path.
• The remaining value beyond main: main routes bearer-token Claude users through Converse but does not set the 1M-context beta, so those users silently lose the 1M window. build_converse_kwargs() now injects it via additionalModelRequestFields, gated on is_anthropic_bedrock_model() — anthropic_beta is Anthropic-only, so non-Claude Converse models (Nova/Llama/DeepSeek) must not receive it (would 400).
• Tests added: resolver coverage for the explicit override under SigV4 and bearer, plus the unchanged default; and request-shaping coverage asserting the 1M beta is present for Claude and absent for non-Claude models.

tests/agent/test_bedrock_adapter.py passes (141 tests).

[GottZ]

This was generated by AI during triage.

Summary

Nine PRs address or reference the Bedrock complex: #24507, #26531, #34742, and merged #64628 change bearer-token routing; #28085, #33536, #34742, and #64628 decode image payloads; #64628 also fixes region-scoped discovery, while #54431/#63650 update the Anthropic SDK and #64857 adds an explicit Converse override plus 1M-context request shaping. The merged #64628 is the recorded best fix for both #28156 and #33317, but the visible diffs leave separable auxiliary, strict-validation, SDK-version, context-metadata, and explicit-override work in some open PRs.

Related pull requests

• fix(bedrock): route Claude through Converse API when bearer token auth #24507 partial — (+147/-1) — n/a: Routes bearer-authenticated Claude requests through Converse and promotes the token into global AWS_BEARER_TOKEN, but the contributor review identifies subprocess secret inheritance, missing auxiliary routing, and incorrect target-model precedence. Its main-loop routing is superseded by merged fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628; closing it does not conflict with the keep_open review because that review's concrete blockers remain in this diff.
• fix(bedrock): correct api_mode detection for bearer-token auth #26531 [closed] partial — (+166/-3) — n/a: Adds bearer-to-Converse routing and Bedrock-runtime URL detection for custom-provider configurations. It remains relevant as a closed reference, but the author states its routing is already on main and its remaining work was superseded by fix(bedrock): support bearer-token auth + raw image bytes for aux vision #28085.
• fix(bedrock): support bearer-token auth + raw image bytes for aux vision #28085 related — (+130/-11) — n/a: The current diff retains the auxiliary bearer-token Converse route, strict malformed-image handling, and retry recognition for Bedrock's deprecated-parameter error wording, while the core raw-image decode is already in merged fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628. Keep the contributor's keep_open review in force for this narrower auxiliary and hardening salvage path.
• fix(bedrock): decode base64 data URL to bytes for Converse image source #33536 fixes — (+31/-1) — n/a: Decodes image data URLs to raw bytes, directly matching the image double-encoding cause, but does so without strict malformed-input handling. Despite the keep_open review on fix(bedrock): decode base64 data URL to bytes for Converse image source #33536, merged fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628 contains the same core raw-bytes implementation, so this focused PR is now a duplicate of fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628 rather than the canonical fix.
• fix(bedrock): streaming fallback to Converse API + image base64 decode + bearer token routing #34742 [closed] fixes — (+113/-2) — n/a: Bundles bearer routing, image decoding, and a streaming-error fallback, with the contributor review flagging missing token propagation, guardrail loss, and absent fallback coverage. It remains relevant while closed because fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628 explicitly salvaged its routing, fallback, and image work into the merged implementation.
• fix(agent): unpin anthropic to 0.112.0 so Bedrock Claude works with bearer-token auth #54431 partial — (+7/-7) — n/a: Updates the Anthropic pin consistently across the manifest, lazy dependency table, and lockfile to obtain SDK-native Bedrock bearer support, but its lockfile also removes the Windows-only pywin32 marker. Preserve the keep_open review's salvage path by regenerating the lockfile against current main and retaining that platform marker.
• fix(bedrock): bearer-token auth (anthropic 0.88) + 1M context for Mythos Claude models #63650 partial — (+124/-6) — n/a: Updates Anthropic to 0.88.0 and adds tested 1M context metadata for Fable 5, Sonnet 5, and Opus 4.7/4.8, including regional-profile cases. Its keep_open review was followed by tests and source-backed metadata changes, but the SDK bump overlaps fix(agent): unpin anthropic to 0.112.0 so Bedrock Claude works with bearer-token auth #54431 and should be separated from the context-table delta if maintainers choose a different target version.
• fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628 [merged] best fix — (+293/-22) — n/a: This merged reference implementation routes bearer-token Claude through Converse, filters and orders picker profiles by region, and decodes image data URLs to bytes. It is the recorded best fix for both Bedrock+Claude: wizard accepts Bearer-only setup, runtime fails on missing IAM + picker shows unroutable us./global. profiles in EU region #28156 and bedrock_adapter: image data URLs sent as base64 string instead of raw bytes — all image uploads rejected by Bedrock 'Failed to sanitize image' #33317 and provides the canonical implementation against which the remaining open diffs should be reduced.
• fix(bedrock): honor api_mode=bedrock_converse so bearer-token auth works for Claude #64857 related — (+98/-10) — n/a: Its original bearer-routing premise is already implemented by fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628, while the rebased diff uniquely adds an explicit bedrock_converse override and Claude-only 1M-context fields with focused tests. Consistent with the contributor's keep_open review, retain only those two salvageable additions and preserve fix(bedrock): bearer-token Converse routing + region-scoped picker (#28156) #64628's automatic bearer route.

Duplicates

#24507, #26531, and the bearer-routing portion of #34742 overlap the routing now merged in #64628; #33536 and the image-decoding portions of #28085/#34742 duplicate #64628's raw-bytes fix. #54431 and #63650 overlap on the Anthropic SDK bump, while #64857's original bearer fix overlaps #64628 but its explicit override and Converse 1M request shaping do not.

Suggested consolidation

Keep #64857 open with a salvage path limited to the explicit Converse override and tested Claude-only 1M request shaping, and keep #28085 open only for auxiliary bearer routing plus strict malformed-image/deprecated-parameter hardening. Close #24507 and #33536 as duplicates of merged #64628; leave closed #26531/#34742 closed as superseded or salvaged references. For #54431 and #63650, require author action to rebase and either select one clean SDK-pin update or split #63650's tested context metadata from the competing version bump; do not disturb merged #64628, the recorded best fix for both issues.

Cross-PR triage: Reviewed 9 pull requests and 2 issues in this complex. Each diff was read against this issue; Assessment working set: 86 kB of PR diffs, 36 kB of issue/PR text, 41 kB of discussion (50 comments), 11 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.