[ryanngit]

Summary

• validate Kiro API keys against supported Amazon Q runtime regions and persist detected region
• route API-key inference only through q.<region>.amazonaws.com; incompatible CodeWhisperer/Kiro runtime surfaces no longer receive deterministic retries
• expose Auto, US East, and Frankfurt choices while keeping request traffic pinned to one stored region
• keep one stable per-credential Kiro client fingerprint and enable upstream prompt-cache headers
• bound each import-time region probe to 10 seconds
• validate dashboard provider tests through Amazon Q, bypass unrelated generic proxy probes, and clear stale error/model-lock state only after Q success

Why

Kiro API keys authenticate on the Amazon Q surface. The same key can return HTTP 400 on codewhisperer.* and fails authentication on runtime.*.kiro.dev. Rotating a valid request across those surfaces adds latency and can mark healthy credentials unavailable.

Official Amazon Q clients currently expose runtime endpoints in us-east-1 and eu-central-1. Auto mode tries those bounded endpoints during import, persists the first working region, and never rotates regions per inference request. Stable key + region + client fingerprint preserves cache locality.

Provider tests previously treated authType="api_key" as OAuth and could fail on a generic Google proxy probe before contacting Q. Tests now use the same Q model-catalog surface and persisted proxy identity as inference.

Verification

• focused Vitest: 22/22 passed
• changed-file ESLint: clean
• production Next.js build: passed
• live downstream proof: 9/9 Kiro API-key rows validated, one Opus SSE canary returned HTTP 200 with one response.completed, one [DONE], zero errors

References

• https://github.com/aws/amazon-q-developer-cli/blob/main/crates/chat-cli/src/api_client/endpoints.rs
• https://github.com/aws/aws-toolkit-vscode/blob/master/packages/core/src/codewhisperer/region/regionProfileManager.ts
• fix(sse): sanitize Kiro tool schemas to avoid 400 "Improperly formed request" cheaper-inference/OmniRoute#4847