feat: add bedrock_mantle provider with SigV4 key config, DB migration, and UI support

[Pratham-Mishra04]

Summary

Adds bedrock_mantle as a first-class provider, enabling Bifrost to route requests to AWS Bedrock through a Mantle proxy endpoint. The provider supports the same SigV4 credential options as the existing Bedrock provider (inherited IAM role, explicit access/secret key, session token, AssumeRole) as well as a Bearer API key authentication mode.

Changes

• Added BedrockMantle to the Anthropic passthrough allowlist in clearAnthropicPassthroughForNonNativeProvider so raw request bodies are preserved when routing through Bedrock Mantle.
• Added BedrockMantleKeyConfig redaction logic in clientconfig.go, mirroring the existing Bedrock redaction pattern.
• Added a new migrationAddBedrockMantleKeyColumns database migration that introduces seven bedrock_mantle_* SigV4 credential columns to the config_keys table.
• Extended TableKey with the seven Bedrock Mantle credential fields, along with BeforeSave serialization and AfterFind reconstruction hooks.
• Updated mergeUpdatedKey in the HTTP handler to correctly restore redacted Bedrock Mantle credential fields during key updates.
• Fixed isClaudeModel in the Anthropic integration to recognize bedrock_mantle (previously incorrectly matched bedrock) as a provider that can serve Claude models.
• Included BedrockMantleKeyConfig in the key hash inputs used by mergeProviderKeys and reconcileProviderKeys for config file/DB reconciliation.
• Added Bedrock Mantle credential redaction to GetAllKeys.
• Extended config.schema.json with bedrock_mantle_key and provider_with_bedrock_mantle_config definitions and registered bedrock_mantle as a valid provider name throughout the schema.
• Added UI support: provider icon (reusing the Bedrock SVG mark with a distinct gradient ID), model placeholder text, isKeyRequiredByProvider entry, label, form schema (BedrockMantleKeyConfigSchema), type definitions (BedrockMantleKeyConfig, DefaultBedrockMantleKeyConfig), and a full authentication method tab UI (IAM Role / Explicit Credentials / API Key) matching the Bedrock provider UX.
• Added bedrock_mantle to the Anthropic beta-headers provider family and the provider config sheet's Anthropic family list.
• Stripped the internal _auth_type field from bedrock_mantle_key_config before submitting the form payload.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

# Core/Transports
go version
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Configure a bedrock_mantle provider in config.json or via the UI with one of the three auth methods:

• IAM Role (Inherited): set only region; leave access/secret key empty.
• Explicit Credentials: set access_key, secret_key, and region; optionally set session_token, role_arn, external_id, and session_name.
• API Key: set region and provide a Bearer token as the key value.

Send a request targeting a Claude model through the bedrock_mantle provider and verify the response is returned correctly and that credentials are redacted in the UI and API responses.

Screenshots/Recordings

Add before/after screenshots of the new Bedrock Mantle provider form and icon in the UI.

Breaking changes

• Yes
• No

Related issues

Link related issues and discussions.

Security considerations

• All seven Bedrock Mantle credential fields (access_key, secret_key, session_token, region, role_arn, external_id, role_session_name) are stored as SecretVar and are redacted in API responses and the UI, consistent with the existing Bedrock provider handling.
• The _auth_type discriminator field is stripped from the payload before it is persisted or transmitted.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• tests: add bedrock_mantle provider capabilities and Postman environment config #4739
• feat: add AWS Bedrock Mantle provider docs #4738
• feat: add bedrock_mantle provider with SigV4 key config, DB migration, and UI support #4737 👈 (View in Graphite)
• feat: add bedrock_mantle as a first-class provider with native-Anthropic and OpenAI-compatible routing #4736
• refactor: replace pre-built SigV4 body signing with lazy BodySigner closure passed through request handlers #4735
• refactor: introduce BearerAuthHeader helper and migrate OpenAI-compatible providers from schemas.Key to map[string]string auth header param #4425 : 1 other dependent PR (#4709 )
• refactor: extract HandleAnthropicChatCompletionRequest / HandleAnthropicResponsesRequest and make completeRequest a package-level func shared by Anthropic, Azure, and Bedrock providers #4394
• refactor: centralize Anthropic request building into BuildAnthropicChatRequestBody and AnthropicProviderRequestDefaultsMap #3309 : 1 other dependent PR (#4360 )
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge; all seven credential fields are correctly redacted, the DB migration is idempotent with a full rollback path, and the key-merge and passthrough logic are consistent with the existing Bedrock provider.

The change is a faithful port of the existing Bedrock provider pattern into a new provider namespace. Credential redaction handles nil receivers correctly (SecretVar.Redacted guards against nil), the mergeUpdatedKey outer guard keeps mergedKey.BedrockMantleKeyConfig non-nil before field writes, the migration adds only nullable columns with no index creation, and the UI validation correctly skips the top-level API key requirement for IAM-role and explicit-credentials auth modes.

No files require special attention.

Important Files Changed

Filename	Overview
framework/configstore/migrations.go	Adds migrationAddBedrockMantleKeyColumns with 7 nullable column additions via the idempotent addColumnIfNotExists helper and a complete rollback via dropColumnIfExists; no index creation, so no CONCURRENT concern.
framework/configstore/tables/key.go	Adds 7 BedrockMantle* column fields plus matching BeforeSave and AfterFind hooks; pattern mirrors the existing Bedrock provider exactly, including correct nil-sentinel handling for optional fields.
framework/configstore/clientconfig.go	Adds BedrockMantle redaction with nil-guards on pointer fields; *AccessKey.Redacted() and *SecretKey.Redacted() dereferences are safe because AccessKey/SecretKey are value-type SecretVar fields (auto-address is never nil).
transports/bifrost-http/handlers/provider_keys.go	Extends mergeUpdatedKey with BedrockMantle credential restoration; the outer guard ensures mergedKey.BedrockMantleKeyConfig is non-nil (it shares the pointer from updateKey), and optional fields are nil-checked before restoration.
transports/bifrost-http/integrations/anthropic.go	Adds BedrockMantle arm to isClaudeModel; previously discussed schemas.Bedrock omission is intentional per the author reply on the existing thread.
transports/bifrost-http/lib/config.go	Includes BedrockMantleKeyConfig in both legacy-hash fallback paths and adds GetAllKeys redaction; cfg.Region.Redacted() on a nil *SecretVar safely returns nil per SecretVar.Redacted()'s nil-receiver guard.
transports/config.schema.json	Adds bedrock_mantle_key and provider_with_bedrock_mantle_config definitions; field names match Go JSON tags (session_name maps to RoleSessionName json:session_name,omitempty) and region is correctly marked required.
ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx	Adds BedrockMantle three-tab auth UI; _auth_type detection effect correctly respects form.formState.isDirty, field-clearing logic on tab switch is complete, and data-testid attributes are present on all tab triggers.
ui/lib/types/schemas.ts	Adds bedrockMantleKeyConfigSchema with region-required and access/secret key pair-or-both-empty refinements; api_key mode correctly passes validation when both keys and session token are cleared.
ui/lib/types/config.ts	Adds BedrockMantleKeyConfig interface and DefaultBedrockMantleKeyConfig; field names correctly match Go JSON tags (session_name, role_arn, etc.).

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant UI as UI (React)
    participant Handler as HTTP Handler
    participant Config as Config Store
    participant DB as Database
    participant Core as Bifrost Core

    UI->>Handler: POST /providers/bedrock_mantle/keys
    Note over UI,Handler: Strips _auth_type from bedrock_mantle_key_config
    Handler->>Config: SaveProviderKey(key)
    Config->>DB: "BeforeSave() serialize 7 bedrock_mantle_* columns"
    DB-->>Config: OK
    Config-->>Handler: stored key (raw)
    Handler-->>UI: redacted key (AccessKey/SecretKey/etc. masked)

    UI->>Handler: PUT /providers/bedrock_mantle/keys/:id (redacted fields)
    Handler->>Handler: mergeUpdatedKey(oldRaw, oldRedacted, update)
    Note over Handler: Restores real values for unchanged redacted fields
    Handler->>Config: UpdateProviderKey(mergedKey)
    Config->>DB: BeforeSave() re-serialize + encrypt columns
    DB-->>Config: OK
    Config-->>Handler: updated raw key
    Handler-->>UI: redacted key

    Core->>Config: GetAllKeys()
    Config->>DB: AfterFind() decrypt + reconstruct BedrockMantleKeyConfig
    DB-->>Config: TableKey rows
    Config-->>Core: keys with redacted BedrockMantleKeyConfig
    Core->>Core: clearAnthropicPassthroughForNonNativeProvider (allow raw body)
    Core->>Core: isClaudeModel BedrockMantle arm matched

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant UI as UI (React)
    participant Handler as HTTP Handler
    participant Config as Config Store
    participant DB as Database
    participant Core as Bifrost Core

    UI->>Handler: POST /providers/bedrock_mantle/keys
    Note over UI,Handler: Strips _auth_type from bedrock_mantle_key_config
    Handler->>Config: SaveProviderKey(key)
    Config->>DB: "BeforeSave() serialize 7 bedrock_mantle_* columns"
    DB-->>Config: OK
    Config-->>Handler: stored key (raw)
    Handler-->>UI: redacted key (AccessKey/SecretKey/etc. masked)

    UI->>Handler: PUT /providers/bedrock_mantle/keys/:id (redacted fields)
    Handler->>Handler: mergeUpdatedKey(oldRaw, oldRedacted, update)
    Note over Handler: Restores real values for unchanged redacted fields
    Handler->>Config: UpdateProviderKey(mergedKey)
    Config->>DB: BeforeSave() re-serialize + encrypt columns
    DB-->>Config: OK
    Config-->>Handler: updated raw key
    Handler-->>UI: redacted key

    Core->>Config: GetAllKeys()
    Config->>DB: AfterFind() decrypt + reconstruct BedrockMantleKeyConfig
    DB-->>Config: TableKey rows
    Config-->>Core: keys with redacted BedrockMantleKeyConfig
    Core->>Core: clearAnthropicPassthroughForNonNativeProvider (allow raw body)
    Core->>Core: isClaudeModel BedrockMantle arm matched

Loading

_{Reviews (7): Last reviewed commit: "feat: adds transports wiring for bedrock..." | Re-trigger Greptile}

[coderabbitai]

Warning

Review limit reached

@Pratham-Mishra04, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 8 minutes and 46 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e4972037-298e-488e-b7f2-24f5214f77e4

📥 Commits

Reviewing files that changed from the base of the PR and between 9004cc8 and b5555cb.

📒 Files selected for processing (19)

• core/bifrost.go
• framework/configstore/clientconfig.go
• framework/configstore/migrations.go
• framework/configstore/tables/key.go
• transports/bifrost-http/handlers/provider_keys.go
• transports/bifrost-http/integrations/anthropic.go
• transports/bifrost-http/lib/config.go
• transports/config.schema.json
• ui/app/workspace/providers/dialogs/providerConfigSheet.tsx
• ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx
• ui/app/workspace/providers/fragments/betaHeadersFormFragment.tsx
• ui/app/workspace/providers/views/modelProviderKeysTableView.tsx
• ui/app/workspace/providers/views/providerKeyForm.tsx
• ui/lib/constants/config.ts
• ui/lib/constants/icons.tsx
• ui/lib/constants/logs.ts
• ui/lib/schemas/providerForm.ts
• ui/lib/types/config.ts
• ui/lib/types/schemas.ts

📝 Walkthrough

Walkthrough

Bedrock Mantle support is added across transport schemas, configstore persistence, provider-key handling, and the provider settings UI.

Changes

Bedrock Mantle provider support

Layer / File(s)	Summary
Provider schema and validation transports/config.schema.json, ui/lib/types/config.ts, ui/lib/types/schemas.ts, ui/lib/schemas/providerForm.ts	The transport schema, shared config types, and form-level validation add Bedrock Mantle provider and key shapes.
Configstore storage and redaction framework/configstore/migrations.go, framework/configstore/tables/key.go, framework/configstore/clientconfig.go	The configstore table, migration, save path, decrypt path, and redaction output add Bedrock Mantle credential columns and runtime config handling.
Provider-key merging and passthrough transports/bifrost-http/handlers/provider_keys.go, transports/bifrost-http/lib/config.go, core/bifrost.go, transports/bifrost-http/integrations/anthropic.go	Provider-key merging, legacy hash generation, export redaction, Anthropic model matching, and passthrough clearing account for Bedrock Mantle config.
Provider metadata and labels ui/lib/constants/config.ts, ui/lib/constants/icons.tsx, ui/lib/constants/logs.ts, ui/app/workspace/providers/dialogs/providerConfigSheet.tsx, ui/app/workspace/providers/fragments/betaHeadersFormFragment.tsx	Provider names, labels, icons, placeholders, key requirements, beta-header defaults, and provider-sheet family classification include bedrock_mantle.
Bedrock Mantle key form ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx, ui/app/workspace/providers/views/modelProviderKeysTableView.tsx, ui/app/workspace/providers/views/providerKeyForm.tsx	The provider key form adds Bedrock Mantle auth modes, hides the generic API key field, strips submit-time auth markers, and treats Mantle regions as secret-backed when rendering key status.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested reviewers

• akshaydeo
• danpiths
• roroghost17

Poem

A bunny hopped in Mantle green,
With tabs and keys all neatly seen.
🐰 The secret trail now bends and glows,
For Bedrock Mantle, rabbit knows.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 45.45% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding the bedrock_mantle provider with key config, migration, and UI support.
Description check	✅ Passed	The description follows the template well, covering summary, changes, testing, screenshots, breaking changes, security, and checklist sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-26-feat_adds_transports_wiring_for_bedrock_mantle

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

ui/app/workspace/providers/views/modelProviderKeysTableView.tsx (1)

234-241: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Include the other Mantle secret-ref fields in this warning heuristic.

The new Mantle form also allows access_key, secret_key, session_token, role_arn, external_id, and session_name to come from env/vault refs, but this check only looks at region and key.value. Unresolved refs in those other fields will still show as a hard failure instead of the warning state.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/app/workspace/providers/views/modelProviderKeysTableView.tsx` around lines
234 - 241, The warning heuristic in modelProviderKeysTableView’s
hasSecretVarConfig check only considers bedrock_mantle_key_config.region and
key.value, so add the other Mantle ref-capable fields to the same non-plain_text
detection. Update the condition to inspect bedrock_mantle_key_config.access_key,
secret_key, session_token, role_arn, external_id, and session_name alongside the
existing region/value checks so unresolved env/vault refs in Mantle show the
warning state instead of a hard failure.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/configstore/migrations.go`:
- Around line 1114-1144: The migrationAddBedrockMantleKeyColumns change
currently only defines Migrate, so add an explicit rollback contract in the
migrator entry. Either implement Rollback to best-effort drop the
bedrock_mantle_* columns added to tables.TableKey, or mark this migration as
intentionally non-rollbackable if cleanup is not feasible. Keep the change
localized to migrationAddBedrockMantleKeyColumns and the migrator.New
definition.

In `@framework/configstore/tables/key.go`:
- Around line 288-341: BedrockMantle credentials are being copied into
persistence in BeforeSave without going through the existing
encryption/decryption flow, so they can be saved in plaintext while the row is
still marked encrypted. Update the Bedrock Mantle handling in the key save/load
path by extending the encrypt.IsEnabled() branch and the AfterFind decrypt
branch to include BedrockMantleAccessKey, BedrockMantleSecretKey,
BedrockMantleSessionToken, BedrockMantleRegion, BedrockMantleRoleARN,
BedrockMantleExternalID, and BedrockMantleRoleSessionName, keeping the encrypt
status in sync with the actual field state.

In `@ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx`:
- Around line 131-148: The Mantle auth detection in apiKeysFormFragment’s
useEffect only runs on mount-like changes, so it misses updates after
ProviderKeyForm calls form.reset(...). Update the detection effect to also react
to the loaded form values or reset state, and ensure setBedrockMantleAuthType
and form.setValue("key.bedrock_mantle_key_config._auth_type", ...) run again
when existing Mantle credentials are repopulated so the correct api_key/explicit
view is shown instead of staying on the default iam_role state.

In `@ui/lib/schemas/providerForm.ts`:
- Around line 153-166: Update the Bedrock Mantle credential refinement in
providerForm’s schema so `session_token` alone does not pass validation; the
current `refine` on `access_key`/`secret_key` treats empty keys as valid even
when `session_token` is filled. Adjust the logic to require all three fields to
be empty for IAM auth, or require both `access_key` and `secret_key` to be
present regardless of `session_token`, and keep the existing error path/message
tied to the Bedrock Mantle config check.

In `@ui/lib/types/schemas.ts`:
- Around line 211-223: Update the Bedrock Mantle credential validation in the
schema refine so explicit auth cannot pass with both keys empty. Use the
existing `_auth_type` captured in the schema and adjust the refine on the
Bedrock Mantle config to require `access_key` and `secret_key` when `_auth_type`
is `"explicit"`, while keeping the current optional behavior only for the
non-explicit flow. Make the fix in the same validation block that currently
checks `isSecretVarSet(data.access_key)` and `isSecretVarSet(data.secret_key)`,
so `providerKeyForm` cannot save an explicit-auth config with only `region`.

---

Outside diff comments:
In `@ui/app/workspace/providers/views/modelProviderKeysTableView.tsx`:
- Around line 234-241: The warning heuristic in modelProviderKeysTableView’s
hasSecretVarConfig check only considers bedrock_mantle_key_config.region and
key.value, so add the other Mantle ref-capable fields to the same non-plain_text
detection. Update the condition to inspect bedrock_mantle_key_config.access_key,
secret_key, session_token, role_arn, external_id, and session_name alongside the
existing region/value checks so unresolved env/vault refs in Mantle show the
warning state instead of a hard failure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a822cfa4-4d54-417a-a87d-df4f77b06a8e

📥 Commits

Reviewing files that changed from the base of the PR and between 24d4d45 and 436c314.

📒 Files selected for processing (19)

• core/bifrost.go
• framework/configstore/clientconfig.go
• framework/configstore/migrations.go
• framework/configstore/tables/key.go
• transports/bifrost-http/handlers/provider_keys.go
• transports/bifrost-http/integrations/anthropic.go
• transports/bifrost-http/lib/config.go
• transports/config.schema.json
• ui/app/workspace/providers/dialogs/providerConfigSheet.tsx
• ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx
• ui/app/workspace/providers/fragments/betaHeadersFormFragment.tsx
• ui/app/workspace/providers/views/modelProviderKeysTableView.tsx
• ui/app/workspace/providers/views/providerKeyForm.tsx
• ui/lib/constants/config.ts
• ui/lib/constants/icons.tsx
• ui/lib/constants/logs.ts
• ui/lib/schemas/providerForm.ts
• ui/lib/types/config.ts
• ui/lib/types/schemas.ts

[coderabbitai]

🧹 Nitpick comments (1)

ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx (1)

1075-1122: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

data-testid parity with the Bedrock section is incomplete.

The Bedrock branch attaches data-testid to its assume-role inputs (apikey-bedrock-role-arn-input, apikey-bedrock-external-id-input, apikey-bedrock-session-name-input) at Lines 882/900/918, but the equivalent Mantle inputs here (role_arn, external_id, session_name) have none. The Mantle tabs and API-key input already follow the convention, so this leaves the assume-role fields unselectable for E2E tests.

Per a prior maintainer preference, you may prefer to batch data-testid additions (with matching tests/e2e/ updates) into a dedicated PR rather than add them here — your call, but flagging the asymmetry for consistency.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx` around lines
1075 - 1122, The Mantle assume-role fields in apiKeysFormFragment are missing
the same data-testid parity used by the Bedrock inputs, leaving `role_arn`,
`external_id`, and `session_name` hard to target in E2E tests. Update the
`FormField` renders for `bedrock_mantle_key_config.role_arn`,
`bedrock_mantle_key_config.external_id`, and
`bedrock_mantle_key_config.session_name` to include matching test ids consistent
with the existing API key and Bedrock naming pattern, and keep the
`SecretVarInput` usage unchanged. If you’re batching test selector changes
separately, make sure these Mantle selectors are tracked alongside any related
`tests/e2e/` updates.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx`:
- Around line 1075-1122: The Mantle assume-role fields in apiKeysFormFragment
are missing the same data-testid parity used by the Bedrock inputs, leaving
`role_arn`, `external_id`, and `session_name` hard to target in E2E tests.
Update the `FormField` renders for `bedrock_mantle_key_config.role_arn`,
`bedrock_mantle_key_config.external_id`, and
`bedrock_mantle_key_config.session_name` to include matching test ids consistent
with the existing API key and Bedrock naming pattern, and keep the
`SecretVarInput` usage unchanged. If you’re batching test selector changes
separately, make sure these Mantle selectors are tracked alongside any related
`tests/e2e/` updates.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 916462a0-c618-46dd-949d-619601ec77a3

📥 Commits

Reviewing files that changed from the base of the PR and between d48556a and 753eda2.

📒 Files selected for processing (19)

• core/bifrost.go
• framework/configstore/clientconfig.go
• framework/configstore/migrations.go
• framework/configstore/tables/key.go
• transports/bifrost-http/handlers/provider_keys.go
• transports/bifrost-http/integrations/anthropic.go
• transports/bifrost-http/lib/config.go
• transports/config.schema.json
• ui/app/workspace/providers/dialogs/providerConfigSheet.tsx
• ui/app/workspace/providers/fragments/apiKeysFormFragment.tsx
• ui/app/workspace/providers/fragments/betaHeadersFormFragment.tsx
• ui/app/workspace/providers/views/modelProviderKeysTableView.tsx
• ui/app/workspace/providers/views/providerKeyForm.tsx
• ui/lib/constants/config.ts
• ui/lib/constants/icons.tsx
• ui/lib/constants/logs.ts
• ui/lib/schemas/providerForm.ts
• ui/lib/types/config.ts
• ui/lib/types/schemas.ts

✅ Files skipped from review due to trivial changes (1)

• ui/lib/constants/config.ts

🚧 Files skipped from review as they are similar to previous changes (16)

• transports/bifrost-http/integrations/anthropic.go
• ui/app/workspace/providers/dialogs/providerConfigSheet.tsx
• ui/lib/constants/icons.tsx
• ui/app/workspace/providers/views/modelProviderKeysTableView.tsx
• transports/bifrost-http/handlers/provider_keys.go
• core/bifrost.go
• ui/app/workspace/providers/views/providerKeyForm.tsx
• ui/app/workspace/providers/fragments/betaHeadersFormFragment.tsx
• ui/lib/types/config.ts
• framework/configstore/clientconfig.go
• ui/lib/schemas/providerForm.ts
• transports/bifrost-http/lib/config.go
• framework/configstore/migrations.go
• transports/config.schema.json
• ui/lib/types/schemas.ts
• framework/configstore/tables/key.go

[akshaydeo]

Merge activity

• Jun 27, 3:42 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 27, 3:43 PM UTC: Graphite couldn't merge this pull request because a downstack PR refactor: extract HandleAnthropicChatCompletionRequest / HandleAnthropicResponsesRequest and make completeRequest a package-level func shared by Anthropic, Azure, and Bedrock providers #4394 failed to merge.
• Jun 27, 4:50 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 27, 5:00 PM UTC: Graphite rebased this pull request as part of a merge.
• Jun 27, 5:01 PM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.