fix(core): resolve Bedrock AWS profile credentials for V2

[acorpstein]

Hi I'm from Amazon One Medical, we use Bedrock for everything and was trying out V2 branch and decided to create a patch - I've been using this exact patch locally for about 1.5 weeks and haven't had any issues.

Issue for this PR

Closes #40663

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

V2 maps Amazon Bedrock models to the native provider before the legacy AI SDK credential hook runs. As a result, configured AWS profiles were detected but their credentials never reached the native SigV4 signer. Some AWS environment values, such as AWS_REGION, could also be mistaken for bearer credentials.

This change:

• Separates credential-bearing environment variables from variables that only indicate AWS is configured.
• Resolves configured profiles through the AWS default credential chain before creating the native Bedrock model.
• Passes the resulting access key, secret key, and session token to the native SigV4 signer.
• Preserves explicit static credentials and Bedrock bearer API keys.
• Expands regional Bedrock endpoint templates after provider settings are merged, so configured regions are respected.
• Reuses the AWS credential provider for each profile while allowing it to refresh temporary credentials.

How did you verify your code works?

• Ran the focused catalog, model resolver, and Bedrock provider tests: 77 passed.
• Ran the repository pre-push typecheck: 33 packages passed.
• Regenerated the client types.
• Built the Linux x64 CLI successfully with bun run build --single.
• Ran this build with AWS_PROFILE with credentialHelper scripts for about a week of full coding work. This should bring v2 to feature parity with v1.

Screenshots / recordings

N/A, this change has no UI behavior.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential duplicate found:

• PR fix(core): resolve Bedrock credentials from the AWS default chain #40522: fix(core): resolve Bedrock credentials from the AWS default chain
  fix(core): resolve Bedrock credentials from the AWS default chain #40522

This PR appears to address the exact same issue—resolving Bedrock credentials from the AWS default credential chain. The current PR #43681 may be a reopened/updated fix for the same problem or a related follow-up.

Related PRs (likely context or dependencies):

• PR fix(core): expand AWS_REGION in Bedrock Mantle base URL #40076: fix(core): expand AWS_REGION in Bedrock Mantle base URL
  fix(core): expand AWS_REGION in Bedrock Mantle base URL #40076
  Related to the same Bedrock endpoint region expansion mentioned in the current PR.

• PR chore(core): remove unreachable AI SDK providers #43115: chore(core): remove unreachable AI SDK providers
  chore(core): remove unreachable AI SDK providers #43115
  May be related to the legacy AI SDK credential hook mentioned in the PR description.

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍

[acorpstein]

@rekram1-node - This should fix a major bedrock issue in v2

I see that you're removing ai-sdk - so if this conflicts with that effort let me know and I can possibly do another patch to help you out + help out with testing.

[github-actions]

Hey! Your PR title (v2) fix(core): resolve Bedrock AWS profile credentials doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

[rekram1-node]

interesting ill have to look over this ty

[rekram1-node]

yeah ik bedrock is rlly broken rn for this case have a few provider things to go over idally this can all be done via a plugin but rn the hooks arent there for it.

[acorpstein]

@rekram1-node yeah np, i think that might be a bit better to use a plugin approach.

-- since this probably won't be merged as is, I can try taking a stab at setting up the plugin hooks and post another update here? worth it? or are things moving too fast?

[acorpstein]

@rekram1-node I took a pass at the plugin approach you suggested.

I added two generic provider hooks to both the Effect and Promise plugin APIs:

• ctx.provider.hook("available", ...) lets providers using automatic activation determine availability from ambient authentication.
• ctx.provider.hook("model.prepare", ...) runs after catalog, variant, credential, and native-package mapping, but before URL validation and provider model construction. It can mutate the runtime modelID and settings.

Bedrock now owns its AWS behavior entirely inside AmazonBedrockPlugin. The plugin:

• Detects availability using the actual AWS default credential chain, including default shared profiles without AWS_PROFILE.
• Resolves profile, SSO, process, container, web-identity, and instance-role credentials before native model construction.
• Preserves explicit static credentials and Bedrock bearer API keys.
• Expands region-dependent endpoints from the effective configuration.
• Retries after credential-chain failures and periodically refreshes cached non-expiring credentials.

Basically retry logic is as follows for bedrock specifically:

• If credential resolution fails, the next attempt uses forceRefresh.
• If it returns temporary credentials from SSO, STS, credential_process, etc., those credentials usually include an expiration: Date. The AWS SDK automatically refreshes them when they are within five minutes of expiration.
• Static environment or shared-file credentials usually have no expiration, so the five-minute interval is intended to periodically reread them.

[rekram1-node]

Yeah taking stabs is welcome ill go over it

[Enough1122]

AI code review — automated review for reference; please use your judgment.

1. packages/core/src/plugin/provider/amazon-bedrock.ts:70 — the module-level awsCredentialChains cache is keyed only by profile name ("" when unset) and lives for the whole process — if AWS_SHARED_CREDENTIALS_FILE/AWS_PROFILE or config changes, the stale chain keeps being reused, and distinct configurations sharing the empty key collide — consider including the relevant inputs in the key or clearing the map on integration/plugin reload.

2. packages/core/src/plugin/provider/amazon-bedrock.ts:82 — the wrapper passes forceRefresh: true after any failure and again every 5 minutes — during an outage every available()/resolve call becomes a fresh STS/IMDS/SSO round-trip (thundering-herd + throttling risk), and 5-minute forced expiry is aggressive for tokens that are typically valid for an hour — add backoff on failure, lengthen the interval, or lean on the SDK's own refresh semantics.

3. packages/core/src/catalog.ts:157 + amazon-bedrock.ts:140 — provider.available() now walks all auto providers sequentially (Effect.forEach default concurrency) and detectAvailability re-resolves AWS credentials on every call because the chains are built with ignoreCache: true — this puts file/IMDS I/O into a hot, user-visible path and scales O(providers × credential fetches) — memoize the resolution per tick or cache a short-TTL positive/negative availability result, and/or bound the concurrency.

4. packages/core/src/plugin/provider/amazon-bedrock.ts:105 — resolveAWSCredentials collapses every error to undefined at logDebug — a typo'd profile or missing permission makes the provider silently vanish from the catalog with no actionable signal — log at warning (once per profile) or surface the last error on the provider/integration status.

5. packages/core/src/plugin/provider/amazon-bedrock.ts:136 — isBedrockProvider calls provider.package.startsWith(...) unguarded while other code treats package as nullable (resolved.package ?? "") — if a catalog row ever lacks a package, available() throws and breaks listing for every provider, not just Bedrock — use typeof provider.package === "string" && provider.package.startsWith(...).

6. packages/core/src/plugin/provider/amazon-bedrock.ts:160 — in prepareNativeModel, when resolveAWSCredentials fails the function just returns, so the model is constructed with no credentials and the failure only appears later as an opaque SigV4/auth error at request time — emit a clearer diagnostic (typed unsupported error or a note on the prepared event) so users learn "profile X is not resolvable" up front.

7. Nit — packages/core/test/plugin/provider-amazon-bedrock.test.ts: several suites now depend on the shared module-level awsCredentialChains cache; consider exposing a reset (or clearing between tests) so test order can't mask regressions in the cache-key logic.

Overall: strong change — the V2 hook design, precedence rules (bearer/API key > explicit credentials > AWS chain), and the new tests (late-profile recovery, region-template preservation, never-project-SigV4-as-bearer) are well thought out. Items 3–5 are the ones I'd address before merge. Thanks!