fix(core): Bedrock SDK/language model cache has no TTL — STS tokens expire mid-session #30940

Description

Using Bedrock with STS credentials (SAML/SSO). I have a background process that keeps the profile's credentials continuously fresh on disk — aws CLI calls against the same profile succeed all day without interruption. But after ~60 minutes, OpenCode subagent calls start failing with "The security token included in the request is expired."

Root cause: packages/core/src/aisdk.ts caches LanguageModelV3 instances in a Map with no TTL. The credential provider (fromNodeProviderChain) is called once at first use, baked into the SDK object, and that same object is returned on every subsequent call — even after the on-disk credentials have been rotated. The bedrock-auth.ts comment even acknowledges this: "STS-vended credentials should be refreshed by the consumer (rebuild the model) before they expire; the route does not refresh." But the consumer never rebuilds.

Fresh credentials are sitting right there on disk. OpenCode just never goes back to read them.

Steps to reproduce

1. Configure Bedrock with an STS-vended profile (SAML, aws-vault, SSO — anything with an x_security_token_expires)
2. Have a background process keeping the on-disk credentials fresh (so the issue isn't "token expired" in the traditional sense)
3. Start a session and use it actively
4. ~60 minutes in, spawn a subagent or make any Bedrock call
5. Error: AI_APICallError: The security token included in the request is expired

OpenCode version

1.15.13

Operating System

macOS 15.x

Terminal

Ghostty