provider: amazon-bedrock models not listed with AWS credential/profile auth (next channel) #40663

Summary

In the next channel (opencode2), an amazon-bedrock provider configured with AWS credentials (accessKeyId/secretAccessKey/sessionToken via npm: "@ai-sdk/amazon-bedrock") is not listed in the model picker, even though direct /api/generate calls succeed with SigV4. profile / credential_process auth from a V1 config is silently dropped. Users who authenticate Bedrock via IAM roles/profiles (or static AWS credentials) cannot select Bedrock models at all in V2.

Environment

• opencode version: opencode2 v0.0.0-next-16820 (channel: next)
• OS: Darwin 25.5.0 (macOS, arm64)
• Terminal: Apple_Terminal, xterm-256color, truecolor
• Shell: /bin/zsh
• Install/channel: next (global npm install of @opencode-ai/cli)
• Active plugins: ~/.config/opencode/plugins/notification.ts (fails to load with a SchemaError; unrelated, pre-existing)

Reproduction

1. In ~/.config/opencode/opencode.json, configure amazon-bedrock with the SDK npm package, AWS credentials, and no apiKey:

   "provider": {
     "amazon-bedrock": {
       "npm": "@ai-sdk/amazon-bedrock",
       "options": {
         "region": "us-west-2",
         "profile": "claudecodeplatform-prod-us-west-2",
         "accessKeyId": "{env:BEDROCK_ACCESS_KEY_ID}",
         "secretAccessKey": "{env:BEDROCK_SECRET_ACCESS_KEY}",
         "sessionToken": "{env:BEDROCK_SESSION_TOKEN}"
       },
       "models": { "claude-sonnet-46-global": { "id": "global.anthropic.claude-sonnet-4-6" } }
     }
   }

   (Set the BEDROCK_* env vars, or pass real static keys.)

2. Start opencode2 and open the model picker → the amazon-bedrock models are not shown.

3. opencode2 api get /api/provider → only opencode is listed.

4. opencode2 api post /api/generate --data '{... model: {id, providerID:"amazon-bedrock"}}' → succeeds ({"data":{"text":"OK"}}) when the credentials are present. So the request/auth path works; only the listing/catalog path hides the provider.

5. Any attempt to satisfy the listing gate via an API key backfires:

   • Setting a dummy apiKey in config → Bedrock responds 403 Invalid API Key format: Must start with pre-defined prefix (route uses bearer auth).
   • Setting a declared env var (e.g. AWS_REGION) to create a "connection" → V2 resolves that env var into a key credential and sends its value as the API key → same 403.

Expected Behavior

Out of the box, an amazon-bedrock provider that is correctly authenticated (via static AWS credentials in settings, or via profile/credential_process from the V1 config that the migration guide says should keep working) should be listed in the model picker and usable, without requiring an API key.

Actual Behavior

The provider is filtered out of /api/provider and /api/model, so its models never appear in the picker. Direct /api/generate calls succeed via SigV4, proving the credentials are valid and the request path works. profile / credential_process values in provider options are silently ignored by the V2 adapter.

Root Cause Notes

Interlocking behaviors in the V2 catalog/auth (observed in the shipped next build):

1. Catalog availability gate. /api/provider and /api/model return only available() providers:

   const available = (provider, integration) => {
     if (provider.disabled) return false
     if (typeof provider.settings?.apiKey === "string") return true
     if (integration?.connections.length) return true
     return provider.integrationID === undefined && !integration
   }

   A Bedrock provider configured with npm + AWS credentials and no apiKey/connection fails all branches → not listed, and its models are excluded.

2. Auth selection conflict. The native Bedrock route picks auth by apiKey presence:

   auth: apiKey === undefined ? BedrockConverse.sigV4Auth(credentials) : Auth.bearer(apiKey)

   So you cannot set an apiKey to pass the availability gate without forcing bearer auth, which Bedrock rejects for non-API-key credentials.

3. Env/connection values become keys. Integration.connection.resolve maps any set declared env var to a key credential:

   if (connection.type === "env") {
     const key = process.env[connection.name]
     return key ? Credential.Key.make({ type: "key", key }) : undefined
   }

   Setting AWS_REGION (a declared var) to conjure a connection makes V2 send us-west-2 as the API key → 403.

4. profile/credential_process unsupported. V2's Bedrock adapter only encodes {region, accessKeyId, secretAccessKey, sessionToken?}. A config without a key or static credentials fails with ProviderShared.request: Bedrock Converse requires either route bearer auth or AWS credentials configured on the route — the V1 profile option is silently dropped.

Additional Context

• Consistency: reproducible consistently.
• Workaround: none within the picker for credential-based auth; direct /api/generate works. V1 (stable opencode) handles profile/credential_process fine.
• Suggested fix direction: make available() also return true when the provider has resolvable AWS credentials (SigV4), and stop treating non-key declared env vars (AWS_REGION, AWS_ACCESS_KEY_ID) as API keys.