When model.maxTokens is 0 (unset/unknown), omit maxTokens from the
Bedrock ConverseStream inferenceConfig instead of sending 0.
Bedrock's inferenceConfig.maxTokens is optional — when omitted, the
model uses its own internal default. This is optimal for Bedrock's
token quota management:
- At request start, Bedrock reserves input_tokens + max_tokens from
your TPM quota
- For Claude 3.7+ models, output tokens have a 5x burndown rate
- Sending an unnecessarily high maxTokens wastes TPM capacity during
the reservation window, reducing concurrent request throughput
- Omitting it lets Bedrock use the model default (~4096 for Claude),
matching expected output sizes and maximizing quota utilization
Also applies the same conditional pattern to temperature — only
include it in inferenceConfig when explicitly set.
Changes:
- simple-options.ts: Use ?? instead of || so explicit 0 is preserved;
return undefined when model.maxTokens is 0 (unset)
- amazon-bedrock.ts: Spread maxTokens and temperature into
inferenceConfig only when defined
Fixes#3399
BedrockRuntimeClient was constructed without the endpoint option,
causing model.baseUrl to be silently ignored. This meant custom
Bedrock endpoints (VPC endpoints, proxy setups, custom routing)
were never used — requests always went to the default regional
endpoint.
Pass model.baseUrl as the endpoint config when set. When not set
(the default), the SDK falls back to the standard regional endpoint
constructed from the region config, preserving existing behavior.
Fixesopenclaw/openclaw#47899
Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.
When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
header with `Bearer <token>` and removes SigV4-specific headers
This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.
Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.
Required IAM permission on the token's identity:
bedrock:CallWithBearerToken
Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.
Exposes the new ThinkingConfig.display field on Anthropic and Bedrock
Claude providers. Defaults to 'summarized' so Claude Opus 4.7 and Mythos
Preview keep returning thinking text despite Anthropic's silent default
change to 'omitted'. Set to 'omitted' explicitly to skip thinking
streaming for faster time-to-first-text-token.
Mutate persisted tool-call blocks in place on function_call completion,
remove partialJson, and emit the same reference on toolcall_end.
Add regression coverage for persisted block cleanup and event identity.
fixes#3078
The 2.5-flash-lite model was incorrectly matching the 2.5-flash
case, setting minimal budget to 128. Per Google's docs, flash-lite's
minimum thinking budget is 512, not 128. This caused the error:
The thinking budget 128 is invalid. Please choose a value between
512 and 24576.
Add a dedicated 2.5-flash-lite case before the 2.5-flash case so
the more specific match takes priority.
Fixes#2838
Co-authored-by: JasonOA888 <JasonOA888@users.noreply.github.com>
- Add NON_OVERFLOW_PATTERNS to explicitly exclude known non-overflow errors
- Consolidate Cerebras 400/413 no-body check into OVERFLOW_PATTERNS
- Format Bedrock errors as ${error.name}: ${error.message} for pattern matching
Google's promptTokenCount includes cachedContentTokenCount, so using it
directly as the input token count causes double-counting when calculateCost
multiplies input by the input rate AND cacheRead by the cacheRead rate.
The google-gemini-cli provider already handles this correctly (subtracting
cachedContentTokenCount from promptTokenCount), but google.ts and
google-vertex.ts were using the raw promptTokenCount.
This fix aligns both providers with the google-gemini-cli behavior.
Add an optional requestMetadata field to BedrockOptions that forwards
key-value pairs to the Bedrock Converse API ConverseStreamCommand. Tags
appear in AWS Cost Explorer split cost allocation data, enabling callers
to attribute inference costs to specific applications or contexts.
Changes:
- Add requestMetadata?: Record<string, string> to BedrockOptions with
JSDoc documenting AWS constraints (max 50 pairs, key 64 chars, value
256 chars, no aws: prefix)
- Pass requestMetadata to commandInput via conditional spread to avoid
sending undefined when omitted
- Export BedrockOptions from package root (consistent with other
provider option types)
- Add E2E tests: metadata forwarded to SDK payload, and omitted when
not provided
closes#2510
Add AWS_BEDROCK_FORCE_CACHE=1 environment variable support. When the
model ID doesn't contain a recognizable Claude model name, users can
set this variable to force cache point injection.
