Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.
When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
header with `Bearer <token>` and removes SigV4-specific headers
This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.
Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.
Required IAM permission on the token's identity:
bedrock:CallWithBearerToken
Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.
Exposes the new ThinkingConfig.display field on Anthropic and Bedrock
Claude providers. Defaults to 'summarized' so Claude Opus 4.7 and Mythos
Preview keep returning thinking text despite Anthropic's silent default
change to 'omitted'. Set to 'omitted' explicitly to skip thinking
streaming for faster time-to-first-text-token.
Mutate persisted tool-call blocks in place on function_call completion,
remove partialJson, and emit the same reference on toolcall_end.
Add regression coverage for persisted block cleanup and event identity.
fixes#3078
The OpenRouterRouting interface only had only and order, but the runtime
passes the entire object as-is to the OpenRouter API's provider field.
This means all other fields worked at runtime but had no TypeScript
type-checking, no autocomplete, and no config validation.
This adds all fields from the OpenRouter provider selection API
(https://openrouter.ai/docs/guides/routing/provider-selection):
allow_fallbacks, require_parameters, data_collection, zdr,
enforce_distillable_text, ignore, quantizations, sort, max_price,
preferred_min_throughput, preferred_max_latency.
Also fixes the models.md documentation which had an invalid fallbacks
field in the example (not part of the OpenRouter API), replaces it with
a comprehensive example showing all available fields, and clarifies that
openRouterRouting is sent as-is in the provider field.
The 2.5-flash-lite model was incorrectly matching the 2.5-flash
case, setting minimal budget to 128. Per Google's docs, flash-lite's
minimum thinking budget is 512, not 128. This caused the error:
The thinking budget 128 is invalid. Please choose a value between
512 and 24576.
Add a dedicated 2.5-flash-lite case before the 2.5-flash case so
the more specific match takes priority.
Fixes#2838
Co-authored-by: JasonOA888 <JasonOA888@users.noreply.github.com>
- Add NON_OVERFLOW_PATTERNS to explicitly exclude known non-overflow errors
- Consolidate Cerebras 400/413 no-body check into OVERFLOW_PATTERNS
- Format Bedrock errors as ${error.name}: ${error.message} for pattern matching
Google's promptTokenCount includes cachedContentTokenCount, so using it
directly as the input token count causes double-counting when calculateCost
multiplies input by the input rate AND cacheRead by the cacheRead rate.
The google-gemini-cli provider already handles this correctly (subtracting
cachedContentTokenCount from promptTokenCount), but google.ts and
google-vertex.ts were using the raw promptTokenCount.
This fix aligns both providers with the google-gemini-cli behavior.
