[Bug] Bedrock Mantle and Bundle Fix

[mconflitti-pbc]

Affected area

AI providers and models

What happened?

Prime Agent 0.9.3 had two independent Bedrock problems:

1. The Node release bundle dynamically loaded dist/bundle/amazon-bedrock.js, but the bundle script did not emit that chunk.
2. Bedrock OpenAI GPT-5 frontier models were routed through the classic bedrock-runtime Converse API. OpenAI frontier models on Bedrock need the OpenAI-compatible Bedrock Mantle Responses API instead.

The first problem caused a startup failure:

Error: Cannot find module '<node-global-prefix>/lib/node_modules/prime-agent/dist/bundle/amazon-bedrock.js'

After the missing chunk was supplied manually, the second problem appeared as an AWS authorization error because the agent was still calling the classic runtime API:

AccessDeniedException: User ... is not authorized to perform:
bedrock:InvokeModelWithResponseStream
on resource ... openai.gpt-5.6-luna

Classic Bedrock models, including Claude, should remain on the existing Converse Stream path.

Steps to reproduce

1. Use an unpatched global Prime Agent 0.9.3 installation. The installation used for this report is the global npm package under nvm:

   npm list -g --depth=0 prime-agent
   # prime-agent@0.9.3

2. Authenticate an AWS profile with access to Bedrock and select the region:

   export AWS_PROFILE=claude
   export AWS_REGION=us-east-1

3. Run a Bedrock OpenAI GPT-5 frontier model:

   prime-agent \
     --provider amazon-bedrock \
     --model openai.gpt-5.6-luna \
     --thinking off \
     --no-tools \
     --no-session \
     -p 'Reply with exactly OK.'

4. On the unpatched release, observe the missing dist/bundle/amazon-bedrock.js module error.

5. If that chunk is restored manually and the command is rerun without the Mantle routing change, observe the bedrock:InvokeModelWithResponseStream authorization error for openai.gpt-5.6-luna.

Expected behavior

The command should:

• Load the Bedrock provider from the release bundle without a missing-module error.

• Route Bedrock openai.gpt-5.* and global.openai.gpt-5.* models through:

  https://bedrock-mantle.us-east-1.api.aws/openai/v1/responses
  

• Use the OpenAI Responses API and AWS SigV4 authentication.

• Normalize global.openai.* inference-profile IDs to openai.* on the wire.

• Preserve tool-call conversion for amazon-bedrock.

• Leave classic Bedrock Converse Stream models unchanged.

• Retain session-based prompt caching through the Responses request body.

The AWS identity still needs the appropriate Bedrock Mantle permission. Being logged in alone does not grant that action.

Prime Agent version

0.9.3

Installation method

npm package

Operating system

macOS

Operating system version

macOS 15.7.9

CPU architecture

arm64 / aarch64

Shell and terminal

zsh 5.9 (arm64-apple-darwin24.0) in Terminal.app

Additional context

Mantle routing

Model generation classifies Bedrock openai.gpt-5.* and global.openai.gpt-5.* entries as openai-responses and assigns a regional Mantle base URL:

https://bedrock-mantle.us-east-1.api.aws/openai/v1

The OpenAI Responses provider lazily loads the AWS Bedrock provider so browser bundles remain valid:

const { bedrock } = (await importNodeOnlyProvider("openai/providers/bedrock/aws")) as
  typeof import("openai/providers/bedrock/aws");

return new OpenAI({
  provider: bedrock({
    region,
    baseURL: model.baseUrl,
    ...(process.env.AWS_PROFILE ? { profile: process.env.AWS_PROFILE } : {}),
  }),
  maxRetries: 0,
});

The Mantle path deliberately does not forward Prime session or tracking headers into the AWS-signed request. Those headers caused SignatureDoesNotMatch. The session ID remains in the request body as the cache key.

Global inference-profile IDs are normalized on the wire:

model: model.id.startsWith("global.")
  ? model.id.slice("global.".length)
  : model.id

The actual condition is scoped to Amazon Bedrock Mantle models.

Caching

Mantle uses the existing OpenAI Responses cache fields:

prompt_cache_key: cacheRetention === "none" ? undefined : options?.sessionId,
prompt_cache_retention: cacheRetention === "long" ? "24h" : undefined,
store: false,

none omits the cache key and retention. short keeps the session key without a retention override. PI_CACHE_RETENTION=long requests 24-hour retention. store: false prevents response objects from being persisted for stateful response chaining.

Classic Bedrock Claude models retain Prime's existing automatic prompt caching. For application inference profile ARNs whose model name cannot be detected:

export AWS_BEDROCK_FORCE_CACHE=1

Discussion 1763 bundle fix

The coding-agent bundle has a second entry point with the exact filename required by the lazy loader:

entryPoints: [
  { in: join(packageDir, "dist", "cli.js"), out: "cli" },
  { in: bedrockProviderEntry, out: "amazon-bedrock" },
],

The build fails if dist/bundle/amazon-bedrock.js is missing. The Bedrock provider entry exports both direct stream functions and the existing bedrockProviderModule wrapper, covering the Node lazy loader and Bun path.

@smithy/hash-node is declared as a package dependency because OpenAI's Bedrock provider uses it for SigV4 request hashing.

Verification

• Focused regression test passed:

  Test Files  1 passed
  Tests       1 passed
  

• npm run check passed Biome, TypeScript, installer, and browser smoke checks.

• The installed bundle's amazon-bedrock.js module imported successfully and exposed both streamBedrock and streamSimpleBedrock.

• A live AWS SSO request using:

  AWS_PROFILE=claude AWS_REGION=us-east-1 prime-agent \
    --provider amazon-bedrock \
    --model openai.gpt-5.6-luna \
    --thinking off --no-tools --no-session \
    -p 'Reply with exactly OK.'

  returned:

  OK
  

The live identity was the configured AWS SSO role. The focused test also verified the Mantle URL, SigV4 authorization, model ID normalization, cache fields, and exclusion of unsigned Prime headers.

The full source bundle emission was not rerun in the fresh clone because compiled sibling workspace artifacts were not present. The installed release bundle and the source-level check/test evidence above are the available proof.

Related Discussion:

#1763

[kevinjosethomas]

I’m taking a look at this.

[mconflitti-pbc]

Appreciate it! Let me know if there is anything I can do to assist or test.

[kevinjosethomas]

I’m looking into the Bedrock bundle/startup failure reported here in #2134.