Amazon Bedrock as a built-in AI provider, with AWS profile/SSO sign-in

[luisabrie]

I'd like to propose Amazon Bedrock as a built-in AI provider and ask whether the scope is acceptable before I open a PR.

Proposal

• Add "Amazon Bedrock" to Add a provider, next to OpenAI and Anthropic.
• Sign in with an AWS CLI profile from ~/.aws/config, either SSO or static keys, or with a Bedrock API key.
  • Profile credentials come from aws configure export-credentials. They stay in memory, and each request is signed with SigV4.
  • "Sign in…" runs aws sso login when the session expires.
  • Only the profile name is stored, in the provider's existing Keychain slot.
• Requests use Bedrock's Converse API, so any Bedrock chat model works: Claude, GPT, gpt-oss, Nova, Llama, Mistral, and others.
  • Refresh lists the models the account can call in the selected region, including cross-Region inference profiles.
  • The Reasoning setting goes into the field each model publishes for it: reasoning_config for GPT-5.4+, output_config.effort for Claude 5.5.
• Settings get a Region row, a Sign in row, and an AWS SSO status card, using the existing row and card styles. The region is included in settings backups.

Not in scope

• Requests to other providers don't change.
• No AWS SDK dependency. Profile sign-in needs AWS CLI v2 installed; API-key sign-in doesn't.
• No Bedrock speech-to-text, Agents, Knowledge Bases, or the bedrock-mantle endpoint.

Why

• Many teams can use LLMs only through their AWS account. Models are approved, billed, and logged there, and people sign in with IAM Identity Center rather than long-lived API keys.
• Bedrock's OpenAI-compatible route works with API keys only, which many organizations don't allow.

Evidence so far (macOS 27.2, Apple Silicon, IAM Identity Center profile, us-east-1)

• Normal and streaming replies worked for Claude Sonnet 5.5, Claude Haiku 4.5, GPT-6 Astra, GPT-5.6 Luna, GPT-5.4, gpt-oss 20B, Nova Lite, and Llama 3.3 70B.
• Command Mode: GPT-5.4 returned the expected execute_terminal_command call while streaming. Llama 3.3 rejects tools when streaming; the client retries without streaming, but the model still made no tool call, so not every Bedrock model suits Command Mode.
• Refresh listed 108 chat models in us-east-1.
• Verify model passes with Reasoning on, for GPT-5.6 Luna and Claude Sonnet 5.5.
• Dictation cleanup and Command Mode used Bedrock end to end in the app.]
• Not tested yet: Bedrock API-key sign-in end to end, regions outside the US, Intel Macs.

Size
The implementation is ready on a fork branch: link. It adds about 1,300 lines of source in 10 new files (most under Services/AmazonBedrock/), changes 9 existing files (+636/−184), and adds 666 lines of tests. SwiftLint --strict passes.

Would you accept a PR with this scope? I'm happy to narrow it, for example to Claude only or to profile sign-in only. If you'd rather use the AWS SDK for Swift than the AWS CLI, I can switch.