Skip to content

Fix OpenCode Bedrock provider regression#18

Open
the-data-sherpa wants to merge 1 commit into
tailscale:mainfrom
the-data-sherpa:fix-opencode-bedrock
Open

Fix OpenCode Bedrock provider regression#18
the-data-sherpa wants to merge 1 commit into
tailscale:mainfrom
the-data-sherpa:fix-opencode-bedrock

Conversation

@the-data-sherpa
Copy link
Copy Markdown

Summary

Restore OpenCode's built-in Bedrock provider path when aperture-cli generates an OpenCode config.

Problem

This regressed in v0.0.7.

Before the refactor, v0.0.6 wrote Bedrock configs for OpenCode under the built-in provider ID amazon-bedrock. OpenCode has Bedrock-specific handling wired to that provider ID.

In v0.0.7, the OpenCode config writer was generalized to emit the selected Aperture provider ID for every backend. That changed Bedrock from the built-in OpenCode provider path to a generic custom provider entry.

For us, that meant Bedrock launches through Aperture + OpenCode no longer followed the same code path as v0.0.6, and requests started failing with errors like:

The security token included in the request is invalid.

Root Cause

OpenCode keys its Bedrock-specific behavior off the built-in provider ID amazon-bedrock.

By switching the generated config to use the selected Aperture provider ID instead, v0.0.7 stopped using OpenCode's Bedrock-aware path and treated the config as a generic custom provider.

Fix

For Bedrock only:

  • write the provider entry using OpenCode's built-in provider ID amazon-bedrock
  • keep the configured model names aligned with that provider ID

All other backends continue to use the selected Aperture provider ID as before.

Why This Is Narrow

This change only affects providers that advertise Bedrock compatibility (bedrock_model_invoke or bedrock_converse). The generated config for Anthropic, OpenAI-compatible, Vertex, Gemini, and other backends is unchanged.

Validation

  • go test ./internal/clients/opencode
  • verified locally by reproducing the v0.0.7 failure path and confirming the Bedrock/OpenCode flow works again after this change

In v0.0.7 the OpenCode config writer started emitting the selected Aperture provider ID for every backend. That changed Bedrock from the built-in OpenCode provider ID used in v0.0.6 (amazon-bedrock) to a generic custom provider entry.

OpenCode wires its Bedrock-specific handling to the built-in amazon-bedrock provider ID. When aperture-cli stopped using that ID, Bedrock launches no longer followed the same path as v0.0.6 and requests could fail with invalid security token errors when using OpenCode through Aperture.

Restore the built-in amazon-bedrock provider ID for Bedrock configs only, keep the model names aligned with that provider, and update the OpenCode config test coverage to assert the provider ID and model naming behavior explicitly.

Verified with go test ./internal/clients/opencode.
@the-data-sherpa
Copy link
Copy Markdown
Author

Reviewer note: local repro / validation steps used on our side.

  1. Checkout v0.0.7 and build ./.build/aperture.
  2. Launch ./.build/aperture -debug.
  3. In the Aperture UI, choose OpenCode.
  4. Choose an Aperture provider backed by Amazon Bedrock.
  5. Start the same OpenCode flow that previously worked for us on v0.0.6.

Observed on unpatched v0.0.7:

  • the OpenCode + Bedrock flow failed with The security token included in the request is invalid.

Observed with this patch:

  • the same OpenCode -> Bedrock provider flow works again in our environment.

Focused automated check run locally:

  • go test ./internal/clients/opencode

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants