lex-llm-bedrock 0.3.7 → 0.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d0046ccd6a590eef46ec16fa6092134f7b63eb5d2512d6c75249ee51a63633ec
-  data.tar.gz: 4944f376912c69fc937856c81630996eeaa2e1504f94dd5ea06d0d8ab8d0ff66
+  metadata.gz: 1d0b15f1168f45e6f11211963cc8c0939085562bd92e720bcd74426367824318
+  data.tar.gz: e68d8865e321e62f0b7c54cf16a573286174626531229b325e53b0aecbc8c3ea
 SHA512:
-  metadata.gz: a2fd955d35142f9d765d8059cb3a793f4453eab7dfefb171c4223a0b88ad59d520e653a3841c86bbfa9ecc193f9e8b85549176ab4ff559b673cfe4393a7aa519
-  data.tar.gz: bfeeee234144ba6b45cb7bd39495533c7c18c998d1c44e9c4ce6ac17d4a2b95403f28de6f0d25d07a49d5a2f413689cb8f4a2ee2aa59e5716f443daff80c5a0a
+  metadata.gz: ac5ed2ff6e4d586891edc3d05a8935cd32b25b561862a882c04a17d2c42324f8cfde527338c8d464cc8373d06dfa4b758fc3a7ab4c1ac70072d22d9998799207
+  data.tar.gz: 1e6f4bd752aa5fe9eeb033426405718826135763e2f6974674a7238ffbf74134024ad8f164962d02dc908aa8276417451087c7092e623beda5e0df58977efbf4

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.3.9 - 2026-05-18
+
+- Fix streaming tool call parsing: `stream_converse` now handles content_block_start/delta/stop events for tool_use blocks, capturing tool ids, names, and accumulated input JSON. Previously only text deltas were captured and tool calls were silently dropped.
+
+
+## 0.3.8 - 2026-05-13
+
+- Auto-prefix `us.` on `inference_profile_id` for Anthropic, Meta, Mistral, Cohere, and AI21 models at API call time.
+- Filter empty content blocks from messages to satisfy Bedrock validation.
+- Wire Bearer token into AWS SDK via `Aws::StaticTokenProvider` to eliminate IMDS timeout on startup.
+- Add `source` and `credential_fingerprint` fields to all discovered instances.
+- Inject default capabilities into all discovered instances.
+- Add static `CONTEXT_WINDOWS` map; `infer_limits` reads from `model_detail` cache instead of live API.
+- Override `fetch_model_detail` to return static context window data without a network call.
+- Cache live results in `discover_offerings`.
+- Add `unresolved_credential?` filter — instances with `vault://` or `env://` credential refs are skipped during registration.
+- Inject `default_model` into all discovered instances.
+
 ## 0.3.7 - 2026-05-12
 
 - Use `Legion::Logging::Helper` explicitly across Bedrock provider, actor, and fleet runner logging surfaces.

data/lib/legion/extensions/llm/bedrock/provider.rb

@@ -26,6 +26,28 @@ module Legion
 
           ALIASES = STATIC_MODELS.to_h { |entry| [entry.fetch(:alias), entry.fetch(:model)] }.freeze
 
+          CONTEXT_WINDOWS = {
+            'anthropic.claude-sonnet-4' => 200_000,
+            'anthropic.claude-haiku-4' => 200_000,
+            'anthropic.claude-opus-4' => 200_000,
+            'anthropic.claude-3-5-sonnet' => 200_000,
+            'anthropic.claude-3-5-haiku' => 200_000,
+            'anthropic.claude-3-haiku' => 200_000,
+            'anthropic.claude-3-opus' => 200_000,
+            'anthropic.claude-3-sonnet' => 200_000,
+            'meta.llama3' => 128_000,
+            'meta.llama3-1' => 128_000,
+            'meta.llama3-2' => 128_000,
+            'meta.llama3-3' => 128_000,
+            'mistral.mistral-large' => 128_000,
+            'mistral.mistral-small' => 128_000,
+            'amazon.titan-text-express' => 8_192,
+            'amazon.titan-text-premier' => 32_000,
+            'amazon.nova-pro' => 300_000,
+            'amazon.nova-lite' => 300_000,
+            'amazon.nova-micro' => 128_000
+          }.freeze
+
           class << self
             def slug = 'bedrock'
 
@@ -38,6 +60,7 @@ module Legion
                 bedrock_session_token
                 bedrock_profile
                 bedrock_stub_responses
+                bearer_token
               ]
             end
 
@@ -51,6 +74,15 @@ module Legion
             def resolve_model_id(model_id, config: nil) # rubocop:disable Lint/UnusedMethodArgument
               ALIASES.fetch(model_id.to_s, model_id.to_s)
             end
+
+            INFERENCE_PROFILE_PREFIXES = %w[anthropic. meta. mistral. cohere. ai21.].freeze
+
+            def inference_profile_id(model)
+              return model if model.start_with?('us.', 'eu.', 'ap.', 'arn:')
+              return model unless INFERENCE_PROFILE_PREFIXES.any? { |p| model.start_with?(p) }
+
+              "us.#{model}"
+            end
           end
 
           # Capability predicates inferred from Bedrock model IDs and API modalities.
@@ -86,15 +118,19 @@ module Legion
 
           def discover_offerings(live: false, **filters)
             unless live
+              return @cached_offerings if @cached_offerings&.any?
+
               log.debug { 'bedrock.provider.discover_offerings: returning static catalog' }
               return static_offerings(**filters)
             end
 
             log.info { "bedrock.provider.discover_offerings: listing foundation models (region=#{region})" }
             response = bedrock_client.list_foundation_models(**filters)
-            Array(value(response, :model_summaries)).map { |summary| offering_from_summary(summary) }.tap do |offerings|
-              log.info { "bedrock.provider.discover_offerings: found #{offerings.size} models" }
+            @cached_offerings = Array(value(response, :model_summaries)).map do |summary|
+              offering_from_summary(summary)
             end
+            log.info { "bedrock.provider.discover_offerings: found #{@cached_offerings.size} models" }
+            @cached_offerings
           end
 
           def offering_for(model:, model_family: nil, instance_id: :default, **metadata)
@@ -194,7 +230,7 @@ module Legion
             log.debug { "bedrock.provider.count_tokens: model=#{model_id(model)}" }
             request = Utils.deep_merge(
               {
-                model_id: model_id(model),
+                model_id: self.class.inference_profile_id(model_id(model)),
                 input: { converse: { messages: format_messages(messages), system: system_blocks(system) }.compact }
               },
               params
@@ -283,6 +319,7 @@ module Legion
 
           def build_offering(model:, model_family:, usage_type:, instance_id: :default, alias_name: nil,
                              capabilities: nil, metadata: {})
+            limits = infer_limits(model)
             Legion::Extensions::Llm::Routing::ModelOffering.new(
               provider_family: :bedrock,
               instance_id: instance_id,
@@ -291,10 +328,24 @@ module Legion
               model: model,
               usage_type: usage_type,
               capabilities: capabilities || default_capabilities(model),
+              limits: limits,
               metadata: metadata.merge(model_family: model_family, alias: alias_name).compact
             )
           end
 
+          def infer_limits(model)
+            detail = model_detail(model.to_s)
+            return detail if detail.is_a?(Hash) && detail[:context_window]
+
+            ctx = CONTEXT_WINDOWS.find { |prefix, _| model.to_s.start_with?(prefix) }&.last
+            ctx ? { context_window: ctx } : {}
+          end
+
+          def fetch_model_detail(model_name)
+            ctx = CONTEXT_WINDOWS.find { |prefix, _| model_name.start_with?(prefix) }&.last
+            ctx ? { context_window: ctx } : nil
+          end
+
           def configured_transport(default)
             config.respond_to?(:transport) ? config.transport : default
           end
@@ -305,7 +356,7 @@ module Legion
 
           def converse_request(messages, model:, temperature:, max_tokens:, tools:, tool_prefs:)
             {
-              model_id: model_id(model),
+              model_id: self.class.inference_profile_id(model_id(model)),
               messages: format_messages(messages.reject { |message| message.role == :system }),
               system: format_system(messages),
               inference_config: { temperature: temperature, max_tokens: max_tokens || model_max_tokens(model) }.compact,
@@ -314,11 +365,11 @@ module Legion
           end
 
           def format_messages(messages)
-            messages.map do |message|
-              {
-                role: bedrock_role(message.role),
-                content: content_blocks(message.content)
-              }
+            messages.filter_map do |message|
+              blocks = content_blocks(message.content)
+              next if blocks.empty?
+
+              { role: bedrock_role(message.role), content: blocks }
             end
           end
 
@@ -339,7 +390,13 @@ module Legion
           end
 
           def content_blocks(content)
-            raw_content(content) || [{ text: content_text(content) }]
+            raw = raw_content(content)
+            return raw if raw
+
+            text = content_text(content)
+            return [] if text.strip.empty?
+
+            [{ text: text }]
           end
 
           def raw_content(content)
@@ -417,30 +474,99 @@ module Legion
           end
 
           def stream_converse(request, fallback_model)
-            accumulated = +''
-            final_usage = nil
+            state = { accumulated: +'', final_usage: nil, stop_reason: nil, tool_use_blocks: [], current_tool_use: nil }
 
             runtime_client.converse_stream(**request) do |stream|
-              stream.on_content_block_delta_event do |event|
-                text = value(value(event, :delta), :text)
-                next if text.nil?
+              wire_stream_handlers(stream, state, fallback_model) { |chunk| yield chunk if block_given? }
+            end
+
+            Legion::Extensions::Llm::Message.new(
+              role: :assistant,
+              content: state[:accumulated],
+              model_id: fallback_model,
+              tool_calls: build_stream_tool_calls(state[:tool_use_blocks]),
+              input_tokens: value(state[:final_usage], :input_tokens),
+              output_tokens: value(state[:final_usage], :output_tokens),
+              stop_reason: state[:stop_reason]
+            )
+          end
 
-                accumulated << text
+          def wire_stream_handlers(stream, state, fallback_model, &)
+            wire_block_start(stream, state)
+            wire_block_delta(stream, state, fallback_model, &)
+            wire_block_stop(stream, state)
+            wire_message_stop(stream, state)
+            stream.on_metadata_event { |event| state[:final_usage] = value(event, :usage) }
+          end
+
+          def wire_block_start(stream, state)
+            return unless stream.respond_to?(:on_content_block_start_event)
+
+            stream.on_content_block_start_event do |event|
+              start = value(event, :start)
+              tool_start = value(start, :tool_use) if start
+              next unless tool_start
+
+              state[:current_tool_use] = {
+                tool_use_id: value(tool_start, :tool_use_id),
+                name: value(tool_start, :name),
+                input_json: +''
+              }
+            end
+          end
+
+          def wire_block_delta(stream, state, fallback_model)
+            stream.on_content_block_delta_event do |event|
+              delta = value(event, :delta)
+              text = value(delta, :text)
+              if text
+                state[:accumulated] << text
                 if block_given?
                   yield Legion::Extensions::Llm::Chunk.new(role: :assistant, content: text,
                                                            model_id: fallback_model)
                 end
               end
-              stream.on_metadata_event { |event| final_usage = value(event, :usage) }
+
+              tool_input = value(delta, :tool_use)
+              next unless tool_input && state[:current_tool_use]
+
+              input_chunk = value(tool_input, :input)
+              state[:current_tool_use][:input_json] << input_chunk.to_s if input_chunk
             end
+          end
 
-            Legion::Extensions::Llm::Message.new(
-              role: :assistant,
-              content: accumulated,
-              model_id: fallback_model,
-              input_tokens: value(final_usage, :input_tokens),
-              output_tokens: value(final_usage, :output_tokens)
-            )
+          def wire_block_stop(stream, state)
+            return unless stream.respond_to?(:on_content_block_stop_event)
+
+            stream.on_content_block_stop_event do |_event|
+              next unless state[:current_tool_use]
+
+              state[:tool_use_blocks] << state[:current_tool_use]
+              state[:current_tool_use] = nil
+            end
+          end
+
+          def wire_message_stop(stream, state)
+            return unless stream.respond_to?(:on_message_stop_event)
+
+            stream.on_message_stop_event do |event|
+              state[:stop_reason] = value(event, :stop_reason)
+            end
+          end
+
+          def build_stream_tool_calls(tool_use_blocks)
+            return nil if tool_use_blocks.empty?
+
+            tool_use_blocks.to_h do |block|
+              input = begin
+                Legion::JSON.load(block[:input_json])
+              rescue StandardError
+                {}
+              end
+              name = block[:name]
+              id = block[:tool_use_id] || name
+              [id, Legion::Extensions::Llm::ToolCall.new(id: id, name: name, arguments: input)]
+            end
           end
 
           def parse_embedding_response(response, model:)
@@ -477,12 +603,23 @@ module Legion
           end
 
           def client_options
-            {
+            opts = {
               region: region,
               endpoint: config.bedrock_endpoint,
-              credentials: credentials,
               stub_responses: config.bedrock_stub_responses
-            }.compact
+            }
+
+            if bearer_token_configured?
+              opts[:token_provider] = Aws::StaticTokenProvider.new(config.bearer_token)
+            else
+              opts[:credentials] = credentials
+            end
+
+            opts.compact
+          end
+
+          def bearer_token_configured?
+            config.respond_to?(:bearer_token) && !config.bearer_token.to_s.empty?
           end
 
           def credentials

data/lib/legion/extensions/llm/bedrock/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Llm
       module Bedrock
-        VERSION = '0.3.7'
+        VERSION = '0.3.9'
       end
     end
   end

data/lib/legion/extensions/llm/bedrock.rb

@@ -59,6 +59,8 @@ module Legion
           @registry_publisher ||= Legion::Extensions::Llm::RegistryPublisher.new(provider_family: PROVIDER_FAMILY)
         end
 
+        DEFAULT_CAPABILITIES = %i[completion streaming embedding].freeze
+
         def self.discover_instances
           candidates = {}
           discover_env_bearer(candidates)
@@ -66,7 +68,23 @@ module Legion
           discover_env_sigv4(candidates)
           discover_settings(candidates)
           discover_broker(candidates)
-          CredentialSources.dedup_credentials(candidates).transform_values { |config| sanitize_instance_config(config) }
+          CredentialSources.dedup_credentials(candidates)
+                           .reject { |_, config| unresolved_credential?(config) }
+                           .transform_values do |config|
+            sanitized = sanitize_instance_config(config)
+            sanitized[:capabilities] ||= DEFAULT_CAPABILITIES.dup
+            sanitized[:default_model] ||= 'us.anthropic.claude-sonnet-4-6'
+            sanitized
+          end
+        end
+
+        def self.unresolved_credential?(config)
+          return false if config[:bedrock_profile]
+
+          cred = config[:bearer_token] || config[:bedrock_access_key_id] || config[:api_key]
+          return true if cred.nil?
+
+          cred.to_s.match?(%r{\A(vault|env)://})
         end
 
         def self.discover_env_bearer(candidates)
@@ -76,7 +94,9 @@ module Legion
           candidates[:env_bearer] = {
             bearer_token: bearer,
             bedrock_region: CredentialSources.env('AWS_DEFAULT_REGION') || DEFAULT_REGION,
-            tier: :cloud
+            tier: :cloud,
+            source: CredentialSources.source_tag(:env, 'AWS_BEARER_TOKEN_BEDROCK'),
+            credential_fingerprint: CredentialSources.credential_fingerprint(bearer)
           }
         end
 
@@ -88,7 +108,9 @@ module Legion
           candidates[:claude] = {
             bearer_token: claude_bearer,
             bedrock_region: CredentialSources.claude_env_value('AWS_DEFAULT_REGION') || DEFAULT_REGION,
-            tier: :cloud
+            tier: :cloud,
+            source: CredentialSources.source_tag(:file, '~/.claude/settings.json', 'AWS_BEARER_TOKEN_BEDROCK'),
+            credential_fingerprint: CredentialSources.credential_fingerprint(claude_bearer)
           }
         end
 
@@ -100,7 +122,10 @@ module Legion
           candidates[:env_sigv4] = {
             api_key: akid, bedrock_access_key_id: akid, bedrock_secret_access_key: skey,
             bedrock_session_token: CredentialSources.env('AWS_SESSION_TOKEN'),
-            bedrock_region: CredentialSources.env('AWS_DEFAULT_REGION') || DEFAULT_REGION, tier: :cloud
+            bedrock_region: CredentialSources.env('AWS_DEFAULT_REGION') || DEFAULT_REGION,
+            tier: :cloud,
+            source: CredentialSources.source_tag(:env, 'AWS_ACCESS_KEY_ID'),
+            credential_fingerprint: CredentialSources.credential_fingerprint(akid)
           }.compact
         end
 
@@ -109,12 +134,19 @@ module Legion
           return unless settings.is_a?(Hash) && !settings.empty?
 
           default_config = dedup_config(normalize_instance_config(settings))
-          candidates[:settings] = default_config.merge(tier: :cloud) unless default_config.empty?
+          unless default_config.empty?
+            default_config[:source] = CredentialSources.source_tag(:settings, 'extensions.llm.bedrock')
+            default_config[:credential_fingerprint] = CredentialSources.config_fingerprint(default_config)
+            candidates[:settings] = default_config.merge(tier: :cloud)
+          end
 
           settings_instances(settings).each do |name, config|
             next unless config.is_a?(Hash)
 
-            candidates[name.to_sym] = dedup_config(normalize_instance_config(config)).merge(tier: :cloud)
+            normalized = dedup_config(normalize_instance_config(config))
+            normalized[:source] = CredentialSources.source_tag(:settings, "extensions.llm.bedrock.instances.#{name}")
+            normalized[:credential_fingerprint] = CredentialSources.config_fingerprint(normalized)
+            candidates[name.to_sym] = normalized.merge(tier: :cloud)
           end
         end
 
@@ -122,7 +154,11 @@ module Legion
           return unless defined?(Legion::Identity::Broker)
 
           broker_creds = broker_aws_credentials
-          candidates[:broker] = broker_creds.merge(tier: :cloud) if broker_creds
+          return unless broker_creds
+
+          broker_creds[:source] = CredentialSources.source_tag(:broker, 'identity', 'aws')
+          broker_creds[:credential_fingerprint] = CredentialSources.config_fingerprint(broker_creds)
+          candidates[:broker] = broker_creds.merge(tier: :cloud)
         end
 
         # Scan Claude config env hash for any key containing all of

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-llm-bedrock
 version: !ruby/object:Gem::Version
-  version: 0.3.7
+  version: 0.3.9
 platform: ruby
 authors:
 - LegionIO