@oh-my-pi/pi-ai 17.2.4 → 17.2.6

package/src/providers/aws-credentials.ts

@@ -4,16 +4,11 @@
  * Chain (first hit wins):
  *  1. Static credentials from the environment
  *     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
- *  2. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
- *      - static `aws_access_key_id` / `aws_secret_access_key` / `aws_session_token`
- *      - SSO profile referencing a cached token in `~/.aws/sso/cache/*.json`,
- *        which we exchange for short-lived role credentials via
- *        `https://portal.sso.{region}.amazonaws.com/federation/credentials`.
- *      - `credential_process` — an external command emitting the AWS SDK
- *        `Version: 1` JSON envelope on stdout. Used by `aws-vault`, `granted`,
- *        in-house brokers, etc.
- *  3. EC2 IMDSv2 (only when `AWS_EC2_METADATA_DISABLED` is unset / falsey and
- *     `169.254.169.254` is reachable within a 1 s timeout).
+ *  2. Web identity (`AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`).
+ *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
+ *      - static keys, SSO, or `credential_process`.
+ *  4. ECS/container credentials from `AWS_CONTAINER_CREDENTIALS_*`.
+ *  5. EC2 IMDSv2 when metadata is enabled.
  *
  * Resolved credentials are cached process-wide per profile and refreshed
  * 60 s before `Expiration` to absorb clock skew.
@@ -26,6 +21,14 @@ import { $env, isEnoent, logger } from "@oh-my-pi/pi-utils";
 import * as AIError from "../error";
 import type { FetchImpl } from "../types";
 import { raceWithSignal } from "../utils/abort";
+import {
+	type AwsIniFile,
+	parseAwsIni,
+	resolveAwsProfile,
+	resolveAwsRegion,
+	shouldLoadAwsSharedConfig,
+} from "../utils/aws-profile";
+import { isLocalOrMetadataHost } from "../utils/proxy";
 import type { AwsCredentials } from "./aws-sigv4";
 
 export interface ResolvedCredentials extends AwsCredentials {
@@ -55,6 +58,23 @@ const FILE_SESSION_CREDS_TTL_MS = 5 * 60_000;
  */
 const SHARED_RESOLVE_TIMEOUT_MS = 30_000;
 
+function requireDynamicCredentialExpiration(
+	value: string | undefined,
+	source: "AWS web identity" | "AWS container credential",
+	kind: "web-identity" | "container",
+): number {
+	const expiresAt = value ? Date.parse(value) : Number.NaN;
+	if (Number.isFinite(expiresAt)) return expiresAt;
+	throw new AIError.AwsCredentialsError(`${source} response has a missing or invalid Expiration.`, kind);
+}
+
+/** Credential-process expiry is optional; missing/malformed values disable caching. */
+function dynamicCredentialExpiration(value: string | undefined): number {
+	if (!value) return Date.now();
+	const expiresAt = Date.parse(value);
+	return Number.isFinite(expiresAt) ? expiresAt : Date.now();
+}
+
 interface CacheEntry {
 	creds: ResolvedCredentials;
 	expiresAt: number;
@@ -63,10 +83,15 @@ interface CacheEntry {
 const cache: Map<string, CacheEntry> = new Map();
 const inflight: Map<string, Promise<ResolvedCredentials>> = new Map();
 
+function credentialCacheKey(profile: string, region: string, loadSharedConfig: boolean): string {
+	return `${profile}\x00${region}\x00${loadSharedConfig ? "config" : "credentials"}`;
+}
+
 export async function resolveAwsCredentials(opts: CredentialResolveOptions = {}): Promise<ResolvedCredentials> {
-	const profile = opts.profile || $env.AWS_PROFILE || "default";
-	const region = opts.region || $env.AWS_REGION || $env.AWS_DEFAULT_REGION || "us-east-1";
-	const cacheKey = `${profile}\x00${region}`;
+	const profile = resolveAwsProfile(opts.profile);
+	const region = resolveAwsRegion(opts.region, opts.profile);
+	const loadSharedConfig = shouldLoadAwsSharedConfig(opts.profile);
+	const cacheKey = credentialCacheKey(profile, region, loadSharedConfig);
 
 	const hit = cache.get(cacheKey);
 	if (hit && hit.expiresAt - REFRESH_SKEW_MS > Date.now()) return hit.creds;
@@ -81,7 +106,13 @@ export async function resolveAwsCredentials(opts: CredentialResolveOptions = {})
 	const fetchImpl = opts.fetch ?? (globalThis.fetch as FetchImpl);
 	const promise = (async () => {
 		try {
-			const creds = await resolveFresh(profile, region, AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS), fetchImpl);
+			const creds = await resolveFresh(
+				profile,
+				region,
+				loadSharedConfig,
+				AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS),
+				fetchImpl,
+			);
 			cache.set(cacheKey, { creds, expiresAt: creds.expiresAt ?? Number.POSITIVE_INFINITY });
 			return creds;
 		} finally {
@@ -95,6 +126,7 @@ export async function resolveAwsCredentials(opts: CredentialResolveOptions = {})
 async function resolveFresh(
 	profile: string,
 	region: string,
+	loadSharedConfig: boolean,
 	signal?: AbortSignal,
 	fetchImpl: FetchImpl = globalThis.fetch as FetchImpl,
 ): Promise<ResolvedCredentials> {
@@ -102,19 +134,27 @@ async function resolveFresh(
 	const envCreds = readEnvCredentials();
 	if (envCreds) return envCreds;
 
-	// 2. Profile (static or SSO).
-	const profileCreds = await readProfileCredentials(profile, region, signal, fetchImpl);
+	// 2. Web identity.
+	const webIdentityCreds = await readWebIdentityCredentials(region, signal, fetchImpl);
+	if (webIdentityCreds) return webIdentityCreds;
+
+	// 3. Profile (static, SSO, or credential_process).
+	const profileCreds = await readProfileCredentials(profile, region, loadSharedConfig, signal, fetchImpl);
 	if (profileCreds) return profileCreds;
 
-	// 3. EC2 IMDSv2.
+	// 4. ECS/container credentials.
+	const containerCreds = await readContainerCredentials(signal, fetchImpl);
+	if (containerCreds) return containerCreds;
+
+	// 5. EC2 IMDSv2.
 	if ($env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true") {
 		const imdsCreds = await readImdsCredentials(signal, fetchImpl);
 		if (imdsCreds) return imdsCreds;
 	}
 
 	throw new AIError.AwsCredentialsError(
-		`Unable to resolve AWS credentials. Set AWS_ACCESS_KEY_ID+AWS_SECRET_ACCESS_KEY, ` +
-			`or configure profile '${profile}' in ~/.aws/credentials (or ~/.aws/config for SSO).`,
+		`Unable to resolve AWS credentials. Configure static environment keys, web identity, ` +
+			`an AWS profile, ECS credentials, or an EC2 instance role.`,
 		"resolution",
 	);
 }
@@ -129,42 +169,10 @@ function readEnvCredentials(): ResolvedCredentials | undefined {
 		: { accessKeyId: ak, secretAccessKey: sk };
 }
 
-// ---------- INI parsing ----------
-
-/** Map of section name -> map of key -> value. Section names are stripped of
- * any leading `profile ` (so `~/.aws/config` aligns with `~/.aws/credentials`). */
-type IniFile = Record<string, Record<string, string>>;
-
-function parseIni(text: string): IniFile {
-	const out: IniFile = {};
-	let current: Record<string, string> | null = null;
-	for (const rawLine of text.split(/\r?\n/)) {
-		const line = rawLine.trim();
-		if (!line || line.startsWith("#") || line.startsWith(";")) continue;
-		if (line.startsWith("[") && line.endsWith("]")) {
-			let name = line.slice(1, -1).trim();
-			if (name.startsWith("profile ")) name = name.slice(8).trim();
-			if (name.startsWith("sso-session ")) name = `sso-session:${name.slice(12).trim()}`;
-			let section = out[name];
-			if (!section) {
-				section = {};
-				out[name] = section;
-			}
-			current = section;
-			continue;
-		}
-		if (!current) continue;
-		const eq = line.indexOf("=");
-		if (eq === -1) continue;
-		current[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
-	}
-	return out;
-}
-
-async function readIniFile(p: string): Promise<IniFile | undefined> {
+async function readIniFile(p: string): Promise<AwsIniFile | undefined> {
 	try {
 		const text = await fs.promises.readFile(p, "utf8");
-		return parseIni(text);
+		return parseAwsIni(text);
 	} catch (err) {
 		if (isEnoent(err)) return undefined;
 		throw err;
@@ -176,6 +184,7 @@ async function readIniFile(p: string): Promise<IniFile | undefined> {
 async function readProfileCredentials(
 	profile: string,
 	region: string,
+	loadSharedConfig: boolean,
 	signal: AbortSignal | undefined,
 	fetchImpl: FetchImpl,
 ): Promise<ResolvedCredentials | undefined> {
@@ -184,7 +193,7 @@ async function readProfileCredentials(
 	const configPath = $env.AWS_CONFIG_FILE || path.join(home, ".aws", "config");
 
 	const credentialsIni = await readIniFile(credentialsPath);
-	const configIni = await readIniFile(configPath);
+	const configIni = loadSharedConfig ? await readIniFile(configPath) : undefined;
 
 	// Static credentials live in ~/.aws/credentials; SSO config lives in
 	// ~/.aws/config under `[profile foo]`. Merge into a single view.
@@ -225,7 +234,7 @@ interface SsoCachedToken {
 
 async function readSsoCredentials(
 	profileCfg: Record<string, string>,
-	configIni: IniFile | undefined,
+	configIni: AwsIniFile | undefined,
 	defaultRegion: string,
 	signal: AbortSignal | undefined,
 	fetchImpl: FetchImpl,
@@ -407,10 +416,11 @@ async function readCredentialProcess(
 		accessKeyId: parsed.AccessKeyId,
 		secretAccessKey: parsed.SecretAccessKey,
 	};
-	if (parsed.SessionToken) out.sessionToken = parsed.SessionToken;
-	if (parsed.Expiration) {
-		const exp = Date.parse(parsed.Expiration);
-		if (!Number.isNaN(exp)) out.expiresAt = exp;
+	if (parsed.SessionToken) {
+		out.sessionToken = parsed.SessionToken;
+		out.expiresAt = dynamicCredentialExpiration(parsed.Expiration);
+	} else if (parsed.Expiration) {
+		out.expiresAt = dynamicCredentialExpiration(parsed.Expiration);
 	}
 	return out;
 }
@@ -515,39 +525,214 @@ export function tokenizeCredentialProcessCommand(cmd: string): string[] {
 	return tokens;
 }
 
+// ---------- Web identity ----------
+
+function xmlTag(xml: string, tag: string): string | undefined {
+	const value = new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`).exec(xml)?.[1];
+	if (!value) return undefined;
+	return value
+		.replaceAll("&amp;", "&")
+		.replaceAll("&lt;", "<")
+		.replaceAll("&gt;", ">")
+		.replaceAll("&quot;", '"')
+		.replaceAll("&apos;", "'");
+}
+
+function stsEndpoint(region: string): string {
+	const dnsSuffix = region.startsWith("cn-") ? "amazonaws.com.cn" : "amazonaws.com";
+	return `https://sts.${region}.${dnsSuffix}/`;
+}
+
+async function readWebIdentityCredentials(
+	region: string,
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials | undefined> {
+	const tokenFile = $env.AWS_WEB_IDENTITY_TOKEN_FILE;
+	const roleArn = $env.AWS_ROLE_ARN;
+	if (!tokenFile || !roleArn) return undefined;
+	let token: string;
+	try {
+		token = (await Bun.file(tokenFile).text()).trim();
+	} catch (err) {
+		throw new AIError.AwsCredentialsError(
+			`Unable to read AWS web identity token file: ${String(err)}`,
+			"web-identity",
+			{
+				cause: err,
+			},
+		);
+	}
+	if (!token) {
+		throw new AIError.AwsCredentialsError("AWS web identity token file is empty.", "web-identity");
+	}
+	const body = new URLSearchParams({
+		Action: "AssumeRoleWithWebIdentity",
+		Version: "2011-06-15",
+		RoleArn: roleArn,
+		RoleSessionName: $env.AWS_ROLE_SESSION_NAME || `omp-${process.pid}`,
+		WebIdentityToken: token,
+	});
+	const response = await fetchImpl(stsEndpoint(region), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: body.toString(),
+		signal,
+	});
+	const xml = await response.text();
+	if (!response.ok) {
+		throw new AIError.AwsCredentialsError(
+			`AWS AssumeRoleWithWebIdentity failed: ${response.status} ${xmlTag(xml, "Message") ?? xml.slice(0, 200)}`,
+			"web-identity",
+		);
+	}
+	const accessKeyId = xmlTag(xml, "AccessKeyId");
+	const secretAccessKey = xmlTag(xml, "SecretAccessKey");
+	const sessionToken = xmlTag(xml, "SessionToken");
+	if (!accessKeyId || !secretAccessKey || !sessionToken) {
+		throw new AIError.AwsCredentialsError(
+			"AWS AssumeRoleWithWebIdentity response is missing credentials.",
+			"web-identity",
+		);
+	}
+	const expiresAt = requireDynamicCredentialExpiration(xmlTag(xml, "Expiration"), "AWS web identity", "web-identity");
+	return {
+		accessKeyId,
+		secretAccessKey,
+		sessionToken,
+		expiresAt,
+	};
+}
+
+// ---------- ECS/container credentials ----------
+
+interface ContainerCredentialResponse {
+	AccessKeyId?: string;
+	SecretAccessKey?: string;
+	Token?: string;
+	Expiration?: string;
+}
+
+const ECS_TASK_CREDENTIALS_BASE_URL = new URL("http://169.254.170.2/");
+
+async function readContainerCredentials(
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials | undefined> {
+	const relativeUri = $env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+	const fullUri = $env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+	if (!relativeUri && !fullUri) return undefined;
+	let endpoint: URL;
+	if (relativeUri) {
+		if (!relativeUri.startsWith("/") || relativeUri.startsWith("//")) {
+			throw new AIError.AwsCredentialsError(
+				"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI must be a single-host absolute path.",
+				"container",
+			);
+		}
+		endpoint = new URL(relativeUri.slice(1), ECS_TASK_CREDENTIALS_BASE_URL);
+	} else {
+		try {
+			endpoint = new URL(fullUri as string);
+		} catch (err) {
+			throw new AIError.AwsCredentialsError(
+				`AWS_CONTAINER_CREDENTIALS_FULL_URI is invalid: ${String(err)}`,
+				"container",
+				{ cause: err },
+			);
+		}
+		if (endpoint.protocol !== "https:" && !isLocalOrMetadataHost(endpoint.hostname)) {
+			throw new AIError.AwsCredentialsError(
+				"AWS_CONTAINER_CREDENTIALS_FULL_URI must use HTTPS or a local metadata host.",
+				"container",
+			);
+		}
+	}
+	let authorization = $env.AWS_CONTAINER_AUTHORIZATION_TOKEN;
+	const authorizationTokenFile = $env.AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE;
+	if (!authorization && authorizationTokenFile) {
+		try {
+			authorization = (await Bun.file(authorizationTokenFile).text()).trim();
+		} catch (err) {
+			throw new AIError.AwsCredentialsError(
+				`Unable to read AWS container authorization token file: ${String(err)}`,
+				"container",
+				{ cause: err },
+			);
+		}
+	}
+	const response = await fetchImpl(endpoint, {
+		headers: authorization ? { authorization } : undefined,
+		signal,
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new AIError.AwsCredentialsError(
+			`AWS container credential endpoint failed: ${response.status} ${body.slice(0, 200)}`,
+			"container",
+		);
+	}
+	const body = (await response.json()) as ContainerCredentialResponse;
+	if (!body.AccessKeyId || !body.SecretAccessKey || !body.Token) {
+		throw new AIError.AwsCredentialsError(
+			"AWS container credential response is missing AccessKeyId/SecretAccessKey/Token.",
+			"container",
+		);
+	}
+	return {
+		accessKeyId: body.AccessKeyId,
+		secretAccessKey: body.SecretAccessKey,
+		sessionToken: body.Token,
+		expiresAt: requireDynamicCredentialExpiration(body.Expiration, "AWS container credential", "container"),
+	};
+}
+
 // ---------- IMDSv2 ----------
 
-const IMDS_HOST = "169.254.169.254";
+const IMDS_IPV4_BASE_URL = "http://169.254.169.254/";
+const IMDS_IPV6_BASE_URL = "http://[fd00:ec2::254]/";
 const IMDS_TIMEOUT_MS = 1000;
 
+function imdsRequestSignal(parentSignal: AbortSignal | undefined): AbortSignal {
+	const timeout = AbortSignal.timeout(IMDS_TIMEOUT_MS);
+	return parentSignal ? AbortSignal.any([parentSignal, timeout]) : timeout;
+}
+
+function imdsBaseUrl(): URL {
+	const mode = $env.AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE?.toLowerCase();
+	const fallback = mode === "ipv6" ? IMDS_IPV6_BASE_URL : IMDS_IPV4_BASE_URL;
+	const endpoint = new URL($env.AWS_EC2_METADATA_SERVICE_ENDPOINT || fallback);
+	if (!endpoint.pathname.endsWith("/")) endpoint.pathname += "/";
+	return endpoint;
+}
+
 async function readImdsCredentials(
 	parentSignal: AbortSignal | undefined,
 	fetchImpl: FetchImpl,
 ): Promise<ResolvedCredentials | undefined> {
-	const timeout = AbortSignal.timeout(IMDS_TIMEOUT_MS);
-	const signal = parentSignal ? AbortSignal.any([parentSignal, timeout]) : timeout;
 	try {
-		const tokenRes = await fetchImpl(`http://${IMDS_HOST}/latest/api/token`, {
+		const endpoint = imdsBaseUrl();
+		const tokenRes = await fetchImpl(new URL("latest/api/token", endpoint), {
 			method: "PUT",
 			headers: { "x-aws-ec2-metadata-token-ttl-seconds": "21600" },
-			signal,
+			signal: imdsRequestSignal(parentSignal),
 		});
 		if (!tokenRes.ok) return undefined;
 		const token = await tokenRes.text();
 
-		const roleRes = await fetchImpl(`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/`, {
+		const roleRes = await fetchImpl(new URL("latest/meta-data/iam/security-credentials/", endpoint), {
 			headers: { "x-aws-ec2-metadata-token": token },
-			signal,
+			signal: imdsRequestSignal(parentSignal),
 		});
 		if (!roleRes.ok) return undefined;
 		const role = (await roleRes.text()).trim();
 		if (!role) return undefined;
 
 		const credsRes = await fetchImpl(
-			`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,
+			new URL(`latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`, endpoint),
 			{
 				headers: { "x-aws-ec2-metadata-token": token },
-				signal,
+				signal: imdsRequestSignal(parentSignal),
 			},
 		);
 		if (!credsRes.ok) return undefined;
@@ -557,14 +742,15 @@ async function readImdsCredentials(
 			Token?: string;
 			Expiration?: string;
 		};
-		if (!body.AccessKeyId || !body.SecretAccessKey) return undefined;
-		const out: ResolvedCredentials = {
+		if (!body.AccessKeyId || !body.SecretAccessKey || !body.Token || !body.Expiration) return undefined;
+		const expiresAt = Date.parse(body.Expiration);
+		if (!Number.isFinite(expiresAt)) return undefined;
+		return {
 			accessKeyId: body.AccessKeyId,
 			secretAccessKey: body.SecretAccessKey,
+			sessionToken: body.Token,
+			expiresAt,
 		};
-		if (body.Token) out.sessionToken = body.Token;
-		if (body.Expiration) out.expiresAt = Date.parse(body.Expiration);
-		return out;
 	} catch {
 		return undefined;
 	}
@@ -580,7 +766,7 @@ export function clearAwsCredentialCache(): void {
  * 401/403 responses so stale credentials are re-resolved instead of served until restart.
  */
 export function invalidateAwsCredentialCache(opts: { profile?: string; region?: string } = {}): void {
-	const profile = opts.profile || $env.AWS_PROFILE || "default";
-	const region = opts.region || $env.AWS_REGION || $env.AWS_DEFAULT_REGION || "us-east-1";
-	cache.delete(`${profile}\x00${region}`);
+	const profile = resolveAwsProfile(opts.profile);
+	const region = resolveAwsRegion(opts.region, opts.profile);
+	cache.delete(credentialCacheKey(profile, region, shouldLoadAwsSharedConfig(opts.profile)));
 }

package/src/providers/bedrock-mantle.ts

@@ -0,0 +1,110 @@
+import { type AwsBedrockProviderOptions, resolveAwsBearerToken } from "../registry/aws";
+import type { FetchImpl, Model } from "../types";
+import { resolveAwsRegion } from "../utils/aws-profile";
+import { invalidateAwsCredentialCache, resolveAwsCredentials } from "./aws-credentials";
+import { signRequest } from "./aws-sigv4";
+import type { OpenAIResponsesOptions } from "./openai-responses";
+import { NO_AUTH_SENTINEL } from "./openai-shared";
+
+export type BedrockMantleProviderOptions = AwsBedrockProviderOptions;
+
+export interface BedrockMantleOptions extends OpenAIResponsesOptions {
+	providerOptions?: BedrockMantleProviderOptions;
+}
+
+async function requestBody(input: string | URL | Request, init?: RequestInit): Promise<Uint8Array> {
+	if (init?.body !== undefined && init.body !== null) {
+		if (typeof init.body === "string") return new TextEncoder().encode(init.body);
+		if (init.body instanceof Uint8Array) return init.body;
+		if (init.body instanceof ArrayBuffer) return new Uint8Array(init.body);
+		throw new TypeError(`Cannot SigV4-sign ${init.body.constructor?.name ?? typeof init.body} request body`);
+	}
+	if (input instanceof Request) return new Uint8Array(await input.clone().arrayBuffer());
+	return new Uint8Array();
+}
+
+function createSignedFetch(options: BedrockMantleOptions, region: string): FetchImpl {
+	const baseFetch = options.fetch ?? (globalThis.fetch as FetchImpl);
+	const signedFetch = async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
+		const url = new URL(input instanceof Request ? input.url : input.toString());
+		const method = init?.method ?? (input instanceof Request ? input.method : "POST");
+		const headers = new Headers(input instanceof Request ? input.headers : undefined);
+		for (const [name, value] of new Headers(init?.headers)) headers.set(name, value);
+		headers.delete("authorization");
+		const body = await requestBody(input, init);
+		const credentials = await resolveAwsCredentials({
+			profile: options.providerOptions?.profile,
+			region,
+			signal: options.signal,
+			fetch: baseFetch,
+		});
+		const signed = await signRequest({
+			method,
+			host: url.host,
+			path: url.pathname,
+			query: url.search.slice(1),
+			body,
+			region,
+			service: "bedrock-mantle",
+			credentials,
+			headers: { "content-type": headers.get("content-type") ?? "application/json" },
+		});
+		for (const [name, value] of Object.entries(signed)) {
+			if (value !== undefined && name !== "host") headers.set(name, value);
+		}
+		const response = await baseFetch(
+			url,
+			method === "GET" || method === "HEAD" ? { ...init, method, headers } : { ...init, method, headers, body },
+		);
+		if (response.status === 401 || response.status === 403) {
+			invalidateAwsCredentialCache({ profile: options.providerOptions?.profile, region });
+		}
+		return response;
+	};
+	return Object.assign(signedFetch, baseFetch.preconnect ? { preconnect: baseFetch.preconnect } : {});
+}
+
+function resolveBearerToken(options: BedrockMantleOptions): string | undefined {
+	const apiKey = options.apiKey === NO_AUTH_SENTINEL ? undefined : options.apiKey;
+	return resolveAwsBearerToken(apiKey, options.providerOptions?.bearerToken);
+}
+
+export function createBedrockMantleAuthenticatedFetch(options: BedrockMantleOptions = {}): FetchImpl {
+	const region = resolveAwsRegion(options.providerOptions?.region, options.providerOptions?.profile);
+	const bearerToken = resolveBearerToken(options);
+	if (!bearerToken) return createSignedFetch(options, region);
+
+	const baseFetch = options.fetch ?? (globalThis.fetch as FetchImpl);
+	const authenticatedFetch = async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
+		const headers = new Headers(input instanceof Request ? input.headers : undefined);
+		for (const [name, value] of new Headers(init?.headers)) headers.set(name, value);
+		headers.set("authorization", `Bearer ${bearerToken}`);
+		return baseFetch(input, { ...init, headers });
+	};
+	return Object.assign(authenticatedFetch, baseFetch.preconnect ? { preconnect: baseFetch.preconnect } : {});
+}
+
+export interface PreparedBedrockMantleRequest {
+	model: Model<"openai-responses">;
+	options: OpenAIResponsesOptions;
+}
+
+export function prepareBedrockMantleRequest(
+	model: Model<"openai-responses">,
+	options: BedrockMantleOptions,
+): PreparedBedrockMantleRequest {
+	const region = resolveAwsRegion(options.providerOptions?.region, options.providerOptions?.profile);
+	const resolvedModel = { ...model, baseUrl: model.baseUrl.replaceAll("{region}", encodeURIComponent(region)) };
+	const bearerToken = resolveBearerToken(options);
+	if (bearerToken) {
+		return { model: resolvedModel, options: { ...options, apiKey: bearerToken } };
+	}
+	return {
+		model: resolvedModel,
+		options: {
+			...options,
+			apiKey: NO_AUTH_SENTINEL,
+			fetch: createBedrockMantleAuthenticatedFetch(options),
+		},
+	};
+}

package/src/providers/cursor.ts

@@ -1816,11 +1816,14 @@ async function handleExecServerMessage(
 		case "piEditArgs": {
 			const args = execMsg.message.value;
 			const toolCallId = crypto.randomUUID();
-			// `PiEditReplacement` is the local `edit` tool's replace mode verbatim:
-			// snake_case `old_text`/`new_text` entries against one path.
+			// `PiEditReplacement` maps onto the local `edit` tool's replace mode:
+			// one snake_case `old_string`/`new_string` per call. Multi-replacement
+			// frames display the first replacement; the exec handler applies all.
+			const firstEdit = args.edits[0];
 			synthesizeCursorExecToolCall(output, stream, state, toolCallId, "edit", {
 				path: args.path,
-				edits: args.edits.map(edit => ({ old_text: edit.oldText, new_text: edit.newText })),
+				old_string: firstEdit?.oldText ?? "",
+				new_string: firstEdit?.newText ?? "",
 			});
 			const { execResult } = await resolveExecHandler(
 				{ args, toolCallId },

package/src/providers/ollama.ts

@@ -251,7 +251,7 @@ function convertMessages(model: Model<"ollama-chat">, context: Context): OllamaM
 	const messages: Message[] = [...systemMessages, ...context.messages];
 	const isCloud = model.provider === "ollama-cloud";
 	const supportsImages = model.input.includes("image");
-	return transformMessages(messages, model).map((msg, index) => {
+	const converted = transformMessages(messages, model).map((msg, index) => {
 		// Real `systemPrompt` entries (always emitted first) stay on Ollama's
 		// `system` role. After the static prefix, a developer turn keeps `system`
 		// when it's an agent-owned control instruction (empty/unexpected-stop
@@ -272,6 +272,21 @@ function convertMessages(model: Model<"ollama-chat">, context: Context): OllamaM
 		}
 		return converted;
 	});
+	// Ollama returns `done_reason: "load"` and generates nothing when a request
+	// carries no `user`-role message (e.g. a plan-approval handoff into a fresh
+	// session whose only non-system turn is an agent-attributed developer message
+	// mapped to `system`). Demote the last non-prefix system turn to `user` so the
+	// request can actually produce output; the static system-prompt prefix stays
+	// on `system` for prefix caching. (#7465)
+	if (!converted.some(m => m.role === "user")) {
+		for (let i = converted.length - 1; i >= systemPrompts.length; i--) {
+			if (converted[i].role === "system") {
+				converted[i].role = "user";
+				break;
+			}
+		}
+	}
+	return converted;
 }
 
 function convertTools(tools: Tool[] | undefined): OllamaFunctionTool[] | undefined {
@@ -403,6 +418,12 @@ function mapDoneReason(doneReason: string | undefined, output: AssistantMessage)
 	if (doneReason === "tool_calls") {
 		return "toolUse";
 	}
+	if (doneReason === "load") {
+		// Ollama emits done_reason:"load" (model loaded, nothing generated) when a
+		// request has no user-role turn. Surface it as an error rather than a clean
+		// empty stop so it isn't laundered and retried behind a misleading hint. (#7465)
+		return "error";
+	}
 	if (doneReason === undefined && output.content.some(block => block.type === "toolCall")) {
 		return "toolUse";
 	}
@@ -411,6 +432,8 @@ function mapDoneReason(doneReason: string | undefined, output: AssistantMessage)
 
 const EMPTY_OLLAMA_LENGTH_COMPLETION_MESSAGE =
 	"Model returned no content: prompt filled the context window; raise Ollama num_ctx or shorten the prompt.";
+const EMPTY_OLLAMA_LOAD_COMPLETION_MESSAGE =
+	"Ollama loaded the model but generated nothing (done_reason: load): the request contained no user-role message.";
 
 function hasVisibleAssistantContent(output: AssistantMessage): boolean {
 	return output.content.some(block => {
@@ -697,6 +720,9 @@ const streamOllamaOnce = (
 				output.stopReason = "error";
 				output.errorMessage = EMPTY_OLLAMA_LENGTH_COMPLETION_MESSAGE;
 			}
+			if (output.stopReason === "error" && !output.errorMessage) {
+				output.errorMessage = EMPTY_OLLAMA_LOAD_COMPLETION_MESSAGE;
+			}
 			// Tool calls always mean "execute and continue" in the OpenAI/Ollama contract.
 			// If the turn produced tool-call blocks but reported a natural `stop`, promote
 			// to `toolUse` so the agent loop runs them (it gates execution on the stop