1package provider
2
3import (
4 "bytes"
5 "context"
6 "encoding/json"
7 "net/http"
8 "net/http/httptest"
9 "strings"
10 "sync/atomic"
11 "testing"
12 "time"
13)
14
15func TestBedrockRetriesTransientRequestOpenFailures(t *testing.T) {
16 var attempts atomic.Int32
17 server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
18 if attempts.Add(1) < 5 {
19 http.Error(w, "temporarily unavailable", http.StatusServiceUnavailable)
20 return
21 }
22 w.WriteHeader(http.StatusOK)
23 }))
24 t.Cleanup(server.Close)
25
26 client := &bedrockClient{
27 bearerToken: "synthetic-token",
28 region: "us-east-1",
29 baseURL: server.URL,
30 http: server.Client(),
31 }
32 events, err := client.Stream(context.Background(), Request{Model: "anthropic.claude-sonnet-4-5"})
33 if err != nil {
34 t.Fatal(err)
35 }
36 for range events {
37 }
38 if got := attempts.Load(); got != 5 {
39 t.Fatalf("request attempts = %d, want initial request plus four retries", got)
40 }
41}
42
43// TestSigV4Known checks our signer against AWS's published test vector
44// from the SigV4 documentation. The expected Authorization header below
45// is taken from "get-vanilla" in the suite (adapted: we use POST with
46// an empty body since Bedrock is always POST).
47//
48// We don't run the official suite (it lives in S3 as a tarball and the
49// signing rules vary slightly between examples); instead this test
50// pins a fixed input/output so future refactors can't silently break
51// the signer.
52func TestSigV4Deterministic(t *testing.T) {
53 creds := &bedrockSigV4Creds{
54 accessKeyID: "AKIDEXAMPLE",
55 secretAccessKey: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
56 }
57 body := []byte(`{"hello":"world"}`)
58 req, err := http.NewRequest("POST", "https://bedrock-runtime.us-east-1.amazonaws.com/model/foo/converse-stream", bytes.NewReader(body))
59 if err != nil {
60 t.Fatal(err)
61 }
62 req.Header.Set("content-type", "application/json")
63 when := time.Date(2024, 1, 15, 12, 0, 0, 0, time.UTC)
64 if err := signSigV4(req, body, "bedrock", "us-east-1", creds, when); err != nil {
65 t.Fatal(err)
66 }
67 auth := req.Header.Get("Authorization")
68 if !strings.HasPrefix(auth, "AWS4-HMAC-SHA256 ") {
69 t.Fatalf("missing AWS4 prefix: %q", auth)
70 }
71 if !strings.Contains(auth, "Credential=AKIDEXAMPLE/20240115/us-east-1/bedrock/aws4_request") {
72 t.Errorf("wrong credential scope: %q", auth)
73 }
74 if !strings.Contains(auth, "SignedHeaders=") {
75 t.Errorf("missing SignedHeaders: %q", auth)
76 }
77 if !strings.Contains(auth, "Signature=") {
78 t.Errorf("missing Signature: %q", auth)
79 }
80 // Sign again with identical inputs -> identical signature (determinism).
81 req2, _ := http.NewRequest("POST", "https://bedrock-runtime.us-east-1.amazonaws.com/model/foo/converse-stream", bytes.NewReader(body))
82 req2.Header.Set("content-type", "application/json")
83 if err := signSigV4(req2, body, "bedrock", "us-east-1", creds, when); err != nil {
84 t.Fatal(err)
85 }
86 if req2.Header.Get("Authorization") != auth {
87 t.Errorf("signature not deterministic:\n a=%q\n b=%q", auth, req2.Header.Get("Authorization"))
88 }
89}
90
91func TestSigV4PathEncoding(t *testing.T) {
92 // Bedrock model IDs include colons and dots. The colon must encode
93 // to %3A in the canonical path (per SigV4 rules).
94 cases := map[string]string{
95 "/model/anthropic.claude-sonnet-4-5-20250929-v1:0/converse-stream": "/model/anthropic.claude-sonnet-4-5-20250929-v1%3A0/converse-stream",
96 "/": "/",
97 "": "/",
98 "/a": "/a",
99 }
100 for in, want := range cases {
101 got := canonicalSigV4Path(in)
102 if got != want {
103 t.Errorf("canonicalSigV4Path(%q) = %q, want %q", in, got, want)
104 }
105 }
106}
107
108func TestReadAWSCredentialsFile(t *testing.T) {
109 // Smoke test: parses an INI-ish file when present. We don't require
110 // the file to exist on the test host.
111 if _, err := readAWSCredentialsFile("default"); err != nil {
112 // missing file or missing profile is fine — both are non-panics
113 t.Logf("no aws creds available (expected on CI): %v", err)
114 }
115}
116
117func TestNormalizeBedrockToolResultsMovesResultsAdjacentToToolUse(t *testing.T) {
118 msgs := []Message{
119 {Role: RoleAssistant, Content: []Content{ToolCallBlock{ID: "tool-1", Name: "edit", Arguments: json.RawMessage(`{"path":"a"}`)}}},
120 {Role: RoleUser, Content: []Content{TextBlock{Text: "what's wrong"}}},
121 {Role: RoleTool, Content: []Content{ToolResultBlock{CallID: "tool-1", Content: []Content{TextBlock{Text: "edited"}}}}},
122 }
123
124 out := normalizeBedrockToolResults(msgs)
125 if len(out) != 3 {
126 t.Fatalf("got %d messages, want 3: %+v", len(out), out)
127 }
128 if out[0].Role != RoleAssistant {
129 t.Fatalf("first role = %s, want assistant", out[0].Role)
130 }
131 if out[1].Role != RoleTool {
132 t.Fatalf("second role = %s, want tool", out[1].Role)
133 }
134 tr, ok := out[1].Content[0].(ToolResultBlock)
135 if !ok {
136 t.Fatalf("second message content = %T, want ToolResultBlock", out[1].Content[0])
137 }
138 if tr.CallID != "tool-1" || tr.IsError {
139 t.Fatalf("unexpected tool result: %+v", tr)
140 }
141 if out[2].Role != RoleUser {
142 t.Fatalf("third role = %s, want user", out[2].Role)
143 }
144}
145
146func TestNormalizeBedrockToolResultsInjectsMissingResult(t *testing.T) {
147 msgs := []Message{
148 {Role: RoleAssistant, Content: []Content{ToolCallBlock{ID: "tool-1", Name: "edit", Arguments: json.RawMessage(`{}`)}}},
149 {Role: RoleUser, Content: []Content{TextBlock{Text: "what's wrong"}}},
150 }
151
152 out := normalizeBedrockToolResults(msgs)
153 if len(out) != 3 {
154 t.Fatalf("got %d messages, want 3: %+v", len(out), out)
155 }
156 tr, ok := out[1].Content[0].(ToolResultBlock)
157 if !ok {
158 t.Fatalf("second message content = %T, want ToolResultBlock", out[1].Content[0])
159 }
160 if tr.CallID != "tool-1" || !tr.IsError {
161 t.Fatalf("unexpected synthetic result: %+v", tr)
162 }
163}
164
165func TestBedrockModelSupportsCaching(t *testing.T) {
166 cases := []struct {
167 model string
168 want bool
169 }{
170 // Bare Claude IDs (as they come from catalog_builtin)
171 {"anthropic.claude-sonnet-4-5-20250929-v1:0", true},
172 {"anthropic.claude-haiku-4-5-20251001-v1:0", true},
173 {"anthropic.claude-opus-4-5-20251101-v1:0", true},
174 // Geo-prefixed (resolved form that arrives at bedrockModelSupportsCaching)
175 {"us.anthropic.claude-sonnet-4-5-20250929-v1:0", true},
176 {"eu.anthropic.claude-haiku-4-5-20251001-v1:0", true},
177 {"global.anthropic.claude-opus-4-5-20251101-v1:0", true},
178 // Nova models have PriceCacheWrite==0 — they use automatic caching
179 {"amazon.nova-pro-v1:0", false},
180 {"amazon.nova-lite-v1:0", false},
181 {"amazon.nova-micro-v1:0", false},
182 // DeepSeek — no cache write price
183 {"deepseek.r1-v1:0", false},
184 // Unknown model with claude prefix
185 {"anthropic.claude-future-v99:0", true},
186 // Unknown non-claude model
187 {"some.unknown-model-v1:0", false},
188 }
189 for _, c := range cases {
190 got := bedrockModelSupportsCaching(c.model)
191 if got != c.want {
192 t.Errorf("bedrockModelSupportsCaching(%q) = %v, want %v", c.model, got, c.want)
193 }
194 }
195}
196
197func TestBedrockBuildRequestClaudeOpus5AdaptiveThinking(t *testing.T) {
198 client := &bedrockClient{region: "us-east-1"}
199 temperature := float32(0.7)
200 req, err := client.buildRequest(Request{
201 Model: "global.anthropic.claude-opus-5",
202 Reasoning: "max",
203 Temperature: &temperature,
204 Messages: []Message{
205 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
206 },
207 })
208 if err != nil {
209 t.Fatal(err)
210 }
211 if req.InferenceConfig.Temperature != nil {
212 t.Fatalf("adaptive thinking must omit temperature, got %v", *req.InferenceConfig.Temperature)
213 }
214 if req.AdditionalModelRequestFields == nil {
215 t.Fatal("missing additionalModelRequestFields")
216 }
217 thinking, ok := req.AdditionalModelRequestFields["thinking"].(map[string]interface{})
218 if !ok || thinking["type"] != "adaptive" {
219 t.Fatalf("unexpected thinking config: %#v", req.AdditionalModelRequestFields["thinking"])
220 }
221 output, ok := req.AdditionalModelRequestFields["output_config"].(map[string]interface{})
222 if !ok || output["effort"] != "max" {
223 t.Fatalf("unexpected output config: %#v", req.AdditionalModelRequestFields["output_config"])
224 }
225}
226
227func TestBedrockBuildRequestMaxTokens(t *testing.T) {
228 client := &bedrockClient{region: "us-east-1"}
229
230 // A non-zero MaxTokens must flow through to InferenceConfig so the
231 // model gets its full output budget. This is the regression guard
232 // for long writes/edits being truncated at Bedrock's 4096 default.
233 req, err := client.buildRequest(Request{
234 Model: "anthropic.claude-sonnet-4-5-20250929-v1:0",
235 MaxTokens: 64000,
236 Messages: []Message{
237 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
238 },
239 })
240 if err != nil {
241 t.Fatal(err)
242 }
243 if req.InferenceConfig.MaxTokens != 64000 {
244 t.Errorf("MaxTokens = %d, want 64000", req.InferenceConfig.MaxTokens)
245 }
246
247 // Zero still falls back to the conservative provider default so an
248 // unset budget never sends maxTokens:0 (which Bedrock rejects).
249 reqZero, err := client.buildRequest(Request{
250 Model: "anthropic.claude-sonnet-4-5-20250929-v1:0",
251 Messages: []Message{
252 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
253 },
254 })
255 if err != nil {
256 t.Fatal(err)
257 }
258 if reqZero.InferenceConfig.MaxTokens != 4096 {
259 t.Errorf("zero MaxTokens default = %d, want 4096", reqZero.InferenceConfig.MaxTokens)
260 }
261}
262
263func TestBedrockBuildRequestCachingClaudeModel(t *testing.T) {
264 // A Claude model (PriceCacheWrite > 0) should get cachePoint markers
265 // in the system array and on the last user message.
266 client := &bedrockClient{region: "us-east-1"}
267 req, err := client.buildRequest(Request{
268 Model: "anthropic.claude-sonnet-4-5-20250929-v1:0",
269 System: "You are a helpful assistant.",
270 Messages: []Message{
271 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
272 },
273 })
274 if err != nil {
275 t.Fatal(err)
276 }
277
278 // system should be: [{text: ...}, {cachePoint: {type: default}}]
279 if len(req.System) != 2 {
280 t.Fatalf("system len = %d, want 2 (text + cachePoint)", len(req.System))
281 }
282 if _, ok := req.System[0]["text"]; !ok {
283 t.Errorf("system[0] missing text key: %v", req.System[0])
284 }
285 if _, ok := req.System[1]["cachePoint"]; !ok {
286 t.Errorf("system[1] missing cachePoint key: %v", req.System[1])
287 }
288
289 // last user message should end with a cachePoint block
290 if len(req.Messages) == 0 {
291 t.Fatal("no messages")
292 }
293 lastMsg := req.Messages[len(req.Messages)-1]
294 if lastMsg.Role != "user" {
295 t.Fatalf("last message role = %q, want user", lastMsg.Role)
296 }
297 lastBlock := lastMsg.Content[len(lastMsg.Content)-1]
298 if _, ok := lastBlock["cachePoint"]; !ok {
299 t.Errorf("last user message final block missing cachePoint: %v", lastBlock)
300 }
301}
302
303func TestBedrockBuildRequestNoCachingNovaModel(t *testing.T) {
304 // A Nova model (PriceCacheWrite == 0) should NOT get cachePoint markers.
305 client := &bedrockClient{region: "us-east-1"}
306 req, err := client.buildRequest(Request{
307 Model: "amazon.nova-pro-v1:0",
308 System: "You are helpful.",
309 Messages: []Message{
310 {Role: RoleUser, Content: []Content{TextBlock{Text: "hi"}}},
311 },
312 })
313 if err != nil {
314 t.Fatal(err)
315 }
316
317 // system should be plain: [{text: ...}] with no cachePoint
318 if len(req.System) != 1 {
319 t.Fatalf("system len = %d, want 1 (text only)", len(req.System))
320 }
321 if _, ok := req.System[0]["cachePoint"]; ok {
322 t.Errorf("Nova system unexpectedly contains cachePoint")
323 }
324
325 // last user message should NOT end with a cachePoint block
326 if len(req.Messages) == 0 {
327 t.Fatal("no messages")
328 }
329 lastMsg := req.Messages[len(req.Messages)-1]
330 for _, block := range lastMsg.Content {
331 if _, ok := block["cachePoint"]; ok {
332 t.Errorf("Nova user message unexpectedly contains cachePoint: %v", block)
333 }
334 }
335}
336
337func TestBedrockBuildRequestCachingMultiTurn(t *testing.T) {
338 // In a multi-turn conversation the cachePoint should be on the LAST
339 // user message only, not on earlier ones.
340 client := &bedrockClient{region: "us-east-1"}
341 req, err := client.buildRequest(Request{
342 Model: "anthropic.claude-sonnet-4-5-20250929-v1:0",
343 Messages: []Message{
344 {Role: RoleUser, Content: []Content{TextBlock{Text: "turn 1"}}},
345 {Role: RoleAssistant, Content: []Content{TextBlock{Text: "response 1"}}},
346 {Role: RoleUser, Content: []Content{TextBlock{Text: "turn 2"}}},
347 },
348 })
349 if err != nil {
350 t.Fatal(err)
351 }
352
353 // Find all user messages and verify only the last has a cachePoint.
354 var userMsgs []bedrockMessage
355 for _, m := range req.Messages {
356 if m.Role == "user" {
357 userMsgs = append(userMsgs, m)
358 }
359 }
360 if len(userMsgs) != 2 {
361 t.Fatalf("expected 2 user messages, got %d", len(userMsgs))
362 }
363
364 // First user message: no cachePoint
365 for _, block := range userMsgs[0].Content {
366 if _, ok := block["cachePoint"]; ok {
367 t.Errorf("first user message should not have cachePoint: %v", block)
368 }
369 }
370
371 // Last user message: ends with cachePoint
372 lastContent := userMsgs[len(userMsgs)-1].Content
373 lastBlock := lastContent[len(lastContent)-1]
374 if _, ok := lastBlock["cachePoint"]; !ok {
375 t.Errorf("last user message should end with cachePoint, got: %v", lastBlock)
376 }
377}
378
379func TestBedrockBuildRequestCachingNoSystemNoCrash(t *testing.T) {
380 // No system prompt: system array should be nil, not a bare cachePoint.
381 client := &bedrockClient{region: "us-east-1"}
382 req, err := client.buildRequest(Request{
383 Model: "anthropic.claude-sonnet-4-5-20250929-v1:0",
384 Messages: []Message{{Role: RoleUser, Content: []Content{TextBlock{Text: "hi"}}}},
385 })
386 if err != nil {
387 t.Fatal(err)
388 }
389 if len(req.System) != 0 {
390 t.Errorf("empty system prompt should produce nil system, got: %v", req.System)
391 }
392 // Message cachePoint still present
393 lastBlock := req.Messages[0].Content[len(req.Messages[0].Content)-1]
394 if _, ok := lastBlock["cachePoint"]; !ok {
395 t.Errorf("user message should still have cachePoint when system is empty")
396 }
397}
398
399func TestBedrockTagLastUserCache(t *testing.T) {
400 msgs := []bedrockMessage{
401 {Role: "user", Content: []map[string]interface{}{{"text": "hi"}}},
402 {Role: "assistant", Content: []map[string]interface{}{{"text": "hello"}}},
403 {Role: "user", Content: []map[string]interface{}{{"text": "followup"}}},
404 }
405 bedrockTagLastUserCache(msgs)
406
407 // Only the last user message (index 2) should have a cachePoint appended.
408 last := msgs[2].Content
409 if _, ok := last[len(last)-1]["cachePoint"]; !ok {
410 t.Errorf("last user message should end with cachePoint")
411 }
412 // The first user message should be untouched.
413 if len(msgs[0].Content) != 1 {
414 t.Errorf("first user message content len = %d, want 1", len(msgs[0].Content))
415 }
416 if _, ok := msgs[0].Content[0]["cachePoint"]; ok {
417 t.Errorf("first user message should not have cachePoint")
418 }
419}
420
421func TestBedrockTagLastUserCacheEmpty(t *testing.T) {
422 // Should not panic on empty or assistant-only history.
423 bedrockTagLastUserCache(nil)
424 bedrockTagLastUserCache([]bedrockMessage{})
425 msgs := []bedrockMessage{
426 {Role: "assistant", Content: []map[string]interface{}{{"text": "hi"}}},
427 }
428 bedrockTagLastUserCache(msgs) // should not panic, no user message to tag
429}
430
431func TestBedrockBuildRequestCachingWireJSON(t *testing.T) {
432 // Verify the JSON shape Bedrock actually receives has the right keys.
433 client := &bedrockClient{region: "us-east-1"}
434 breq, err := client.buildRequest(Request{
435 Model: "anthropic.claude-sonnet-4-5-20250929-v1:0",
436 System: "be helpful",
437 Messages: []Message{
438 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
439 },
440 })
441 if err != nil {
442 t.Fatal(err)
443 }
444 b, err := json.Marshal(breq)
445 if err != nil {
446 t.Fatal(err)
447 }
448 s := string(b)
449 if !strings.Contains(s, `"cachePoint"`) {
450 t.Errorf("serialised request missing cachePoint key: %s", s)
451 }
452 if !strings.Contains(s, `"type":"default"`) {
453 t.Errorf("serialised request missing cachePoint type:default: %s", s)
454 }
455}
456
457// TestBedrockBuildRequestBtwToolHistory reproduces the /btw HTTP 400 bug:
458// the side-chat sends no tools but the frozen main transcript contains
459// toolUse / toolResult blocks. Bedrock rejects such a request unless
460// toolConfig is present. buildRequest must inject a stub toolConfig.
461func TestBedrockBuildRequestBtwToolHistory(t *testing.T) {
462 client := &bedrockClient{region: "us-east-1"}
463 req, err := client.buildRequest(Request{
464 Model: "amazon.nova-pro-v1:0",
465 // No tools — simulates /btw side-chat.
466 Messages: []Message{
467 // Frozen main transcript: one tool call + result already happened.
468 {Role: RoleAssistant, Content: []Content{
469 ToolCallBlock{ID: "tc-1", Name: "bash", Arguments: json.RawMessage(`{"command":"ls"}`)},
470 }},
471 {Role: RoleTool, Content: []Content{
472 ToolResultBlock{CallID: "tc-1", Content: []Content{TextBlock{Text: "file.go"}}},
473 }},
474 // Side-chat question appended by btwDialog.submit.
475 {Role: RoleUser, Content: []Content{TextBlock{Text: "what does that file do?"}}},
476 },
477 })
478 if err != nil {
479 t.Fatal(err)
480 }
481 if req.ToolConfig == nil {
482 t.Fatal("buildRequest should inject a stub toolConfig when history has tool blocks and req.Tools is empty, but ToolConfig is nil")
483 }
484 if len(req.ToolConfig.Tools) == 0 {
485 t.Fatal("stub toolConfig should have at least one tool")
486 }
487 // The stub must have a valid name and a non-nil schema so Bedrock won't
488 // reject it for a different reason.
489 stub := req.ToolConfig.Tools[0]
490 if stub.ToolSpec.Name == "" {
491 t.Error("stub tool name must not be empty")
492 }
493 if stub.ToolSpec.InputSchema.JSON == nil {
494 t.Error("stub tool schema must not be nil")
495 }
496 // Serialised wire payload must include toolConfig.
497 b, err := json.Marshal(req)
498 if err != nil {
499 t.Fatal(err)
500 }
501 if !strings.Contains(string(b), `"toolConfig"`) {
502 t.Errorf("serialised request missing toolConfig: %s", b)
503 }
504}
505
506// TestBedrockBuildRequestNoToolHistoryNoStub ensures that when there are
507// no tool blocks in the history and no tools in the request (ordinary
508// conversational call), we do NOT inject a toolConfig at all — the extra
509// field is unnecessary and some models may behave differently with it.
510func TestBedrockBuildRequestNoToolHistoryNoStub(t *testing.T) {
511 client := &bedrockClient{region: "us-east-1"}
512 req, err := client.buildRequest(Request{
513 Model: "amazon.nova-pro-v1:0",
514 Messages: []Message{
515 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
516 },
517 })
518 if err != nil {
519 t.Fatal(err)
520 }
521 if req.ToolConfig != nil {
522 t.Errorf("expected nil ToolConfig for plain conversation, got: %+v", req.ToolConfig)
523 }
524}
525
526func TestBedrockBuildRequestSkipsEmptyToolMessages(t *testing.T) {
527 client := &bedrockClient{}
528 req, err := client.buildRequest(Request{Messages: []Message{
529 {Role: RoleTool, Content: []Content{ToolResultBlock{CallID: "missing", Content: []Content{TextBlock{Text: "orphan"}}}}},
530 {Role: RoleUser, Content: []Content{TextBlock{Text: "hello"}}},
531 }})
532 if err != nil {
533 t.Fatal(err)
534 }
535 if len(req.Messages) != 1 {
536 t.Fatalf("got %d bedrock messages, want 1: %+v", len(req.Messages), req.Messages)
537 }
538 if req.Messages[0].Role != "user" {
539 t.Fatalf("role = %s, want user", req.Messages[0].Role)
540 }
541}
542
543func TestBedrockEventPayloadHelpers(t *testing.T) {
544 wrapped := []byte(`{"contentBlockDelta":{"contentBlockIndex":0,"delta":{"text":"Hello"}}}`)
545 if got := bedrockEventTypeFromPayload(wrapped); got != "contentBlockDelta" {
546 t.Fatalf("event type = %q, want contentBlockDelta", got)
547 }
548 var delta struct {
549 ContentBlockIndex int `json:"contentBlockIndex"`
550 Delta struct {
551 Text string `json:"text"`
552 } `json:"delta"`
553 }
554 if err := unmarshalBedrockEventPayload(wrapped, "contentBlockDelta", &delta); err != nil {
555 t.Fatal(err)
556 }
557 if delta.ContentBlockIndex != 0 || delta.Delta.Text != "Hello" {
558 t.Fatalf("unexpected wrapped delta: %+v", delta)
559 }
560
561 direct := []byte(`{"contentBlockIndex":1,"delta":{"text":"world"}}`)
562 if err := unmarshalBedrockEventPayload(direct, "contentBlockDelta", &delta); err != nil {
563 t.Fatal(err)
564 }
565 if delta.ContentBlockIndex != 1 || delta.Delta.Text != "world" {
566 t.Fatalf("unexpected direct delta: %+v", delta)
567 }
568}
569
570// TestBedrockBuildRequestImageBlock is the regression test for the bug where
571// reading an image caused the Bedrock provider to return HTTP 500. The root
572// cause was a missing case ImageBlock in buildRequest's content-block switch,
573// which caused image content to be silently dropped and Bedrock to receive an
574// empty or malformed message.
575func TestBedrockBuildRequestImageBlock(t *testing.T) {
576 client := &bedrockClient{region: "us-east-1"}
577
578 // Minimal 1×1 red JPEG (smallest valid JPEG we can construct inline).
579 // This is 26 bytes: SOI + minimal APP0 marker + EOI.
580 // We use a real tiny JPEG to exercise the shrink path too.
581 jpegBytes := []byte{
582 0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 0x4A, 0x46, 0x49, 0x46, 0x00, 0x01,
583 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0xFF, 0xD9,
584 }
585
586 req, err := client.buildRequest(Request{
587 Model: "amazon.nova-pro-v1:0",
588 Messages: []Message{
589 {
590 Role: RoleUser,
591 Content: []Content{
592 TextBlock{Text: "what's in this image?"},
593 ImageBlock{MimeType: "image/jpeg", Data: jpegBytes},
594 },
595 },
596 },
597 })
598 if err != nil {
599 t.Fatal(err)
600 }
601 if len(req.Messages) != 1 {
602 t.Fatalf("expected 1 message, got %d", len(req.Messages))
603 }
604 msg := req.Messages[0]
605 // Expect 2 content blocks: text + image (+ optional cachePoint for Nova which
606 // has no cachePoint, so exactly text + image).
607 var imageBlock map[string]interface{}
608 for _, block := range msg.Content {
609 if img, ok := block["image"]; ok {
610 imageBlock = img.(map[string]interface{})
611 }
612 }
613 if imageBlock == nil {
614 b, _ := json.Marshal(req)
615 t.Fatalf("image block missing from Bedrock request; full request: %s", b)
616 }
617 if imageBlock["format"] != "jpeg" {
618 t.Errorf("image format = %q, want \"jpeg\"", imageBlock["format"])
619 }
620 src, ok := imageBlock["source"].(map[string]interface{})
621 if !ok || src["bytes"] == "" {
622 t.Errorf("image source.bytes is missing or empty: %v", imageBlock["source"])
623 }
624}
625
626// TestBedrockBuildRequestImageInToolResult is the core regression for the
627// HTTP 500 crash: when the read tool returns an image it is wrapped inside a
628// ToolResultBlock. The previous serialiser only handled TextBlock inner
629// content, so the image was silently dropped, leaving Bedrock a toolResult
630// with empty content — which it rejects with HTTP 500.
631func TestBedrockBuildRequestImageInToolResult(t *testing.T) {
632 client := &bedrockClient{region: "us-east-1"}
633
634 pngHeader := []byte{0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A} // PNG magic bytes
635
636 req, err := client.buildRequest(Request{
637 Model: "amazon.nova-pro-v1:0",
638 Messages: []Message{
639 {
640 Role: RoleAssistant,
641 Content: []Content{
642 ToolCallBlock{ID: "read-1", Name: "read", Arguments: json.RawMessage(`{"path":"/tmp/cat.jpg"}`)},
643 },
644 },
645 {
646 Role: RoleTool,
647 Content: []Content{
648 ToolResultBlock{
649 CallID: "read-1",
650 Content: []Content{
651 ImageBlock{MimeType: "image/png", Data: pngHeader},
652 },
653 },
654 },
655 },
656 {
657 Role: RoleUser,
658 Content: []Content{TextBlock{Text: "what's in the image?"}},
659 },
660 },
661 Tools: []Tool{{Name: "read", Schema: json.RawMessage(`{"type":"object"}`)}},
662 })
663 if err != nil {
664 t.Fatal(err)
665 }
666
667 // Find the toolResult content block in the serialised messages.
668 var toolResultContent []map[string]interface{}
669 for _, m := range req.Messages {
670 for _, block := range m.Content {
671 if tr, ok := block["toolResult"]; ok {
672 trd := tr.(map[string]interface{})
673 toolResultContent = trd["content"].([]map[string]interface{})
674 break
675 }
676 }
677 }
678 if toolResultContent == nil {
679 b, _ := json.Marshal(req)
680 t.Fatalf("toolResult block not found in request: %s", b)
681 }
682 if len(toolResultContent) == 0 {
683 t.Fatal("toolResult content is empty — image was dropped (reproduces HTTP 500 bug)")
684 }
685 block := toolResultContent[0]
686 img, ok := block["image"]
687 if !ok {
688 t.Fatalf("expected image block inside toolResult content, got: %v", block)
689 }
690 imgMap := img.(map[string]interface{})
691 if imgMap["format"] != "png" {
692 t.Errorf("image format = %q, want \"png\"", imgMap["format"])
693 }
694 src, ok := imgMap["source"].(map[string]interface{})
695 if !ok || src["bytes"] == "" {
696 t.Errorf("image source.bytes missing or empty: %v", imgMap["source"])
697 }
698}
699
700func TestResolveBedrockInferenceProfileID(t *testing.T) {
701 cases := []struct {
702 model string
703 region string
704 want string
705 }{
706 // Opus 5 is available through its global inference profile only.
707 {"anthropic.claude-opus-5", "us-east-1", "global.anthropic.claude-opus-5"},
708 {"anthropic.claude-opus-5", "eu-central-1", "global.anthropic.claude-opus-5"},
709 // Other bare Anthropic foundation IDs get the region-matched prefix.
710 {"anthropic.claude-sonnet-4-5-20250929-v1:0", "us-east-1", "us.anthropic.claude-sonnet-4-5-20250929-v1:0"},
711 {"anthropic.claude-sonnet-4-5-20250929-v1:0", "eu-central-1", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"},
712 {"anthropic.claude-opus-4-6-v1", "ap-southeast-2", "apac.anthropic.claude-opus-4-6-v1"},
713 {"anthropic.claude-opus-4-6-v1", "us-gov-west-1", "us-gov.anthropic.claude-opus-4-6-v1"},
714 {"deepseek.r1-v1:0", "eu-west-1", "eu.deepseek.r1-v1:0"},
715 // Empty region defaults to us.
716 {"anthropic.claude-opus-4-6-v1", "", "us.anthropic.claude-opus-4-6-v1"},
717 // Already-prefixed IDs are left untouched.
718 {"eu.anthropic.claude-sonnet-4-5-20250929-v1:0", "us-east-1", "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"},
719 {"global.anthropic.claude-opus-4-6-v1", "us-east-1", "global.anthropic.claude-opus-4-6-v1"},
720 {"us.anthropic.claude-opus-4-6-v1", "eu-central-1", "us.anthropic.claude-opus-4-6-v1"},
721 // ARNs are passed through verbatim.
722 {"arn:aws:bedrock:us-east-1:123:inference-profile/us.anthropic.claude-opus-4-6-v1", "eu-west-1", "arn:aws:bedrock:us-east-1:123:inference-profile/us.anthropic.claude-opus-4-6-v1"},
723 // Families that don't need a profile are untouched.
724 {"amazon.nova-pro-v1:0", "us-east-1", "amazon.nova-pro-v1:0"},
725 {"", "us-east-1", ""},
726 }
727 for _, c := range cases {
728 if got := resolveBedrockInferenceProfileID(c.model, c.region); got != c.want {
729 t.Errorf("resolveBedrockInferenceProfileID(%q, %q) = %q; want %q", c.model, c.region, got, c.want)
730 }
731 }
732}
733
734func TestClaudeOpus5BedrockCatalog(t *testing.T) {
735 m, err := FindModel("amazon-bedrock", "global.anthropic.claude-opus-5")
736 if err != nil {
737 t.Fatal(err)
738 }
739 if m.ContextWindow != 1000000 || m.MaxOutput != 128000 || !m.Reasoning || !m.AdaptiveThinking {
740 t.Fatalf("unexpected Bedrock Opus 5 model: %+v", m)
741 }
742 if _, err := FindModel("amazon-bedrock", "anthropic.claude-opus-5"); err == nil {
743 t.Fatal("bare Bedrock Opus 5 ID must not be exposed in the catalog")
744 }
745}