add Qwen model support and Bedrock API Keys authentication

[pamaldi]

Summary

This PR adds support for AWS Bedrock API Keys (bearer token authentication) as an alternative to traditional IAM credentials (boto3/aioboto3), and enables Qwen model routing which was previously missing from the BedrockProvider.

Problem

1. Authentication: The BedrockProvider only supported IAM credentials via aioboto3.Session(). AWS recently introduced Bedrock API Keys (prefixed with ABSK), which provide a simpler authentication method using bearer tokens. These are especially useful for developers who want to quickly test Bedrock models without configuring full IAM credentials.

2. Qwen models: The chat_completion() method in BedrockProvider only routed to _claude_bedrock_completion() for Claude models. Qwen models (e.g., qwen.qwen3-32b-v1:0) were not routed despite having a _qwen_bedrock_completion() method already implemented, resulting in a "Model not yet supported in Bedrock provider" error.

Changes

src/openagents/lms/providers.py

Bearer Token Authentication

• Added AWS_BEARER_TOKEN_BEDROCK environment variable support in BedrockProvider.__init__()
• When the bearer token is set, the provider uses the Bedrock Converse API via direct HTTP requests (with aiohttp) instead of aioboto3
• When the bearer token is not set, the provider falls back to the existing aioboto3 flow (no breaking changes)
• The aioboto3 import is now conditional — only required when bearer token is not configured

New method: _claude_bedrock_bearer()

• Implements the Bedrock Converse API with bearer token authentication
• Converts standard chat messages to Converse API format
• Handles system messages as system parameter (separate from messages)
• Handles tool role messages by converting them to user role with toolResult content blocks (Converse API requirement)
• Handles assistant messages with tool_calls by converting to toolUse content blocks
• Formats tools with proper inputSchema structure required by Converse API
• Parses Converse API responses back to the standardized internal format
• This method is model-agnostic and works with all Bedrock models (Claude, Qwen, Llama, etc.)

Qwen Model Routing

• Added elif "qwen" in self.model_name.lower() branch in chat_completion() to route Qwen models to _qwen_bedrock_completion()
• Added bearer token check in _qwen_bedrock_completion() — when bearer token is available, Qwen models also use the Converse API path

Configuration

Using Bedrock API Keys (new)

# Set the bearer token
export AWS_BEARER_TOKEN_BEDROCK="ABSKxxxxx..."
export AWS_DEFAULT_REGION="us-east-1"

Agent YAML configuration

config:
  model_name: "qwen.qwen3-32b-v1:0"  # or any Bedrock model
  provider: "bedrock"
  region: "us-east-1"

Using IAM credentials (existing, unchanged)

export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_DEFAULT_REGION="us-east-1"

How to Test

1. Generate a Bedrock API Key from the AWS Console
2. Set the environment variable: export AWS_BEARER_TOKEN_BEDROCK="your-key"
3. Configure an agent with provider: "bedrock" and a supported model (Claude or Qwen)
4. Start the network: openagents network start network.yaml
5. Start the agent: openagents agent start agents/charlie.yaml
6. Send a message — the agent should respond using the Bedrock Converse API

Quick API test (without OpenAgents)

curl -X POST "https://bedrock-runtime.us-east-1.amazonaws.com/model/qwen.qwen3-32b-v1:0/converse" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK" \
  -d '{"messages": [{"role": "user", "content": [{"text": "Hello!"}]}]}'

Backward Compatibility

• No breaking changes. Existing IAM credential authentication continues to work as before.
• The bearer token path is only activated when AWS_BEARER_TOKEN_BEDROCK is set.
• The aioboto3 dependency is only required when using IAM credentials (not needed for bearer token auth).

[vercel]

Someone is attempting to deploy a commit to the Raphael's projects Team on Vercel.

A member of the Team first needs to authorize it.