falg23043 swaps per-user Anthropic keys for AWS Bedrock server-side credentials

falg23043 converted Mike from a bring-your-own-API-key tool to a firm-hosted deployment by replacing the direct Anthropic API with AWS Bedrock. Users no longer manage any Claude credentials; the firm's AWS account covers it.

infrastructuresecurity

A new backend/src/lib/llm/bedrock.ts adapter mirrors the existing claude.ts but uses AnthropicBedrock from @anthropic-ai/bedrock-sdk, authenticated via AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_REGION. If those env vars aren't present it falls back to the AWS credential chain. A BEDROCK_MODEL_ID_MAP in models.ts translates logical IDs to real Bedrock cross-region inference IDs (all pinned to the N. Virginia cross-region prefix) - Sonnet 4.6 and Haiku 4.5 each get a versioned inference profile ID. All three model defaults flip to Bedrock. The frontend model picker replaces the "Anthropic" group with "Bedrock", and isModelAvailable returns true unconditionally for Bedrock models since credentials are server-side.

Migration 001_bedrock_remove_claude_key.sql drops user_profiles.claude_api_key, updates the tabular_model default, and rewrites any existing Claude or Gemini model preferences to Bedrock equivalents. There's no rollback.

Two issues to address before running this in production. The stream adapter logs every raw event to stdout and appends unconditionally to bedrock-raw-stream.log in the working directory - a debugging artifact that will fill disk. Separately, the opus-4-6 entry in BEDROCK_MODEL_ID_MAP maps to anthropic.claude-opus-4-6-v1, which doesn't match Bedrock's versioned naming convention (the haiku entry includes a full date suffix and :0 revision token). That ID looks unverified and will likely 404.

The companion BEDROCK.md is a session-recovery memo listing what changed and what's still TODO for this specific deployment. Useful context, but specific to falg23043's environment and not something to commit into a general fork adoption.

So what Worth pulling only if you also want a firm-hosted Bedrock deployment - the change drops the per-user key model entirely rather than coexisting with it. The adapter itself could be cherry-picked as an additional provider if you want to keep the BYOK option alive. Before adopting: remove the disk-logging from the stream handler, verify the opus model ID, and treat `BEDROCK.md` as throwaway notes.

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

2 commits from falg23043/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`69114a66`	feat: replace Anthropic direct API with AWS Bedrock	Guillaume Falardeau	2026-05-04	↗ GitHub
commit body - Add @anthropic-ai/bedrock-sdk package - New bedrock.ts provider adapter (mirrors claude.ts, uses AnthropicBedrock client) - Bedrock model IDs: sonnet-4-6, haiku-4-5 (user-selectable), opus-4-6 (internal) - Remove per-user claude_api_key; AWS creds are server-side env vars - Update model defaults: main=bedrock-sonnet, tabular/title=bedrock-haiku - Frontend: add Bedrock group to model picker, remove Anthropic API key UI - DB migration 001: drop claude_api_key column, update tabular_model default
`4c9bdbdf`	docs: add BEDROCK.md session recovery reference	Guillaume Falardeau	2026-05-04	↗ GitHub

SHA

Subject

Author

Date

69114a66

feat: replace Anthropic direct API with AWS Bedrock

Guillaume Falardeau

2026-05-04

↗ GitHub

commit body

- Add @anthropic-ai/bedrock-sdk package
- New bedrock.ts provider adapter (mirrors claude.ts, uses AnthropicBedrock client)
- Bedrock model IDs: sonnet-4-6, haiku-4-5 (user-selectable), opus-4-6 (internal)
- Remove per-user claude_api_key; AWS creds are server-side env vars
- Update model defaults: main=bedrock-sonnet, tabular/title=bedrock-haiku
- Frontend: add Bedrock group to model picker, remove Anthropic API key UI
- DB migration 001: drop claude_api_key column, update tabular_model default

4c9bdbdf

docs: add BEDROCK.md session recovery reference

Guillaume Falardeau

2026-05-04

↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-132.md from inside the repo you want the changes in.