Bedrock models do not appear in the WebUI model picker

[munim]

Bug Description

AWS Bedrock models and profiles do not appear in the WebUI model picker, despite being properly configured and authenticated. The agent CLI correctly discovers and lists Bedrock models, but the WebUI silently skips the bedrock provider.

Steps to Reproduce

1. Configure AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) in ~/.hermes/.env
2. Optionally set AWS_REGION (defaults to us-east-1)
3. Open the WebUI model picker (click the model selector)
4. Observe: bedrock provider group is completely absent

Expected Behavior

Bedrock models should appear in the WebUI model picker, grouped under "AWS Bedrock".

Actual Behavior

Bedrock is silently dropped from the provider groups list. No error is logged. The agent CLI (hermes model) correctly shows 49 bedrock models.

Environment

• Hermes Agent version: latest (main branch)
• WebUI: ui-server/config.py
• Provider: AWS Bedrock (eu-central-1)
• Models discovered: 49 (Claude, Llama, Mistral, etc.)

[nesquena-hermes]

Summary

Confirmed bug. The WebUI's model-picker provider catalog (_PROVIDER_MODELS and the env-var → provider detection block in api/config.py) has no Bedrock entry, so even with valid AWS credentials in ~/.hermes/.env the picker silently drops the provider. The agent CLI works because hermes_cli/models.py and agent/bedrock_adapter.py implement live Bedrock discovery (bedrock_model_ids_or_none()); the WebUI never reaches that code path.

Code reference

The WebUI's hardcoded provider catalog at api/config.py:1035-1088 covers anthropic, openai, openai-codex, google, deepseek, nous, zai, kimi-coding, etc. — but the dict has no bedrock key. Grep confirms:

$ grep -n "bedrock" api/config.py
754:    "aws": "bedrock",
755:    "aws-bedrock": "bedrock",
756:    "amazon": "bedrock",
757:    "amazon-bedrock": "bedrock",

Those four lines are alias entries in _PROVIDER_ALIASES, but the canonical bedrock slug has no models list and no display label in _PROVIDER_DISPLAY (api/config.py:690-716).

The env-var detection block at api/config.py:2993-3052 enumerates ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, GOOGLE_API_KEY, GLM_API_KEY, KIMI_API_KEY, DEEPSEEK_API_KEY, etc. — but never checks AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_PROFILE, so detected_providers never gets bedrock added even when boto3 would succeed.

By contrast, the agent side at hermes_cli/models.py:2272-2275 does live discovery:

if normalized == "bedrock":
    try:
        from agent.bedrock_adapter import bedrock_model_ids_or_none
        ids = bedrock_model_ids_or_none()

…and agent/bedrock_adapter.py:335-352 walks bedrock-runtime for the resolved region.

Layer / responsibility

This is a WebUI-side gap. The agent's Bedrock discovery is fine — bedrock_model_ids_or_none() already returns the 49 models you see in hermes model. The WebUI just doesn't call it and doesn't carry a fallback static list.

Fix sketch

Two layers, both in api/config.py:

1. Add a static fallback group (mirrors what hermes_cli/models.py:444 ships):

_PROVIDER_DISPLAY = {
    ...
    "bedrock": "AWS Bedrock",
    ...
}

_PROVIDER_MODELS = {
    ...
    "bedrock": [
        {"id": "anthropic.claude-sonnet-4-5-20250929-v1:0",  "label": "Claude Sonnet 4.5 (Bedrock)"},
        {"id": "anthropic.claude-opus-4-1-20250805-v1:0",    "label": "Claude Opus 4.1 (Bedrock)"},
        # ... whatever the agent's static `_PROVIDER_MODELS["bedrock"]` carries
    ],
    ...
}

Preferred form: import the agent's list directly when hermes_cli is on sys.path, the same pattern _PROVIDER_ALIASES already uses at api/config.py:737-749:

try:
    from hermes_cli.models import _PROVIDER_MODELS as _agent_pm
    if "bedrock" in _agent_pm:
        _PROVIDER_MODELS.setdefault("bedrock", list(_agent_pm["bedrock"]))
except Exception:
    pass

2. Detect AWS creds in the env-var block at api/config.py:2993-3052. The agent's agent.bedrock_adapter.has_aws_credentials() helper (referenced from hermes_cli/auth_commands.py:552) is the canonical detector — it walks AWS_ACCESS_KEY_ID, AWS_PROFILE, and the boto3 credential chain. The WebUI should call it when available:

try:
    from agent.bedrock_adapter import has_aws_credentials
    if has_aws_credentials():
        detected_providers.add("bedrock")
except Exception:
    # Fallback to env-only detection so non-agent installs still work.
    if all_env.get("AWS_ACCESS_KEY_ID") or os.getenv("AWS_PROFILE"):
        detected_providers.add("bedrock")

3. (Optional follow-up) Live Bedrock discovery in the picker would go through the same bedrock_model_ids_or_none() call and overlay onto the static list — same shape as the Nous live-overlay path at api/config.py:1367+. Not required to close this bug; the static list alone restores parity with hermes model.

Test plan

• Add a fixture-style test under tests/ that monkeypatches AWS_ACCESS_KEY_ID and asserts get_available_models()['groups'] contains a bedrock-keyed entry.
• Manual: set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY in ~/.hermes/.env, restart, open the picker, confirm "AWS Bedrock" group appears.

Happy to help review a PR that does the static-list overlay + AWS env detection; live discovery can come as a follow-up since it adds a synchronous boto3 import to the picker hot path.

[nesquena-hermes]

Fixed in v0.51.120 by @munim via #2786. Bedrock is now registered in PROVIDER_LABELS, has 6 default Claude model IDs (Opus 4.7/4.6/4.5, Sonnet 4.6/4.5, Haiku 4.5), and auto-detects from AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY.