🤖 feat: add support for Amazon Bedrock (#765)

Add Amazon Bedrock as a supported AI provider using
`@ai-sdk/amazon-bedrock` with flexible AWS authentication via
`@aws-sdk/credential-providers`.

## Authentication Methods (in priority order)

1. **Explicit credentials in providers.jsonc** (`accessKeyId` +
`secretAccessKey`)
2. **`AWS_BEARER_TOKEN_BEDROCK`** - Bedrock API key (simplest auth)
3. **AWS credential provider chain**:
- Environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`)
   - Shared credentials file (`~/.aws/credentials`)
   - EC2 instance profiles
   - ECS task roles
   - EKS service accounts (IRSA)
   - SSO credentials
   - And more...

## Configuration

> **Note:** Region is always required - either in config or via
`AWS_REGION` environment variable.

**Simplest setup with Bedrock API key:**
```bash
export AWS_REGION=us-east-1
export AWS_BEARER_TOKEN_BEDROCK=your-api-key
```

**Or explicit credentials in `providers.jsonc`:**
```json
{
  "bedrock": {
    "region": "us-east-1",
    "accessKeyId": "...",
    "secretAccessKey": "..."
  }
}
```

**Or just region (uses credential chain automatically):**
```json
{
  "bedrock": {
    "region": "us-east-1"
  }
}
```

## Supported Models

**Model string format:** `bedrock:<model-id>`

Examples:
- `bedrock:anthropic.claude-3-5-sonnet-20241022-v2:0`
- `bedrock:us.amazon.nova-pro-v1:0`
- `bedrock:meta.llama3-70b-instruct-v1:0`

Closes #764

---
_Generated with `mux`_

Author: ibetitsmike

bun.lock

@@ -173,6 +173,85 @@ By default, mux connects to Ollama at `http://localhost:11434/api`. To use a rem
 }
 ```
 
+#### Amazon Bedrock (Cloud)
+
+Access Anthropic Claude and other models through AWS Bedrock:
+
+- `bedrock:us.anthropic.claude-sonnet-4-20250514-v1:0`
+- `bedrock:us.amazon.nova-pro-v1:0`
+
+Model IDs follow the Bedrock format: `[region.]vendor.model-name-version`. mux automatically parses these for display (e.g., `us.anthropic.claude-sonnet-4-20250514-v1:0` displays as "Sonnet 4").
+
+**Authentication Options:**
+
+Bedrock supports multiple authentication methods, tried in order:
+
+1. **Bearer Token** (simplest) — A single API key for Bedrock access
+2. **Explicit Credentials** — Access Key ID + Secret Access Key in config
+3. **AWS Credential Chain** — Automatic credential resolution (recommended for AWS environments)
+
+**Option 1: Bearer Token**
+
+The simplest approach if you have a Bedrock API key:
+
+```jsonc
+{
+  "bedrock": {
+    "region": "us-east-1",
+    "bearerToken": "your-bedrock-api-key",
+  },
+}
+```
+
+Or set via environment variable:
+
+```bash
+export AWS_REGION=us-east-1
+export AWS_BEARER_TOKEN_BEDROCK=your-bedrock-api-key
+```
+
+**Option 2: Explicit AWS Credentials**
+
+Use IAM access keys directly:
+
+```jsonc
+{
+  "bedrock": {
+    "region": "us-east-1",
+    "accessKeyId": "AKIA...",
+    "secretAccessKey": "...",
+  },
+}
+```
+
+**Option 3: AWS Credential Chain (Recommended for AWS)**
+
+If no explicit credentials are provided, mux uses the AWS SDK's `fromNodeProviderChain()` which automatically resolves credentials from (in order):
+
+1. **Environment variables** — `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`
+2. **Shared credentials file** — `~/.aws/credentials` (supports profiles via `AWS_PROFILE`)
+3. **SSO credentials** — AWS IAM Identity Center (configure with `aws sso login`)
+4. **EC2 instance profile** — Automatic on EC2 instances with IAM roles
+5. **ECS task role** — Automatic in ECS containers
+6. **EKS Pod Identity / IRSA** — Automatic in Kubernetes with IAM Roles for Service Accounts
+
+For region, mux checks `AWS_REGION` and `AWS_DEFAULT_REGION` environment variables, so standard AWS CLI configurations work automatically.
+
+This means if you're already authenticated with AWS CLI (`aws sso login` or configured credentials), mux will automatically use those credentials:
+
+```jsonc
+{
+  "bedrock": {
+    "region": "us-east-1",
+    // No credentials needed — uses AWS credential chain
+  },
+}
+```
+
+**Required IAM Permissions:**
+
+Your AWS credentials need the `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream` permissions for the models you want to use.
+
 ### Provider Configuration
 
 All providers are configured in `~/.mux/providers.jsonc`. Example configurations:
@@ -199,6 +278,10 @@ All providers are configured in `~/.mux/providers.jsonc`. Example configurations
   "openrouter": {
     "apiKey": "sk-or-v1-...",
   },
+  // Bedrock (uses AWS credential chain if no explicit credentials)
+  "bedrock": {
+    "region": "us-east-1",
+  },
   // Optional for Ollama (only needed for custom URL)
   "ollama": {
     "baseUrl": "http://your-server:11434/api",

docs/models.md

@@ -45,10 +45,12 @@
     "postinstall": "sh scripts/postinstall.sh"
   },
   "dependencies": {
+    "@ai-sdk/amazon-bedrock": "^3.0.61",
     "@ai-sdk/anthropic": "^2.0.47",
     "@ai-sdk/google": "^2.0.43",
     "@ai-sdk/openai": "^2.0.72",
     "@ai-sdk/xai": "^2.0.36",
+    "@aws-sdk/credential-providers": "^3.940.0",
     "@lydell/node-pty": "1.1.0",
     "@mozilla/readability": "^0.6.0",
     "@openrouter/ai-sdk-provider": "^1.2.5",

package.json

@@ -1,6 +1,7 @@
 import React from "react";
 import AnthropicIcon from "@/browser/assets/icons/anthropic.svg?react";
 import OpenAIIcon from "@/browser/assets/icons/openai.svg?react";
+import AWSIcon from "@/browser/assets/icons/aws.svg?react";
 import { TooltipWrapper, Tooltip } from "@/browser/components/Tooltip";
 import { formatModelDisplayName } from "@/common/utils/ai/modelDisplay";
 
@@ -29,6 +30,8 @@ export const ModelDisplay: React.FC<ModelDisplayProps> = ({ modelString, showToo
         return <AnthropicIcon />;
       case "openai":
         return <OpenAIIcon />;
+      case "bedrock":
+        return <AWSIcon />;
       default:
         return null;
     }