[ChmaraX]

Why

Thalamus signed Amazon Bedrock requests itself, with service bedrock and a hand-built Mantle URL. The OpenAI SDK now owns that endpoint and signs Mantle requests with bedrock-mantle. Callers keep the same Bedrock config fields.

What changed

• Bedrock API key and SigV4 clients are built with openai/providers/bedrock and openai/providers/bedrock/aws.
• Both entrypoints load on first use. A static import breaks every Thalamus import on openai 6.17.0, which Novu still resolves.
• The custom signer is gone. The edge observer still sends the configured API key. SigV4 on the observer stays the old placeholder bearer, because that worker does not sign.

Scope

• Thalamus only. The public config shapes are unchanged.
• README still names the old optional packages. The changelog and the in-repo skill name the new ones.
• Novu is not updated. It will see a peer warning until it bumps openai.

Tradeoffs

baseURL: null is passed so an AWS_BEDROCK_BASE_URL on the host cannot replace the SDK's Mantle URL.

Blast radius

Anyone on Bedrock moves from /v1 to the SDK's /openai/v1 host. SigV4 callers install @aws-sdk/credential-provider-node, @smithy/hash-node, and @smithy/signature-v4 instead of @aws-crypto/sha256-js. The openai peer floor is >=6.45.0. Novu does not construct this provider.

Verification

• pnpm test passed 255 tests. pnpm typecheck passed.
• The earlier cloud run also captured a real client sending bearer traffic to https://bedrock-mantle.us-east-1.api.aws/openai/v1/responses and signing SigV4 with service bedrock-mantle.

Confidence Score: 5/5

The latest extraction appears safe to merge; the existing observer test gap is non-blocking.

Findings

1.  Test accepts broken observer URLs ▶

Fix with agent prompt

### Issue 1
__tests__/openai/openai.bedrock.test.ts:292-293
The new observer test passes even though it sends an invalid `streamUrl`. `MockOpenAI` has no `baseURL`, so the URL starts with `undefined/responses/`. The test only checks `Authorization`. Give the mock a valid `baseURL` and assert the full `streamUrl` so this test catches broken observer URLs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Moves Bedrock requests to the OpenAI SDK providers while keeping the public config fields unchanged.

• Bedrock requests use the OpenAI SDK's endpoint and signing providers.

_{Reviews (2) · Last reviewed commit: "refactor(openai): move Bedrock client se..." · Reviewed by Greptile}

[linear-code]

NV-9271

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​smithy/​hash-node@​4.2.14 ⏵ 4.5.2	+1		-20	+1
	openai@​6.37.0 ⏵ 7.47.0	+7		+1	+1

View full report

[greptile-apps]

Test accepts broken observer URLs

The new observer test passes even though it sends an invalid streamUrl. MockOpenAI has no baseURL, so the URL starts with undefined/responses/. The test only checks Authorization. Give the mock a valid baseURL and assert the full streamUrl so this test catches broken observer URLs.

Prompt To Fix With AI

This is a comment left during a code review.
Path: __tests__/openai/openai.bedrock.test.ts
Line: 292-293

Comment:
**Test accepts broken observer URLs**

The new observer test passes even though it sends an invalid `streamUrl`. `MockOpenAI` has no `baseURL`, so the URL starts with `undefined/responses/`. The test only checks `Authorization`. Give the mock a valid `baseURL` and assert the full `streamUrl` so this test catches broken observer URLs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.