Cloud-Native Providers (Bedrock, Vertex AI, GitHub Copilot)

These three workers use cloud-platform auth rather than a plain API key. None of them routes through the LiteLLM gateway; each has a dedicated adapter in src/adapters/.

---

AWS Bedrock

• Kind: raw API (Amazon Bedrock Converse API, NOT the OpenAI-compat shim)
• Adapter: src/adapters/BedrockAdapter.ts
• Official docs: https://docs.aws.amazon.com/bedrock/latest/userguide/inference.html

Base URL & auth

Endpoint	Regional: https://bedrock-runtime.<region>.amazonaws.com
Auth	AWS Signature Version 4 (SigV4) — signed per-request by the SDK
SDK	@aws-sdk/client-bedrock-runtime (dynamically imported)

SigV4 signing is handled automatically by the SDK. You never construct a bearer token manually.

Credential resolution order (SDK default chain):

1. Explicit BEDROCK_ACCESS_KEY_ID + BEDROCK_SECRET_ACCESS_KEY env vars — passed directly to the SDK.
2. Named profile via BEDROCK_PROFILE (overrides AWS_PROFILE for Bedrock calls only).
3. SDK default chain: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars → ~/.aws/credentials → ECS task role → EC2 instance metadata.

BEDROCK_SESSION_TOKEN (or AWS_SESSION_TOKEN) is forwarded when temporary credentials (STS assume-role) are in use.

Environment variables

Variable	Required	Default	Purpose
BEDROCK_REGION	yes (fallback: AWS_REGION, AWS_DEFAULT_REGION)	us-east-1	AWS region for Bedrock API calls
BEDROCK_MODEL	no	anthropic.claude-3-5-sonnet-20241022-v2:0	Model id or inference-profile ARN
BEDROCK_ACCESS_KEY_ID	one of the auth options	—	AWS access key id
BEDROCK_SECRET_ACCESS_KEY	one of the auth options	—	AWS secret access key
BEDROCK_SESSION_TOKEN	no	—	STS session token for temporary credentials
BEDROCK_PROFILE	one of the auth options	—	Named AWS profile from ~/.aws/credentials

At least one auth option must be configured. The compare-fleet adapter (loop-bedrock-direct) and the implementer (loop-bedrock-build) share the same env vars and adapter.

Worker profiles

Worker id	Role	Tier	Cost class	Priority rank
loop-bedrock-build	Implementer (build-fleet, CYBERINE_BUILD_FLEET)	strong	2	9
loop-bedrock-direct	Compare-fleet (auto-registered when credentials present)	—	—	—

Both workers are registered only when credentials are detected at startup (availability.bedrockDirect).

Models (selected)

Model ids in Bedrock use the provider-prefixed format. Common ids:

Model id	Notes
anthropic.claude-3-5-sonnet-20241022-v2:0	Default. Strong, widely available.
anthropic.claude-3-haiku-20240307-v1:0	Fast and cheap.
anthropic.claude-opus-4-8-*	Flagship (requires cross-region inference profile).
amazon.nova-pro-v1:0	Amazon Nova frontier.
amazon.titan-text-express-v1	Amazon Titan.
meta.llama3-70b-instruct-v1:0	Open-weight.

Use inference-profile ARNs for cross-region routing (required for some newer models).

Gotchas

• Model access must be enabled per-region in the AWS Console (Bedrock > Model access).
• Not all models are available in all regions — check the Bedrock availability matrix before picking a region.
• Cross-region inference profiles are the recommended path for frontier models; they carry a small latency overhead.
• SigV4 signs each request; the SDK handles expiration/rotation when using IAM roles.
• BEDROCK_REGION defaults to us-east-1 — set explicitly for non-us regions.

Cyberine integration notes

• The BedrockAdapter implements the Converse API tool-calling loop (ConverseCommand / ConverseStreamCommand) and maps Cyberine Tool[] to Bedrock toolSpec. The loop is the same as LoopAgentAdapter but speaks Bedrock's native wire format.
• Register loop-bedrock-build in CYBERINE_BUILD_FLEET to include it in implementer fan-out.
• The compare-fleet worker loop-bedrock-direct is registered automatically — no CYBERINE_BUILD_FLEET entry needed for compare runs.

---

Google Vertex AI

• Kind: raw API (Vertex AI Generative AI SDK — Gemini models and Claude-on-Vertex)
• Adapter: src/adapters/VertexAdapter.ts
• Official docs: https://cloud.google.com/vertex-ai/generative-ai/docs

Base URL & auth

Endpoint	https://<location>-aiplatform.googleapis.com/v1/projects/<project>/locations/<location>/publishers/google/models/<model>:streamGenerateContent
Auth	Application Default Credentials (ADC) or explicit service account JSON key
SDK	@google-cloud/vertexai (dynamically imported — npm install @google-cloud/vertexai required)

Credential resolution:

1. VERTEX_SERVICE_ACCOUNT_KEY_JSON env var — full service account JSON key as a string. Passed directly to the SDK googleAuthOptions.
2. ADC default chain: gcloud auth application-default login → Workload Identity (GKE) → GCE metadata server.

ADC is the preferred path on GCP-hosted workloads. For local development, run gcloud auth application-default login once.

Environment variables

Variable	Required	Default	Purpose
VERTEX_PROJECT_ID	yes	—	GCP project id
VERTEX_LOCATION	no	us-central1	Vertex AI region / location
VERTEX_MODEL	no	gemini-2.5-pro	Model id (see models below)
VERTEX_SERVICE_ACCOUNT_KEY_JSON	no (falls back to ADC)	—	Full service account key JSON as a string

VERTEX_PROJECT_ID is the only hard requirement; auth falls back to ADC when VERTEX_SERVICE_ACCOUNT_KEY_JSON is absent.

Worker profiles

Worker id	Role	Tier	Cost class	Priority rank
loop-vertex-build	Implementer (build-fleet, CYBERINE_BUILD_FLEET)	strong	2	9
loop-vertex-direct	Compare-fleet (auto-registered when VERTEX_PROJECT_ID is set)	—	—	—

Both workers are registered only when availability.vertexDirect is true (i.e. VERTEX_PROJECT_ID is non-empty).

Model variants (implementer)

Variant key	Model id	Trigger
default	gemini-2.5-pro	All tasks
reasoning	gemini-2.5-pro	Complex / ambiguous tasks
flash	gemini-2.0-flash-001	Trivial / standard tasks

Override with VERTEX_MODEL.

Models (selected)

Model id	Notes
gemini-2.5-pro	Default. Frontier reasoning, 1M ctx.
gemini-2.0-flash-001	Fast and cheap flash variant.
gemini-2.5-flash	Balanced flash.
claude-sonnet-4-5@anthropic	Claude-on-Vertex (requires Anthropic model garden enablement).
claude-opus-4-8@anthropic	Opus-tier Claude-on-Vertex.

Claude-on-Vertex ids use the <claude-id>@anthropic suffix in the Vertex model registry.

Gotchas

• @google-cloud/vertexai must be installed separately (npm install @google-cloud/vertexai); if absent the adapter fails at run time with a clear error.
• ADC must be initialized before use; gcloud auth application-default login is the standard local setup.
• Claude-on-Vertex requires the model to be enabled in the Vertex AI Model Garden within your GCP project.
• VERTEX_LOCATION defaults to us-central1; Gemini 2.5 Pro is not available in all regions — check the Vertex model availability matrix.
• VERTEX_SERVICE_ACCOUNT_KEY_JSON is the full JSON object as a single-line string — not a file path.

Cyberine integration notes

• The VertexAdapter maps Cyberine Tool[] to Vertex FunctionDeclaration and runs the same tool-calling loop pattern as LoopAgentAdapter.
• Register loop-vertex-build in CYBERINE_BUILD_FLEET to include it in implementer fan-out.
• The compare-fleet worker loop-vertex-direct is auto-registered when VERTEX_PROJECT_ID is present.

---

GitHub Copilot

• Kind: raw API (OpenAI-compatible endpoint at https://api.githubcopilot.com, OAuth-authenticated)
• Adapter: LoopAgentAdapter with a dynamic token provider (getCopilotToken)
• Auth module: src/auth/copilotAuth.ts

Base URL & auth

Base URL	https://api.githubcopilot.com
Auth	Short-lived OAuth bearer token (30-minute TTL); refreshed automatically from a stored GitHub device-code token
Integration header	Copilot-Integration-Id: vscode-chat (required)

Auth flow:

1. Run cyberine auth login copilot — triggers the GitHub device-code flow (OAuth 2.0 Device Authorization Grant).
2. The GitHub access token is stored GLOBALLY to ~/.cyberine/copilot.json (mode 0600, dir 0700) — the same home as every other provider's ~/.cyberine/.env, so a login from one repo is reachable from any directory. A pre-fix store at .local/auth/copilot.json (cwd-scoped) is migrated automatically on first use.
3. On each request, getCopilotToken() checks the cached Copilot token; if expired (30-min TTL) it re-exchanges the stored GitHub token for a fresh Copilot token automatically. A failed re-exchange (revoked token, GitHub outage) THROWS rather than returning null, so LoopAgentAdapter surfaces a distinct "token refresh failed" error instead of the generic not-authenticated message.
4. When no stored auth exists at all, getCopilotToken() returns null and the worker is skipped with the generic not-authenticated message.
5. cyberine auth logout copilot deletes the token store (~/.cyberine/copilot.json); it does not also revoke the underlying GitHub OAuth token (revocation requires a client secret this public device-code flow does not have). The command prints this caveat on success, pointing at https://github.com/settings/connections/applications for manual revocation.

There is no COPILOT_API_KEY env var — auth is entirely OAuth-based. The worker is gated on availability.copilotAuthed (~/.cyberine/copilot.json present with a non-expired token).

Environment variables

Variable	Required	Default	Purpose
COPILOT_MODEL	no	gpt-4o	Model id to request from the Copilot endpoint

No API key env var. Authentication is handled exclusively via cyberine auth login copilot.

Worker profile

Worker id	Role	Tier	Cost class	Cost model	Priority rank
loop-copilot-build	Implementer (build-fleet, CYBERINE_BUILD_FLEET)	standard	1	subscription	6

Priority rank 6 (preferred over most metered workers) because the marginal cost per token is $0 under a Copilot subscription.

Gotchas

• Requires an active GitHub Copilot subscription (individual, business, or enterprise).
• Copilot tokens expire after 30 minutes; getCopilotToken() refreshes them automatically as long as the stored GitHub token remains valid. GitHub tokens themselves do not expire unless revoked.
• The Copilot endpoint is OpenAI-compatible but is not a general API — the available model set is determined by GitHub, not configurable to arbitrary ids. gpt-4o is the broadly available default.
• Re-authenticate with cyberine auth login copilot if the GitHub token is revoked or the ~/.cyberine/copilot.json file is deleted.

Cyberine integration notes

• loop-copilot-build uses LoopAgentAdapter with the standard implementer sandbox toolset; the only difference from an API-key worker is the tokenProvider: getCopilotToken option (a function, not a static key) and the required Copilot-Integration-Id header.
• Register loop-copilot-build in CYBERINE_BUILD_FLEET to include it in implementer fan-out.
• This worker has the lowest priority rank (6) among implementers — the router prefers it over metered workers because its cost model is subscription (flat $0 marginal).

---

Sources

• https://docs.aws.amazon.com/bedrock/latest/userguide/inference.html
• https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_Converse.html
• https://cloud.google.com/vertex-ai/generative-ai/docs/reference/rest
• https://cloud.google.com/vertex-ai/generative-ai/docs/model-garden/explore-models
• https://docs.github.com/en/copilot/github-copilot-chat/about-github-copilot-chat
• https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow