feat(webapp): run the dashboard agent through AWS Bedrock behind an env switch (#4609)

## What & why

The dashboard agent can now run its model calls through AWS Bedrock
instead of the direct Anthropic API, chosen by a single env switch. It's
**off by default** (`DASHBOARD_AGENT_MODEL_PROVIDER` unset ⇒
`anthropic`), so merging changes nothing at runtime — the Bedrock path
is a dormant branch until an operator sets the switch and AWS config.
The default Anthropic path is byte-for-byte unchanged.

This also carries a related tenant-isolation hardening for the agent's
delegated token (kept together deliberately — both land the agent on
Bedrock for HIPAA readiness). Refs: TRI-13251, TRI-11032.

## What's inside

**Provider seam** —
`internal-packages/dashboard-agent/src/model-provider.ts`: the registry
now holds both `anthropic` and `bedrock`; `resolveDashboardAgentModel()`
maps the canonical `"anthropic:<id>"` strings the managed prompts carry
to the active provider, and the cache-breakpoint helpers emit the active
provider's shape — Anthropic `cacheControl` vs Bedrock `cachePoint`.
Managed prompt strings stay canonical, so stored prompts don't change
meaning. Unmapped model ids throw rather than shipping a guaranteed-404
profile. All agent, watch, compaction and title callsites route through
the resolver; the `dashboardAgentModelKey` locals override (test mock
injection) is preserved.

**Cache telemetry** — `step-cache.ts`: cache token usage is read from
the active provider (Anthropic reports it on provider metadata; Bedrock
reports the write on metadata and the read via standard usage), so
`gen_ai.usage.cache_*` is populated on both. This also fixes a latent
ordering bug where step attributes could null-overwrite the prompt-cache
read count.

**Webapp callsites** — `dashboardAgentHeadStart.server.ts` and the
head-start route resolve the model and the cache breakpoint through the
same seam, so the warm-up prefix and the following turn share one
provider. The head-start firing gate is provider-aware: on Bedrock it
gates on `AWS_REGION` and lets the SDK resolve credentials (IAM role /
static keys / session token / bearer), so a role-based deploy still
warms; on Anthropic it stays `Boolean(ANTHROPIC_API_KEY)`.
`app/env.server.ts` gains the optional AWS vars and validates
`DASHBOARD_AGENT_MODEL_PROVIDER`. `ANTHROPIC_API_KEY` is untouched and
not required on a Bedrock deploy.

**Tenant-isolation hardening** —
`internal-packages/rbac/src/fallback.ts`: for a **scoped** context, the
OSS `authenticateUserActor` now applies the same membership floor as the
session path — a delegated user-actor token whose user is not a member
of the scoped org/project is denied (403). Unscoped tokens keep their
prior behavior (no tenant claim, no lookup). The user lookup falls back
replica→primary so replication lag can't spuriously 401 a just-joined
member. Members and admins are unaffected. Previously this invariant
held only through per-route discipline; this makes it structural.

## Enabling Bedrock (later, ops)

- Set `DASHBOARD_AGENT_MODEL_PROVIDER=bedrock` **identically** in both
the webapp and the agent task container — the webapp warms the cache
prefix and the task reads it, so a split would silently miss the cache.
- Set `AWS_REGION` and provide credentials the Bedrock SDK can resolve
(IAM role preferred). For v1 this runs **without** an Anthropic API key.
Note: with no Anthropic key set, rollback is "turn the agent off", not
"unset the switch" (unsetting falls back to the Anthropic provider,
which then has no key).
- Two things to confirm before rollout: the Sonnet inference-profile id
is validated against the SDK's own model-id union but still warrants a
live smoke test; and Bedrock prompt caching for Sonnet is a 5-minute
window (not Anthropic's 1h), so input-token cost rises when flipped.

## Testing

Unit tests cover both provider paths: the provider switch and
per-provider cache shapes, a structural regex asserting Bedrock ids are
real inference profiles (not an echo of the table), the split-metadata
cache telemetry, and real-Postgres RBAC tests — member allowed, scoped
non-member denied (org-only and project-only), missing user → 401, admin
non-member exempt, unscoped success. `typecheck --filter webapp` and the
dashboard-agent + rbac suites pass.

Author: kathiekiwi

apps/webapp/app/env.server.ts

@@ -209,6 +209,28 @@ const EnvironmentSchema = z
     // uses its own key on the Trigger side. When unset, Head Start is disabled
     // and the first turn falls back to the normal cold-start path.
     ANTHROPIC_API_KEY: z.string().optional(),
+    // Selects the dashboard agent's LLM provider (default anthropic). The internal
+    // seam reads process.env directly; this entry validates the value webapp-side.
+    DASHBOARD_AGENT_MODEL_PROVIDER: z.preprocess(
+      (v) => (typeof v === "string" && v.trim() === "" ? undefined : v),
+      z.enum(["anthropic", "bedrock"]).default("anthropic")
+    ),
+    // AWS credentials for the dashboard agent's Bedrock provider (only used when
+    // DASHBOARD_AGENT_MODEL_PROVIDER=bedrock; default path stays Anthropic). The
+    // provider resolves credentials itself, so only the region is read here.
+    AWS_REGION: z.string().optional(),
+    AWS_DEFAULT_REGION: z.string().optional(),
+    AWS_ACCESS_KEY_ID: z.string().optional(),
+    AWS_SECRET_ACCESS_KEY: z.string().optional(),
+    AWS_SESSION_TOKEN: z.string().optional(),
+    AWS_BEARER_TOKEN_BEDROCK: z.string().optional(),
+    // Dedicated, non-global credentials for the dashboard agent's Bedrock calls (a
+    // Bedrock-invoke-only IAM user). Kept separate from AWS_ACCESS_KEY_ID/etc so
+    // injecting them can't hijack the default credential chain the ECR/STS deploy
+    // clients rely on.
+    DASHBOARD_AGENT_AWS_ACCESS_KEY_ID: z.string().optional(),
+    DASHBOARD_AGENT_AWS_SECRET_ACCESS_KEY: z.string().optional(),
+    DASHBOARD_AGENT_AWS_REGION: z.string().optional(),
     DIRECT_URL: z
       .string()
       .refine(

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.ts

@@ -17,6 +17,7 @@ import {
   softDeleteChat,
 } from "@internal/dashboard-agent-db";
 import { watchDraftSchema, type WatchDraft } from "@internal/dashboard-agent-contracts";
+import { dashboardAgentProvider } from "@internal/dashboard-agent/model-provider";
 import { generateFriendlyId } from "@trigger.dev/core/v3/isomorphic";
 import type { UIMessage } from "ai";
 import { z } from "zod";
@@ -329,7 +330,10 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
     const chatId = generateFriendlyId("chat");
     try {
       const repoSnapshot = await resolveDashboardAgentRepoSnapshot(project.id);
-      const headStarted = Boolean(env.ANTHROPIC_API_KEY);
+      const headStarted =
+        dashboardAgentProvider() === "bedrock"
+          ? Boolean(env.DASHBOARD_AGENT_AWS_REGION || env.AWS_REGION || env.AWS_DEFAULT_REGION)
+          : Boolean(env.ANTHROPIC_API_KEY);
 
       // The lookups and the mint all run before the chat row exists, so a failure here can't
       // leave an empty chat behind in the user's history.

apps/webapp/app/services/dashboardAgentHeadStart.server.ts

@@ -1,4 +1,3 @@
-import { createAnthropic } from "@ai-sdk/anthropic";
 import {
   DASHBOARD_AGENT_CODE_SYSTEM_PROMPT,
   DASHBOARD_AGENT_MODEL,
@@ -8,9 +7,12 @@ import {
 } from "@internal/dashboard-agent/tool-schemas";
 import {
   describePromptPrefix,
-  PROMPT_CACHE_CONTROL,
   promptCacheAttributes,
 } from "@internal/dashboard-agent/prompt-prefix";
+import {
+  resolveDashboardAgentModel,
+  withCacheBreakpoint,
+} from "@internal/dashboard-agent/model-provider";
 import { ApiClient, SessionStreamInstance, writeTurnCompleteRecord } from "@trigger.dev/core/v3";
 import { chat as chatServer } from "@trigger.dev/sdk/chat-server";
 import { streamText, type UIMessage, type UIMessageChunk } from "ai";
@@ -23,8 +25,6 @@ import { logger } from "~/services/logger.server";
 
 const TASK_ID = "dashboard-agent";
 
-const anthropic = createAnthropic({ apiKey: env.ANTHROPIC_API_KEY });
-
 /** Shown when the warm first turn produced nothing. The provider error is only logged. */
 export const HEAD_START_FAILURE_ERROR_TEXT =
   "The assistant couldn't start this response. Please send your message again.";
@@ -113,16 +113,16 @@ export async function startDashboardAgentHeadStart(params: {
     run: async ({ chat: helper }) =>
       streamText({
         ...helper.toStreamTextOptions({ tools }),
-        model: anthropic(DASHBOARD_AGENT_MODEL),
+        model: resolveDashboardAgentModel(DASHBOARD_AGENT_MODEL),
         // A structured system message, not a bare string: without provider options
-        // Anthropic neither writes nor reads the cache, so this call paid full price
+        // the provider neither writes nor reads the cache, so this call paid full price
         // for the prefix and the agent's step 2 then paid for a fresh write. The tool
         // key order is frozen (see `tool-schemas.ts`) so both prefixes are identical
         // — the logged fingerprint is how a drift becomes visible.
         system: {
           role: "system",
           content: system,
-          providerOptions: { anthropic: { cacheControl: PROMPT_CACHE_CONTROL } },
+          providerOptions: withCacheBreakpoint(undefined, "prefix"),
         },
         onStepFinish: (step) => {
           logger.info(

internal-packages/dashboard-agent/package.json

@@ -9,9 +9,11 @@
     ".": "./src/index.ts",
     "./tool-curation": "./src/tool-curation.ts",
     "./tool-schemas": "./src/tool-schemas.ts",
-    "./prompt-prefix": "./src/prompt-prefix.ts"
+    "./prompt-prefix": "./src/prompt-prefix.ts",
+    "./model-provider": "./src/model-provider.ts"
   },
   "dependencies": {
+    "@ai-sdk/amazon-bedrock": "4.0.117",
     "@ai-sdk/anthropic": "^3.0.0",
     "@internal/dashboard-agent-contracts": "workspace:*",
     "@internal/dashboard-agent-db": "workspace:*",

internal-packages/dashboard-agent/src/agent-runtime.ts

@@ -1,4 +1,3 @@
-import { anthropic } from "@ai-sdk/anthropic";
 import {
   appendChatMessageOnce,
   createDashboardAgentDb,
@@ -18,22 +17,16 @@ import {
   type UpsertInvestigationResult,
 } from "@internal/dashboard-agent-db";
 import { locals, logger } from "@trigger.dev/sdk";
-import {
-  createProviderRegistry,
-  type LanguageModel,
-  type ModelMessage,
-  type ToolSet,
-  type UIMessage,
-} from "ai";
+import { type LanguageModel, type ModelMessage, type ToolSet, type UIMessage } from "ai";
 import { z } from "zod";
 import {
   agentPageContextSchema,
   forceSettledInvestigationState,
   investigationStateSchema,
   type InvestigationState,
 } from "@internal/dashboard-agent-contracts";
+import { withCacheBreakpoint } from "./model-provider";
 import { codeSystemPrompt, systemPrompt } from "./prompts";
-import { PROMPT_CACHE_CONTROL } from "./prompt-prefix";
 import { buildDashboardAgentTools } from "./tools";
 
 /**
@@ -63,8 +56,8 @@ function getDb(): DashboardAgentDbClient {
 }
 
 // Resolves the `"provider:model-id"` strings on our managed prompts to AI SDK
-// models. Add another @ai-sdk/* provider here to allow it on a prompt.
-export const registry = createProviderRegistry({ anthropic });
+// models, against whichever provider is switched on.
+export { registry, resolveDashboardAgentModel } from "./model-provider";
 
 // The agent's persistence, behind an interface so tests can inject a fake via
 // `locals` and never need a real database.
@@ -354,20 +347,17 @@ export function sanitizeReplayedToolInputs(messages: ModelMessage[]): ModelMessa
   }) as ModelMessage[];
 }
 
-// Same Anthropic breakpoint `prepareMessages` rolls onto a turn's last message.
+// Same breakpoint `prepareMessages` rolls onto a turn's last message.
 export function withCacheBreakpointOnLast(messages: ModelMessage[]): ModelMessage[] {
   if (messages.length === 0) return messages;
   const last = messages[messages.length - 1]!;
   return [
     ...messages.slice(0, -1),
     {
       ...last,
-      providerOptions: {
-        ...last.providerOptions,
-        // Merged, not replaced: the breakpoint is one Anthropic option among any
-        // others the message already carries.
-        anthropic: { ...last.providerOptions?.anthropic, cacheControl: PROMPT_CACHE_CONTROL },
-      },
+      // Merged, not replaced: the breakpoint is one provider option among any
+      // others the message already carries.
+      providerOptions: withCacheBreakpoint(last.providerOptions, "prefix"),
     },
   ];
 }

internal-packages/dashboard-agent/src/cache-breakpoint.test.ts

@@ -35,6 +35,7 @@ describe("withCacheBreakpointOnLast", () => {
     const prepared = withCacheBreakpointOnLast(lastMessageWithAnthropicOptions());
 
     expect(prepared[1]!.providerOptions).toEqual({
+      __cacheBreakpoint: { kind: "prefix" },
       anthropic: { cacheControl: PROMPT_CACHE_CONTROL, thinking: { budget: 1024 } },
       openai: { store: false },
     });
@@ -54,6 +55,7 @@ describe("prepareTurnMessages", () => {
     });
 
     expect(prepared[1]!.providerOptions).toEqual({
+      __cacheBreakpoint: { kind: "prefix" },
       anthropic: { cacheControl: PROMPT_CACHE_CONTROL, thinking: { budget: 1024 } },
       openai: { store: false },
     });

internal-packages/dashboard-agent/src/compaction.ts

@@ -5,7 +5,7 @@ import { generateText, type ModelMessage, type UIMessage } from "ai";
 import {
   dashboardAgentModelKey,
   latestCards,
-  registry,
+  resolveDashboardAgentModel,
   sanitizeReplayedToolInputs,
 } from "./agent-runtime";
 
@@ -271,7 +271,7 @@ export function renderTranscriptForSummary(messages: ModelMessage[]): string {
 
 async function summarizeConversation(event: SummarizeEvent): Promise<string> {
   const { text } = await generateText({
-    model: locals.get(dashboardAgentModelKey) ?? registry.languageModel(SUMMARY_MODEL),
+    model: locals.get(dashboardAgentModelKey) ?? resolveDashboardAgentModel(SUMMARY_MODEL),
     system: SUMMARY_INSTRUCTION,
     prompt: renderTranscriptForSummary(event.messages),
     maxOutputTokens: SUMMARY_MAX_OUTPUT_TOKENS,

internal-packages/dashboard-agent/src/dashboard-agent.ts

@@ -16,7 +16,7 @@ import {
   getStore,
   getSystemPrompt,
   modeFor,
-  registry,
+  resolveDashboardAgentModel,
   sanitizeReplayedToolInputs,
   settlementCardMessages,
   clearOpenInvestigations,
@@ -25,7 +25,7 @@ import {
   type DashboardAgentStore,
 } from "./agent-runtime";
 import { titlePrompt } from "./prompts";
-import { PROMPT_CACHE_CONTROL } from "./prompt-prefix";
+import { withCacheBreakpoint } from "./model-provider";
 import { recordPromptCacheUsage, stepCachePrepareStep } from "./step-cache";
 import { dashboardAgentActionSchema, handleWatchAction } from "./watch-actions";
 import { dashboardAgentCompaction, withDurableState } from "./compaction";
@@ -309,9 +309,7 @@ async function generateAndSaveTitle(
   const { text } = await generateText({
     model:
       locals.get(dashboardAgentModelKey) ??
-      registry.languageModel(
-        (resolved.model ?? "anthropic:claude-haiku-4-5") as `anthropic:${string}`
-      ),
+      resolveDashboardAgentModel(resolved.model ?? "anthropic:claude-haiku-4-5"),
     system: resolved.text,
     prompt: userText,
     ...resolved.toAISDKTelemetry(),
@@ -428,7 +426,7 @@ export const dashboardAgent = chat.agent({
     // prompt; the resolve is cached per process. The cache breakpoint on the system
     // block carries through toStreamTextOptions() and survives suspend/resume.
     chat.prompt.set(await getSystemPrompt(modeFor(clientData)), {
-      providerOptions: { anthropic: { cacheControl: PROMPT_CACHE_CONTROL } },
+      providerOptions: withCacheBreakpoint(undefined, "prefix"),
     });
   },
 
@@ -581,9 +579,7 @@ export const dashboardAgent = chat.agent({
       ...options,
       model:
         locals.get(dashboardAgentModelKey) ??
-        registry.languageModel(
-          (resolved.model ?? "anthropic:claude-sonnet-4-6") as `anthropic:${string}`
-        ),
+        resolveDashboardAgentModel(resolved.model ?? "anthropic:claude-sonnet-4-6"),
       messages,
       abortSignal: signal,
       prepareStep: stepCachePrepareStep(options) as never,

internal-packages/dashboard-agent/src/eval-turn.ts

@@ -1,11 +1,11 @@
-import { anthropic } from "@ai-sdk/anthropic";
 import {
   createDashboardAgentDb,
   insertTurnEval,
   type DashboardAgentDbClient,
 } from "@internal/dashboard-agent-db";
 import { logger, task } from "@trigger.dev/sdk";
 import { EVAL_ERROR_CATEGORIES, redactedEvalOutputErrored } from "./eval-policy";
+import { resolveDashboardAgentModel } from "./model-provider";
 import { generateObject } from "ai";
 import { z } from "zod";
 
@@ -164,7 +164,7 @@ export const evalTurn = task({
   id: "dashboard-agent-eval-turn",
   run: async (payload: EvalTurnPayload, { ctx }) => {
     const { object } = await generateObject({
-      model: anthropic(JUDGE_MODEL),
+      model: resolveDashboardAgentModel(`anthropic:${JUDGE_MODEL}`),
       schema: TurnEval,
       system: JUDGE_SYSTEM,
       prompt: [