refactor(bedrock): make resolve_bedrock_runtime_region the single region chokepoint

Follow-up structural pass on the review fix:

- Runtime provider, auxiliary resolution, model validation
  (hermes_cli/models.py), live discovery (bedrock_model_ids_or_none),
  and the Mantle URL/SigV4 fallbacks all resolve their region through
  resolve_bedrock_runtime_region() — one canonical implementation of the
  config-first priority instead of three hand-rolled copies.
- agent_init: drop the 'if "client_kwargs" in locals()' guard by
  initializing client_kwargs unconditionally at the top of the else
  branch; the Mantle kwargs hook is a documented no-op for non-Mantle
  base URLs.

agent/agent_init.py

@@ -1431,19 +1431,19 @@ def init_agent(
                         "select a provider, or run `hermes setup` for first-time "
                         "configuration."
                     )
-        # Bedrock GPT-5.5 uses Bedrock Mantle's OpenAI Responses endpoint.
+        # Bedrock GPT-5.5/5.6 use Bedrock Mantle's OpenAI Responses endpoint.
         # Runtime resolution uses api_key="aws-sdk" as the IAM-auth sentinel;
         # attach an httpx client that SigV4-signs every OpenAI SDK request.
-        if "client_kwargs" in locals():
-            try:
-                from agent.bedrock_adapter import configure_bedrock_openai_client_kwargs
-                configure_bedrock_openai_client_kwargs(
-                    client_kwargs,
-                    timeout=_provider_timeout,
-                )
-            except Exception:
-                if agent.provider == "bedrock" and "bedrock-mantle." in str(client_kwargs.get("base_url", "")):
-                    raise
+        # No-op for non-Mantle base URLs.
+        try:
+            from agent.bedrock_adapter import configure_bedrock_openai_client_kwargs
+            configure_bedrock_openai_client_kwargs(
+                client_kwargs,
+                timeout=_provider_timeout,
+            )
+        except Exception:
+            if agent.provider == "bedrock" and "bedrock-mantle." in str(client_kwargs.get("base_url", "")):
+                raise
         
         agent._client_kwargs = client_kwargs  # stored for rebuilding after interrupt
 

agent/bedrock_adapter.py

@@ -189,7 +189,7 @@ def merge_bedrock_openai_model_ids(model_ids: List[str]) -> List[str]:
 
 def bedrock_openai_base_url(region: str) -> str:
     """Return Bedrock Mantle's OpenAI-compatible base URL for *region*."""
-    resolved = (region or "").strip() or resolve_bedrock_region()
+    resolved = (region or "").strip() or resolve_bedrock_runtime_region()
     return f"https://bedrock-mantle.{resolved}.api.aws/openai/v1"
 
 
@@ -224,7 +224,7 @@ class BedrockOpenAISigV4Auth(httpx.Auth):
     requires_request_body = True
 
     def __init__(self, region: str, service: str = "bedrock"):
-        self.region = (region or "").strip() or resolve_bedrock_region()
+        self.region = (region or "").strip() or resolve_bedrock_runtime_region()
         self.service = service
 
     def auth_flow(self, request):  # pragma: no cover - exercised by live call
@@ -286,7 +286,7 @@ def configure_bedrock_openai_client_kwargs(
     api_key = client_kwargs.get("api_key")
     if isinstance(api_key, str) and api_key.strip() and api_key not in {"aws-sdk", "no-key-required"}:
         return client_kwargs
-    region = bedrock_openai_region_from_base_url(base_url) or resolve_bedrock_region()
+    region = bedrock_openai_region_from_base_url(base_url) or resolve_bedrock_runtime_region()
     client_kwargs["api_key"] = "aws-sdk"
     client_kwargs["http_client"] = build_bedrock_openai_http_client(region, timeout=timeout)
     return client_kwargs
@@ -585,7 +585,7 @@ def bedrock_model_ids_or_none() -> Optional[List[str]]:
     ``list_authenticated_providers`` section 2, and section 3.
     """
     try:
-        discovered = discover_bedrock_models(resolve_bedrock_region())
+        discovered = discover_bedrock_models(resolve_bedrock_runtime_region())
         if discovered:
             return merge_bedrock_openai_model_ids([m["id"] for m in discovered])
     except Exception:

hermes_cli/models.py

@@ -6808,8 +6808,8 @@ def validate_requested_model(
     # AWS SDK control plane (ListFoundationModels + ListInferenceProfiles).
     if normalized == "bedrock":
         try:
-            from agent.bedrock_adapter import discover_bedrock_models, resolve_bedrock_region
-            region = resolve_bedrock_region()
+            from agent.bedrock_adapter import discover_bedrock_models, resolve_bedrock_runtime_region
+            region = resolve_bedrock_runtime_region()
             discovered = discover_bedrock_models(region)
             discovered_ids = {m["id"] for m in discovered}
             if requested in discovered_ids:

hermes_cli/runtime_provider.py

@@ -2235,7 +2235,7 @@ def resolve_runtime_provider(
         from agent.bedrock_adapter import (
             has_aws_credentials,
             resolve_aws_auth_env_var,
-            resolve_bedrock_region,
+            resolve_bedrock_runtime_region,
             is_anthropic_bedrock_model,
             is_openai_bedrock_model,
             bedrock_openai_base_url,
@@ -2258,9 +2258,9 @@ def resolve_runtime_provider(
         # Read bedrock-specific config from config.yaml
         _bedrock_cfg = load_config().get("bedrock", {})
         # Region priority: config.yaml bedrock.region → env var → us-east-1.
-        # Same resolution as resolve_bedrock_runtime_region() in
-        # agent/bedrock_adapter.py — auxiliary calls must agree with this.
-        region = (_bedrock_cfg.get("region") or "").strip() or resolve_bedrock_region()
+        # resolve_bedrock_runtime_region() is the canonical implementation of
+        # this priority; auxiliary resolution uses the same helper.
+        region = resolve_bedrock_runtime_region({"bedrock": _bedrock_cfg})
         auth_source = resolve_aws_auth_env_var() or "aws-sdk-default-chain"
         # Build guardrail config if configured
         _gr = _bedrock_cfg.get("guardrail", {})