CORE-1801: Support Bedrock authentication in CodeLayer

[K-Mistele]

Summary

• add a separate codex_bedrock AWS-profile auth record while preserving existing Codex OAuth/API records
• resolve CodeLayer Codex connections from explicit options, HumanLayer auth selection, legacy overrides, or Codex config.toml
• generate and cache Bedrock bearer keys in memory with expiry-aware, single-flight refresh
• authenticate the existing custom Responses request path against regional Bedrock Mantle endpoints and retry once after recognized auth failures
• preserve current ChatGPT transports and static custom Responses behavior
• add coverage for auth compatibility, selection precedence, request replay, refresh races, redaction, and model/endpoint mapping

Testing

• bun run typecheck
• bun run test
• bun run --cwd packages/agentlayer-provider-auth build
• bun run --cwd agents/codelayer build
• bun run biome:check
• git diff --check

Part of CORE-1801.

[github-actions]

Docs Agent Review

Agent finished with reason: error

---

To apply these recommendations, comment: @docs-agent apply

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​smithy/​node-config-provider@​4.6.2
	@​smithy/​config-resolver@​4.7.2
	@​aws/​bedrock-token-generator@​1.1.0
	smol-toml@​1.8.0
	@​smithy/​types@​4.18.0
	@​aws-sdk/​credential-providers@​3.1126.0

View full report