From 50463bba0085e29923788faaf2a972201876c908 Mon Sep 17 00:00:00 2001
From: Rohit C Prasad <rohit.prasad15@gmail.com>
Date: Sat, 25 Jul 2026 16:23:56 -0700
Subject: [PATCH] Package boto3 for Bedrock and pin google-auth

New [bedrock] extra; desktop builds and CI install it; PyInstaller collects
boto3/botocore so the lazy import works in the bundled sidecar.
---
 .github/workflows/ci.yml         |  2 +-
 .github/workflows/release.yml    |  2 +-
 packaging/build_dmg.sh           |  2 +-
 packaging/build_windows.ps1      |  2 +-
 packaging/openworker-server.spec | 11 +++++++++++
 pyproject.toml                   |  3 +++
 6 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fb4b7525..90cb22d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Install
         run: |
           python -m pip install --upgrade pip
-          pip install -e ".[messaging,dev]"
+          pip install -e ".[messaging,dev,bedrock]"
       - name: Test
         run: pytest tests -q
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 213de4a6..5ccf5cc2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,7 +79,7 @@ jobs:
           python -m venv .venv
           if [ "$RUNNER_OS" = "Windows" ]; then VPY=.venv/Scripts/python; else VPY=.venv/bin/python; fi
           "$VPY" -m pip install --upgrade pip
-          "$VPY" -m pip install -e . pyinstaller typer tzdata
+          "$VPY" -m pip install -e ".[bedrock]" pyinstaller typer tzdata
           "$VPY" -c "import aisuite, coworker"  # fail fast if either import breaks
 
       - name: npm ci
diff --git a/packaging/build_dmg.sh b/packaging/build_dmg.sh
index 7e91496e..5ee9c975 100755
--- a/packaging/build_dmg.sh
+++ b/packaging/build_dmg.sh
@@ -12,7 +12,7 @@
 #   - A Python venv at .venv (repo root) with this package installed editable, plus the
 #     build-only deps:
 #       python3 -m venv .venv
-#       .venv/bin/pip install -e . pyinstaller tzdata typer
+#       .venv/bin/pip install -e '.[bedrock]' pyinstaller tzdata typer
 #     `typer` is needed only at BUILD time: PyInstaller walks the `mcp` package and
 #     `mcp.cli` calls sys.exit() at import if typer is absent, which aborts the freeze.
 #     (aisuite installs like any other dependency — git-pinned in pyproject.toml.)
diff --git a/packaging/build_windows.ps1 b/packaging/build_windows.ps1
index 4c9bf1d9..f3f42380 100644
--- a/packaging/build_windows.ps1
+++ b/packaging/build_windows.ps1
@@ -15,7 +15,7 @@
     - A Python venv at platform\.venv with this package installed editable, plus pyinstaller.
       `typer` is needed only at build time: PyInstaller walks the `mcp` package and `mcp.cli`
       calls sys.exit() at import if typer is absent, which aborts the freeze.
-        py -m venv .venv ; .\.venv\Scripts\pip install -e . pyinstaller tzdata typer
+        py -m venv .venv ; .\.venv\Scripts\pip install -e ".[bedrock]" pyinstaller tzdata typer
 
   The result is UNSIGNED — first launch shows a SmartScreen warning ("More info" -> "Run anyway").
   Authenticode signing is a later step.
diff --git a/packaging/openworker-server.spec b/packaging/openworker-server.spec
index 70954b5a..fb113ad3 100644
--- a/packaging/openworker-server.spec
+++ b/packaging/openworker-server.spec
@@ -70,6 +70,17 @@ if IS_WINDOWS:
     except Exception:
         pass
 
+# [bedrock] extra — boto3 is lazy-imported (bedrock_provider.py) so static analysis
+# misses it, and botocore's service-model JSON data dir only ships via collect_all.
+for pkg in ("boto3", "botocore"):
+    try:
+        d, b, h = collect_all(pkg)
+        datas += d
+        binaries += b
+        hiddenimports += h
+    except Exception:
+        pass
+
 for pkg in ("slack_bolt", "telegram"):  # [messaging] extra — optional
     try:
         hiddenimports += collect_submodules(pkg)
diff --git a/pyproject.toml b/pyproject.toml
index aa04eef4..8eaef6ed 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,6 +11,7 @@ dependencies = [
     "openai>=1.0",
     "anthropic>=0.40",  # native Claude Messages API provider
     "google-genai>=1.0",  # native Gemini provider
+    "google-auth>=2.23",  # Vertex credentials (service account / ADC / MaaS bearer)
     "textual>=1.0",
     "fastapi>=0.110",
     "uvicorn[standard]>=0.27",
@@ -43,6 +44,8 @@ dev = ["pytest>=8", "pytest-asyncio", "httpx"]
 messaging = ["python-telegram-bot>=21", "slack-bolt>=1.18", "aiohttp>=3.9"]
 # Interactive Cowork browser automation.
 browser = ["playwright>=1.44"]
+# AWS Bedrock provider (lazy-imported; desktop builds bundle it, pip users opt in).
+bedrock = ["boto3>=1.34"]
 
 [project.scripts]
 openworker = "coworker.cli:main"