Image tool fails on Bedrock: requireApiKey() called unconditionally

Summary

The bundled image generation pipeline (dist/image-*.js) calls requireApiKey() unconditionally before invoking a model, including for providers that do not use API keys (notably AWS Bedrock, which authenticates via AWS SDK credentials).

This causes the image tool to throw Missing API key for any Bedrock vision call, even when the AWS credentials are correctly configured and other Bedrock-routed tools (chat, summarize, etc.) work fine.

Repro

OpenClaw configured with Bedrock as default chat provider and AWS SDK credential chain (env / profile / IAM role) for image-capable Bedrock models (e.g. Anthropic Claude on Bedrock, Amazon Nova Pro/Lite for vision).

openclaw image --image /path/to/picture.jpg --prompt "describe"

→ throws Missing API key for provider amazon-bedrock (or similar) before any HTTP call to Bedrock is made.

Root cause

In the current bundle (file name was dist/image-AqMQXNZh.js on the version where this was first patched on 2026-05-07; same bug pattern exists today in dist/image-B1ZpnSjH.js), prepareResolvedImageRuntime does:

let apiKey = requireApiKey(await getApiKeyForModel({ model, ... }), model.provider);

For model.provider === "amazon-bedrock" (and any other AWS-SDK-mode provider), getApiKeyForModel returns no key because Bedrock uses the AWS credential chain. requireApiKey() then throws.

The chat/text path correctly branches on AWS-SDK-mode providers and skips the API-key requirement; the image path does not.

Expected behavior

The image runtime should follow the same provider classification used elsewhere: if the provider is AWS-SDK-mode (Bedrock, anything that signs requests with AWS SigV4 instead of an API key), skip requireApiKey and let the SDK resolve credentials downstream. Same for any provider whose auth model is "credentials, not bearer key".

A provider-aware guard around the image-path requireApiKey() call (mirroring the chat path) is sufficient.

Local mitigation we've used

We've been carrying a patched copy of the affected image bundle and rolling the patch forward across releases. This works but breaks every time a release renames the bundle (the file name has hashed once already, from image-AqMQXNZh.js → image-B1ZpnSjH.js). Upstream fix is the only way for Bedrock users to keep the image tool working without per-release surgery.

Severity

Hard-blocks all image-tool usage for Bedrock-only deployments. There is no chat-side workaround — the image tool is the only entry point for vision calls.

Environment

• OpenClaw 2026.3.x (current at time of report; bug has existed since at least 2026-05-07 build)
• Node v25.x
• Default model: amazon-bedrock/us.anthropic.claude-opus-4-7 (vision-capable)
• Auth: AWS SDK credential chain via personal AWS profile