Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/core/ports.ts`:
- Around line 60-64: The new BEDROCK_RUNTIME_ADAPTER_PORT constant is not
included in the gateway port conflict checks, so NEMOCLAW_GATEWAY_PORT can still
be set to 11436 and cause a bind conflict; update the gateway overlap validation
logic to include BEDROCK_RUNTIME_ADAPTER_PORT (the parsePort constant you added)
in the set/array/Set of reserved gateway ports used by the port conflict
validator (look for functions/values like validateGatewayPortOverlap,
validatePortConflicts, RESERVED_GATEWAY_PORTS or similar that check
NEMOCLAW_GATEWAY_PORT), so the validator treats 11436 as reserved and
rejects/flags any gateway port that collides with it.

In `@src/lib/inference/bedrock-runtime-adapter.ts`:
- Around line 535-553: The streamChunk function currently calls responseId() for
each chunk causing a new id per chunk; change streamChunk to accept a
completionId parameter and use that instead of calling responseId(), then in
convertBedrockConverseStream() generate a single completionId once (e.g., const
completionId = responseId()) and pass it into every streamChunk(...) invocation
(the six existing calls) so all chunks share the same completion id and comply
with OpenAI streaming semantics.

In `@src/lib/onboard.ts`:
- Around line 189-192: The Bedrock-specific onboarding branch (the
require/imports for bedrockRuntime and bedrockRuntimeAdapter and the
selection/setup/resume logic) should be extracted from src/lib/onboard.ts into a
focused helper module (e.g., src/lib/onboard-bedrock.ts) so the core onboarding
flow remains small; move all Bedrock-related code paths (the Bedrock selection
UI/decision logic, setup routines, and resume handlers referenced around the
bedrockRuntime and bedrockRuntimeAdapter usage) into that module, export a
minimal API (e.g., functions like handleBedrockSelection, setupBedrockRuntime,
resumeBedrockOnboarding) and replace the inline branch in onboard.ts with a
single call to the new helper to preserve behavior and reduce onboard.ts size.
- Around line 6692-6704: The Bedrock branch currently returns right after
verifyInferenceRoute(), skipping the adapter smoke test; modify the flow so that
after verifyInferenceRoute() succeeds you also run the existing inference smoke
test (the same check used for other providers) against adapter.baseUrl using
adapter.credentialEnv to validate the user-entered model and region/profile;
only after that smoke succeeds (and not before) set preferredInferenceApi and
update the registry/return. Apply the same change for the other occurrence
around the 7505-7561 block that handles Bedrock.
- Around line 6675-6690: The code currently skips prompting for Bedrock creds
when resolveProviderCredential(selectedCredentialEnv) is truthy, which can be an
old Anthropic-compatible key; change the guard so you only skip when the
credential proves usable for Bedrock: replace the single-check of
resolveProviderCredential(selectedCredentialEnv) with a combined check that
either bedrockRuntime.hasBedrockRuntimeAwsAuthEnv() is true or the resolved
credential validates for Bedrock (e.g., call a small validation helper or
attempt a lightweight Bedrock auth check). Concretely, update the condition
around isBedrockRuntimeCustomAnthropic to require both
resolveProviderCredential(selectedCredentialEnv) AND a successful bedrock
auth-state check (or fall through to await
ensureNamedCredential(selectedCredentialEnv, ...) when validation fails), and
apply the same fix in the other occurrence referenced (lines ~7506-7521).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/bedrock-runtime.ts`:
- Around line 121-123: The credential check uses
getExplicitCompatibleCredential(options.credentialEnv) which misses the exported
default; change the lookup to use the default fallback (options.credentialEnv ||
BEDROCK_RUNTIME_COMPATIBLE_CREDENTIAL_ENV) so compatibleCredential is resolved
the same way it is for messaging, and keep hasBedrockRuntimeAwsAuthEnv() and
printMissingBedrockAuth(...) unchanged except that printMissingBedrockAuth
should still receive the same resolved env variable expression for consistent
output.

---

Nitpick comments:
In `@src/lib/onboard.ts`:
- Around line 7386-7398: This change adds a Bedrock-specific early-return path
via bedrockRuntimeOnboard.setupBedrockRuntimeInference (called with sandboxName,
provider, model, endpointUrl, credentialEnv, isNonInteractive, runOpenshell,
upsertProvider, verifyInferenceRoute, verifyOnboardInferenceSmoke) which affects
provider selection, inference setup, and resume behavior in core onboarding;
before merging, run the onboarding E2E suites targeted at this code path — queue
and pass cloud-e2e, messaging-compatible-endpoint-e2e, and rebuild-openclaw-e2e
(and repeat the same verification for the duplicate/related block around the
other occurrence of the Bedrock path at the 9753-9760 region) to validate
provider selection, inference routing, and resume behavior end-to-end.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/inference/bedrock-runtime-adapter.ts`:
- Around line 612-614: The streaming branch handling event.messageStop currently
calls finishReason(event.messageStop.stopReason, false) which always passes
false for tool call presence; update that call to pass toolIndexes.size > 0 (or
equivalent check of tool call presence) so finishReason receives the same
tool-call boolean used in the non-streaming path and maintains consistent
finish_reason behavior; locate the call in the streaming handler where
streamChunk(model, completionId, {}, finishReason(...)) is invoked and replace
the hardcoded false with the boolean derived from toolIndexes.