diff --git a/.gitignore b/.gitignore
index 7204a35a5..c74beb7a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@ target/
 node_modules/
 apps/codex-plus-manager/src-tauri/gen/
 
+.kiro
 .codex_asar_extract/
 .codex_asar_extract_latest/
 .superpowers/
diff --git a/Cargo.lock b/Cargo.lock
index 04bcc8109..305939866 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -415,6 +415,7 @@ dependencies = [
  "directories",
  "fs2",
  "futures-util",
+ "proptest",
  "reqwest 0.12.28",
  "rusqlite",
  "serde",
@@ -2643,6 +2644,31 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proptest"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+dependencies = [
+ "bit-set",
+ "bit-vec",
+ "bitflags 2.11.1",
+ "num-traits",
+ "rand",
+ "rand_chacha",
+ "rand_xorshift",
+ "regex-syntax",
+ "rusty-fork",
+ "tempfile",
+ "unarray",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
 [[package]]
 name = "quick-xml"
 version = "0.39.4"
@@ -2766,6 +2792,15 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "raw-window-handle"
 version = "0.6.2"
@@ -3037,6 +3072,18 @@ version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
+[[package]]
+name = "rusty-fork"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2"
+dependencies = [
+ "fnv",
+ "quick-error",
+ "tempfile",
+ "wait-timeout",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -4331,6 +4378,12 @@ version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
 [[package]]
 name = "unic-char-property"
 version = "0.9.0"
@@ -4493,6 +4546,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "wait-timeout"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
diff --git a/apps/codex-plus-manager/package-lock.json b/apps/codex-plus-manager/package-lock.json
index 351aa4f57..8c238dc8e 100644
--- a/apps/codex-plus-manager/package-lock.json
+++ b/apps/codex-plus-manager/package-lock.json
@@ -32,6 +32,7 @@
         "@types/react": "^19.0.0",
         "@types/react-dom": "^19.0.0",
         "@vitejs/plugin-react": "^4.3.4",
+        "fast-check": "4.8.0",
         "tailwindcss": "^4.0.0"
       }
     },
@@ -2086,6 +2087,29 @@
         "node": ">=6"
       }
     },
+    "node_modules/fast-check": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.8.0.tgz",
+      "integrity": "sha512-GOJ158CUMnN6cSahsv4+ExARvIDuzzinFjkp0E9WtiBa5zcVeLozVkWaE4IzFcc+Y48Wp1EDlUZsXRyAztQcSg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "pure-rand": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=12.17.0"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -2537,6 +2561,23 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/pure-rand": {
+      "version": "8.4.1",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.1.tgz",
+      "integrity": "sha512-c58R2+SPFcSIPXoU834QN/KPDDOSd8sXcSrqf6e83Me6Rrp1EYkxukkjXMVrKvKaADs1SOyNkWdfvLf6zY8qLQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/react": {
       "version": "19.2.6",
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
diff --git a/apps/codex-plus-manager/package.json b/apps/codex-plus-manager/package.json
index 9b461d5cc..4e5afbdcf 100644
--- a/apps/codex-plus-manager/package.json
+++ b/apps/codex-plus-manager/package.json
@@ -35,6 +35,7 @@
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^4.3.4",
+    "fast-check": "4.8.0",
     "tailwindcss": "^4.0.0"
   }
 }
diff --git a/apps/codex-plus-manager/src/App.tsx b/apps/codex-plus-manager/src/App.tsx
index 11a2c709b..4a073ed73 100644
--- a/apps/codex-plus-manager/src/App.tsx
+++ b/apps/codex-plus-manager/src/App.tsx
@@ -54,6 +54,7 @@ import {
 } from "lucide-react";
 import { ProviderPresetSelector } from "@/components/ProviderPresetSelector";
 import type { PresetPatch } from "@/components/ProviderPresetSelector";
+import { BedrockRelayProfileEditor } from "@/components/BedrockRelayProfileEditor";
 import { useEffect, useMemo, useRef, useState, type CSSProperties, type ReactNode } from "react";
 
 import { Badge as UiBadge } from "@/components/ui/badge";
@@ -68,6 +69,8 @@ import {
   serializeModelWindowRows,
   type ModelWindowRow,
 } from "./model-windows";
+import type { BedrockConfig } from "./bedrock-config";
+import { isBedrockRelayProfile, bedrockAllowsProviderTesting, resolveBedrockAfterDerive, bedrockValidationError } from "./bedrock-config";
 import { getLanguage, t, tf, toggleLanguage } from "@/i18n";
 
 type Status = "ok" | "failed" | "not_implemented" | "not_checked" | string;
@@ -210,6 +213,7 @@ export type RelayProfile = {
   modelWindows: string;
   userAgent: string;
   aggregate?: RelayAggregateConfig | null;
+  bedrock?: BedrockConfig | null;
 };
 
 type RelayAggregateStrategy = "failover" | "conversationRoundRobin" | "requestRoundRobin" | "weightedRoundRobin";
@@ -3762,14 +3766,20 @@ function SortableRelayProfileCard({
         </Button>
         <span className="relay-card-extra">
           <Button
-            disabled={isAggregateRelayProfile(profile)}
+            disabled={isAggregateRelayProfile(profile) || !bedrockAllowsProviderTesting(profile)}
             onClick={(event) => {
               event.stopPropagation();
-              if (isAggregateRelayProfile(profile)) return;
+              if (isAggregateRelayProfile(profile) || !bedrockAllowsProviderTesting(profile)) return;
               void actions.testRelayProfile(profile);
             }}
             size="icon"
-            title={isAggregateRelayProfile(profile) ? t("聚合供应商会在真实对话中轮转成员，请测试成员供应商") : t("发送 hi 测试")}
+            title={
+              isAggregateRelayProfile(profile)
+                ? t("聚合供应商会在真实对话中轮转成员，请测试成员供应商")
+                : !bedrockAllowsProviderTesting(profile)
+                  ? t("AWS Profile 模式下无法在此测试供应商；请在 Codex 会话中验证")
+                  : t("发送 hi 测试")
+            }
             variant="ghost"
           >
             <TestTube className="h-4 w-4" />
@@ -3888,7 +3898,11 @@ function RelayProfileDetail({
     setDraft(nextDraft);
     setModelWindowRows(modelWindowRowsFromProfile(nextDraft.modelList, nextDraft.modelWindows || ""));
   }, [profile.id, profile.modelList, profile.modelWindows, profileUsesLiveFiles, isActive, isNew, relayFiles?.configContents, relayFiles?.authContents]);
-  const validationError = isAggregateRelayProfile(draft) ? aggregateRelayProfileValidation(draft) : null;
+  const validationError = isAggregateRelayProfile(draft)
+    ? aggregateRelayProfileValidation(draft)
+    : isBedrockRelayProfile(draft)
+      ? bedrockValidationError(draft.bedrock!, draft.apiKey)
+      : null;
   const draftWithModelRows = () => {
     const serializedRows = serializeModelWindowRows(modelWindowRows);
     return { ...draft, modelList: serializedRows.modelList, modelWindows: serializedRows.modelWindows };
@@ -4016,6 +4030,18 @@ function RelayProfileEditor({
       />
     );
   }
+  if (isBedrockRelayProfile(profile)) {
+    return (
+      // 沿用通用 relay 编辑器的卡片外壳（border/border-radius/margin/padding/动画），
+      // 保证 Bedrock 编辑器和其它编辑器视觉一致，避免直接贴到父容器边缘。
+      <div className="relay-profile-editor">
+        <BedrockRelayProfileEditor
+          profile={profile}
+          onChange={(patch) => onProfileChange(applyRelayProfilePatchToFiles(profile, patch, { allowGenerateFiles: isNew }))}
+        />
+      </div>
+    );
+  }
 
   const showApiFields = profile.relayMode !== "official" || profile.officialMixApiKey;
   const updateDraft = (patch: Partial<RelayProfile>) => {
@@ -4071,6 +4097,26 @@ function RelayProfileEditor({
           onSelect={(patch: PresetPatch) => {
             updateDraft(patch as unknown as Partial<RelayProfile>);
           }}
+          onSelectBedrock={() => {
+            // 「直连 AWS Bedrock」的最常见路径是 AWS Profile (SSO)，因此默认预填
+            // authMode=awsProfile + awsProfile=default。region 默认 us-east-2 是
+            // 因为 Bedrock Mantle 的 GPT-5.5 目前仅在 us-east-2 独家开放（见文档 §A）。
+            // 模型默认 openai.gpt-5.5——Bedrock Mantle 的 /v1/responses endpoint
+            // 只暴露 GPT-5.x 系列（openai.gpt-5.5 / openai.gpt-5.4）；gpt-oss 等
+            // Bedrock native 模型 ID 走 Mantle 会 404（模型不存在），需要走 LiteLLM 中转。
+            updateDraft({
+              relayMode: "pureApi",
+              model: "openai.gpt-5.5",
+              bedrock: {
+                authMode: "awsProfile",
+                providerId: "",
+                region: "us-east-2",
+                awsProfile: "default",
+                iamUserName: "",
+                iamKeyValidityDays: "90",
+              },
+            });
+          }}
         />
       ) : null}
       <div className="relay-fields">
@@ -6306,6 +6352,9 @@ function deriveRelayProfileFromFiles(profile: RelayProfile): RelayProfile {
     autoCompactLimit: codexTopLevelIntFromConfig(configContents, "model_auto_compact_token_limit"),
     configContents,
     authContents,
+    // 磁盘 config 有 Bedrock 特征时以推导结果为准；否则保留 profile 上已有的 bedrock，
+    // 避免 UI 中间态（例如刚点「Amazon Bedrock」按钮但 config 还是通用 custom 模板）被吞掉。
+    bedrock: resolveBedrockAfterDerive(profile.bedrock, configContents),
   };
 }
 
diff --git a/apps/codex-plus-manager/src/bedrock-config.test.ts b/apps/codex-plus-manager/src/bedrock-config.test.ts
new file mode 100644
index 000000000..d54039b9f
--- /dev/null
+++ b/apps/codex-plus-manager/src/bedrock-config.test.ts
@@ -0,0 +1,602 @@
+import { describe, it } from "node:test";
+import * as assert from "node:assert/strict";
+import * as fc from "fast-check";
+import { bedrockAllowsProviderTesting, bedrockAwsProfileConfigureCommand, bedrockAwsProfileLoginCommand, bedrockLongTermApiKeyCommand, bedrockShortTermApiKeyGuidanceText, bedrockValidationError, bedrockValidationErrorForBottom, deriveBedrockConfigFromConfigText, isBedrockRelayProfile, resolveBedrockAfterDerive, RESERVED_MODEL_PROVIDER_IDS_MIRROR, type BedrockConfig } from "./bedrock-config.ts";
+
+// Feature: amazon-bedrock-provider, Property 12: 测试/诊断按钮可见性判定
+// **Validates: Requirements 9.1, 9.2**
+describe("Property 12: bedrockAllowsProviderTesting", () => {
+  it("returns false iff bedrock exists and authMode === 'awsProfile'", () => {
+    const bedrockConfigArb: fc.Arbitrary<BedrockConfig | null | undefined> = fc.oneof(
+      // null
+      fc.constant(null),
+      // undefined
+      fc.constant(undefined),
+      // bearerToken mode
+      fc.record({
+        authMode: fc.constant("bearerToken" as const),
+        providerId: fc.string(),
+        region: fc.string(),
+        awsProfile: fc.string(),
+        iamUserName: fc.string(),
+        iamKeyValidityDays: fc.string(),
+      }),
+      // awsProfile mode
+      fc.record({
+        authMode: fc.constant("awsProfile" as const),
+        providerId: fc.string(),
+        region: fc.string(),
+        awsProfile: fc.string(),
+        iamUserName: fc.string(),
+        iamKeyValidityDays: fc.string(),
+      }),
+    );
+
+    fc.assert(
+      fc.property(bedrockConfigArb, (bedrock) => {
+        const profile = { bedrock } as { bedrock?: BedrockConfig | null };
+        const result = bedrockAllowsProviderTesting(profile);
+
+        // returns false iff bedrock exists AND authMode === "awsProfile"
+        const shouldBeFalse = bedrock != null && bedrock.authMode === "awsProfile";
+        assert.strictEqual(result, !shouldBeFalse);
+      }),
+      { numRuns: 100 },
+    );
+  });
+});
+
+
+// Feature: amazon-bedrock-provider, Property 8: Bearer Token 生成与识别往返
+// **Validates: Requirements 10.2**
+describe("Property 8: Bearer Token generation and recognition roundtrip (TS)", () => {
+  it("deriveBedrockConfigFromConfigText correctly recognizes bearer token configs", () => {
+    // Reserved provider IDs that cannot be used
+    const reserved = ["amazon-bedrock", "openai", "ollama", "lmstudio", "oss", "ollama-chat"];
+
+    // Generate non-reserved provider IDs: lowercase letter followed by alphanumeric chars
+    const providerIdArb = fc.stringMatching(/^[a-z][a-z0-9]{1,12}$/)
+      .filter(id => !reserved.includes(id));
+    // Generate non-empty region strings
+    const regionArb = fc.stringMatching(/^[a-z][a-z0-9-]{2,15}$/);
+
+    fc.assert(
+      fc.property(providerIdArb, regionArb, (providerId, region) => {
+        // Construct a config.toml text matching what complete_bedrock_bearer_token_config generates
+        const configText = [
+          `model_provider = "${providerId}"`,
+          `web_search = "disabled"`,
+          "",
+          `[model_providers.${providerId}]`,
+          `name = "${providerId}"`,
+          `wire_api = "responses"`,
+          `requires_openai_auth = true`,
+          `base_url = "https://bedrock-mantle.${region}.api.aws/openai/v1"`,
+          `experimental_bearer_token = "some-test-key"`,
+          "",
+        ].join("\n");
+
+        const result = deriveBedrockConfigFromConfigText(configText);
+
+        assert.notStrictEqual(result, null, "Should recognize as Bedrock config");
+        assert.strictEqual(result!.authMode, "bearerToken");
+        assert.strictEqual(result!.providerId, providerId);
+        assert.strictEqual(result!.region, region);
+      }),
+      { numRuns: 100 },
+    );
+  });
+});
+
+// Feature: amazon-bedrock-provider, Property 9: AWS Profile 生成与识别往返
+// **Validates: Requirements 10.1**
+describe("Property 9: AWS Profile generation and recognition roundtrip (TS)", () => {
+  it("deriveBedrockConfigFromConfigText correctly recognizes AWS Profile configs", () => {
+    // Generate non-empty region strings
+    const regionArb = fc.stringMatching(/^[a-z][a-z0-9-]{2,15}$/);
+    // Generate AWS profile names (possibly empty)
+    const awsProfileArb = fc.stringMatching(/^[a-zA-Z0-9_-]{0,20}$/);
+
+    fc.assert(
+      fc.property(regionArb, awsProfileArb, (region, awsProfile) => {
+        // Construct a config.toml matching what complete_bedrock_aws_profile_config generates
+        const profileLine = awsProfile.trim() ? `profile = "${awsProfile.trim()}"` : "";
+        const configLines = [
+          `model_provider = "amazon-bedrock"`,
+          "",
+          `[model_providers.amazon-bedrock.aws]`,
+          `region = "${region}"`,
+        ];
+        if (profileLine) configLines.push(profileLine);
+        configLines.push("");
+        const configText = configLines.join("\n");
+
+        const result = deriveBedrockConfigFromConfigText(configText);
+
+        assert.notStrictEqual(result, null, "Should recognize as Bedrock config");
+        assert.strictEqual(result!.authMode, "awsProfile");
+        assert.strictEqual(result!.region, region);
+        const expectedProfile = awsProfile.trim() || "";
+        assert.strictEqual(result!.awsProfile, expectedProfile);
+      }),
+      { numRuns: 100 },
+    );
+  });
+});
+
+// 隔离+opt-in 回归保护
+describe("deriveBedrockConfigFromConfigText - non-Bedrock configs", () => {
+  it("returns null for standard custom provider config", () => {
+    const config = `model_provider = "custom"\nmodel = "gpt-4"\n\n[model_providers.custom]\nname = "custom"\nbase_url = "https://example.com"\nwire_api = "responses"\nrequires_openai_auth = true\n`;
+    assert.strictEqual(deriveBedrockConfigFromConfigText(config), null);
+  });
+
+  it("returns null for OpenAI-style config", () => {
+    const config = `model_provider = "openai"\nmodel = "gpt-4"\n\n[model_providers.openai]\nname = "openai"\nbase_url = "https://api.openai.com/v1"\nwire_api = "responses"\nrequires_openai_auth = true\n`;
+    assert.strictEqual(deriveBedrockConfigFromConfigText(config), null);
+  });
+
+  it("returns null for config without model_provider", () => {
+    const config = `model = "some-model"\n\n[model_providers.foo]\nname = "foo"\nbase_url = "https://foo.example.com"\n`;
+    assert.strictEqual(deriveBedrockConfigFromConfigText(config), null);
+  });
+
+  it("returns null for requires_openai_auth but non-bedrock base_url", () => {
+    const config = `model_provider = "myapi"\n\n[model_providers.myapi]\nname = "myapi"\nbase_url = "https://api.myservice.com/v1"\nrequires_openai_auth = true\n`;
+    assert.strictEqual(deriveBedrockConfigFromConfigText(config), null);
+  });
+
+  it("returns null for empty config", () => {
+    assert.strictEqual(deriveBedrockConfigFromConfigText(""), null);
+  });
+});
+
+// 保留字列表一致性测试
+describe("Reserved provider ID list consistency", () => {
+  it("TS RESERVED_MODEL_PROVIDER_IDS_MIRROR matches Rust RESERVED_MODEL_PROVIDER_IDS", () => {
+    // This list must match the Rust constant in crates/codex-plus-core/src/relay_config.rs
+    const rustReservedIds = [
+      "amazon-bedrock",
+      "openai",
+      "ollama",
+      "lmstudio",
+      "oss",
+      "ollama-chat",
+    ];
+
+    // Compare as sets (order-independent)
+    const tsSet = new Set(RESERVED_MODEL_PROVIDER_IDS_MIRROR);
+    const rustSet = new Set(rustReservedIds);
+
+    assert.strictEqual(tsSet.size, rustSet.size, "Lists should have the same length");
+    for (const id of rustReservedIds) {
+      assert.ok(tsSet.has(id), `TS list is missing "${id}" from Rust list`);
+    }
+    for (const id of RESERVED_MODEL_PROVIDER_IDS_MIRROR) {
+      assert.ok(rustSet.has(id), `TS list has extra "${id}" not in Rust list`);
+    }
+  });
+});
+
+
+// Regression: 保留字冲突不能同时以 inline + 底部两条红字重复展示。
+// `bedrockValidationErrorForBottom` 必须跳过"该标识符与保留供应商冲突"这一类错误，
+// 让保留字冲突的错误只由 Provider ID 字段下方的 inline `<p>` 展示；
+// 其它字段（region / apiKey）空缺时底部仍需展示。
+describe("bedrockValidationErrorForBottom skips reserved-provider-id conflict", () => {
+  const reservedBedrock = (region: string): BedrockConfig => ({
+    authMode: "bearerToken",
+    providerId: "openai", // 命中保留字
+    region,
+    awsProfile: "",
+    iamUserName: "",
+    iamKeyValidityDays: "90",
+  });
+
+  it("reserved provider id alone: bedrockValidationError reports it, bedrockValidationErrorForBottom returns null", () => {
+    const bedrock = reservedBedrock("us-east-2");
+    // 完整校验返回保留字冲突文本（保存按钮门控依赖该返回值）
+    assert.strictEqual(bedrockValidationError(bedrock, "sk-key"), "该标识符与保留供应商冲突");
+    // 底部聚合校验跳过保留字冲突，返回 null（因为其他字段都合法）
+    assert.strictEqual(bedrockValidationErrorForBottom(bedrock, "sk-key"), null);
+  });
+
+  it("reserved provider id + empty region: bottom surfaces region error, inline shows conflict", () => {
+    const bedrock = reservedBedrock("");
+    // 完整校验先命中 region 空（region 优先级最高）
+    assert.strictEqual(bedrockValidationError(bedrock, "sk-key"), "region 为必填项");
+    // 底部聚合校验也能报出 region 空错误（保留字冲突由 inline 单独展示）
+    assert.strictEqual(bedrockValidationErrorForBottom(bedrock, "sk-key"), "region 为必填项");
+  });
+
+  it("reserved provider id + empty apiKey (region OK): bottom surfaces apiKey error", () => {
+    const bedrock = reservedBedrock("us-east-2");
+    // 完整校验先命中保留字冲突（在 apiKey 之前）
+    assert.strictEqual(bedrockValidationError(bedrock, ""), "该标识符与保留供应商冲突");
+    // 底部跳过保留字冲突，报出 apiKey 空错误
+    assert.strictEqual(bedrockValidationErrorForBottom(bedrock, ""), "Bedrock API Key 为必填项");
+  });
+
+  it("non-reserved provider id: bottom surfaces exactly the same error as full validation", () => {
+    const bedrock: BedrockConfig = {
+      authMode: "bearerToken",
+      providerId: "my-valid-bedrock",
+      region: "",
+      awsProfile: "",
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+    assert.strictEqual(bedrockValidationError(bedrock, "sk-key"), "region 为必填项");
+    assert.strictEqual(bedrockValidationErrorForBottom(bedrock, "sk-key"), "region 为必填项");
+  });
+});
+
+// Regression: bedrockLongTermApiKeyCommand 对非法天数输入 fallback 到 90，
+// 避免把 abc / -5 之类的字符串原样嵌入到示例命令里让用户拷去 shell 报错。
+describe("bedrockLongTermApiKeyCommand rejects invalid validity days", () => {
+  it("non-numeric days fallback to 90", () => {
+    const cmd = bedrockLongTermApiKeyCommand("me", "abc");
+    assert.ok(cmd.includes("--credential-age-days 90"), `Expected fallback to 90, got: ${cmd}`);
+    assert.ok(!cmd.includes("abc"), `Should not embed non-numeric literal, got: ${cmd}`);
+  });
+
+  it("negative-looking days fallback to 90", () => {
+    const cmd = bedrockLongTermApiKeyCommand("me", "-5");
+    assert.ok(cmd.includes("--credential-age-days 90"), `Expected fallback to 90, got: ${cmd}`);
+    assert.ok(!cmd.includes("-5"), `Should not embed negative literal, got: ${cmd}`);
+  });
+
+  it("valid positive integer preserved as-is", () => {
+    const cmd = bedrockLongTermApiKeyCommand("me", "30");
+    assert.ok(cmd.includes("--credential-age-days 30"), `Expected preserved value, got: ${cmd}`);
+  });
+
+  it("empty days fallback to 90", () => {
+    const cmd = bedrockLongTermApiKeyCommand("me", "");
+    assert.ok(cmd.includes("--credential-age-days 90"), `Expected fallback to 90, got: ${cmd}`);
+  });
+
+  it("leading-zero days rejected as non-canonical (fallback to 90)", () => {
+    // 090 之类非规范正整数虽然形式上是数字，但 create-service-specific-credential 不接受
+    const cmd = bedrockLongTermApiKeyCommand("me", "090");
+    assert.ok(cmd.includes("--credential-age-days 90"), `Expected fallback to 90, got: ${cmd}`);
+  });
+});
+
+// Feature: amazon-bedrock-provider, Property 4: Region 必填校验
+// **Validates: Requirements 2.4, 5.4**
+describe("Property 4: Region required validation (frontend)", () => {
+  it("returns error for empty/whitespace region, passes for non-empty region", () => {
+    const authModeArb = fc.constantFrom("bearerToken" as const, "awsProfile" as const);
+    // Empty or whitespace-only region (empty string or only spaces/tabs/newlines)
+    const emptyRegionArb = fc.stringMatching(/^[ \t\n]{0,10}$/);
+    // Non-empty region
+    const nonEmptyRegionArb = fc.stringMatching(/^[a-z][a-z0-9-]{2,15}$/);
+
+    fc.assert(
+      fc.property(authModeArb, emptyRegionArb, (authMode, emptyRegion) => {
+        const bedrock = {
+          authMode,
+          providerId: "my-valid-provider",
+          region: emptyRegion,
+          awsProfile: "",
+          iamUserName: "",
+          iamKeyValidityDays: "90",
+        };
+        const result = bedrockValidationError(bedrock, "valid-api-key");
+        assert.notStrictEqual(result, null, `Expected error for empty region "${emptyRegion}" with authMode=${authMode}`);
+      }),
+      { numRuns: 100 }
+    );
+
+    fc.assert(
+      fc.property(authModeArb, nonEmptyRegionArb, (authMode, region) => {
+        const bedrock = {
+          authMode,
+          providerId: "my-valid-provider",
+          region,
+          awsProfile: "",
+          iamUserName: "",
+          iamKeyValidityDays: "90",
+        };
+        // For bearerToken, all other required fields are valid
+        // For awsProfile, region is the only required field
+        const result = bedrockValidationError(bedrock, "valid-api-key");
+        // The region check itself should not produce an error
+        if (result !== null) {
+          // If there IS an error, it should NOT be about region
+          assert.ok(!result.includes("region"), `Got unexpected region error: "${result}" for non-empty region "${region}"`);
+        }
+      }),
+      { numRuns: 100 }
+    );
+  });
+});
+
+// Feature: amazon-bedrock-provider, Property 5: Bedrock API Key 必填校验（Bearer Token 路径）
+// **Validates: Requirements 3.4**
+describe("Property 5: Bedrock API Key required validation (Bearer Token)", () => {
+  it("returns error for empty/whitespace API key in bearerToken mode, passes for non-empty", () => {
+    // Empty or whitespace-only API key
+    const emptyKeyArb = fc.array(fc.constantFrom(" ", "\t", "\n"), { minLength: 0, maxLength: 10 }).map(arr => arr.join(""));
+    // Non-empty API key
+    const nonEmptyKeyArb = fc.string({ minLength: 1 }).filter(s => s.trim().length > 0);
+
+    fc.assert(
+      fc.property(emptyKeyArb, (emptyKey) => {
+        const bedrock = {
+          authMode: "bearerToken" as const,
+          providerId: "my-valid-provider",
+          region: "us-east-2",
+          awsProfile: "",
+          iamUserName: "",
+          iamKeyValidityDays: "90",
+        };
+        const result = bedrockValidationError(bedrock, emptyKey);
+        assert.notStrictEqual(result, null, `Expected error for empty API key "${emptyKey}"`);
+      }),
+      { numRuns: 100 }
+    );
+
+    fc.assert(
+      fc.property(nonEmptyKeyArb, (apiKey) => {
+        const bedrock = {
+          authMode: "bearerToken" as const,
+          providerId: "my-valid-provider",
+          region: "us-east-2",
+          awsProfile: "",
+          iamUserName: "",
+          iamKeyValidityDays: "90",
+        };
+        const result = bedrockValidationError(bedrock, apiKey);
+        // Should pass validation (null means no error)
+        assert.strictEqual(result, null, `Got unexpected error: "${result}" for non-empty API key`);
+      }),
+      { numRuns: 100 }
+    );
+  });
+});
+
+// Feature: amazon-bedrock-provider, Property 6: Long-Term API Key 命令生成
+// **Validates: Requirements 7.1, 7.4**
+describe("Property 6: Long-Term API Key command generation", () => {
+  it("command contains required parts for any non-empty user and days", () => {
+    // 非空 IAM 用户名（含空白字符也允许，trim 后非空即可）
+    const userArb = fc.stringMatching(/^\s{0,3}[a-zA-Z][a-zA-Z0-9_-]{0,20}\s{0,3}$/);
+    // 有效期天数字符串（数字，非空非空白）
+    const daysArb = fc.stringMatching(/^\s{0,3}[1-9][0-9]{0,3}\s{0,3}$/);
+
+    fc.assert(
+      fc.property(userArb, daysArb, (user, days) => {
+        const cmd = bedrockLongTermApiKeyCommand(user, days);
+        const trimmedUser = user.trim();
+        const trimmedDays = days.trim();
+        assert.ok(cmd.includes("aws iam create-service-specific-credential"), `Missing subcommand in: ${cmd}`);
+        assert.ok(cmd.includes(`--user-name ${trimmedUser}`), `Missing --user-name in: ${cmd}`);
+        assert.ok(cmd.includes(`--credential-age-days ${trimmedDays}`), `Missing --credential-age-days in: ${cmd}`);
+      }),
+      { numRuns: 100 }
+    );
+  });
+});
+
+// Feature: amazon-bedrock-provider, Requirements 8.4, 8.5: AWS SSO commands concatenation
+describe("AWS SSO commands concatenation", () => {
+  it("concatenated text contains both aws configure sso and aws sso login lines", () => {
+    const configureCmd = bedrockAwsProfileConfigureCommand("my-dev");
+    const loginCmd = bedrockAwsProfileLoginCommand("my-dev");
+    const combined = `${configureCmd}\n${loginCmd}`;
+    assert.ok(
+      combined.includes("aws configure sso"),
+      `Combined text should contain "aws configure sso", got: ${combined}`,
+    );
+    assert.ok(
+      combined.includes("aws sso login"),
+      `Combined text should contain "aws sso login", got: ${combined}`,
+    );
+  });
+
+  it("empty profile also produces both commands in concatenation", () => {
+    const configureCmd = bedrockAwsProfileConfigureCommand("");
+    const loginCmd = bedrockAwsProfileLoginCommand("");
+    const combined = `${configureCmd}\n${loginCmd}`;
+    assert.ok(combined.includes("aws configure sso"));
+    assert.ok(combined.includes("aws sso login"));
+  });
+});
+
+// Feature: amazon-bedrock-provider, Property 7: AWS Profile 配置/登录命令生成
+// **Validates: Requirements 8.1, 8.2, 8.3**
+describe("Property 7: AWS Profile configure/login command generation", () => {
+  it("commands include --profile when non-empty, plain command when empty/whitespace", () => {
+    // 任意 profile 名称：可为空、可含空白、可含普通标识符字符
+    const profileArb = fc.oneof(
+      fc.constant(""),
+      fc.stringMatching(/^[ \t\n]{0,5}$/),  // whitespace only
+      fc.stringMatching(/^\s{0,3}[a-zA-Z][a-zA-Z0-9_-]{0,20}\s{0,3}$/),  // valid trimmed
+    );
+
+    fc.assert(
+      fc.property(profileArb, (profile) => {
+        const trimmed = profile.trim();
+        const configCmd = bedrockAwsProfileConfigureCommand(profile);
+        const loginCmd = bedrockAwsProfileLoginCommand(profile);
+        if (trimmed) {
+          assert.ok(configCmd.includes(`aws configure sso --profile ${trimmed}`),
+            `configure command should include --profile ${trimmed}, got: ${configCmd}`);
+          assert.ok(loginCmd.includes(`aws sso login --profile ${trimmed}`),
+            `login command should include --profile ${trimmed}, got: ${loginCmd}`);
+        } else {
+          assert.strictEqual(configCmd, "aws configure sso",
+            `configure command should be plain for empty profile, got: ${configCmd}`);
+          assert.strictEqual(loginCmd, "aws sso login",
+            `login command should be plain for empty profile, got: ${loginCmd}`);
+        }
+      }),
+      { numRuns: 100 }
+    );
+  });
+});
+
+// Feature: amazon-bedrock-provider, Requirements 7.2: Short-Term API Key 说明文本
+describe("bedrockShortTermApiKeyGuidanceText", () => {
+  it("does not contain the Long-Term command and mentions 12 hour validity", () => {
+    const text = bedrockShortTermApiKeyGuidanceText();
+    assert.ok(
+      !text.includes("aws iam create-service-specific-credential"),
+      `Short-term guidance should NOT contain the long-term subcommand`,
+    );
+    assert.ok(text.includes("12"), `Short-term guidance should mention "12" (hours)`);
+    assert.ok(text.includes("小时"), `Short-term guidance should mention "小时"`);
+  });
+});
+
+// Feature: amazon-bedrock-provider, Requirements 9.1, 9.2
+// 测试按钮 / Provider Doctor 按钮的可见性在两条 Bedrock 鉴权路径下的差异
+// - `SortableRelayProfileCard` 的测试按钮 disabled 表达式：
+//     isAggregateRelayProfile(profile) || !bedrockAllowsProviderTesting(profile)
+// - `RelayProfileEditor` 对 Bedrock profile 走 <BedrockRelayProfileEditor>（内部不渲染 Provider Doctor）
+// 因此只需覆盖以下纯逻辑即可：
+//   1) bedrockAllowsProviderTesting(profile) 在 authMode === "awsProfile" 时返回 false（测试按钮禁用）
+//   2) bedrockAllowsProviderTesting(profile) 在 authMode === "bearerToken" 时返回 true（测试按钮可用）
+//   3) isBedrockRelayProfile(profile) 为 true → 编辑器分支切走，不渲染 Provider Doctor UI
+describe("Test button & Provider Doctor visibility per Bedrock authMode", () => {
+  it("AWS Profile path: test button predicate returns disabled state", () => {
+    const profile = {
+      bedrock: {
+        authMode: "awsProfile",
+        providerId: "",
+        region: "us-east-1",
+        awsProfile: "default",
+        iamUserName: "",
+        iamKeyValidityDays: "90",
+      } satisfies BedrockConfig,
+    };
+    // 测试按钮判定：`isAggregateRelayProfile || !bedrockAllowsProviderTesting`
+    // 对于非聚合的 AWS Profile Bedrock：!bedrockAllowsProviderTesting === true → 按钮禁用
+    assert.strictEqual(
+      bedrockAllowsProviderTesting(profile),
+      false,
+      "AWS Profile mode should NOT allow provider testing",
+    );
+    // 编辑器分支切走：isBedrockRelayProfile === true → 渲染 BedrockRelayProfileEditor
+    // （该组件不渲染 Provider Doctor 按钮）
+    assert.strictEqual(
+      isBedrockRelayProfile(profile),
+      true,
+      "Bedrock profile should route to BedrockRelayProfileEditor (no Provider Doctor)",
+    );
+  });
+
+  it("Bearer Token path: test button predicate returns enabled state", () => {
+    const profile = {
+      bedrock: {
+        authMode: "bearerToken",
+        providerId: "my-bedrock",
+        region: "us-east-1",
+        awsProfile: "",
+        iamUserName: "",
+        iamKeyValidityDays: "90",
+      } satisfies BedrockConfig,
+    };
+    // 测试按钮判定：bedrockAllowsProviderTesting === true → 按钮可用
+    assert.strictEqual(
+      bedrockAllowsProviderTesting(profile),
+      true,
+      "Bearer Token mode should ALLOW provider testing (same as pure API mode)",
+    );
+    // 编辑器仍然进入 BedrockRelayProfileEditor（同样不渲染 Provider Doctor）
+    assert.strictEqual(isBedrockRelayProfile(profile), true);
+  });
+
+  it("Non-Bedrock profile: test button predicate depends only on aggregate flag", () => {
+    // 模拟纯 API 模式（bedrock 字段为空）
+    const profile = { bedrock: null };
+    assert.strictEqual(
+      bedrockAllowsProviderTesting(profile),
+      true,
+      "Non-Bedrock profile should allow testing (like pure API)",
+    );
+    assert.strictEqual(isBedrockRelayProfile(profile), false);
+  });
+});
+
+// 保护 onSelectBedrock 中间态：
+// 在 `deriveRelayProfileFromFiles` 里必须用 `resolveBedrockAfterDerive` 而不是
+// 直接 `deriveBedrockConfigFromConfigText`，否则用户刚点 Amazon Bedrock 按钮
+// （bedrock 已被 patch 到 profile 上但 config 还没写 Bedrock 特征）时，
+// bedrock 会被无条件覆盖成 null，导致编辑器不切换到 BedrockRelayProfileEditor。
+describe("resolveBedrockAfterDerive - preserve UI-set bedrock across derive", () => {
+  const bedrockMantleConfig = [
+    `model_provider = "mantle"`,
+    `web_search = "disabled"`,
+    "",
+    `[model_providers.mantle]`,
+    `name = "mantle"`,
+    `wire_api = "responses"`,
+    `requires_openai_auth = true`,
+    `base_url = "https://bedrock-mantle.us-east-2.api.aws/openai/v1"`,
+    `experimental_bearer_token = "some-key"`,
+    "",
+  ].join("\n");
+
+  const genericCustomConfig = [
+    `model_provider = "custom"`,
+    "",
+    `[model_providers.custom]`,
+    `name = "custom"`,
+    `wire_api = "responses"`,
+    `requires_openai_auth = true`,
+    `base_url = ""`,
+    "",
+  ].join("\n");
+
+  const uiPatchedBedrock: BedrockConfig = {
+    authMode: null,
+    providerId: "",
+    region: "",
+    awsProfile: "",
+    iamUserName: "",
+    iamKeyValidityDays: "90",
+  };
+
+  it("returns existing bedrock when config lacks Bedrock features (onSelectBedrock initial state)", () => {
+    // 复现 bug 场景：用户刚点 Amazon Bedrock 按钮，
+    // profile.bedrock 已被 patch 成 {authMode: null, ...} 的中间态，
+    // 但 withGeneratedRelayFiles 生成的 config 还是通用 custom 模板。
+    const result = resolveBedrockAfterDerive(uiPatchedBedrock, genericCustomConfig);
+    assert.notStrictEqual(result, null, "existing bedrock must NOT be overwritten to null");
+    assert.strictEqual(result!.authMode, null);
+  });
+
+  it("returns existing bedrock when config is empty (fresh new profile)", () => {
+    const result = resolveBedrockAfterDerive(uiPatchedBedrock, "");
+    assert.notStrictEqual(result, null);
+    assert.strictEqual(result!.authMode, null);
+  });
+
+  it("returns derived bedrock when config has Bedrock features (magnetic from disk)", () => {
+    // 磁盘 config 有 Bedrock 特征时，即便 existing 也有值，也以推导结果为准，
+    // 保留「从磁盘反推 profile」的语义。
+    const staleExisting: BedrockConfig = {
+      authMode: "awsProfile",
+      providerId: "",
+      region: "eu-west-1",
+      awsProfile: "stale",
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+    const result = resolveBedrockAfterDerive(staleExisting, bedrockMantleConfig);
+    assert.notStrictEqual(result, null);
+    assert.strictEqual(result!.authMode, "bearerToken");
+    assert.strictEqual(result!.providerId, "mantle");
+    assert.strictEqual(result!.region, "us-east-2");
+  });
+
+  it("returns null when neither existing nor config indicate Bedrock (non-Bedrock profile)", () => {
+    // 普通 custom provider profile：既没有 UI 侧的 bedrock patch，config 也没有 Bedrock 特征。
+    assert.strictEqual(resolveBedrockAfterDerive(null, genericCustomConfig), null);
+    assert.strictEqual(resolveBedrockAfterDerive(undefined, genericCustomConfig), null);
+    assert.strictEqual(resolveBedrockAfterDerive(null, ""), null);
+  });
+});
diff --git a/apps/codex-plus-manager/src/bedrock-config.ts b/apps/codex-plus-manager/src/bedrock-config.ts
new file mode 100644
index 000000000..dd6f3a13f
--- /dev/null
+++ b/apps/codex-plus-manager/src/bedrock-config.ts
@@ -0,0 +1,397 @@
+export type BedrockAuthMode = "bearerToken" | "awsProfile";
+
+export type BedrockConfig = {
+  authMode: BedrockAuthMode | null; // null = 尚未选择路径（仅草稿态）
+  providerId: string;
+  region: string;
+  awsProfile: string;
+  iamUserName: string;
+  iamKeyValidityDays: string;
+};
+
+// ---------------------------------------------------------------------------
+// 保留 provider 标识符（与 Rust 端同步）
+// ---------------------------------------------------------------------------
+
+/** 与 Rust 端 RESERVED_MODEL_PROVIDER_IDS 保持同步的保留 provider 标识符列表 */
+export const RESERVED_MODEL_PROVIDER_IDS_MIRROR: readonly string[] = [
+  "amazon-bedrock",
+  "openai",
+  "ollama",
+  "lmstudio",
+  "oss",
+  "ollama-chat",
+] as const;
+
+/** 检查给定 id（trim 后）是否命中保留 provider 标识符 */
+export function isReservedProviderId(id: string): boolean {
+  return RESERVED_MODEL_PROVIDER_IDS_MIRROR.includes(id.trim());
+}
+
+// ---------------------------------------------------------------------------
+// Bedrock Mantle URL 模板常量
+//
+// 与 Rust 端 `crates/codex-plus-core/src/relay_config.rs` 的
+// `BEDROCK_MANTLE_URL_PREFIX` / `BEDROCK_MANTLE_URL_SUFFIX` 保持一致。
+// 修改这里必须同步修改 Rust 常量（前后端都在生成与识别端使用）。
+// ---------------------------------------------------------------------------
+export const BEDROCK_MANTLE_URL_PREFIX = "https://bedrock-mantle.";
+export const BEDROCK_MANTLE_URL_SUFFIX = ".api.aws/openai/v1";
+
+/**
+ * 校验 Bedrock 配置的必填字段，返回第一个错误信息或 null（全部通过）。
+ *
+ * 当前实现直接返回展示用的中文文本，`t()` 在缺失映射时会回落到原文，所以在
+ * 前端表现为原样中文；未来若要真正做多语言，可以把这里改成稳定英文 key
+ * 并在 `i18n-en.ts` / `i18n.ts` 添加映射。
+ *
+ * 优先级：region → (bearerToken) providerId 空 → providerId 保留字冲突 → apiKey 空。
+ * 该函数负责为 saveDraft 门控生成"任意一个 error 都拦保存"的信号；
+ * UI 里各条 error 的具体展示（inline / 底部）由 `bedrockValidationErrorForBottom`
+ * 与 `isReservedProviderId` 组合决定，避免"保留字冲突"同时被 inline 与底部展示。
+ */
+export function bedrockValidationError(bedrock: BedrockConfig, profileApiKey: string): string | null {
+  if (!bedrock.region.trim()) return "region 为必填项";
+  if (bedrock.authMode === "bearerToken") {
+    if (!bedrock.providerId.trim()) return "provider 标识符为必填项";
+    if (isReservedProviderId(bedrock.providerId)) return "该标识符与保留供应商冲突";
+    if (!profileApiKey.trim()) return "Bedrock API Key 为必填项";
+  }
+  return null;
+}
+
+/**
+ * `bedrockValidationError` 的子集，仅返回**非"保留字冲突"**类别的错误。
+ *
+ * 用于 `BedrockRelayProfileEditor` 底部聚合展示：保留字冲突已经由 Provider ID
+ * 输入框下方的 inline `<p>` 展示，如果底部再展示同一条消息就会重复；
+ * 但如果同时还有 region 或 apiKey 空的错误，底部仍需展示这些错误。
+ */
+export function bedrockValidationErrorForBottom(bedrock: BedrockConfig, profileApiKey: string): string | null {
+  if (!bedrock.region.trim()) return "region 为必填项";
+  if (bedrock.authMode === "bearerToken") {
+    if (!bedrock.providerId.trim()) return "provider 标识符为必填项";
+    // 保留字冲突交给 inline 展示，此处跳过
+    if (!profileApiKey.trim()) return "Bedrock API Key 为必填项";
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// TOML 解析辅助函数（纯字符串解析，不依赖 App.tsx 的私有函数）
+// ---------------------------------------------------------------------------
+
+/** 从一行中提取 `[sectionName]` 形式的表头名称，找不到返回 null */
+function tomlSectionNameFromLine(line: string): string | null {
+  const match = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+  return match ? match[1].trim() : null;
+}
+
+/**
+ * 转义在 RegExp 中具有特殊含义的字符，以便把任意字符串安全地拼进正则字面量。
+ * 当前调用点只传硬编码 key，但作为 helper 语义上必须是安全的。
+ */
+function escapeRegExp(input: string): string {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** 从一行中提取 `key = "value"` 或 `key = 'value'` 的字符串赋值，找不到返回 null */
+function tomlStringAssignment(line: string, key: string): string | null {
+  const match = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*([\"'])(.*?)\\1\\s*(?:#.*)?$`).exec(line.trim());
+  return match ? match[2].replace(/\\(["'\\])/g, "$1") : null;
+}
+
+/** 从一行中提取 `key = true` 或 `key = false` 的布尔赋值，找不到返回 null */
+function tomlBoolAssignment(line: string, key: string): boolean | null {
+  const match = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*(true|false)\\s*(?:#.*)?$`).exec(line.trim());
+  return match ? match[1] === "true" : null;
+}
+
+/** 读取根级（第一个 `[...]` 表头之前）的字符串赋值 */
+function rootTomlStringValue(contents: string, key: string): string {
+  const lines = contents.split(/\r?\n/);
+  for (const line of lines) {
+    // 遇到表头即停止（根级结束）
+    if (tomlSectionNameFromLine(line) !== null) break;
+    const value = tomlStringAssignment(line, key);
+    if (value !== null) return value;
+  }
+  return "";
+}
+
+/**
+ * 读取当前活跃 provider 表下的布尔字段值。
+ *
+ * 逻辑：先从根级获取 `model_provider` 的值，然后在
+ * `[model_providers.<provider>]` section 中查找 `key = true|false`。
+ */
+export function codexProviderBoolFromConfig(contents: string, key: string): boolean {
+  const provider = rootTomlStringValue(contents, "model_provider");
+  if (!provider) return false;
+  const targetSection = `model_providers.${provider}`;
+  const lines = contents.split(/\r?\n/);
+  let currentSection = "";
+
+  for (const line of lines) {
+    const section = tomlSectionNameFromLine(line);
+    if (section !== null) {
+      currentSection = section;
+      continue;
+    }
+    if (currentSection === targetSection) {
+      const value = tomlBoolAssignment(line, key);
+      if (value !== null) return value;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * 读取指定 TOML section 下的字符串字段值。
+ *
+ * `sectionName` 就是方括号中的内容，例如 `model_providers.amazon-bedrock.aws`
+ * 对应 TOML 中的 `[model_providers.amazon-bedrock.aws]`。
+ *
+ * 遍历属于该 section 的行（从匹配的表头开始，到下一个 `[...]` 表头结束），
+ * 查找 `key = "value"` 形式的字符串赋值。
+ */
+export function tomlSectionStringValue(contents: string, sectionName: string, key: string): string {
+  const lines = contents.split(/\r?\n/);
+  let inSection = false;
+
+  for (const line of lines) {
+    const section = tomlSectionNameFromLine(line);
+    if (section !== null) {
+      if (inSection) {
+        // 遇到下一个表头，目标 section 结束
+        break;
+      }
+      if (section === sectionName) {
+        inSection = true;
+      }
+      continue;
+    }
+    if (inSection) {
+      const value = tomlStringAssignment(line, key);
+      if (value !== null) return value;
+    }
+  }
+
+  return "";
+}
+
+/**
+ * 读取当前活跃 provider 表下的字符串字段值。
+ *
+ * 逻辑：先从根级获取 `model_provider` 的值，然后在
+ * `[model_providers.<provider>]` section 中查找 `key = "value"`。
+ */
+function codexProviderStringFromConfig(contents: string, key: string): string {
+  const provider = rootTomlStringValue(contents, "model_provider");
+  if (!provider) return "";
+  return tomlSectionStringValue(contents, `model_providers.${provider}`, key);
+}
+
+/**
+ * 从 config.toml 文本中识别 Bedrock 配置并还原为 BedrockConfig。
+ *
+ * 逻辑（镜像 Rust 端 `bedrock_config_from_config_text`）：
+ * 1. 读取根级 `model_provider`
+ * 2. 若为 `"amazon-bedrock"` → AWS Profile 路径
+ * 3. 否则检查活跃 provider 的 `requires_openai_auth = true` 且
+ *    `base_url` 匹配 bedrock-mantle 正则 → Bearer Token 路径
+ * 4. 否则返回 null
+ */
+export function deriveBedrockConfigFromConfigText(configContents: string): BedrockConfig | null {
+  const modelProvider = rootTomlStringValue(configContents, "model_provider");
+
+  // AWS Profile 路径
+  if (modelProvider === "amazon-bedrock") {
+    const region = tomlSectionStringValue(configContents, "model_providers.amazon-bedrock.aws", "region");
+    const awsProfile = tomlSectionStringValue(configContents, "model_providers.amazon-bedrock.aws", "profile");
+    return {
+      authMode: "awsProfile",
+      providerId: "",
+      region,
+      awsProfile,
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+  }
+
+  // Bearer Token 路径：匹配 `<PREFIX><region><SUFFIX>`，其中 region 不含 `.` 或 `/`。
+  if (modelProvider) {
+    const requiresOpenaiAuth = codexProviderBoolFromConfig(configContents, "requires_openai_auth");
+    if (requiresOpenaiAuth) {
+      const baseUrl = codexProviderStringFromConfig(configContents, "base_url");
+      const pattern = new RegExp(
+        `^${escapeRegExp(BEDROCK_MANTLE_URL_PREFIX)}([^./]+)${escapeRegExp(BEDROCK_MANTLE_URL_SUFFIX)}$`,
+      );
+      const match = pattern.exec(baseUrl);
+      if (match) {
+        return {
+          authMode: "bearerToken",
+          providerId: modelProvider,
+          region: match[1],
+          awsProfile: "",
+          iamUserName: "",
+          iamKeyValidityDays: "90",
+        };
+      }
+    }
+  }
+
+  return null;
+}
+
+// 最小接口，避免与 App.tsx 循环依赖
+type HasBedrock = { bedrock?: BedrockConfig | null };
+
+/** 判断 profile 是否为 Bedrock 类型 */
+export function isBedrockRelayProfile(profile: HasBedrock): boolean {
+  return !!profile.bedrock;
+}
+
+/**
+ * 在 `deriveRelayProfileFromFiles` 收尾时决定 `profile.bedrock` 的最终值。
+ *
+ * 语义分层：
+ * 1. **磁盘 config 已有 Bedrock 特征**（Bearer Token URL 或 amazon-bedrock provider）
+ *    → 以 `deriveBedrockConfigFromConfigText(configContents)` 的推导结果为准（磁盘权威）。
+ * 2. **磁盘 config 尚未写入 Bedrock 特征**，但 UI 已通过 patch 主动设置了 `existingBedrock`
+ *    （例如刚点了「Amazon Bedrock」按钮，`bedrock.authMode` 还是 `null` 中间态）
+ *    → 保留 `existingBedrock`，让编辑器能够切换到 `BedrockRelayProfileEditor`
+ *    并等待用户填写。
+ * 3. 其余情况 → 返回 `null`。
+ *
+ * 若直接采用「无条件用推导结果覆盖」的写法，第 2 类中间态会被立即抹掉，
+ * 表现为「点了 Amazon Bedrock 按钮但界面没有切换」。见 issue: onSelectBedrock
+ * 中间态被 deriveRelayProfileFromFiles 吞掉。
+ */
+export function resolveBedrockAfterDerive(
+  existingBedrock: BedrockConfig | null | undefined,
+  configContents: string,
+): BedrockConfig | null {
+  const derived = deriveBedrockConfigFromConfigText(configContents);
+  if (derived) return derived;
+  return existingBedrock ?? null;
+}
+
+/** 判断 profile 是否允许 provider 连通性测试（awsProfile 模式下不允许） */
+export function bedrockAllowsProviderTesting(profile: HasBedrock): boolean {
+  return !profile.bedrock || profile.bedrock.authMode !== "awsProfile";
+}
+
+/**
+ * `ProviderPresetSelector` 的 Bedrock 入口按钮渲染判定：
+ *
+ * 仅当宿主组件提供了 `onSelectBedrock` 回调（说明当前允许创建 Bedrock 供应商）
+ * 才渲染入口按钮。该函数纯粹依据 prop 类型判断，方便在无 DOM 的测试环境中直接
+ * 验证渲染分支的开关逻辑。
+ */
+export function shouldRenderBedrockPresetButton(
+  onSelectBedrock: (() => void) | undefined,
+): boolean {
+  return typeof onSelectBedrock === "function";
+}
+
+// ---------------------------------------------------------------------------
+// CLI 命令生成函数
+// ---------------------------------------------------------------------------
+
+/** Long-Term Key 有效期天数的默认回退值，与 `default_bedrock_iam_key_validity_days` 对齐。 */
+const DEFAULT_LONG_TERM_KEY_DAYS = "90";
+
+/**
+ * 生成创建 Long-Term Bedrock API Key 的 AWS CLI 命令文本。
+ *
+ * - 用户名为空/空白时使用占位符 <IAM_USER_NAME>。
+ * - 有效期若不是正整数字符串（例如空、字母、负号）则回退到 90，
+ *   避免把 `abc` / `-5` 之类的值原样嵌入到示例命令里让用户拷去 shell 报错。
+ */
+export function bedrockLongTermApiKeyCommand(iamUserName: string, validityDays: string): string {
+  const user = iamUserName.trim() || "<IAM_USER_NAME>";
+  const daysTrimmed = validityDays.trim();
+  const days = /^[1-9][0-9]*$/.test(daysTrimmed) ? daysTrimmed : DEFAULT_LONG_TERM_KEY_DAYS;
+  return `aws iam create-service-specific-credential \\\n  --user-name ${user} \\\n  --service-name bedrock.amazonaws.com \\\n  --credential-age-days ${days}`;
+}
+
+/**
+ * Short-Term Bedrock API Key 的说明性文本。
+ * 不包含 `aws iam create-service-specific-credential`，
+ * 包含 "12 小时" 有效期与权限继承说明。
+ */
+export function bedrockShortTermApiKeyGuidanceText(): string {
+  return "短期 Bedrock API Key 通过 aws-bedrock-token-generator 生成，有效期不超过 12 小时，并继承生成时使用的 AWS 主体权限。请参考 aws-bedrock-token-generator 文档在本机生成，本工具不会代为调用 AWS API。";
+}
+
+/**
+ * 生成 AWS SSO configure 命令。profile 名称非空非空白时附加 --profile 参数。
+ */
+export function bedrockAwsProfileConfigureCommand(awsProfile: string): string {
+  const profileFlag = awsProfile.trim() ? ` --profile ${awsProfile.trim()}` : "";
+  return `aws configure sso${profileFlag}`;
+}
+
+/**
+ * 生成 AWS SSO login 命令。profile 名称非空非空白时附加 --profile 参数。
+ */
+export function bedrockAwsProfileLoginCommand(awsProfile: string): string {
+  const profileFlag = awsProfile.trim() ? ` --profile ${awsProfile.trim()}` : "";
+  return `aws sso login${profileFlag}`;
+}
+
+// ---------------------------------------------------------------------------
+// BedrockRelayProfileEditor 渲染逻辑辅助函数（保持 UI 组件与纯函数解耦）
+// ---------------------------------------------------------------------------
+
+/**
+ * 判断当前是否应该渲染鉴权路径专属字段。
+ *
+ * `authMode === null` 时（中间态，用户尚未选择路径）不渲染任何专属字段，
+ * 只保留路径选择按钮；两条路径任选其一后才渲染各自的字段集合。
+ */
+export function bedrockShouldRenderPathFields(bedrock: BedrockConfig | null | undefined): boolean {
+  return !!bedrock && bedrock.authMode !== null;
+}
+
+/**
+ * Bearer Token 分支需要渲染的字段名集合，对应 Requirement 1.3。
+ *
+ * 字段：region、providerId、apiKey（复用 profile.apiKey）、iamUserName、iamKeyValidityDays。
+ * 顺序仅表达"分支下必须至少存在的字段"，不代表 UI 具体排布。
+ */
+export function bedrockBearerTokenFieldKeys(): readonly string[] {
+  return ["region", "providerId", "apiKey", "iamUserName", "iamKeyValidityDays"] as const;
+}
+
+/**
+ * AWS Profile 分支需要渲染的字段名集合，对应 Requirement 1.4。
+ *
+ * 字段：region、awsProfile（AWS profile 名称可选）。
+ */
+export function bedrockAwsProfileFieldKeys(): readonly string[] {
+  return ["region", "awsProfile"] as const;
+}
+
+/**
+ * Bedrock 模型 ID 是否需要展示"非 openai.* 前缀"提示。
+ *
+ * Bedrock via OpenAI 兼容 endpoint 通常需要 `openai.*` 前缀的模型 ID；
+ * 用户填写非该前缀的模型时展示警告，但不阻塞保存（Requirement 6.1）。
+ * 空/全空白的模型串不触发提示。
+ */
+export function bedrockModelNeedsWarning(model: string): boolean {
+  const trimmed = model.trim();
+  return trimmed.length > 0 && !trimmed.startsWith("openai.");
+}
+
+/**
+ * AWS Profile 分支的 CLI 命令文本区域内容：
+ * 把 `aws configure sso [--profile ...]` 与 `aws sso login [--profile ...]` 拼接在一起，
+ * 便于在同一个 `<pre>`/`<textarea>` 中一次性展示两条命令（Requirement 8.4）。
+ */
+export function bedrockAwsProfileCommandBlock(awsProfile: string): string {
+  return `${bedrockAwsProfileConfigureCommand(awsProfile)}\n${bedrockAwsProfileLoginCommand(awsProfile)}`;
+}
diff --git a/apps/codex-plus-manager/src/components/BedrockRelayProfileEditor.test.ts b/apps/codex-plus-manager/src/components/BedrockRelayProfileEditor.test.ts
new file mode 100644
index 000000000..98d7eb8ec
--- /dev/null
+++ b/apps/codex-plus-manager/src/components/BedrockRelayProfileEditor.test.ts
@@ -0,0 +1,132 @@
+import { describe, it } from "node:test";
+import * as assert from "node:assert/strict";
+import {
+  bedrockShouldRenderPathFields,
+  bedrockBearerTokenFieldKeys,
+  bedrockAwsProfileFieldKeys,
+  bedrockModelNeedsWarning,
+  bedrockAwsProfileCommandBlock,
+  bedrockValidationError,
+  type BedrockConfig,
+} from "../bedrock-config.ts";
+
+// 示例单元测试：验证 `BedrockRelayProfileEditor` 的渲染分支与提示逻辑。
+//
+// 组件本身依赖 `@/i18n` 别名与 JSX，无法在 Node 原生 `--experimental-strip-types`
+// 环境下直接加载（Node 不识别 `.tsx`），因此把渲染分支的开关、字段集合、提示可见性、
+// 命令拼接等抽成纯函数放在 `bedrock-config.ts`，测试直接验证这些纯函数。
+describe("BedrockRelayProfileEditor rendering logic", () => {
+  // Requirement 1.2: authMode === null 时不渲染任何路径专属字段
+  it("authMode === null: no path-specific fields render", () => {
+    const bedrock: BedrockConfig = {
+      authMode: null,
+      providerId: "",
+      region: "us-east-1",
+      awsProfile: "",
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+    assert.strictEqual(bedrockShouldRenderPathFields(bedrock), false);
+  });
+
+  it("bedrock === null/undefined: no path-specific fields render", () => {
+    assert.strictEqual(bedrockShouldRenderPathFields(null), false);
+    assert.strictEqual(bedrockShouldRenderPathFields(undefined), false);
+  });
+
+  it("authMode === 'bearerToken' triggers path-specific fields rendering", () => {
+    const bedrock: BedrockConfig = {
+      authMode: "bearerToken",
+      providerId: "my-bedrock",
+      region: "us-east-1",
+      awsProfile: "",
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+    assert.strictEqual(bedrockShouldRenderPathFields(bedrock), true);
+  });
+
+  it("authMode === 'awsProfile' triggers path-specific fields rendering", () => {
+    const bedrock: BedrockConfig = {
+      authMode: "awsProfile",
+      providerId: "",
+      region: "us-east-1",
+      awsProfile: "default",
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+    assert.strictEqual(bedrockShouldRenderPathFields(bedrock), true);
+  });
+
+  // Requirement 1.3: Bearer Token 分支字段集合
+  it("bearerToken field set matches Requirement 1.3", () => {
+    const keys = bedrockBearerTokenFieldKeys();
+    assert.deepStrictEqual(
+      [...keys].sort(),
+      ["apiKey", "iamKeyValidityDays", "iamUserName", "providerId", "region"],
+    );
+  });
+
+  // Requirement 1.4: AWS Profile 分支字段集合
+  it("awsProfile field set matches Requirement 1.4", () => {
+    const keys = bedrockAwsProfileFieldKeys();
+    assert.deepStrictEqual([...keys].sort(), ["awsProfile", "region"]);
+  });
+
+  // Requirement 6.1: 非 openai.* 模型时提示可见，但保存按钮仍可点击
+  it("model warning is visible for non-openai.* model but save button remains enabled", () => {
+    // 触发提示
+    assert.strictEqual(bedrockModelNeedsWarning("anthropic.claude-3"), true);
+    assert.strictEqual(bedrockModelNeedsWarning("claude-3-sonnet"), true);
+    assert.strictEqual(bedrockModelNeedsWarning("meta.llama3"), true);
+
+    // 保存按钮阻塞只由 bedrockValidationError 决定；非 openai.* 前缀不进入校验
+    const bedrock: BedrockConfig = {
+      authMode: "awsProfile",
+      providerId: "",
+      region: "us-east-1",
+      awsProfile: "default",
+      iamUserName: "",
+      iamKeyValidityDays: "90",
+    };
+    assert.strictEqual(
+      bedrockValidationError(bedrock, ""),
+      null,
+      "AWS Profile mode with valid region should not have validation errors",
+    );
+  });
+
+  it("openai.* model does not trigger the warning", () => {
+    assert.strictEqual(bedrockModelNeedsWarning("openai.gpt-oss-120b-1:0"), false);
+    assert.strictEqual(bedrockModelNeedsWarning("openai.gpt-5.5"), false);
+  });
+
+  it("empty/whitespace model does not trigger the warning", () => {
+    assert.strictEqual(bedrockModelNeedsWarning(""), false);
+    assert.strictEqual(bedrockModelNeedsWarning("   "), false);
+    assert.strictEqual(bedrockModelNeedsWarning("\t\n"), false);
+  });
+
+  // Requirement 8.4: AWS Profile 分支命令文本区域同时包含 configure sso 与 sso login
+  it("AWS Profile command block contains both 'aws configure sso' and 'aws sso login'", () => {
+    const block = bedrockAwsProfileCommandBlock("my-dev");
+    assert.ok(block.includes("aws configure sso"), `Missing 'aws configure sso' in: ${block}`);
+    assert.ok(block.includes("aws sso login"), `Missing 'aws sso login' in: ${block}`);
+    // 同一段文本同时展示两行（Requirement 8.4）
+    assert.ok(block.includes("\n"), `Command block should have both commands on separate lines: ${block}`);
+  });
+
+  it("AWS Profile command block with named profile includes --profile flag on both lines", () => {
+    const block = bedrockAwsProfileCommandBlock("my-dev");
+    assert.ok(block.includes("aws configure sso --profile my-dev"));
+    assert.ok(block.includes("aws sso login --profile my-dev"));
+  });
+
+  it("AWS Profile command block with empty profile still contains both plain commands", () => {
+    const block = bedrockAwsProfileCommandBlock("");
+    assert.ok(block.includes("aws configure sso"));
+    assert.ok(block.includes("aws sso login"));
+    // 空 profile 时不应出现 --profile 参数
+    assert.ok(!block.includes("--profile"), `Empty profile should not include --profile flag: ${block}`);
+  });
+});
diff --git a/apps/codex-plus-manager/src/components/BedrockRelayProfileEditor.tsx b/apps/codex-plus-manager/src/components/BedrockRelayProfileEditor.tsx
new file mode 100644
index 000000000..27a7ec823
--- /dev/null
+++ b/apps/codex-plus-manager/src/components/BedrockRelayProfileEditor.tsx
@@ -0,0 +1,243 @@
+import { useMemo, type ReactNode } from "react";
+import type { RelayProfile } from "../App.tsx";
+import type { BedrockConfig, BedrockAuthMode } from "../bedrock-config.ts";
+import {
+  bedrockLongTermApiKeyCommand,
+  bedrockShortTermApiKeyGuidanceText,
+  bedrockAwsProfileCommandBlock,
+  bedrockValidationErrorForBottom,
+  bedrockShouldRenderPathFields,
+  bedrockModelNeedsWarning,
+  isReservedProviderId,
+} from "../bedrock-config.ts";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { t } from "@/i18n";
+
+/**
+ * 只暴露 `profile` + `onChange`。保存/取消按钮由外层通用编辑器 header 统一处理
+ * （详见 App.tsx 中 relay-editor-head 上的「返回列表」/「保存」），
+ * 编辑器内部不再自绘一组按钮，避免和顶部重复且实际点了没反应。
+ */
+export type BedrockRelayProfileEditorProps = {
+  profile: RelayProfile;
+  onChange: (patch: Partial<RelayProfile>) => void;
+};
+
+/**
+ * 与 App.tsx 内部的 `Field` 组件同结构（`<Label className="field"><span>label</span>{children}</Label>`），
+ * 复用通用主题类 `.field` / `.field span`，不再自绘 `.bedrock-field` 那套并列样式。
+ * 独立定义在这里，避免仅为共享 wrapper 就把 App.tsx 里的 Field 导出（改动面更大）。
+ */
+function BedrockField({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <Label className="field">
+      <span>{label}</span>
+      {children}
+    </Label>
+  );
+}
+
+export function BedrockRelayProfileEditor({ profile, onChange }: BedrockRelayProfileEditorProps) {
+  const bedrock = profile.bedrock ?? {
+    authMode: null as BedrockAuthMode | null,
+    providerId: "",
+    region: "",
+    awsProfile: "",
+    iamUserName: "",
+    iamKeyValidityDays: "90",
+  };
+
+  // 底部聚合的校验提示只承担"非保留字冲突"类别的错误；保留字冲突由 Provider ID
+  // 字段下方的 inline `<p>` 展示，避免同一条错误被两处红字重复渲染（P0 bug）。
+  // 保存按钮的门控仍然使用完整的 `bedrockValidationError`（在 App.tsx 里），
+  // 因此保留字冲突时保存按钮会照常禁用。
+  const bottomValidationError = useMemo(
+    () => (bedrock.authMode ? bedrockValidationErrorForBottom(bedrock as BedrockConfig, profile.apiKey) : null),
+    [bedrock, profile.apiKey]
+  );
+
+  const setBedrock = (patch: Partial<BedrockConfig>) => {
+    onChange({ bedrock: { ...(bedrock as BedrockConfig), ...patch } });
+  };
+
+  const isNonOpenAiModel = bedrockModelNeedsWarning(profile.model);
+  const providerIdReserved = bedrock.authMode === "bearerToken" && isReservedProviderId(bedrock.providerId);
+
+  return (
+    <div className="bedrock-editor relay-fields">
+      <h3>{t("Amazon Bedrock 配置")}</h3>
+
+      {/* 供应商显示名——列表和切换菜单里用来标识这个 profile。
+       * 与 Bearer Token 分支下的「Provider 标识符」不同：后者会写入 config.toml 的
+       * `model_provider` 字段（受 TOML key 语法约束），这个 name 只是 UI 展示。 */}
+      <BedrockField label={t("名称")}>
+        <Input
+          type="text"
+          value={profile.name}
+          onChange={(e) => onChange({ name: e.target.value })}
+          placeholder={t("例如 Bedrock 生产环境")}
+        />
+      </BedrockField>
+
+      {/* 鉴权路径二选一——沿用 Bedrock 专用的 radio 分段样式（.bedrock-auth-mode） */}
+      <div className="bedrock-auth-mode">
+        <label>{t("鉴权路径")}</label>
+        <div className="bedrock-auth-mode-choices">
+          <label>
+            <input
+              type="radio"
+              name="bedrockAuthMode"
+              value="bearerToken"
+              checked={bedrock.authMode === "bearerToken"}
+              onChange={() => setBedrock({ authMode: "bearerToken" })}
+            />
+            {t("Bedrock API Key (Bearer Token)")}
+          </label>
+          <label>
+            <input
+              type="radio"
+              name="bedrockAuthMode"
+              value="awsProfile"
+              checked={bedrock.authMode === "awsProfile"}
+              onChange={() => setBedrock({ authMode: "awsProfile" })}
+            />
+            {t("AWS Profile (SSO)")}
+          </label>
+        </div>
+      </div>
+
+      {/* 通用字段：Region
+       * AWS region 命名规范全部小写（如 us-east-1、ap-southeast-2），
+       * 但 macOS Safari/WKWebView 会对文本输入首字母自动大写；
+       * 关掉 autocapitalize 只是第一道防线，onChange 里再统一 toLowerCase()
+       * 强制小写，兼容用户手动输入大写的情况。 */}
+      {bedrockShouldRenderPathFields(bedrock) && (
+        <BedrockField label={t("AWS Region")}>
+          <Input
+            type="text"
+            value={bedrock.region}
+            onChange={(e) => setBedrock({ region: e.target.value.toLowerCase() })}
+            placeholder="us-east-1"
+            autoCapitalize="off"
+            autoCorrect="off"
+            autoComplete="off"
+            spellCheck={false}
+          />
+        </BedrockField>
+      )}
+
+      {/* Bearer Token 分支 */}
+      {bedrock.authMode === "bearerToken" && (
+        <>
+          <BedrockField label={t("Provider 标识符")}>
+            <Input
+              type="text"
+              value={bedrock.providerId}
+              onChange={(e) => setBedrock({ providerId: e.target.value })}
+              placeholder="my-bedrock"
+              autoCapitalize="off"
+              autoCorrect="off"
+              autoComplete="off"
+              spellCheck={false}
+            />
+            {providerIdReserved && (
+              <p className="bedrock-error">{t("该标识符与保留供应商冲突")}</p>
+            )}
+          </BedrockField>
+          <BedrockField label={t("Bedrock API Key")}>
+            <Input
+              type="password"
+              value={profile.apiKey}
+              onChange={(e) => onChange({ apiKey: e.target.value })}
+              placeholder={t("从 AWS IAM 生成的 Long-Term 或 Short-Term Key")}
+            />
+          </BedrockField>
+          <BedrockField label={t("IAM 用户名")}>
+            <Input
+              type="text"
+              value={bedrock.iamUserName}
+              onChange={(e) => setBedrock({ iamUserName: e.target.value })}
+              placeholder="my-iam-user"
+              autoCapitalize="off"
+              autoCorrect="off"
+              autoComplete="off"
+              spellCheck={false}
+            />
+            <p className="field-hint">
+              {t("用于下方 Long-Term Key 示例命令的 --user-name 参数；留空时会渲染成 <IAM_USER_NAME> 占位符。")}
+            </p>
+          </BedrockField>
+          <BedrockField label={t("Long-Term Key 有效期（天）")}>
+            <Input
+              type="text"
+              value={bedrock.iamKeyValidityDays}
+              onChange={(e) => setBedrock({ iamKeyValidityDays: e.target.value })}
+              placeholder="90"
+            />
+          </BedrockField>
+          <div className="bedrock-cli-hint">
+            <h4>{t("Long-Term API Key 生成命令")}</h4>
+            <pre>{bedrockLongTermApiKeyCommand(bedrock.iamUserName, bedrock.iamKeyValidityDays)}</pre>
+          </div>
+          <div className="bedrock-cli-hint">
+            <h4>{t("Short-Term API Key 说明")}</h4>
+            <p>{bedrockShortTermApiKeyGuidanceText()}</p>
+          </div>
+        </>
+      )}
+
+      {/* AWS Profile 分支 */}
+      {bedrock.authMode === "awsProfile" && (
+        <>
+          <BedrockField label={t("AWS Profile 名称（可选）")}>
+            <Input
+              type="text"
+              value={bedrock.awsProfile}
+              onChange={(e) => setBedrock({ awsProfile: e.target.value })}
+              placeholder="default"
+              autoCapitalize="off"
+              autoCorrect="off"
+              autoComplete="off"
+              spellCheck={false}
+            />
+          </BedrockField>
+          <div className="bedrock-cli-hint">
+            <h4>{t("AWS SSO 配置/登录命令")}</h4>
+            <pre>{bedrockAwsProfileCommandBlock(bedrock.awsProfile)}</pre>
+          </div>
+        </>
+      )}
+
+      {/* 模型字段（Bedrock Mantle 的 /v1/responses endpoint 只暴露 GPT-5.x 系列） */}
+      <BedrockField label={t("模型")}>
+        <Input
+          type="text"
+          value={profile.model}
+          onChange={(e) => onChange({ model: e.target.value })}
+          placeholder="openai.gpt-5.5"
+          autoCapitalize="off"
+          autoCorrect="off"
+          autoComplete="off"
+          spellCheck={false}
+        />
+        <p className="field-hint">
+          {t("Bedrock Mantle 的 /v1/responses 端点仅暴露 GPT-5.x：openai.gpt-5.5（仅 us-east-2）、openai.gpt-5.4。GPT-OSS 等 Bedrock native 模型 ID 走 Mantle 会返回 404，需要通过 LiteLLM 中转。")}
+        </p>
+        {isNonOpenAiModel && (
+          <p className="bedrock-warning">
+            {t("Bedrock via OpenAI-兼容 endpoint 通常需要 openai.* 前缀的模型 ID；已按当前值保存")}
+          </p>
+        )}
+      </BedrockField>
+
+      {/* 底部聚合的校验提示（region / providerId / apiKey 空缺）。
+       * 保留字冲突已经由 Provider ID 字段下方的 inline `<p>` 展示，此处刻意跳过
+       * 以避免重复；保存按钮的门控仍然由 App.tsx 里的 `bedrockValidationError`
+       * 覆盖所有情况。 */}
+      {bottomValidationError && (
+        <p className="bedrock-error">{t(bottomValidationError)}</p>
+      )}
+    </div>
+  );
+}
diff --git a/apps/codex-plus-manager/src/components/ProviderPresetSelector.test.ts b/apps/codex-plus-manager/src/components/ProviderPresetSelector.test.ts
new file mode 100644
index 000000000..be7d8fb96
--- /dev/null
+++ b/apps/codex-plus-manager/src/components/ProviderPresetSelector.test.ts
@@ -0,0 +1,29 @@
+import { describe, it } from "node:test";
+import * as assert from "node:assert/strict";
+import { shouldRenderBedrockPresetButton } from "../bedrock-config.ts";
+
+// 示例单元测试：验证 `ProviderPresetSelector` 中 Bedrock 入口按钮的渲染判定。
+//
+// 组件本身依赖 `@/i18n` 别名与 JSX，无法在 Node 原生 `--experimental-strip-types`
+// 环境下直接加载（Node 不识别 `.tsx`），因此把渲染分支的开关抽成纯函数
+// `shouldRenderBedrockPresetButton` 并由组件复用，测试直接验证该函数。
+describe("ProviderPresetSelector Bedrock preset button visibility", () => {
+  it("returns true when onSelectBedrock is a function (button renders)", () => {
+    const callback = () => {};
+    assert.strictEqual(shouldRenderBedrockPresetButton(callback), true);
+  });
+
+  it("returns false when onSelectBedrock is undefined (button hidden)", () => {
+    assert.strictEqual(shouldRenderBedrockPresetButton(undefined), false);
+  });
+
+  it("returns true for any function reference regardless of body", () => {
+    // 组件调用点只依赖回调是否存在，不关心内部实现
+    assert.strictEqual(
+      shouldRenderBedrockPresetButton(() => {
+        throw new Error("should never be called by the predicate");
+      }),
+      true,
+    );
+  });
+});
diff --git a/apps/codex-plus-manager/src/components/ProviderPresetSelector.tsx b/apps/codex-plus-manager/src/components/ProviderPresetSelector.tsx
index bc86b7463..a5b295b97 100644
--- a/apps/codex-plus-manager/src/components/ProviderPresetSelector.tsx
+++ b/apps/codex-plus-manager/src/components/ProviderPresetSelector.tsx
@@ -1,6 +1,7 @@
 import { useState, useMemo } from "react";
 import type { ProviderPreset, RelayProtocol } from "../presets";
 import { PRESETS } from "../presets";
+import { shouldRenderBedrockPresetButton } from "../bedrock-config";
 import { t, tf } from "@/i18n";
 
 export type RelayProfile = {
@@ -51,10 +52,24 @@ export function createPresetPatch(preset: ProviderPreset): PresetPatch {
   };
 }
 
+/**
+ * Bedrock 按钮在搜索模式下命中的关键词集合——包含中英文常见叫法。
+ * 只有当前查询与其中之一（子串关系）匹配时，才把 Bedrock 按钮塞进搜索结果。
+ */
+const BEDROCK_SEARCH_KEYWORDS = ["amazon bedrock", "bedrock", "aws", "amazon"] as const;
+
+function bedrockMatchesQuery(query: string): boolean {
+  const q = query.trim().toLowerCase();
+  if (!q) return false;
+  return BEDROCK_SEARCH_KEYWORDS.some((keyword) => keyword.includes(q) || q.includes(keyword));
+}
+
 export function ProviderPresetSelector({
   onSelect,
+  onSelectBedrock,
 }: {
   onSelect: (patch: PresetPatch) => void;
+  onSelectBedrock?: () => void;
 }) {
   const [collapsed, setCollapsed] = useState(true);
   const [query, setQuery] = useState("");
@@ -78,6 +93,15 @@ export function ProviderPresetSelector({
     setQuery("");
   };
 
+  const handleSelectBedrock = () => {
+    if (onSelectBedrock) onSelectBedrock();
+    setCollapsed(true);
+    setQuery("");
+  };
+
+  const bedrockButtonAvailable = shouldRenderBedrockPresetButton(onSelectBedrock);
+  const bedrockVisibleInSearch = bedrockButtonAvailable && bedrockMatchesQuery(query);
+
   return (
     <div className="preset-selector">
       <button
@@ -108,31 +132,40 @@ export function ProviderPresetSelector({
             />
           </div>
 
-          {filtered.length === 0 && (
+          {filtered.length === 0 && !bedrockVisibleInSearch && (
             <div className="preset-empty">
               {t("没有匹配「")}{query}{t("」的供应商")}
             </div>
           )}
 
           {query.trim()
-            ? // 搜索模式：所有匹配结果放在一个分组
-              filtered.map((preset) => (
-                <PresetButton
-                  key={preset.id}
-                  preset={preset}
-                  onSelect={handleSelect}
-                />
-              ))
-            : // 浏览模式：按分类分组
+            ? // 搜索模式：Bedrock（如果匹配）排在最前，然后是过滤后的常规 preset
+              (
+                <>
+                  {bedrockVisibleInSearch && (
+                    <BedrockPresetButton onSelect={handleSelectBedrock} />
+                  )}
+                  {filtered.map((preset) => (
+                    <PresetButton
+                      key={preset.id}
+                      preset={preset}
+                      onSelect={handleSelect}
+                    />
+                  ))}
+                </>
+              )
+            : // 浏览模式：按分类分组；Bedrock 归入「第三方」分组，排在 Azure OpenAI 前面
               categories.map((cat) => {
                 const items = PRESETS.filter((p) => p.category === cat);
-                if (items.length === 0) return null;
+                const injectBedrock = cat === "third_party" && bedrockButtonAvailable;
+                if (items.length === 0 && !injectBedrock) return null;
                 return (
                   <div className="preset-category" key={cat}>
                     <h3 className="preset-category-label">
                       {categoryLabels[cat] || cat}
                     </h3>
                     <div className="preset-category-items">
+                      {injectBedrock && <BedrockPresetButton onSelect={handleSelectBedrock} />}
                       {items.map((preset) => (
                         <PresetButton
                           key={preset.id}
@@ -150,6 +183,27 @@ export function ProviderPresetSelector({
   );
 }
 
+/**
+ * Bedrock 专用的预设按钮：外观与普通 `PresetButton` 一致，
+ * 但点击后不派发 `onSelect(patch)`，而是走 `onSelectBedrock` 通道
+ * （由宿主编辑器切换到 `BedrockRelayProfileEditor`）。
+ */
+function BedrockPresetButton({ onSelect }: { onSelect: () => void }) {
+  return (
+    <button
+      className="preset-btn"
+      onClick={onSelect}
+      type="button"
+      data-preset-kind="bedrock"
+      title={t("Amazon Bedrock")}
+    >
+      <span className="preset-btn-icon">B</span>
+      <span className="preset-btn-name">{t("Amazon Bedrock")}</span>
+      <span className="preset-btn-model">{t("需要选择鉴权路径")}</span>
+    </button>
+  );
+}
+
 function PresetButton({
   preset,
   onSelect,
diff --git a/apps/codex-plus-manager/src/i18n-en.ts b/apps/codex-plus-manager/src/i18n-en.ts
index afcb02de2..54be36773 100644
--- a/apps/codex-plus-manager/src/i18n-en.ts
+++ b/apps/codex-plus-manager/src/i18n-en.ts
@@ -545,6 +545,7 @@ export const EN_PLAIN: Record<string, string> = {
   "聚合/中转": "Aggregate/relay",
   "聚合供应商": "Aggregate provider",
   "聚合供应商会在真实对话中轮转成员，请测试成员供应商": "Aggregate providers rotate members in real conversations; test the member providers instead",
+  "AWS Profile 模式下无法在此测试供应商；请在 Codex 会话中验证": "Testing this provider isn't available in AWS Profile mode; verify it inside a Codex session instead",
   "聚合供应商只保存成员和策略配置，成员来自已有 API 供应商；切为当前后会通过本地协议代理轮转请求。":
     "Aggregate providers only store member and strategy config drawn from existing API providers; once active, requests rotate through the local protocol proxy.",
   "聚合供应商至少需要勾选 1 个已填写 Base URL / Key 的 API 供应商。":
diff --git a/apps/codex-plus-manager/src/styles.css b/apps/codex-plus-manager/src/styles.css
index 220da61b7..1aad7f76d 100644
--- a/apps/codex-plus-manager/src/styles.css
+++ b/apps/codex-plus-manager/src/styles.css
@@ -3330,3 +3330,114 @@ body {
 .relay-model-row input {
   font-family: "JetBrains Mono", ui-monospace, SFMono-Regular, Consolas, monospace;
 }
+
+/* -----------------------------------------------------------------------
+ * Bedrock 编辑器独有样式
+ *
+ * BedrockRelayProfileEditor 用 <Field>/<Input>/<Button> 通用组件，
+ * 表单字段本身的排版走 .field / .field span / Input 内置 tailwind 规则；
+ * 下面只保留 Bedrock 独有的部分：容器 gap、标题字号、鉴权路径 radio
+ * 分段选择器、CLI 命令展示块、错误/警告文案色。
+ * ----------------------------------------------------------------------- */
+
+.bedrock-editor h3 {
+  margin: 0 0 4px;
+  font-size: 15px;
+  font-weight: 700;
+  color: hsl(var(--foreground));
+}
+
+.bedrock-editor h4 {
+  margin: 0 0 6px;
+  font-size: 12px;
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+  color: hsl(var(--muted-foreground));
+}
+
+.bedrock-auth-mode {
+  display: grid;
+  gap: 8px;
+}
+
+.bedrock-auth-mode > label {
+  color: hsl(var(--foreground));
+  font-weight: 600;
+  font-size: 13px;
+}
+
+.bedrock-auth-mode-choices {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+
+.bedrock-auth-mode-choices label {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 40px;
+  padding: 0 12px;
+  border: 1px solid hsl(var(--border));
+  border-radius: 8px;
+  background: hsl(var(--surface-raised));
+  color: hsl(var(--foreground));
+  font-size: 13px;
+  cursor: pointer;
+  transition:
+    border-color var(--motion-fast) var(--motion-ease),
+    background-color var(--motion-fast) var(--motion-ease);
+}
+
+.bedrock-auth-mode-choices label:hover {
+  border-color: hsl(var(--primary) / 0.45);
+}
+
+.bedrock-auth-mode-choices input[type="radio"] {
+  width: 16px;
+  height: 16px;
+  margin: 0;
+}
+
+.bedrock-cli-hint {
+  display: grid;
+  gap: 6px;
+  padding: 10px 12px;
+  border: 1px solid hsl(var(--border));
+  border-radius: 8px;
+  background: hsl(var(--surface-sunken));
+}
+
+.bedrock-cli-hint p {
+  margin: 0;
+  color: hsl(var(--muted-foreground));
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.bedrock-cli-hint pre {
+  margin: 0;
+  padding: 8px 10px;
+  border-radius: 6px;
+  background: hsl(var(--background));
+  color: hsl(var(--foreground));
+  font-family: "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 12px;
+  line-height: 1.55;
+  white-space: pre-wrap;
+  word-break: break-word;
+  overflow-x: auto;
+}
+
+.bedrock-error {
+  margin: 4px 0 0;
+  color: hsl(var(--destructive));
+  font-size: 12px;
+}
+
+.bedrock-warning {
+  margin: 4px 0 0;
+  color: hsl(38 92% 55%);
+  font-size: 12px;
+}
diff --git a/crates/codex-plus-core/Cargo.toml b/crates/codex-plus-core/Cargo.toml
index 2e5609e20..1fcdbce70 100644
--- a/crates/codex-plus-core/Cargo.toml
+++ b/crates/codex-plus-core/Cargo.toml
@@ -43,4 +43,5 @@ windows = { version = "0.58", features = [
 ] }
 
 [dev-dependencies]
+proptest = "1"
 tempfile.workspace = true
diff --git a/crates/codex-plus-core/proptest-regressions/relay_config.txt b/crates/codex-plus-core/proptest-regressions/relay_config.txt
new file mode 100644
index 000000000..a1c642630
--- /dev/null
+++ b/crates/codex-plus-core/proptest-regressions/relay_config.txt
@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc 7f1e313551a0e6bfdc44e693f09759072cfa7bae2be90aacae03d382c76db835 # shrinks to region = "a--", aws_profile = ""
diff --git a/crates/codex-plus-core/src/ccs_import.rs b/crates/codex-plus-core/src/ccs_import.rs
index 0770e1f88..e40abc6c3 100644
--- a/crates/codex-plus-core/src/ccs_import.rs
+++ b/crates/codex-plus-core/src/ccs_import.rs
@@ -100,6 +100,7 @@ pub fn relay_profile_from_ccs(
         model_list: String::new(),
         model_windows: String::new(),
         user_agent: String::new(),
+        bedrock: None,
     }
 }
 
diff --git a/crates/codex-plus-core/src/provider_import.rs b/crates/codex-plus-core/src/provider_import.rs
index 26d67caf0..088d519da 100644
--- a/crates/codex-plus-core/src/provider_import.rs
+++ b/crates/codex-plus-core/src/provider_import.rs
@@ -210,6 +210,7 @@ fn relay_profile_from_request(
         model_list: String::new(),
         model_windows: String::new(),
         user_agent: String::new(),
+        bedrock: None,
     }
 }
 
diff --git a/crates/codex-plus-core/src/relay_config.rs b/crates/codex-plus-core/src/relay_config.rs
index 21076b5a9..6a6cfa728 100644
--- a/crates/codex-plus-core/src/relay_config.rs
+++ b/crates/codex-plus-core/src/relay_config.rs
@@ -6,7 +6,7 @@ use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
 use toml_edit::{DocumentMut, Item, Table, TableLike};
 
-use crate::settings::{RelayContextSelection, RelayProfile, RelayProtocol};
+use crate::settings::{BedrockAuthMode, BedrockConfig, RelayContextSelection, RelayProfile, RelayProtocol};
 
 const RELAY_PROVIDER: &str = "custom";
 const LEGACY_RELAY_PROVIDERS: &[&str] = &["CodexPlusPlus", "CodexPP"];
@@ -707,6 +707,8 @@ pub fn backfill_relay_profile_from_home_with_common(
             profile.model = model;
         }
     }
+    // 从回填后的 config_contents 识别 Bedrock 配置，避免切走再切回时丢失 bedrock 字段
+    profile.bedrock = bedrock_config_from_config_text(&profile.config_contents);
     Ok(())
 }
 
@@ -1940,6 +1942,13 @@ pub fn relay_profile_api_key(profile: &RelayProfile) -> String {
 }
 
 fn complete_relay_profile_config(profile: &RelayProfile) -> anyhow::Result<String> {
+    if let Some(bedrock) = &profile.bedrock {
+        return match bedrock.auth_mode {
+            BedrockAuthMode::BearerToken => complete_bedrock_bearer_token_config(profile, bedrock),
+            BedrockAuthMode::AwsProfile => complete_bedrock_aws_profile_config(profile, bedrock),
+        };
+    }
+
     let mut doc = parse_toml_document(&profile.config_contents)?;
     let provider_id = active_or_default_provider_id(&doc);
     set_provider_id(&mut doc, &provider_id);
@@ -2017,6 +2026,16 @@ fn complete_relay_profile_config(profile: &RelayProfile) -> anyhow::Result<Strin
 }
 
 pub fn normalize_relay_profile_for_storage(profile: &mut RelayProfile) -> anyhow::Result<()> {
+    // Secondary validation for Bedrock BearerToken path — last line of defense before persisting.
+    if let Some(bedrock) = &profile.bedrock {
+        if bedrock.auth_mode == BedrockAuthMode::BearerToken {
+            validate_custom_provider_id(&bedrock.provider_id)
+                .map_err(|e| anyhow::anyhow!(e))?;
+            require_non_empty(&bedrock.region, "AWS 区域")?;
+            require_non_empty(&relay_profile_api_key(profile), "Bedrock API Key")?;
+        }
+    }
+
     if profile.model_windows.trim().is_empty() && profile.model_list.contains('[') {
         let (clean_list, windows) =
             crate::model_suffix::migrate_model_list_with_suffixes(&profile.model_list);
@@ -2435,6 +2454,273 @@ fn account_label_from_jwt(token: &str) -> Option<String> {
         .map(ToString::to_string)
 }
 
+// ---------------------------------------------------------------------------
+// Bedrock Mantle URL 模板常量
+//
+// 与 TS 端 `apps/codex-plus-manager/src/bedrock-config.ts` 的
+// `BEDROCK_MANTLE_URL_PREFIX` / `BEDROCK_MANTLE_URL_SUFFIX` 保持一致。
+// 修改这里必须同步修改 TS 常量（前后端都在生成与识别端使用）。
+// ---------------------------------------------------------------------------
+pub(crate) const BEDROCK_MANTLE_URL_PREFIX: &str = "https://bedrock-mantle.";
+pub(crate) const BEDROCK_MANTLE_URL_SUFFIX: &str = ".api.aws/openai/v1";
+
+/// 从 `config_text` 识别这是否是一个 Bedrock 供应商配置，以及走哪条鉴权路径。
+/// 返回 `None` 表示这不是 Bedrock 配置（保持现状交给既有非 Bedrock 回填逻辑处理）。
+///
+/// 逻辑：
+/// 1. `model_provider == "amazon-bedrock"` → AWS Profile 路径，回填 region / aws_profile
+/// 2. `requires_openai_auth == true` 且 `base_url` 匹配 bedrock-mantle 正则 → Bearer Token 路径
+/// 3. 其余 → None
+pub(crate) fn bedrock_config_from_config_text(config_text: &str) -> Option<BedrockConfig> {
+    use crate::settings::default_bedrock_iam_key_validity_days;
+
+    let root_provider = root_key_string(config_text, "model_provider");
+
+    // 路径 1：AWS Profile 路径识别
+    if root_provider.as_deref() == Some("amazon-bedrock") {
+        let region = table_values(config_text, "model_providers.amazon-bedrock.aws")
+            .and_then(|values| values.get("region").cloned())
+            .map(|v| unquote_toml_string(&v))
+            .unwrap_or_default();
+        let aws_profile = table_values(config_text, "model_providers.amazon-bedrock.aws")
+            .and_then(|values| values.get("profile").cloned())
+            .map(|v| unquote_toml_string(&v))
+            .unwrap_or_default();
+
+        return Some(BedrockConfig {
+            auth_mode: BedrockAuthMode::AwsProfile,
+            provider_id: String::new(),
+            region,
+            aws_profile,
+            iam_user_name: String::new(),
+            iam_key_validity_days: default_bedrock_iam_key_validity_days(),
+        });
+    }
+
+    // 路径 2：Bearer Token 路径识别
+    // 需要当前活跃 provider 的 requires_openai_auth == true 且 base_url 匹配 bedrock-mantle 模式
+    let active_provider = root_provider.as_deref()?;
+    let provider_values = table_values(config_text, &format!("model_providers.{active_provider}"))?;
+
+    let requires_auth = provider_values
+        .get("requires_openai_auth")
+        .map(|v| v.trim() == "true")
+        .unwrap_or(false);
+    if !requires_auth {
+        return None;
+    }
+
+    let base_url = provider_values
+        .get("base_url")
+        .map(|v| unquote_toml_string(v))
+        .unwrap_or_default();
+
+    // 匹配 ^<PREFIX><region><SUFFIX>$，其中 region 不含 '.' 或 '/'（与 TS 正则 [^./]+ 等价）。
+    if base_url.starts_with(BEDROCK_MANTLE_URL_PREFIX)
+        && base_url.ends_with(BEDROCK_MANTLE_URL_SUFFIX)
+    {
+        let region_start = BEDROCK_MANTLE_URL_PREFIX.len();
+        let region_end = base_url.len() - BEDROCK_MANTLE_URL_SUFFIX.len();
+        if region_start < region_end {
+            let region = &base_url[region_start..region_end];
+            if !region.is_empty() && !region.contains('.') && !region.contains('/') {
+                return Some(BedrockConfig {
+                    auth_mode: BedrockAuthMode::BearerToken,
+                    provider_id: active_provider.to_string(),
+                    region: region.to_string(),
+                    aws_profile: String::new(),
+                    iam_user_name: String::new(),
+                    iam_key_validity_days: default_bedrock_iam_key_validity_days(),
+                });
+            }
+        }
+    }
+
+    None
+}
+
+/// 校验用户填写的自定义 provider 标识符：不能为空，不能与保留标识符冲突。
+pub fn validate_custom_provider_id(provider_id: &str) -> Result<String, String> {
+    let trimmed = provider_id.trim();
+    if trimmed.is_empty() {
+        return Err("provider 标识符不能为空".to_string());
+    }
+    if RESERVED_MODEL_PROVIDER_IDS.contains(&trimmed) {
+        return Err(format!(
+            "「{trimmed}」与保留供应商标识符冲突，请换一个名称"
+        ));
+    }
+    Ok(trimmed.to_string())
+}
+
+/// 校验字符串非空（trim 后），为空时返回带 label 的错误信息。
+pub(crate) fn require_non_empty(value: &str, label: &str) -> anyhow::Result<String> {
+    let trimmed = value.trim();
+    if trimmed.is_empty() {
+        return Err(anyhow::anyhow!("{label} 不能为空"));
+    }
+    Ok(trimmed.to_string())
+}
+
+/// 确保已知的根级标量赋值行（model、model_provider 等）出现在任何 `[...]` 表头之前。
+///
+/// 扫描第一个 `[...]` 表头之前的所有行，将匹配已知 key 的赋值行提升到文件最前面，
+/// 保持它们之间的相对顺序，然后跟上其余行；表头之后的所有内容按原样保留，
+/// 不再"提升"任何看起来像根级标量的行——这是因为 TOML 语义下，表段之后的
+/// `key = value` 属于所在 `[section]` 的子字段，与根级同名 key 不是同一个东西。
+///
+/// 该函数用于修补 `toml_edit` 在某些写入顺序下会把新加的根级标量写到表段之后
+/// 的问题；调用方只在自己完全掌控的 config（Codex config.toml）上使用它，
+/// 不承诺对任意 TOML 文本语义正确。
+///
+/// 注释行（`#` 开头）不会被认作根级标量赋值行，避免把 `# model = "foo"` 之类的
+/// 说明性注释误当作真正的赋值抢到最前。
+pub(crate) fn ensure_root_scalars_precede_tables(contents: &str) -> String {
+    const ROOT_SCALAR_KEYS: &[&str] = &[
+        "model",
+        "model_provider",
+        "web_search",
+        "model_context_window",
+        "model_auto_compact_token_limit",
+        "model_catalog_json",
+    ];
+
+    let mut scalar_lines: Vec<&str> = Vec::new();
+    let mut other_lines: Vec<&str> = Vec::new();
+    let mut seen_table = false;
+
+    for line in contents.lines() {
+        let trimmed = line.trim();
+
+        // 一旦看到 `[...]` 表头，就把当前及之后所有行都归入 other_lines，
+        // 避免把表段内的同名 key（例如 `[foo] \n model = "x"`）误认为是根级标量赋值。
+        if !seen_table && trimmed.starts_with('[') && trimmed.ends_with(']') {
+            seen_table = true;
+        }
+
+        let is_root_scalar = if seen_table || trimmed.starts_with('#') {
+            false
+        } else if let Some((key, _)) = trimmed.split_once('=') {
+            ROOT_SCALAR_KEYS.contains(&key.trim())
+        } else {
+            false
+        };
+
+        if is_root_scalar {
+            scalar_lines.push(line);
+        } else {
+            other_lines.push(line);
+        }
+    }
+
+    let mut result = scalar_lines.join("\n");
+    if !scalar_lines.is_empty() && !other_lines.is_empty() {
+        result.push('\n');
+    }
+    result.push_str(&other_lines.join("\n"));
+    ensure_trailing_newline(result)
+}
+
+/// Bearer Token 鉴权路径的 config.toml 生成。
+///
+/// 校验 provider_id / region / API Key 后，生成包含自定义 provider 表的配置文本。
+/// 任一校验失败即通过 `?` 提前返回 `Err`，不产出任何字符串。
+///
+/// `model_providers.<provider_id>` 采用**整表替换**语义（与 AWS Profile 分支一致）：
+/// 即便先前已存在同名 provider 表并携带 `env_key` / `http_headers` 等杂字段，
+/// 也会被完全丢弃，避免旧字段残留影响 Codex 客户端的行为。
+pub(crate) fn complete_bedrock_bearer_token_config(
+    profile: &RelayProfile,
+    bedrock: &BedrockConfig,
+) -> anyhow::Result<String> {
+    let provider_id = validate_custom_provider_id(&bedrock.provider_id)
+        .map_err(|e| anyhow::anyhow!(e))?;
+    let region = require_non_empty(&bedrock.region, "AWS 区域")?;
+    let api_key = require_non_empty(&relay_profile_api_key(profile), "Bedrock API Key")?;
+
+    let mut doc = parse_toml_document(&profile.config_contents)?;
+    set_provider_id(&mut doc, &provider_id);
+
+    // 写入模型（如果非空）
+    let model = relay_profile_model(profile);
+    let (model, _) = crate::model_suffix::parse_model_suffix(&model);
+    if !model.trim().is_empty() {
+        doc["model"] = toml_edit::value(model.trim());
+    }
+
+    // Requirement 3.3：无条件写入 web_search = "disabled"
+    doc["web_search"] = toml_edit::value("disabled");
+
+    // 构建全新的 provider 表——不复用 `retain_only_provider_table` + 字段覆盖的写法，
+    // 因为那样会保留同名旧表下的杂字段（P2 卫生问题）。
+    let base_url = format!("{BEDROCK_MANTLE_URL_PREFIX}{region}{BEDROCK_MANTLE_URL_SUFFIX}");
+    let mut provider_table = toml_edit::Table::new();
+    provider_table.insert("name", toml_edit::value(provider_id.as_str()));
+    provider_table.insert("wire_api", toml_edit::value("responses"));
+    provider_table.insert("requires_openai_auth", toml_edit::value(true));
+    provider_table.insert("base_url", toml_edit::value(base_url.as_str()));
+    provider_table.insert(
+        "experimental_bearer_token",
+        toml_edit::value(api_key.as_str()),
+    );
+
+    // 整表替换 model_providers.<provider_id>，并清空同级其它 provider 兄弟表，
+    // 与 AWS Profile 分支保持一致。
+    let providers = table_mut_or_insert(&mut doc, "model_providers")?;
+    providers.clear();
+    providers.insert(&provider_id, toml_edit::Item::Table(provider_table));
+
+    let rendered = ensure_trailing_newline(doc.to_string());
+    let reordered = move_model_providers_before_profiles(&rendered);
+    Ok(ensure_root_scalars_precede_tables(&reordered))
+}
+
+/// AWS Profile 鉴权路径的配置生成分支。
+/// 使用 Codex 保留的 `amazon-bedrock` provider，配置 `[model_providers.amazon-bedrock.aws]`
+/// 子表（region 必填，profile 可选），不需要 API Key 或 base_url。
+pub(crate) fn complete_bedrock_aws_profile_config(
+    profile: &RelayProfile,
+    bedrock: &BedrockConfig,
+) -> anyhow::Result<String> {
+    const BEDROCK_PROVIDER_ID: &str = "amazon-bedrock";
+
+    let region = require_non_empty(&bedrock.region, "AWS 区域")?;
+
+    let mut doc = parse_toml_document(&profile.config_contents)?;
+    set_provider_id(&mut doc, BEDROCK_PROVIDER_ID);
+
+    // 写入模型（如果非空）
+    let model = relay_profile_model(profile);
+    let (model, _) = crate::model_suffix::parse_model_suffix(&model);
+    if !model.trim().is_empty() {
+        doc["model"] = toml_edit::value(model.trim());
+    }
+
+    // 只保留当前 provider 表，清除其他
+    retain_only_provider_table(&mut doc, BEDROCK_PROVIDER_ID);
+
+    // 构建 model_providers.amazon-bedrock 表，仅包含 aws 子表
+    let aws_profile = bedrock.aws_profile.trim();
+
+    let mut aws_table = toml_edit::Table::new();
+    aws_table.insert("region", toml_edit::value(region.as_str()));
+    if !aws_profile.is_empty() {
+        aws_table.insert("profile", toml_edit::value(aws_profile));
+    }
+
+    let mut provider_table = toml_edit::Table::new();
+    provider_table.insert("aws", toml_edit::Item::Table(aws_table));
+
+    // 整表替换 model_providers.amazon-bedrock
+    // 使用 table_mut_or_insert 确保 model_providers 作为 TOML 表存在
+    let providers = table_mut_or_insert(&mut doc, "model_providers")?;
+    providers.insert(BEDROCK_PROVIDER_ID, toml_edit::Item::Table(provider_table));
+
+    let rendered = ensure_trailing_newline(doc.to_string());
+    let reordered = move_model_providers_before_profiles(&rendered);
+    Ok(ensure_root_scalars_precede_tables(&reordered))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -2494,6 +2780,831 @@ mod tests {
         };
         assert!(relay_profile_model(&empty).trim().is_empty());
     }
+
+    #[test]
+    fn ensure_root_scalars_precede_tables_does_not_steal_in_table_scalars() {
+        // Regression: 表段之内的 `model = "..."` 属于所在 section 的子字段，
+        // 不应该被误当作根级标量抢走到最前面（会破坏 TOML 语义）。
+        let input = "\
+[custom_section]
+model = \"foo\"
+name = \"bar\"
+
+[another_section]
+model_provider = \"baz\"
+";
+        let output = ensure_root_scalars_precede_tables(input);
+        // 输出的第一行不能是表段内的 `model = "foo"`
+        let first_line = output.lines().next().unwrap_or("");
+        assert!(
+            first_line.trim_start().starts_with('['),
+            "First line should still be a table header, but got: {first_line:?}\nFull output:\n{output}"
+        );
+        // model = "foo" 依然出现在 [custom_section] 之后（未被上提）
+        let model_line_idx = output
+            .lines()
+            .position(|line| line.trim() == "model = \"foo\"")
+            .expect("expected `model = \"foo\"` line in output");
+        let custom_section_idx = output
+            .lines()
+            .position(|line| line.trim() == "[custom_section]")
+            .expect("expected [custom_section] line in output");
+        assert!(
+            model_line_idx > custom_section_idx,
+            "model in [custom_section] must remain after its section header; \
+             model at line {model_line_idx}, section at line {custom_section_idx}\nOutput:\n{output}"
+        );
+    }
+
+    #[test]
+    fn ensure_root_scalars_precede_tables_ignores_commented_scalars() {
+        // Regression: `# model = "foo"` 是注释，不是根级赋值，不应被上提。
+        let input = "\
+# model = \"commented-out\"
+
+[custom_section]
+name = \"bar\"
+
+model_provider = \"real\"
+";
+        let output = ensure_root_scalars_precede_tables(input);
+        // 注释行不会被识别为根级 scalar，因此原地保留
+        // 而 `model_provider = "real"` 出现在 [custom_section] 之后，
+        // 按新语义视作表内字段，不被上提（也不会破坏 TOML 语义）。
+        let first_line = output.lines().next().unwrap_or("");
+        assert!(
+            first_line.starts_with("# model"),
+            "Comment line should remain at the top, but got: {first_line:?}\nOutput:\n{output}"
+        );
+    }
+
+    #[test]
+    fn complete_bedrock_bearer_token_config_drops_stale_provider_fields() {
+        // Regression: Bearer Token 分支采用整表替换语义，
+        // 同名旧 provider 表下的杂字段（如 env_key / http_headers）不应残留。
+        let profile = RelayProfile {
+            config_contents: "\
+model_provider = \"my-bedrock\"
+
+[model_providers.my-bedrock]
+name = \"leftover-name\"
+env_key = \"OLD_KEY\"
+env_http_headers = { X-Trace = \"leftover\" }
+http_headers = { Authorization = \"Bearer stale\" }
+
+[model_providers.other-leftover]
+name = \"should-be-cleared\"
+"
+                .to_string(),
+            api_key: "brk-test-key".to_string(),
+            bedrock: Some(BedrockConfig {
+                auth_mode: BedrockAuthMode::BearerToken,
+                provider_id: "my-bedrock".to_string(),
+                region: "us-east-2".to_string(),
+                aws_profile: String::new(),
+                iam_user_name: String::new(),
+                iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+            }),
+            ..RelayProfile::default()
+        };
+        let bedrock = profile.bedrock.as_ref().unwrap();
+        let output = complete_bedrock_bearer_token_config(&profile, bedrock)
+            .expect("bearer token config should succeed");
+
+        // 5 个 Bedrock 必需字段
+        assert!(output.contains("name = \"my-bedrock\""), "expected fresh name, got:\n{output}");
+        assert!(output.contains("wire_api = \"responses\""), "expected wire_api, got:\n{output}");
+        assert!(output.contains("requires_openai_auth = true"), "expected requires_openai_auth, got:\n{output}");
+        assert!(
+            output.contains("base_url = \"https://bedrock-mantle.us-east-2.api.aws/openai/v1\""),
+            "expected bedrock-mantle base_url, got:\n{output}"
+        );
+        assert!(
+            output.contains("experimental_bearer_token = \"brk-test-key\""),
+            "expected experimental_bearer_token, got:\n{output}"
+        );
+
+        // 旧脏字段不应残留
+        assert!(!output.contains("leftover-name"), "stale name should be dropped, got:\n{output}");
+        assert!(!output.contains("OLD_KEY"), "stale env_key value should be dropped, got:\n{output}");
+        assert!(!output.contains("env_key"), "stale env_key field should be dropped, got:\n{output}");
+        assert!(!output.contains("env_http_headers"), "stale env_http_headers should be dropped, got:\n{output}");
+        assert!(!output.contains("http_headers"), "stale http_headers should be dropped, got:\n{output}");
+        assert!(!output.contains("leftover"), "stale header values should be dropped, got:\n{output}");
+        assert!(!output.contains("should-be-cleared"), "sibling provider should be cleared, got:\n{output}");
+        assert!(!output.contains("[model_providers.other-leftover]"), "sibling provider table should be dropped, got:\n{output}");
+    }
+
+    #[test]
+    fn bedrock_config_from_config_text_returns_none_for_non_bedrock_configs() {
+        // 1. 标准自定义供应商配置
+        let custom_config = "model_provider = \"custom\"\nmodel = \"some-model\"\n\n[model_providers.custom]\nname = \"custom\"\nbase_url = \"https://example.com\"\nwire_api = \"responses\"\nrequires_openai_auth = true\n";
+        assert_eq!(
+            bedrock_config_from_config_text(custom_config),
+            None,
+            "Custom provider config should return None"
+        );
+
+        // 2. Official/OpenAI 风格配置
+        let openai_config = "model_provider = \"openai\"\nmodel = \"gpt-4\"\n\n[model_providers.openai]\nname = \"openai\"\nbase_url = \"https://api.openai.com/v1\"\nwire_api = \"responses\"\nrequires_openai_auth = true\n";
+        assert_eq!(
+            bedrock_config_from_config_text(openai_config),
+            None,
+            "OpenAI-style config should return None"
+        );
+
+        // 3. 不含 model_provider 的配置
+        let no_provider_config = "model = \"some-model\"\n\n[model_providers.foo]\nname = \"foo\"\nbase_url = \"https://foo.example.com\"\n";
+        assert_eq!(
+            bedrock_config_from_config_text(no_provider_config),
+            None,
+            "Config without model_provider should return None"
+        );
+
+        // 4. requires_openai_auth = true 但 base_url 不匹配 bedrock-mantle 模式
+        let non_bedrock_url_config = "model_provider = \"myapi\"\nmodel = \"deepseek-v4\"\n\n[model_providers.myapi]\nname = \"myapi\"\nbase_url = \"https://api.myservice.com/v1\"\nwire_api = \"responses\"\nrequires_openai_auth = true\n";
+        assert_eq!(
+            bedrock_config_from_config_text(non_bedrock_url_config),
+            None,
+            "Non-bedrock-mantle base_url config should return None"
+        );
+
+        // 5. 空字符串
+        assert_eq!(
+            bedrock_config_from_config_text(""),
+            None,
+            "Empty config should return None"
+        );
+    }
+
+    #[test]
+    fn backfill_does_not_set_bedrock_for_non_bedrock_config() {
+        let temp = tempfile::tempdir().unwrap();
+        // 写入一个标准自定义供应商的 config.toml（非 Bedrock 形状）
+        std::fs::write(
+            temp.path().join("config.toml"),
+            "model_provider = \"custom\"\nmodel = \"gpt-4\"\n\n[model_providers.custom]\nname = \"custom\"\nwire_api = \"responses\"\nrequires_openai_auth = true\nbase_url = \"https://example.com\"\n",
+        )
+        .unwrap();
+        std::fs::write(temp.path().join("auth.json"), "{}\n").unwrap();
+
+        let mut profile = RelayProfile {
+            relay_mode: crate::settings::RelayMode::PureApi,
+            protocol: crate::settings::RelayProtocol::Responses,
+            config_contents: "model_provider = \"custom\"\nmodel = \"gpt-4\"\n\n[model_providers.custom]\nname = \"custom\"\nwire_api = \"responses\"\nrequires_openai_auth = true\nbase_url = \"https://example.com\"\n"
+                .to_string(),
+            auth_contents: "{}\n".to_string(),
+            bedrock: None,
+            ..RelayProfile::default()
+        };
+        let mut common = String::new();
+
+        backfill_relay_profile_from_home_with_common(temp.path(), &mut profile, &mut common)
+            .unwrap();
+
+        // 回填后 bedrock 字段应保持 None
+        assert!(
+            profile.bedrock.is_none(),
+            "bedrock should remain None for non-Bedrock config after backfill, got: {:?}",
+            profile.bedrock
+        );
+    }
+
+    mod proptest_property_tests {
+        use super::*;
+        use proptest::prelude::*;
+
+        // Feature: amazon-bedrock-provider, Property 10: 保留字冲突校验（通用，不限于 Bedrock）
+        //
+        // *For any* 字符串，`validate_custom_provider_id` 返回 `Err` 当且仅当该字符串（trim 后）为空，
+        // 或该字符串（trim 后）属于 `RESERVED_MODEL_PROVIDER_IDS` 集合；其余情况返回 `Ok`。
+        //
+        // **Validates: Requirements 2.2**
+        proptest! {
+            #[test]
+            fn property_10_reserved_id_conflict_validation(input in ".*") {
+                let trimmed = input.trim();
+                let result = validate_custom_provider_id(&input);
+
+                if trimmed.is_empty() {
+                    // trim 后为空 → 必须返回 Err
+                    prop_assert!(result.is_err(), "Expected Err for empty-after-trim input {:?}, got Ok", input);
+                } else if RESERVED_MODEL_PROVIDER_IDS.contains(&trimmed) {
+                    // trim 后命中保留字 → 必须返回 Err
+                    prop_assert!(result.is_err(), "Expected Err for reserved id {:?}, got Ok", trimmed);
+                } else {
+                    // 其余情况 → 必须返回 Ok(trimmed)
+                    prop_assert!(result.is_ok(), "Expected Ok for non-reserved non-empty id {:?}, got Err: {:?}", trimmed, result);
+                    prop_assert_eq!(result.unwrap(), trimmed.to_string());
+                }
+            }
+        }
+
+        // 补充：显式使用保留字作为输入，确保每一个保留字都被拒绝
+        proptest! {
+            #[test]
+            fn property_10_reserved_ids_explicitly_rejected(
+                idx in 0..RESERVED_MODEL_PROVIDER_IDS.len(),
+                prefix_spaces in "\\s{0,5}",
+                suffix_spaces in "\\s{0,5}",
+            ) {
+                let reserved = RESERVED_MODEL_PROVIDER_IDS[idx];
+                let input = format!("{}{}{}", prefix_spaces, reserved, suffix_spaces);
+                let result = validate_custom_provider_id(&input);
+                prop_assert!(result.is_err(), "Expected Err for reserved id {:?} (with whitespace), got Ok", input);
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 3: 根级标量顺序不变式
+        //
+        // *For any* 任意预先存在的 `config_contents`（用 `proptest` 生成随机根级
+        // `key = "value"` 赋值行 + 随机 `[table.name]` 表头 + 表内字段的 TOML 文本），
+        // 对其调用 `ensure_root_scalars_precede_tables` 后，输出文本中
+        // `model_provider`/`model` 所在行的行号都小于第一个 `[...]` 表头所在行的行号。
+        //
+        // 说明：TOML 语义下，第一个表头之后的 `key = value` 属于所在 `[section]`
+        // 的子字段，与根级同名 key 不是同一个东西。生成器把"根级 scalar 行"限制
+        // 在第一个表头之前，反映这一 TOML 语义约束——`ensure_root_scalars_precede_tables`
+        // 不再"暴力抢走"表段内的同名字段。
+        //
+        // **Validates: Requirements 4.2**
+
+        /// 策略：先生成 0..N 行"表头之前的行"（scalar / 注释 / 空行），再拼接
+        /// 0..M 行"表头及之后的行"（表头 / 表内字段 / 注释 / 空行），保证根级
+        /// scalar 行不会出现在任何 `[...]` 表头之后。
+        fn arb_toml_like_text() -> impl Strategy<Value = String> {
+            // 已知根级标量 key 列表
+            const SCALAR_KEYS: &[&str] = &[
+                "model",
+                "model_provider",
+                "web_search",
+                "model_context_window",
+                "model_auto_compact_token_limit",
+                "model_catalog_json",
+            ];
+
+            let scalar_line = prop::sample::select(SCALAR_KEYS)
+                .prop_flat_map(|key| {
+                    "[a-zA-Z0-9_\\-]{1,20}".prop_map(move |val| {
+                        format!("{} = \"{}\"", key, val)
+                    })
+                });
+
+            let table_header = "[a-zA-Z_][a-zA-Z0-9_]{0,10}(\\.[a-zA-Z_][a-zA-Z0-9_]{0,10}){0,2}"
+                .prop_map(|name| format!("[{}]", name));
+
+            let non_root_scalar_line = prop_oneof![
+                Just(String::new()),                         // 空行
+                Just("# comment line".to_string()),          // 注释
+                "[a-z_]{1,10} = \"[a-z]{1,10}\""             // 非根级 key 的赋值行
+                    .prop_filter("must not be a root scalar key", |line| {
+                        if let Some((key, _)) = line.split_once('=') {
+                            let key = key.trim();
+                            !SCALAR_KEYS.contains(&key)
+                        } else {
+                            true
+                        }
+                    }),
+            ];
+
+            // 表头之前：允许 scalar 与非 scalar 的普通行
+            let pre_header_line = prop_oneof![
+                3 => scalar_line,
+                3 => non_root_scalar_line.clone(),
+            ];
+
+            // 表头及之后：只允许表头与非 scalar 行（表内字段视作 non-scalar）
+            let post_header_line = prop_oneof![
+                3 => table_header,
+                3 => non_root_scalar_line,
+            ];
+
+            (
+                prop::collection::vec(pre_header_line, 0..15),
+                prop::collection::vec(post_header_line, 0..15),
+            )
+                .prop_map(|(pre, post)| {
+                    let mut lines = pre;
+                    lines.extend(post);
+                    lines.join("\n")
+                })
+        }
+
+        proptest! {
+            #[test]
+            fn property_3_root_scalars_precede_tables(input in arb_toml_like_text()) {
+                let output = ensure_root_scalars_precede_tables(&input);
+
+                // 已知根级标量 key 集合
+                const SCALAR_KEYS: &[&str] = &[
+                    "model",
+                    "model_provider",
+                    "web_search",
+                    "model_context_window",
+                    "model_auto_compact_token_limit",
+                    "model_catalog_json",
+                ];
+
+                // 找到输出中第一个表头行的行号（0-based）
+                let first_table_header_line: Option<usize> = output.lines().enumerate()
+                    .find(|(_, line)| {
+                        let trimmed = line.trim();
+                        trimmed.starts_with('[') && trimmed.ends_with(']') && !trimmed.starts_with("[[")
+                    })
+                    .map(|(idx, _)| idx);
+
+                // 检查每个根级标量行是否都出现在第一个表头之前
+                for (line_idx, line) in output.lines().enumerate() {
+                    let trimmed = line.trim();
+                    let is_root_scalar = if let Some((key, _)) = trimmed.split_once('=') {
+                        let key = key.trim();
+                        SCALAR_KEYS.contains(&key)
+                    } else {
+                        false
+                    };
+
+                    if is_root_scalar {
+                        if let Some(first_table) = first_table_header_line {
+                            prop_assert!(
+                                line_idx < first_table,
+                                "Root scalar at line {} ({:?}) is NOT before first table header at line {}.\nOutput:\n{}",
+                                line_idx, trimmed, first_table, output
+                            );
+                        }
+                        // 如果没有表头行，则标量行可以出现在任何位置（属性自动满足）
+                    }
+                }
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 1: Bearer Token 配置生成正确性
+        //
+        // *For any* 非保留的 provider 标识符字符串、任意非空 region 字符串、任意非空
+        // API Key 字符串，生成结果中顶层 `model_provider` 等于该标识符；`base_url` 等于
+        // `https://bedrock-mantle.<region>.api.aws/openai/v1`；`requires_openai_auth`
+        // 为 `true`；`experimental_bearer_token` 等于该 API Key；顶层 `web_search`
+        // 等于 `"disabled"`。
+        //
+        // **Validates: Requirements 2.1, 2.3, 3.1, 3.3**
+        proptest! {
+            #[test]
+            fn property_1_bearer_token_config_correctness(
+                provider_id in "[a-z][a-z0-9]{1,12}",
+                region in "[a-z][a-z0-9\\-]{2,15}",
+                api_key in "[a-zA-Z0-9]{5,30}",
+            ) {
+                // 构造 RelayProfile，设置 api_key 和 bedrock bearer token 配置
+                let profile = RelayProfile {
+                    api_key: api_key.clone(),
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::BearerToken,
+                        provider_id: provider_id.clone(),
+                        region: region.clone(),
+                        aws_profile: String::new(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+
+                let bedrock = profile.bedrock.as_ref().unwrap();
+                let result = complete_bedrock_bearer_token_config(&profile, bedrock);
+
+                // 结果必须为 Ok
+                prop_assert!(result.is_ok(), "Expected Ok, got Err: {:?}", result);
+                let output = result.unwrap();
+
+                // 验证 model_provider = "<provider_id>"
+                let expected_provider = format!("model_provider = \"{}\"", provider_id);
+                prop_assert!(
+                    output.contains(&expected_provider),
+                    "Output should contain {:?}, but got:\n{}",
+                    expected_provider, output
+                );
+
+                // 验证 base_url = "https://bedrock-mantle.<region>.api.aws/openai/v1"
+                let expected_base_url = format!(
+                    "base_url = \"https://bedrock-mantle.{}.api.aws/openai/v1\"",
+                    region
+                );
+                prop_assert!(
+                    output.contains(&expected_base_url),
+                    "Output should contain {:?}, but got:\n{}",
+                    expected_base_url, output
+                );
+
+                // 验证 requires_openai_auth = true
+                prop_assert!(
+                    output.contains("requires_openai_auth = true"),
+                    "Output should contain 'requires_openai_auth = true', but got:\n{}",
+                    output
+                );
+
+                // 验证 experimental_bearer_token = "<api_key>"
+                let expected_token = format!("experimental_bearer_token = \"{}\"", api_key);
+                prop_assert!(
+                    output.contains(&expected_token),
+                    "Output should contain {:?}, but got:\n{}",
+                    expected_token, output
+                );
+
+                // 验证 web_search = "disabled"
+                prop_assert!(
+                    output.contains("web_search = \"disabled\""),
+                    "Output should contain 'web_search = \"disabled\"', but got:\n{}",
+                    output
+                );
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 2: AWS Profile 配置生成正确性
+        //
+        // *For any* 任意非空 region 字符串、任意（可为空）AWS profile 名称字符串，
+        // 生成结果中顶层 `model_provider` 恒等于 `"amazon-bedrock"`；
+        // `model_providers.amazon-bedrock` 表含 `[model_providers.amazon-bedrock.aws]` section
+        // 带 `region = "<region>"`；aws_profile 非空时含 `profile = "<aws_profile>"`，
+        // 为空时不含 `profile =`；不含 `requires_openai_auth`/`base_url`/`experimental_bearer_token`。
+        //
+        // **Validates: Requirements 4.1, 4.3, 5.1, 5.2, 5.3**
+        proptest! {
+            #[test]
+            fn property_2_aws_profile_config_correctness(
+                region in "[a-z][a-z0-9\\-]{2,15}",
+                aws_profile in "(|[a-z][a-z0-9\\-]{1,15})",
+            ) {
+                let profile = RelayProfile {
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::AwsProfile,
+                        region: region.clone(),
+                        aws_profile: aws_profile.clone(),
+                        provider_id: String::new(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+
+                let bedrock = profile.bedrock.as_ref().unwrap();
+                let result = complete_bedrock_aws_profile_config(&profile, bedrock);
+
+                // 结果必须为 Ok
+                prop_assert!(result.is_ok(), "Expected Ok, got Err: {:?}", result);
+                let output = result.unwrap();
+
+                // 验证 model_provider = "amazon-bedrock"
+                prop_assert!(
+                    output.contains("model_provider = \"amazon-bedrock\""),
+                    "Output should contain 'model_provider = \"amazon-bedrock\"', but got:\n{}",
+                    output
+                );
+
+                // 验证 [model_providers.amazon-bedrock.aws] section 含 region = "<region>"
+                let expected_region = format!("region = \"{}\"", region);
+                prop_assert!(
+                    output.contains(&expected_region),
+                    "Output should contain {:?}, but got:\n{}",
+                    expected_region, output
+                );
+
+                // 验证 aws_profile 非空时含 profile = "<aws_profile>"，为空时不含 profile =
+                let trimmed_profile = aws_profile.trim();
+                if !trimmed_profile.is_empty() {
+                    let expected_profile = format!("profile = \"{}\"", trimmed_profile);
+                    prop_assert!(
+                        output.contains(&expected_profile),
+                        "Output should contain {:?} for non-empty aws_profile, but got:\n{}",
+                        expected_profile, output
+                    );
+                } else {
+                    // 在 [model_providers.amazon-bedrock.aws] section 内不应有 profile =
+                    prop_assert!(
+                        !output.contains("profile ="),
+                        "Output should NOT contain 'profile =' for empty aws_profile, but got:\n{}",
+                        output
+                    );
+                }
+
+                // 验证不含 requires_openai_auth / base_url / experimental_bearer_token
+                prop_assert!(
+                    !output.contains("requires_openai_auth"),
+                    "Output should NOT contain 'requires_openai_auth', but got:\n{}",
+                    output
+                );
+                prop_assert!(
+                    !output.contains("base_url"),
+                    "Output should NOT contain 'base_url', but got:\n{}",
+                    output
+                );
+                prop_assert!(
+                    !output.contains("experimental_bearer_token"),
+                    "Output should NOT contain 'experimental_bearer_token', but got:\n{}",
+                    output
+                );
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 4: Region 必填校验
+        //
+        // *For any* 空字符串或全空白字符串作为 region，`require_non_empty` 返回 `Err`；
+        // *for any* 非空非空白字符串返回 `Ok`。
+        // 另外验证 `complete_bedrock_bearer_token_config` 与 `complete_bedrock_aws_profile_config`
+        // 在 region 为空/空白时返回 `Err`，在 region 非空时返回 `Ok`。
+        //
+        // **Validates: Requirements 2.4, 5.4**
+
+        proptest! {
+            #[test]
+            fn property_4_region_required_validation(
+                empty_region in "\\s{0,20}",
+                non_empty_region in "[a-z][a-z0-9\\-]{2,15}",
+            ) {
+                // Part 1: require_non_empty 对空/空白字符串返回 Err
+                let err_result = require_non_empty(&empty_region, "region");
+                prop_assert!(
+                    err_result.is_err(),
+                    "Expected Err for empty/whitespace region {:?}, got Ok",
+                    empty_region
+                );
+
+                // Part 2: require_non_empty 对非空非空白字符串返回 Ok
+                let ok_result = require_non_empty(&non_empty_region, "region");
+                prop_assert!(
+                    ok_result.is_ok(),
+                    "Expected Ok for non-empty region {:?}, got Err: {:?}",
+                    non_empty_region, ok_result
+                );
+                prop_assert_eq!(ok_result.unwrap(), non_empty_region.trim().to_string());
+
+                // Part 3: complete_bedrock_bearer_token_config 在 region 为空/空白时返回 Err
+                let bearer_profile_empty_region = RelayProfile {
+                    api_key: "valid-api-key-12345".to_string(),
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::BearerToken,
+                        provider_id: "my-bedrock-provider".to_string(),
+                        region: empty_region.clone(),
+                        aws_profile: String::new(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+                let bedrock_bearer = bearer_profile_empty_region.bedrock.as_ref().unwrap();
+                let bearer_result = complete_bedrock_bearer_token_config(&bearer_profile_empty_region, bedrock_bearer);
+                prop_assert!(
+                    bearer_result.is_err(),
+                    "Expected Err for bearer token config with empty region {:?}, got Ok",
+                    empty_region
+                );
+
+                // Part 4: complete_bedrock_aws_profile_config 在 region 为空/空白时返回 Err
+                let aws_profile_empty_region = RelayProfile {
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::AwsProfile,
+                        provider_id: String::new(),
+                        region: empty_region.clone(),
+                        aws_profile: "default".to_string(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+                let bedrock_aws = aws_profile_empty_region.bedrock.as_ref().unwrap();
+                let aws_result = complete_bedrock_aws_profile_config(&aws_profile_empty_region, bedrock_aws);
+                prop_assert!(
+                    aws_result.is_err(),
+                    "Expected Err for AWS profile config with empty region {:?}, got Ok",
+                    empty_region
+                );
+
+                // Part 5: 两条路径在 region 非空时返回 Ok
+                let bearer_profile_valid_region = RelayProfile {
+                    api_key: "valid-api-key-12345".to_string(),
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::BearerToken,
+                        provider_id: "my-bedrock-provider".to_string(),
+                        region: non_empty_region.clone(),
+                        aws_profile: String::new(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+                let bedrock_bearer_valid = bearer_profile_valid_region.bedrock.as_ref().unwrap();
+                let bearer_ok_result = complete_bedrock_bearer_token_config(&bearer_profile_valid_region, bedrock_bearer_valid);
+                prop_assert!(
+                    bearer_ok_result.is_ok(),
+                    "Expected Ok for bearer token config with valid region {:?}, got Err: {:?}",
+                    non_empty_region, bearer_ok_result
+                );
+
+                let aws_profile_valid_region = RelayProfile {
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::AwsProfile,
+                        provider_id: String::new(),
+                        region: non_empty_region.clone(),
+                        aws_profile: "default".to_string(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+                let bedrock_aws_valid = aws_profile_valid_region.bedrock.as_ref().unwrap();
+                let aws_ok_result = complete_bedrock_aws_profile_config(&aws_profile_valid_region, bedrock_aws_valid);
+                prop_assert!(
+                    aws_ok_result.is_ok(),
+                    "Expected Ok for AWS profile config with valid region {:?}, got Err: {:?}",
+                    non_empty_region, aws_ok_result
+                );
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 11: Bearer Token 路径生成的 Base URL 与既有测试机制一致
+        //
+        // *For any* 非保留的 provider 标识符字符串与任意非空 region 字符串，对生成后的
+        // `RelayProfile`（`config_contents` 设为 `complete_bedrock_bearer_token_config` 的
+        // 生成结果）调用既有 `relay_profile_base_url`，其返回值恒等于
+        // `https://bedrock-mantle.<region>.api.aws/openai/v1`。
+        //
+        // **Validates: Requirements 9.3**
+        proptest! {
+            #[test]
+            fn property_11_bearer_token_base_url_consistency(
+                provider_id in "[a-z][a-z0-9]{1,12}",
+                region in "[a-z][a-z0-9\\-]{2,15}",
+            ) {
+                // 构造带 BedrockConfig (BearerToken mode) 的 RelayProfile
+                let api_key = "test-api-key-for-property-11".to_string();
+                let profile = RelayProfile {
+                    api_key: api_key.clone(),
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::BearerToken,
+                        provider_id: provider_id.clone(),
+                        region: region.clone(),
+                        aws_profile: String::new(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+
+                // 调用 complete_bedrock_bearer_token_config 生成配置
+                let bedrock = profile.bedrock.as_ref().unwrap();
+                let config_result = complete_bedrock_bearer_token_config(&profile, bedrock);
+                prop_assert!(config_result.is_ok(), "Expected Ok from config generation, got Err: {:?}", config_result);
+                let config_contents = config_result.unwrap();
+
+                // 构造一个新的 RelayProfile，将生成的 config 设为 config_contents
+                let profile_with_config = RelayProfile {
+                    config_contents: config_contents,
+                    ..RelayProfile::default()
+                };
+
+                // 调用既有 relay_profile_base_url 函数
+                let base_url = relay_profile_base_url(&profile_with_config);
+
+                // 断言返回的 base_url 等于期望值
+                let expected_base_url = format!("https://bedrock-mantle.{}.api.aws/openai/v1", region);
+                prop_assert_eq!(
+                    base_url,
+                    expected_base_url,
+                    "relay_profile_base_url should return the Bedrock Mantle URL for region {:?}",
+                    region
+                );
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 9: AWS Profile 生成与识别往返
+        //
+        // *For any* 任意非空 region 字符串与任意（可为空）AWS profile 名称字符串，将
+        // `complete_bedrock_aws_profile_config` 生成的 config.toml 文本交给
+        // `bedrock_config_from_config_text` 解析，得到的 `auth_mode` 恒为 `AwsProfile`，
+        // `region` 等于原始 region，`aws_profile` 等于原始名称（未填写时为空字符串）。
+        //
+        // **Validates: Requirements 10.1**
+        proptest! {
+            #[test]
+            fn property_9_aws_profile_roundtrip(
+                region in "[a-z][a-z0-9\\-]{2,15}",
+                aws_profile in "[a-zA-Z0-9_\\-]{0,20}",
+            ) {
+                // 构造带 BedrockConfig (AwsProfile mode) 的 RelayProfile
+                let profile = RelayProfile {
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::AwsProfile,
+                        provider_id: String::new(),
+                        region: region.clone(),
+                        aws_profile: aws_profile.clone(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+
+                let bedrock = profile.bedrock.as_ref().unwrap();
+
+                // 调用 complete_bedrock_aws_profile_config 生成配置文本
+                let config_result = complete_bedrock_aws_profile_config(&profile, bedrock);
+                prop_assert!(config_result.is_ok(), "Expected Ok from config generation, got Err: {:?}", config_result);
+                let config_text = config_result.unwrap();
+
+                // 将生成的文本交给 bedrock_config_from_config_text 解析
+                let parsed = bedrock_config_from_config_text(&config_text);
+                prop_assert!(parsed.is_some(), "Expected Some(BedrockConfig) from parsing, got None for config:\n{}", config_text);
+                let parsed = parsed.unwrap();
+
+                // 断言 auth_mode 为 AwsProfile
+                prop_assert_eq!(
+                    parsed.auth_mode,
+                    crate::settings::BedrockAuthMode::AwsProfile,
+                    "auth_mode should be AwsProfile"
+                );
+
+                // 断言 region 等于原始 region（trimmed）
+                let expected_region = region.trim().to_string();
+                prop_assert_eq!(
+                    parsed.region,
+                    expected_region,
+                );
+
+                // 断言 aws_profile 等于原始名称（trim 后，空则为空字符串）
+                let expected_profile = if aws_profile.trim().is_empty() {
+                    String::new()
+                } else {
+                    aws_profile.trim().to_string()
+                };
+                prop_assert_eq!(
+                    parsed.aws_profile,
+                    expected_profile,
+                );
+            }
+        }
+
+        // Feature: amazon-bedrock-provider, Property 8: Bearer Token 生成与识别往返
+        //
+        // *For any* 非保留的 provider 标识符字符串与任意非空 region 字符串（API Key 任取一个
+        // 非空字符串），将 complete_bedrock_bearer_token_config 生成的 config.toml 文本交给
+        // `bedrock_config_from_config_text` 解析，得到的 `auth_mode` 恒为 `BearerToken`，
+        // `provider_id` 等于原始标识符，`region` 等于原始 region。
+        //
+        // **Validates: Requirements 10.2**
+        proptest! {
+            #[test]
+            fn property_8_bearer_token_roundtrip(
+                provider_id in "[a-z][a-z0-9]{1,12}",
+                region in "[a-z][a-z0-9\\-]{2,15}",
+            ) {
+                // 使用固定非空 API Key
+                let api_key = "test-api-key-for-roundtrip".to_string();
+
+                // 构造带 BedrockConfig (BearerToken mode) 的 RelayProfile
+                let profile = RelayProfile {
+                    api_key: api_key.clone(),
+                    bedrock: Some(crate::settings::BedrockConfig {
+                        auth_mode: crate::settings::BedrockAuthMode::BearerToken,
+                        provider_id: provider_id.clone(),
+                        region: region.clone(),
+                        aws_profile: String::new(),
+                        iam_user_name: String::new(),
+                        iam_key_validity_days: crate::settings::default_bedrock_iam_key_validity_days(),
+                    }),
+                    ..RelayProfile::default()
+                };
+
+                let bedrock = profile.bedrock.as_ref().unwrap();
+
+                // 调用 complete_bedrock_bearer_token_config 生成配置文本
+                let config_result = complete_bedrock_bearer_token_config(&profile, bedrock);
+                prop_assert!(config_result.is_ok(), "Expected Ok from config generation, got Err: {:?}", config_result);
+                let config_text = config_result.unwrap();
+
+                // 将生成的文本交给 bedrock_config_from_config_text 解析
+                let parsed = bedrock_config_from_config_text(&config_text);
+                prop_assert!(parsed.is_some(), "Expected Some(BedrockConfig) from parsing, got None for config:\n{}", config_text);
+                let parsed = parsed.unwrap();
+
+                // 断言 auth_mode 为 BearerToken
+                prop_assert_eq!(
+                    parsed.auth_mode,
+                    crate::settings::BedrockAuthMode::BearerToken,
+                    "auth_mode should be BearerToken"
+                );
+
+                // 断言 provider_id 等于原始标识符
+                prop_assert_eq!(
+                    parsed.provider_id,
+                    provider_id.clone(),
+                    "provider_id should match the original identifier"
+                );
+
+                // 断言 region 等于原始 region
+                prop_assert_eq!(
+                    parsed.region,
+                    region.clone(),
+                    "region should match the original region"
+                );
+            }
+        }
+    }
 }
 
 pub fn root_key_string(contents: &str, key: &str) -> Option<String> {
diff --git a/crates/codex-plus-core/src/relay_switch.rs b/crates/codex-plus-core/src/relay_switch.rs
index 6a84d37a9..d3e84e087 100644
--- a/crates/codex-plus-core/src/relay_switch.rs
+++ b/crates/codex-plus-core/src/relay_switch.rs
@@ -5,7 +5,7 @@ use anyhow::Context;
 use crate::relay_config::{
     backfill_relay_profile_from_home_with_common, relay_config_status_from_home,
 };
-use crate::settings::{BackendSettings, LaunchMode, RelayMode, SettingsStore};
+use crate::settings::{BackendSettings, BedrockAuthMode, LaunchMode, RelayMode, SettingsStore};
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RelaySwitchResult {
@@ -90,7 +90,16 @@ fn apply_selected_relay_profile(
         )?
     };
     let status = relay_config_status_from_home(home);
-    if relay.relay_mode == RelayMode::PureApi && !status.configured {
+    // Bedrock AWS Profile 模式的 config.toml 形状（顶层 `model_provider = "amazon-bedrock"` +
+    // `[model_providers.amazon-bedrock.aws]` 子表）不带 `requires_openai_auth`/`base_url`/
+    // `experimental_bearer_token`，因此 `relay_config_status_from_home` 的 `configured`
+    // 恒为 false。这里显式绕过检查，避免把合法的 AWS Profile 配置误判为"未检测到完整 custom provider"。
+    let is_bedrock_aws_profile = relay
+        .bedrock
+        .as_ref()
+        .map(|bedrock| bedrock.auth_mode == BedrockAuthMode::AwsProfile)
+        .unwrap_or(false);
+    if relay.relay_mode == RelayMode::PureApi && !status.configured && !is_bedrock_aws_profile {
         anyhow::bail!(
             "纯 API 配置写入后未检测到完整 custom provider，请检查 config.toml 和供应商 API Key。"
         );
diff --git a/crates/codex-plus-core/src/settings.rs b/crates/codex-plus-core/src/settings.rs
index e54611b61..ccc12129e 100644
--- a/crates/codex-plus-core/src/settings.rs
+++ b/crates/codex-plus-core/src/settings.rs
@@ -93,6 +93,37 @@ pub struct RelayProfile {
         skip_serializing_if = "String::is_empty"
     )]
     pub user_agent: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub bedrock: Option<BedrockConfig>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub enum BedrockAuthMode {
+    #[default]
+    BearerToken,
+    AwsProfile,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct BedrockConfig {
+    #[serde(default)]
+    pub auth_mode: BedrockAuthMode,
+    #[serde(default)]
+    pub provider_id: String,
+    #[serde(default)]
+    pub region: String,
+    #[serde(default)]
+    pub aws_profile: String,
+    #[serde(default)]
+    pub iam_user_name: String,
+    #[serde(default = "default_bedrock_iam_key_validity_days")]
+    pub iam_key_validity_days: String,
+}
+
+pub fn default_bedrock_iam_key_validity_days() -> String {
+    "90".to_string()
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize, Default)]
@@ -149,6 +180,7 @@ impl Default for RelayProfile {
             model_list: String::new(),
             model_windows: String::new(),
             user_agent: String::new(),
+            bedrock: None,
         }
     }
 }
@@ -417,6 +449,7 @@ impl BackendSettings {
                 model_list: String::new(),
                 model_windows: String::new(),
                 user_agent: String::new(),
+                bedrock: None,
             };
         }
 
@@ -462,6 +495,7 @@ impl BackendSettings {
             model_list: String::new(),
             model_windows: String::new(),
             user_agent: String::new(),
+            bedrock: None,
         }
     }
 
@@ -2150,4 +2184,71 @@ experimental_bearer_token = "sk-existing""#
         assert!(!updated.provider_sync_enabled);
         assert_eq!(std::fs::read_to_string(&path).unwrap(), original);
     }
+
+    #[test]
+    fn relay_profile_bedrock_none_does_not_serialize_bedrock_key() {
+        // 当 bedrock 为 None 时，序列化输出不应包含 "bedrock" 键，
+        // 以确保旧的 settings.json 落盘格式不变
+        let profile = RelayProfile::default();
+        assert_eq!(profile.bedrock, None);
+
+        let value = serde_json::to_value(&profile).unwrap();
+        assert!(
+            value.get("bedrock").is_none(),
+            "bedrock: None should be skipped during serialization"
+        );
+
+        let json_str = serde_json::to_string(&profile).unwrap();
+        assert!(
+            !json_str.contains("\"bedrock\""),
+            "serialized JSON should not contain bedrock key when it is None"
+        );
+    }
+
+    #[test]
+    fn relay_profile_bedrock_some_roundtrip_serialization() {
+        // 当 bedrock 为 Some(..) 时，序列化 → 反序列化往返应产生相同的结构
+        let config = BedrockConfig {
+            auth_mode: BedrockAuthMode::AwsProfile,
+            provider_id: "my-bedrock-provider".to_string(),
+            region: "us-east-2".to_string(),
+            aws_profile: "bedrock-dev".to_string(),
+            iam_user_name: "deploy-user".to_string(),
+            iam_key_validity_days: "30".to_string(),
+        };
+
+        let profile = RelayProfile {
+            bedrock: Some(config.clone()),
+            ..RelayProfile::default()
+        };
+
+        let serialized = serde_json::to_string(&profile).unwrap();
+        assert!(
+            serialized.contains("\"bedrock\""),
+            "serialized JSON should contain bedrock key when it is Some"
+        );
+
+        let deserialized: RelayProfile = serde_json::from_str(&serialized).unwrap();
+        assert_eq!(deserialized.bedrock, Some(config));
+
+        // 验证 BedrockAuthMode::BearerToken（默认值）的往返
+        let config_bearer = BedrockConfig {
+            auth_mode: BedrockAuthMode::BearerToken,
+            provider_id: "bearer-provider".to_string(),
+            region: "us-west-2".to_string(),
+            aws_profile: String::new(),
+            iam_user_name: String::new(),
+            iam_key_validity_days: "90".to_string(),
+        };
+
+        let profile_bearer = RelayProfile {
+            bedrock: Some(config_bearer.clone()),
+            ..RelayProfile::default()
+        };
+
+        let serialized_bearer = serde_json::to_string(&profile_bearer).unwrap();
+        let deserialized_bearer: RelayProfile =
+            serde_json::from_str(&serialized_bearer).unwrap();
+        assert_eq!(deserialized_bearer.bedrock, Some(config_bearer));
+    }
 }
diff --git a/crates/codex-plus-core/tests/launcher.rs b/crates/codex-plus-core/tests/launcher.rs
index d2df5f0b7..78927a0d3 100644
--- a/crates/codex-plus-core/tests/launcher.rs
+++ b/crates/codex-plus-core/tests/launcher.rs
@@ -1096,6 +1096,7 @@ async fn launch_starts_helper_when_chat_protocol_proxy_is_enabled() {
             model_list: String::new(),
             model_windows: String::new(),
             user_agent: String::new(),
+            bedrock: None,
         }],
         active_relay_id: "relay-chat".to_string(),
         ..BackendSettings::default()
diff --git a/crates/codex-plus-core/tests/relay_switch.rs b/crates/codex-plus-core/tests/relay_switch.rs
index 4ec2f7d60..00434ac73 100644
--- a/crates/codex-plus-core/tests/relay_switch.rs
+++ b/crates/codex-plus-core/tests/relay_switch.rs
@@ -1,7 +1,8 @@
 use codex_plus_core::relay_switch::switch_relay_profile_in_home;
 use codex_plus_core::settings::{
     AggregateRelayMember, AggregateRelayProfile, AggregateRelayStrategy, BackendSettings,
-    LaunchMode, RelayMode, RelayProfile, SettingsStore,
+    BedrockAuthMode, BedrockConfig, LaunchMode, RelayMode, RelayProfile, SettingsStore,
+    default_bedrock_iam_key_validity_days,
 };
 
 #[test]
@@ -221,6 +222,158 @@ goals = true
     assert!(returned.api_key.is_empty());
 }
 
+#[test]
+fn switch_to_bedrock_bearer_token_writes_expected_config() {
+    let temp = tempfile::tempdir().unwrap();
+    let home = temp.path().join("codex");
+    std::fs::create_dir(&home).unwrap();
+    // 用一份合法的初始 config 作种子，方便 backfill 有内容可读
+    std::fs::write(
+        home.join("config.toml"),
+        "model_provider = \"custom\"\n\n[model_providers.custom]\nname = \"custom\"\nwire_api = \"responses\"\nrequires_openai_auth = true\nbase_url = \"https://example.com/v1\"\n",
+    )
+    .unwrap();
+    std::fs::write(home.join("auth.json"), r#"{"OPENAI_API_KEY":"sk-init"}"#).unwrap();
+
+    let store = SettingsStore::new(temp.path().join("settings.json"));
+    let seed_profile = pure_profile("seed", "https://example.com/v1", "sk-init");
+    let bedrock_profile = RelayProfile {
+        id: "bedrock".to_string(),
+        name: "Bedrock (Bearer)".to_string(),
+        relay_mode: RelayMode::PureApi,
+        model: "openai.gpt-oss-120b-1:0".to_string(),
+        api_key: "brk-test-key-12345".to_string(),
+        bedrock: Some(BedrockConfig {
+            auth_mode: BedrockAuthMode::BearerToken,
+            provider_id: "my-bedrock".to_string(),
+            region: "us-east-2".to_string(),
+            aws_profile: String::new(),
+            iam_user_name: String::new(),
+            iam_key_validity_days: default_bedrock_iam_key_validity_days(),
+        }),
+        ..RelayProfile::default()
+    };
+    let original = BackendSettings {
+        active_relay_id: "seed".to_string(),
+        relay_profiles: vec![seed_profile.clone(), bedrock_profile.clone()],
+        ..BackendSettings::default()
+    };
+    store.save(&original).unwrap();
+
+    let next = BackendSettings {
+        active_relay_id: "bedrock".to_string(),
+        relay_profiles: vec![seed_profile, bedrock_profile],
+        ..BackendSettings::default()
+    };
+    switch_relay_profile_in_home(&store, &home, next, "seed").unwrap();
+
+    let live = std::fs::read_to_string(home.join("config.toml")).unwrap();
+    // Property 1 关键片段
+    assert!(
+        live.contains("model_provider = \"my-bedrock\""),
+        "expected model_provider = \"my-bedrock\", got:\n{live}"
+    );
+    assert!(
+        live.contains("base_url = \"https://bedrock-mantle.us-east-2.api.aws/openai/v1\""),
+        "expected bedrock-mantle base_url, got:\n{live}"
+    );
+    assert!(
+        live.contains("requires_openai_auth = true"),
+        "expected requires_openai_auth = true, got:\n{live}"
+    );
+    assert!(
+        live.contains("experimental_bearer_token = \"brk-test-key-12345\""),
+        "expected experimental_bearer_token, got:\n{live}"
+    );
+    assert!(
+        live.contains("web_search = \"disabled\""),
+        "expected web_search = \"disabled\", got:\n{live}"
+    );
+}
+
+#[test]
+fn switch_to_bedrock_aws_profile_writes_expected_config() {
+    let temp = tempfile::tempdir().unwrap();
+    let home = temp.path().join("codex");
+    std::fs::create_dir(&home).unwrap();
+    // 用一份合法的初始 config 作种子
+    std::fs::write(
+        home.join("config.toml"),
+        "model_provider = \"custom\"\n\n[model_providers.custom]\nname = \"custom\"\nwire_api = \"responses\"\nrequires_openai_auth = true\nbase_url = \"https://example.com/v1\"\n",
+    )
+    .unwrap();
+    std::fs::write(home.join("auth.json"), r#"{"OPENAI_API_KEY":"sk-init"}"#).unwrap();
+
+    let store = SettingsStore::new(temp.path().join("settings.json"));
+    let seed_profile = pure_profile("seed", "https://example.com/v1", "sk-init");
+    let bedrock_profile = RelayProfile {
+        id: "bedrock-aws".to_string(),
+        name: "Bedrock (AWS Profile)".to_string(),
+        relay_mode: RelayMode::PureApi,
+        model: "openai.gpt-oss-120b-1:0".to_string(),
+        bedrock: Some(BedrockConfig {
+            auth_mode: BedrockAuthMode::AwsProfile,
+            provider_id: String::new(),
+            region: "us-west-2".to_string(),
+            aws_profile: "my-dev".to_string(),
+            iam_user_name: String::new(),
+            iam_key_validity_days: default_bedrock_iam_key_validity_days(),
+        }),
+        ..RelayProfile::default()
+    };
+    let original = BackendSettings {
+        active_relay_id: "seed".to_string(),
+        relay_profiles: vec![seed_profile.clone(), bedrock_profile.clone()],
+        ..BackendSettings::default()
+    };
+    store.save(&original).unwrap();
+
+    let next = BackendSettings {
+        active_relay_id: "bedrock-aws".to_string(),
+        relay_profiles: vec![seed_profile, bedrock_profile],
+        ..BackendSettings::default()
+    };
+    switch_relay_profile_in_home(&store, &home, next, "seed").unwrap();
+
+    let live = std::fs::read_to_string(home.join("config.toml")).unwrap();
+
+    // Property 2 关键片段
+    assert!(
+        live.contains("model_provider = \"amazon-bedrock\""),
+        "expected model_provider = \"amazon-bedrock\", got:\n{live}"
+    );
+    assert!(
+        live.contains("[model_providers.amazon-bedrock.aws]"),
+        "expected [model_providers.amazon-bedrock.aws] table header, got:\n{live}"
+    );
+    assert!(
+        live.contains("region = \"us-west-2\""),
+        "expected region = \"us-west-2\", got:\n{live}"
+    );
+    assert!(
+        live.contains("profile = \"my-dev\""),
+        "expected profile = \"my-dev\", got:\n{live}"
+    );
+
+    // Requirement 4.2：顶层 model_provider 所在行号 < 第一个 [...] 表头所在行号
+    let lines: Vec<&str> = live.lines().collect();
+    let model_provider_line = lines
+        .iter()
+        .position(|line| line.trim_start().starts_with("model_provider ="))
+        .expect("expected a model_provider line in generated config");
+    let first_table_line = lines
+        .iter()
+        .position(|line| {
+            let trimmed = line.trim_start();
+            trimmed.starts_with('[') && trimmed.contains(']')
+        })
+        .expect("expected at least one [...] table header in generated config");
+    assert!(
+        model_provider_line < first_table_line,
+        "model_provider (line {model_provider_line}) must precede first table (line {first_table_line}); got:\n{live}"
+    );
+}
+
 fn pure_profile(id: &str, base_url: &str, key: &str) -> RelayProfile {
     RelayProfile {
         id: id.to_string(),
diff --git a/tools/i18n-codemod.mjs b/tools/i18n-codemod.mjs
index 1a10cffd8..5acf28fcc 100644
--- a/tools/i18n-codemod.mjs
+++ b/tools/i18n-codemod.mjs
@@ -39,6 +39,7 @@ const WRITE = process.argv.includes("--write");
 const FILES = [
   "src/App.tsx",
   "src/components/ProviderPresetSelector.tsx",
+  "src/components/BedrockRelayProfileEditor.tsx",
 ];
 
 const CJK = /[㐀-䶿一-鿿　-〿＀-￯]/;