fix(web): boto3 in dev deps + Bedrock AWS-credential labelling

Two Generate-panel fixes:
- boto3>=1.40 added to root dev dependency-group so 'uv run studyloop
  web' has a working Bedrock backend (workspace members sync without
  their optional-deps, so the repo .venv lacked boto3 → generation died
  with 'No module named boto3').
- Bedrock provider relabelled: shows 'needs AWS credentials' (not 'needs
  API key') and an AWS-cred hint instead of the key box; Generate is
  blocked until creds resolve. Fixed a latent bug where x-show on a
  nested <span> inside <option> is ignored by browsers (option text is
  flattened) — the unavailable-suffix rendered on every provider. Now
  built via providerOptionLabel(p). Verified live in browser.

Author: NetDevAutomate

packages/studyloop/src/studyloop/web/static/index.html

@@ -802,10 +802,11 @@ <h2>Generate</h2>
               <select x-model="form.provider" @change="onProviderChange()">
                 <option value="">— pick a provider —</option>
                 <template x-for="p in providers" :key="p.slug">
-                  <option :value="p.slug">
-                    <span x-text="p.label"></span>
-                    <span x-show="!p.available"> — needs API key</span>
-                  </option>
+                  <!-- The unavailable-suffix must be part of the option's text,
+                       not a nested <span x-show>: browsers flatten <option>
+                       content and ignore display:none on children, so a hidden
+                       span still renders. Build the whole label via x-text. -->
+                  <option :value="p.slug" x-text="providerOptionLabel(p)"></option>
                 </template>
               </select>
             </label>
@@ -833,6 +834,26 @@ <h2>Generate</h2>
               </div>
             </div>
 
+            <!-- Bedrock uses AWS SigV4 credentials, not a typed API key, so it
+                 gets a guidance hint rather than the key-entry box above. -->
+            <div class="form-row bedrock-creds-hint"
+                 x-show="needsBedrockCreds"
+                 x-transition>
+              <span>AWS credentials</span>
+              <div style="display:flex; flex-direction:column; gap:0.35rem;">
+                <small class="key-hint">
+                  Bedrock authenticates with your AWS credentials, not a typed key.
+                  Set <code>AWS_PROFILE</code> (or <code>AWS_ACCESS_KEY_ID</code>)
+                  before launching StudyLoop, then reload this page.
+                </small>
+                <small class="key-hint">
+                  No credentials yet? Run your Bedrock credential setup
+                  (e.g. <code>aictl claude bedrock</code>) or pick an API-key
+                  provider above.
+                </small>
+              </div>
+            </div>
+
             <label class="form-row" x-show="form.provider">
               <span>Model</span>
               <select x-model="form.model">
@@ -1373,6 +1394,24 @@ <h2>Start a Study Session</h2>
         return !!p && !p.available && p.adapter !== 'bedrock';
       },
 
+      get needsBedrockCreds() {
+        // Bedrock authenticates with AWS SigV4 credentials (IAM role /
+        // AWS_PROFILE / access keys), not a typed API key. When it is chosen
+        // but credentials don't resolve, show an AWS-specific hint instead of
+        // the key-entry box.
+        const p = this.selectedProvider;
+        return !!p && !p.available && p.adapter === 'bedrock';
+      },
+
+      providerOptionLabel(p) {
+        // Build the full <option> text here — x-show/display:none does NOT
+        // work on elements nested inside <option> (browsers render the
+        // flattened text content). Bedrock uses AWS creds, not a typed key.
+        if (p.available) return p.label;
+        const suffix = p.adapter === 'bedrock' ? ' — needs AWS credentials' : ' — needs API key';
+        return p.label + suffix;
+      },
+
       async init() {
         // The tree is 3-level: publisher → course → lesson file. Load the
         // publishers (study-tree top level) and the LLM providers up front;
@@ -1481,6 +1520,9 @@ <h2>Start a Study Session</h2>
         // submission until the key is entered, else the job fails async on the
         // backend (CardGenerationError) instead of a clean disabled button.
         if (this.needsKey) return false;
+        // Same reasoning for Bedrock: block until AWS credentials resolve,
+        // else the job fails async with CardGenerationError.
+        if (this.needsBedrockCreds) return false;
         if (!this.form.publisher) return false;
         if (!this.form.course) return false;
         if (this.form.kinds.length === 0) return false;

packages/studyloop/tests/test_web_key_entry_e2e.py

@@ -104,6 +104,24 @@ def server(stub_config: Path) -> Generator[subprocess.Popen, None, None]:
             }
         ],
     },
+    {
+        # Bedrock uses AWS SigV4 creds, not a typed key. Unavailable → it must
+        # show the AWS-creds hint (not the key box) and block Generate.
+        "slug": "bedrock",
+        "label": "AWS Bedrock",
+        "adapter": "bedrock",
+        "auth_env": "AWS_PROFILE",
+        "available": False,
+        "models": [
+            {
+                "id": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+                "label": "Claude Haiku 4.5 (Bedrock)",
+                "cost_tier": "cheap",
+                "thinking": False,
+                "notes": "",
+            }
+        ],
+    },
 ]
 
 
@@ -261,3 +279,89 @@ def test_save_key_shows_error_on_rejection(self, page: Page) -> None:
         page.click(".api-key-entry button")
         page.wait_for_selector(".api-key-entry .key-error", state="visible", timeout=3000)
         assert "rejected" in page.inner_text(".api-key-entry .key-error").lower()
+
+
+class TestBedrockCredsHint:
+    """Bedrock authenticates with AWS creds, not a typed key.
+
+    When Bedrock is selected but unavailable it must NOT show the API-key
+    box (you can't type a SigV4 credential), must show the AWS-creds hint
+    instead, and must block Generate so the job never reaches the backend
+    only to die with a CardGenerationError.
+    """
+
+    def test_bedrock_shows_aws_hint_not_key_box(self, page: Page) -> None:
+        _route_providers(page, anthropic_available=False)
+        _goto_generate(page)
+        page.wait_for_function(
+            "() => window.Alpine.$data("
+            "document.querySelector('[x-data=\"generatePanel()\"]')"
+            ").providers.length > 0",
+            timeout=3000,
+        )
+        page.select_option('select[x-model="form.provider"]', "bedrock")
+
+        # AWS-creds hint visible; API-key input NOT present.
+        page.wait_for_selector(".bedrock-creds-hint", state="visible", timeout=3000)
+        assert page.is_visible(".bedrock-creds-hint")
+        assert not page.is_visible(".api-key-entry input[type='password']")
+
+        # needsBedrockCreds true, needsKey false.
+        state = page.evaluate(
+            "() => { const d = window.Alpine.$data("
+            "document.querySelector('[x-data=\"generatePanel()\"]'));"
+            " return { bedrock: d.needsBedrockCreds, key: d.needsKey }; }"
+        )
+        assert state["bedrock"] is True
+        assert state["key"] is False
+
+        # The rendered <option>.label must say AWS credentials, NOT "API key".
+        # x-show on a nested <span> is silently ignored inside <option> (the
+        # browser flattens option text), so the suffix is built in
+        # providerOptionLabel() and asserted here on the real .label property.
+        label = page.eval_on_selector(
+            "select[x-model='form.provider'] option[value='bedrock']",
+            "el => el.label",
+        )
+        assert "needs AWS credentials" in label, label
+        assert "API key" not in label, label
+
+    def test_available_provider_option_has_no_suffix(self, page: Page) -> None:
+        # Regression: the suffix must NOT appear on available providers. The
+        # original nested-span x-show rendered it on every option regardless.
+        _route_providers(page, anthropic_available=True)
+        _goto_generate(page)
+        page.wait_for_function(
+            "() => window.Alpine.$data("
+            "document.querySelector('[x-data=\"generatePanel()\"]')"
+            ").providers.length > 0",
+            timeout=3000,
+        )
+        label = page.eval_on_selector(
+            "select[x-model='form.provider'] option[value='anthropic']",
+            "el => el.label",
+        )
+        assert label == "Anthropic", f"available provider should have no suffix, got: {label!r}"
+
+    def test_bedrock_unavailable_blocks_generate(self, page: Page) -> None:
+        _route_providers(page, anthropic_available=False)
+        _goto_generate(page)
+        page.wait_for_function(
+            "() => window.Alpine.$data("
+            "document.querySelector('[x-data=\"generatePanel()\"]')"
+            ").providers.length > 0",
+            timeout=3000,
+        )
+        # Satisfy every OTHER submit precondition so the bedrock-creds guard is
+        # the only thing that could block submission.
+        page.evaluate(
+            "() => { const d = window.Alpine.$data("
+            "document.querySelector('[x-data=\"generatePanel()\"]'));"
+            " d.form.publisher = 'p'; d.form.course = 'c'; }"
+        )
+        page.select_option('select[x-model="form.provider"]', "bedrock")
+        page.wait_for_selector(".bedrock-creds-hint", state="visible", timeout=3000)
+
+        assert page.is_disabled('button[type="submit"]'), (
+            "Generate enabled despite needsBedrockCreds=true — canSubmit() lacks the guard"
+        )

pyproject.toml

@@ -30,6 +30,12 @@ dev = [
     "pytest-asyncio>=1.3.0",
     "mcp[cli]>=1.0.0",
     "bandit>=1.8",
+    # boto3 powers the Bedrock content generator (studyloop[bedrock]). It is
+    # in the dev group so a plain `uv sync` gives `uv run studyloop web` a
+    # working Bedrock backend — otherwise generation dies with
+    # "No module named 'boto3'" because workspace members are synced without
+    # their optional-dependencies.
+    "boto3>=1.40",
 ]
 
 [build-system]