[BUG] Claude apps gateway ignores ANTHROPIC_BEDROCK_REGION_PREFIX and has no config key for global.* Bedrock inference profiles

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

There is no supported way to make a Claude apps gateway serve global Bedrock
cross-region inference profiles (global.anthropic.*). The built-in catalog is
hardcoded to the geographic US tier (us.anthropic.*), and none of the three
levers an operator would reach for work:

1. No upstream key. The bedrock upstream schema is a strict object of

name / provider / region / base_url / auth. There is no
region_prefix (or equivalent), and because unknown keys fail boot, adding
one is a config error rather than an override.

1. ANTHROPIC_BEDROCK_REGION_PREFIX is not effective on the gateway. The env var

exists and validates against ["us","eu","apac","jp","au","global"], but it
is only read by the client-side model-map builder, which runs when the
client's provider is bedrock. The gateway's model routing resolves
provider_ids.bedrock straight off the static catalog and never calls the
prefix resolver, so setting the var in the gateway container changes nothing.

1. Setting ANTHROPIC_BEDROCK_REGION_PREFIX on clients is also not effective. A client

pointed at a gateway resolves its provider to gateway, not bedrock, so the
Bedrock prefix logic never executes there either — clients send first-party
ids (claude-opus-5) and the gateway does the translation.

That leaves hand-enumerating every model in a models: block with an explicit
upstream_model.bedrock: global.anthropic.…. That works, but it opts the
deployment out of auto_include_builtin_models for those entries permanently:
each new model in the catalog silently reverts to us.* until someone edits
gateway.yaml and redeploys. The client-side Bedrock path, by contrast, both
honors the env var and verifies availability with ListInferenceProfiles
before committing to a prefix, warning per-model when a profile is missing. The
gateway has neither.

What Should Happen?

Either of these resolves it:

1. A region_prefix: key on the bedrock upstream, validated against the

same value set the client-side env var already uses, applied to built-in
catalog ids for that upstream so it composes with
auto_include_builtin_models: true. Per-upstream rather than per-process is
the right scope, since a gateway can front several Bedrock upstreams in
different geos.

1. Honor ANTHROPIC_BEDROCK_REGION_PREFIX in the gateway process as a

process-wide default for bedrock upstreams. Cheaper, but it can't express
different prefixes for different upstreams.

Ideally with the client's availability check ported over: resolve the prefix
against ListInferenceProfiles at boot and log per-model when the requested
prefix has no profile in the account, instead of surfacing it as a 400 on the
first request.

Environment Info

• Traced through the 2.1.224 native binary (darwin-arm64, `GIT_SHA

8a2a469b68f918917492973f3b16bd1682b9f82c`). Not a runtime repro — this is a
static read of the routing path, filed because the behavior is
unconditional in the code and matches what we saw deploying.

• Gateway deployment: claude gateway --config gateway.yaml, linux-x64 binary in

a Debian container on ECS Fargate, single bedrock upstream, auth: {} via
task role.

Additional Context

Routing path in 2.1.224, for anyone confirming:

• The catalog is built once at module load by a zero-argument factory; every

entry's provider_ids.bedrock is a us.anthropic.* literal
(us.anthropic.claude-opus-5, us.anthropic.claude-sonnet-5,
us.anthropic.claude-haiku-4-5-20251001-v1:0, …). The upstream's region is
not an input to it — region only builds the endpoint host
(bedrock-runtime.<region>.amazonaws.com).

• Per-request translation looks up models[].upstream_model[<upstream name>]

first and returns it if present; otherwise it falls through to
catalogEntry[upstream.provider], i.e. the static us.* literal.

• The prefix resolver that reads ANTHROPIC_BEDROCK_REGION_PREFIX (and derives

us / eu / apac / global from AWS_REGION otherwise, forcing us-gov
for us-gov-*) is only called from the client-side model-map builder. Its
call sites are all in that one module; the gateway's translation function is
not among them.

Related: #84547 (same function — that report's "omit an upstream to skip it"
lever is inert because the fallback branch is taken whenever the model is listed
or auto_include_builtin_models is true, so omitting the bedrock key
mechanically translates to us.* instead of skipping), #84658 (opposite
direction: a client sending global.* to a geographic upstream), #83690
(metering does not distinguish the two tiers).

Docs gaps found while investigating this are filed separately as #84876.