feat(models): bump platform defaults to Claude Opus 5.5 / Haiku 5.5 (#953)

agent/Dockerfile

@@ -73,10 +73,13 @@ RUN corepack enable && corepack prepare yarn@stable --activate || corepack enabl
 
 # Install Claude Code CLI (the Python SDK requires this binary)
 # Then update known vulnerable transitive packages where fixed versions exist.
-# Pinned 2.1.191 to match the CLI bundled by claude-agent-sdk 0.2.110 (see
+# Pinned 2.1.301 to match the CLI bundled by claude-agent-sdk 0.2.168 (see
 # agent/pyproject.toml) — the SDK and the on-PATH CLI must agree on the control
-# protocol. This version also has the awsCredentialExport behavior #215 needs:
-# returned creds are cached until 5 min before the JSON's `Expiration`, so an
+# protocol. The Claude 5.5 models the platform defaults to (#953) are rejected
+# by CLI builds older than 2.1.280 ("does not support this model"), so this pin
+# is also what makes the default model invocable at all. It also keeps the
+# awsCredentialExport behavior #215 needs (present since 2.1.176): returned
+# creds are cached until 5 min before the JSON's `Expiration`, so an
 # 8 h task re-assumes the 1 h-capped SessionRole before expiry. Older builds
 # only refreshed hourly on a timer, racing the role-chaining cap.
 # claude-code@2.1.x ships an error-shim at bin/claude.exe that its postinstall
@@ -87,7 +90,7 @@ RUN corepack enable && corepack prepare yarn@stable --activate || corepack enabl
 # after the install so the native binary is placed at build time, and hard-verify
 # it exec's (``claude --version`` fails the build if the shim is still on PATH).
 RUN npm install -g npm@latest && \
-    npm install -g @anthropic-ai/claude-code@2.1.191 && \
+    npm install -g @anthropic-ai/claude-code@2.1.301 && \
     CLAUDE_NPM_ROOT="$(npm root -g)/@anthropic-ai/claude-code" && \
     npm --prefix "${CLAUDE_NPM_ROOT}" update tar minimatch glob cross-spawn picomatch && \
     node "${CLAUDE_NPM_ROOT}/install.cjs" && \

agent/README.md

@@ -119,11 +119,11 @@ The `run.sh` script overrides the container's default CMD to run `python /app/sr
 | `AWS_SECRET_ACCESS_KEY` | Conditional† | | Explicit keys, if you are not using CLI-based resolution |
 | `AWS_SESSION_TOKEN` | No | | For temporary credentials |
 | `AWS_PROFILE` | No | | Profile for `aws configure export-credentials` in `run.sh`, or default profile when using the `~/.aws` mount fallback |
-| `ANTHROPIC_MODEL` | No | `global.anthropic.claude-opus-5` | Bedrock **inference profile** ID for `InvokeModel` (see [inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-use.html)). Must be a geo-prefixed profile ID matching the deployment's `bedrockGeoRegion`, not a bare foundation-model ID — see [Model configuration](../docs/guides/DEVELOPER_GUIDE.md#model-configuration) |
+| `ANTHROPIC_MODEL` | No | `global.anthropic.claude-opus-5-5` | Bedrock **inference profile** ID for `InvokeModel` (see [inference profiles](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-use.html)). Must be a geo-prefixed profile ID matching the deployment's `bedrockGeoRegion`, not a bare foundation-model ID — see [Model configuration](../docs/guides/DEVELOPER_GUIDE.md#model-configuration) |
 | `MAX_TURNS` | No | `100` | Max agent turns before stopping |
 | `MAX_BUDGET_USD` | No | | **Local batch only** (shell env when running `entrypoint.py` directly). Range 0.01–100; agent stops when the budget is reached. For deployed AgentCore **server** mode and production tasks, set **`max_budget_usd`** on task creation (REST API, CLI `--max-budget`, or Blueprint default); the orchestrator sends it in the `/invocations` JSON body — server mode does not read `MAX_BUDGET_USD` from the environment. |
 | `DRY_RUN` | No | | Set to `1` to validate config and print the prompt without running the agent |
-| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | No | `global.anthropic.claude-haiku-4-5-20251001-v1:0` | Bedrock **inference profile** ID for the small/fast auxiliary model — the pre-flight safety check and WebFetch summarization (see below). Set by the CDK stack (`cdk/src/stacks/agent.ts` (the runtime environment block)), which derives the prefix from `bedrockGeoRegion` — a geo prefix is required |
+| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | No | `global.anthropic.claude-haiku-5-5` | Bedrock **inference profile** ID for the small/fast auxiliary model — the pre-flight safety check and WebFetch summarization (see below). Set by the CDK stack (`cdk/src/stacks/agent.ts` (the runtime environment block)), which derives the prefix from `bedrockGeoRegion` — a geo prefix is required |
 | `NUDGES_TABLE_NAME` | No | | **Phase 2.** DynamoDB table for mid-task user nudges (`<user_nudge>` XML blocks injected between turns). If unset, the agent runs without nudge support — `nudge_reader.read_pending()` returns `[]` and logs a WARN once. Set automatically by the CDK stack on both AgentCore runtimes. |
 | `JIRA_APP_ACTOR_PROXY_URL` | No | | Resolved per-task from the Jira tenant secret. Forge v2 web-trigger URL used for app-authored Jira comments and transitions. |
 | `JIRA_APP_ACTOR_SHARED_SECRET` | No | | Resolved per-task from the Jira tenant secret. HMAC key for the Forge proxy; redacted from agent diagnostics. |
@@ -133,7 +133,7 @@ The `run.sh` script overrides the container's default CMD to run `python /app/sr
 including non-Jira tasks, so a warm AgentCore process cannot expose one
 tenant's OAuth or Forge credential to the next task.
 
-**Bedrock model access (main model):** Configuring `ANTHROPIC_MODEL` and IAM credentials is not enough. Your AWS account must be able to **invoke** that model in Amazon Bedrock: follow [Request access to models](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html) (Marketplace permissions on first use, Anthropic first-time use where required, valid payment method for Marketplace-backed models). Always use an inference profile ID such as `global.anthropic.claude-opus-5`: a bare foundation-model ID cannot be invoked with on-demand throughput and Bedrock rejects it with `ValidationException`. IAM must also grant the model — see [Model configuration](../docs/guides/DEVELOPER_GUIDE.md#model-configuration) for the full layering. If the CLI stops with a message that the model is not available on your Bedrock deployment, fix model access in the console or switch `ANTHROPIC_MODEL` to an entitled profile, then retry.
+**Bedrock model access (main model):** Configuring `ANTHROPIC_MODEL` and IAM credentials is not enough. Your AWS account must be able to **invoke** that model in Amazon Bedrock: follow [Request access to models](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html) (Marketplace permissions on first use, Anthropic first-time use where required, valid payment method for Marketplace-backed models). Always use an inference profile ID such as `global.anthropic.claude-opus-5-5`: a bare foundation-model ID cannot be invoked with on-demand throughput and Bedrock rejects it with `ValidationException`. IAM must also grant the model — see [Model configuration](../docs/guides/DEVELOPER_GUIDE.md#model-configuration) for the full layering. If the CLI stops with a message that the model is not available on your Bedrock deployment, fix model access in the console or switch `ANTHROPIC_MODEL` to an entitled profile, then retry.
 
 **Pre-flight check model**: Claude Code runs a quick safety verification using a small Haiku model before executing each tool command. On Bedrock, the default Haiku model ID may not be enabled in your account, causing the check to time out with *"Pre-flight check is taking longer than expected"* warnings. The agent sets `ANTHROPIC_DEFAULT_HAIKU_MODEL` to a known-available Bedrock Haiku model ID to avoid this. If you see pre-flight timeout warnings, verify that this model is enabled in your Bedrock model access settings.
 
@@ -145,7 +145,7 @@ tenant's OAuth or Forge credential to the next task.
 # Dry run — validate config, fetch issue, print assembled prompt, then exit
 DRY_RUN=1 ./agent/run.sh "owner/repo" 42
 
-# Run with a specific model (overrides the global.anthropic.claude-opus-5 default).
+# Run with a specific model (overrides the global.anthropic.claude-opus-5-5 default).
 # Must be a geo-prefixed inference profile that IAM grants — see Model configuration.
 ANTHROPIC_MODEL="us.anthropic.claude-sonnet-4-6" ./agent/run.sh "owner/repo" 42
 

agent/pyproject.toml

@@ -16,12 +16,12 @@ dependencies = [
     # would degrade gracefully — but for now we keep the dep to
     # preserve the clean code path.
     "bedrock-agentcore==1.18.1", #https://pypi.org/project/bedrock-agentcore/
-    "claude-agent-sdk==0.2.110", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215)
+    "claude-agent-sdk==0.2.168", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.168 (bundles claude CLI 2.1.301; kept in lockstep with the npm CLI pin in the Dockerfile, #215. Claude 5.5 models need CLI >= 2.1.280, #953)
     "requests==2.34.2", #https://pypi.org/project/requests/
     "fastapi==0.139.0", #https://pypi.org/project/fastapi/
     "uvicorn==0.50.0", #https://pypi.org/project/uvicorn/
     "aws-opentelemetry-distro==0.18.0", #https://pypi.org/project/aws-opentelemetry-distro/
-    "mcp==1.28.1", #https://pypi.org/project/mcp/
+    "mcp==1.30.0", #https://pypi.org/project/mcp/ (1.30.0 clears GHSA-84m7-p3x7-pcfv)
     # CEDAR ENGINE PARITY — DO NOT BUMP IN ISOLATION.
     # cedarpy (Python, agent runtime) and @cedar-policy/cedar-wasm (TypeScript,
     # CDK Lambdas) are two language bindings over the same Cedar Rust core.

agent/scripts/diagnostics/test_sdk_smoke.py

@@ -39,7 +39,7 @@ async def smoke_test():
     if not model:
         print(
             "ERROR: ANTHROPIC_MODEL not set. Pass the geo-prefixed inference-profile "
-            "id the deployment uses, e.g. ANTHROPIC_MODEL=global.anthropic.claude-opus-5",
+            "id the deployment uses, e.g. ANTHROPIC_MODEL=global.anthropic.claude-opus-5-5",
             file=sys.stderr,
         )
         sys.exit(1)

agent/src/config.py

@@ -694,7 +694,7 @@ def build_config(
     resolved_github_token = github_token or resolve_github_token()
     resolved_aws_region = aws_region or os.environ.get("AWS_REGION", "")
     resolved_anthropic_model = anthropic_model or os.environ.get(
-        "ANTHROPIC_MODEL", "global.anthropic.claude-opus-5"
+        "ANTHROPIC_MODEL", "global.anthropic.claude-opus-5-5"
     )
     # Small/fast auxiliary model (WebFetch summarization etc.). Falls back to the
     # deployed ANTHROPIC_DEFAULT_HAIKU_MODEL env, then the platform default. Must
@@ -705,7 +705,7 @@ def build_config(
     # env set at all reaches this literal, so the two must be moved together or a
     # local run silently uses a different geography than a deployed one.
     resolved_haiku_model = haiku_model or os.environ.get(
-        "ANTHROPIC_DEFAULT_HAIKU_MODEL", "global.anthropic.claude-haiku-4-5-20251001-v1:0"
+        "ANTHROPIC_DEFAULT_HAIKU_MODEL", "global.anthropic.claude-haiku-5-5"
     )
 
     # Resolve the workflow id (the create-task boundary already pinned it; local

agent/src/models.py

@@ -154,7 +154,7 @@ class TaskConfig(BaseModel):
     task_description: str = ""
     github_token: str = ""
     aws_region: str
-    anthropic_model: str = "global.anthropic.claude-opus-5"
+    anthropic_model: str = "global.anthropic.claude-opus-5-5"
     # The "small/fast" model Claude Code uses for auxiliary work (e.g. WebFetch
     # page summarization). Must be a cross-region INFERENCE-PROFILE id (geo
     # prefix), not a bare foundation-model id — Claude 4.x cannot be invoked
@@ -164,7 +164,7 @@ class TaskConfig(BaseModel):
     # vars from its resolved bedrockGeoRegion. It applies to direct construction
     # (tests, local runs), so it must name the same geography as the deployment or
     # those paths silently exercise a different one.
-    haiku_model: str = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
+    haiku_model: str = "global.anthropic.claude-haiku-5-5"
     dry_run: bool = False
     max_turns: int = 10
     max_budget_usd: float | None = None

agent/tests/test_config.py

@@ -63,7 +63,7 @@ def test_haiku_model_defaults_to_inference_profile(self, monkeypatch):
             github_token="ghp_test123",
             aws_region="us-east-1",
         )
-        assert config.haiku_model == "global.anthropic.claude-haiku-4-5-20251001-v1:0"
+        assert config.haiku_model == "global.anthropic.claude-haiku-5-5"
 
     def test_haiku_model_resolves_from_env(self, monkeypatch):
         # The deployed ANTHROPIC_DEFAULT_HAIKU_MODEL (set by agent.ts) flows