fix: address comments

Author: JackYPCOnline

src/strands/models/_openai_bedrock.py

@@ -83,23 +83,15 @@ def resolve_bedrock_client_args(
 ) -> dict[str, Any]:
     """Resolve a ``BedrockMantleConfig`` (plus optional ``client_args``) into OpenAI client kwargs.
 
-    Mints a fresh bearer token on every call. When ``client_args`` is provided, it must
-    not contain ``base_url`` or ``api_key`` — those are always derived from the config.
+    Mints a fresh bearer token on every call. Callers are expected to validate that
+    ``client_args`` does not contain ``base_url`` or ``api_key`` before calling this
+    function (typically at ``__init__`` time for fail-fast behavior).
 
     Raises:
-        ValueError: If no region can be resolved, or if ``client_args`` contains
-            ``base_url`` or ``api_key``.
+        ValueError: If no region can be resolved.
         ImportError: If ``aws-bedrock-token-generator`` is not installed.
         RuntimeError: If token minting fails (e.g. missing AWS credentials).
     """
-    if client_args:
-        conflicting = [k for k in ("api_key", "base_url") if k in client_args]
-        if conflicting:
-            raise ValueError(
-                f"client_args must not contain {conflicting} when bedrock_mantle_config is set; "
-                "these are derived from the Mantle config automatically."
-            )
-
     region = _resolve_region(config)
 
     # ``aws-bedrock-token-generator`` is included in the ``openai`` extras group but not in

src/strands/models/openai.py

@@ -110,6 +110,13 @@ def __init__(
             raise ValueError("Only one of 'client' or 'client_args' should be provided, not both.")
         if bedrock_mantle_config is not None and client is not None:
             raise ValueError("'bedrock_mantle_config' cannot be combined with a pre-built 'client'.")
+        if bedrock_mantle_config is not None and client_args:
+            conflicting = [k for k in ("api_key", "base_url") if k in client_args]
+            if conflicting:
+                raise ValueError(
+                    f"client_args must not contain {conflicting} when bedrock_mantle_config is set; "
+                    "these are derived from the Mantle config automatically."
+                )
 
         self._custom_client = client
         self.client_args = client_args or {}

src/strands/models/openai_responses.py

@@ -165,6 +165,14 @@ def __init__(
         self.client_args = client_args or {}
         self._bedrock_mantle_config = bedrock_mantle_config
 
+        if bedrock_mantle_config is not None and client_args:
+            conflicting = [k for k in ("api_key", "base_url") if k in client_args]
+            if conflicting:
+                raise ValueError(
+                    f"client_args must not contain {conflicting} when bedrock_mantle_config is set; "
+                    "these are derived from the Mantle config automatically."
+                )
+
         logger.debug("config=<%s> | initializing", self.config)
 
     def _resolve_client_args(self) -> dict[str, Any]:

tests/strands/models/test_openai.py

@@ -1798,16 +1798,15 @@ def test_bedrock_mantle_config_merges_with_client_args(self, openai_client, mock
         assert resolved["http_client"] is sentinel_http_client
         assert resolved["default_headers"] == {"X-Trace-Id": "abc"}
 
-    def test_bedrock_mantle_config_rejects_base_url_in_client_args(self, openai_client, mock_provide_token):
+    def test_bedrock_mantle_config_rejects_base_url_in_client_args(self, openai_client):
         """client_args must not contain base_url or api_key when bedrock_mantle_config is set."""
         _ = openai_client
-        model = OpenAIModel(
-            model_id="openai.gpt-oss-120b",
-            client_args={"base_url": "https://custom.example.com"},
-            bedrock_mantle_config={"region": "us-east-1"},
-        )
         with pytest.raises(ValueError, match="client_args must not contain"):
-            model._resolve_client_args()
+            OpenAIModel(
+                model_id="openai.gpt-oss-120b",
+                client_args={"base_url": "https://custom.example.com"},
+                bedrock_mantle_config={"region": "us-east-1"},
+            )
 
     def test_bedrock_mantle_config_requires_region(self, openai_client):
         """bedrock_mantle_config raises when no region can be resolved from config, session, or env."""

tests/strands/models/test_openai_responses.py

@@ -1366,16 +1366,15 @@ def test_bedrock_mantle_config_merges_with_client_args(self, openai_client, mock
         assert resolved["timeout"] == 42
         assert resolved["http_client"] is sentinel_http_client
 
-    def test_bedrock_mantle_config_rejects_base_url_in_client_args(self, openai_client, mock_provide_token):
+    def test_bedrock_mantle_config_rejects_base_url_in_client_args(self, openai_client):
         """client_args must not contain base_url or api_key when bedrock_mantle_config is set."""
         _ = openai_client
-        model = OpenAIResponsesModel(
-            model_id="openai.gpt-oss-120b",
-            client_args={"api_key": "should-not-be-here"},
-            bedrock_mantle_config={"region": "us-east-1"},
-        )
         with pytest.raises(ValueError, match="client_args must not contain"):
-            model._resolve_client_args()
+            OpenAIResponsesModel(
+                model_id="openai.gpt-oss-120b",
+                client_args={"api_key": "should-not-be-here"},
+                bedrock_mantle_config={"region": "us-east-1"},
+            )
 
     def test_bedrock_mantle_config_requires_region(self, openai_client):
         """bedrock_mantle_config raises when no region can be resolved from config, session, or env."""