Bug: MCP tool binary attachment triggers Bedrock document name ValidationException (variant of #36113) #37191

Description

Variant of #36113 with the same root cause (unsanitized document filename sent to the Bedrock Converse API), but a different source: an MCP tool attachment instead of a user file upload. No user-uploaded files exist in the session.

When an MCP tool returns a binary file attachment (e.g. Slack MCP slack_slack_read_file on a PDF), the tool result is stored with filename set to a synthetic URI such as slack-file://F0XXXXXXX. On the next Bedrock request in the same session, the AI SDK converts that attachment into a DocumentBlock and passes the full filename as the document name. Bedrock rejects it:

APIError: The document file name can only contain alphanumeric characters,
whitespace characters, hyphens, parentheses, and square brackets. The name
can't contain more than one consecutive whitespace character.
statusCode: 400
x-amzn-errortype: ValidationException

Confirmed via DB inspection of the session. The stored part in opencode.db:

{
  "type": "file",
  "mime": "application/pdf",
  "url": "data:application/pdf;base64,...",
  "filename": "slack-file://F0XXXXXXX"
}

The synthetic filename contains : and /, which fail Bedrock's document name validation.

Why it persists: once the attachment lands in session history, every subsequent Bedrock turn re-sends the document block with the invalid name. The session becomes unrecoverable without reverting to before the tool call, even if subsequent prompts explicitly avoid the file.

Proposed fix: sanitize filename before constructing DocumentBlock.name: strip everything outside [A-Za-z0-9 ()\[\]-] and collapse consecutive whitespace. Same fix as #36113, but it must be applied to all FilePart sources, not only user uploads. MCP tool attachments are a separate code path that currently goes unsanitized.

Session ID: ses_09a3a6cf0ffegoP0YYJYWqmQti
Model: amazon-bedrock/us.anthropic.claude-opus-4-8

Plugins

Slack MCP

OpenCode version

1.18.1

Steps to reproduce

1. Use a Bedrock model in any session
2. Call an MCP tool that returns a binary file attachment (e.g. Slack MCP slack_slack_read_file on a PDF)
3. The tool result is stored with filename set to a synthetic URI such as slack-file://F0XXXXXXX
4. On the next Bedrock request in the same session, the request fails with the ValidationException above, and keeps failing on every turn

Operating System

Linux arm64

Terminal

xterm-256color