fix(vertex): bind parsed credentials before truthiness check + extract shared util

Four review items from the PR review round:

- Precedence bug at gemini.ts:225-233 and anthropic-vertex.ts:43-50:
  the truthiness check was on the raw vertexJsonCredentials field,
  so path-shaped input (which parseVertexJsonCredentials correctly
  returns undefined for) still entered the JSON branch with
  credentials: undefined instead of falling through to vertexKeyFile.
  Bind parseVertexJsonCredentials's result first and branch on it.

- Extract parseVertexJsonCredentials from gemini.ts to a new
  utils/vertex-credentials.ts module. anthropic-vertex.ts previously
  imported from ./gemini, which pulled in the @google/genai runtime
  dependency unnecessarily. The shared util has no provider-specific
  imports.

- a11y on the Vertex.tsx warning: added role="alert" and
  aria-live="polite" so screen readers announce the dynamic
  warning when it appears.

- Mixed-input regression tests: added cases asserting that when
  vertexJsonCredentials is path-shaped AND vertexKeyFile is set,
  the GoogleAuth/GoogleGenAI client is constructed with the
  keyFile, not the (now undefined) credentials. Locks in the
  fallback contract. The pre-existing path-shape-only tests were
  also updated to match the corrected fallthrough: with no
  vertexKeyFile, neither GoogleAuth (anthropic-vertex) nor
  googleAuthOptions (gemini) is constructed.

Author: 0xMink

src/api/providers/__tests__/vertex-credentials.spec.ts

@@ -45,9 +45,10 @@ vitest.mock("@anthropic-ai/vertex-sdk", () => ({
 	})),
 }))
 
-import { GeminiHandler, parseVertexJsonCredentials } from "../gemini"
+import { GeminiHandler } from "../gemini"
 import { VertexHandler } from "../vertex"
 import { AnthropicVertexHandler } from "../anthropic-vertex"
+import { parseVertexJsonCredentials } from "../utils/vertex-credentials"
 
 const VALID_CREDS_JSON = JSON.stringify({
 	type: "service_account",
@@ -155,7 +156,7 @@ describe("GeminiHandler vertex credentials wiring", () => {
 		expect(args.googleAuthOptions.credentials).toMatchObject({ type: "service_account" })
 	})
 
-	it("warns and passes undefined credentials when the field looks like a path", () => {
+	it("warns and falls through past the JSON branch when the field looks like a path", () => {
 		new GeminiHandler({
 			apiModelId: "gemini-2.0-flash-001",
 			vertexProjectId: "p",
@@ -167,7 +168,34 @@ describe("GeminiHandler vertex credentials wiring", () => {
 		expect(warnSpy).toHaveBeenCalledTimes(1)
 		expect(googleGenAICtor).toHaveBeenCalledTimes(1)
 		const args = googleGenAICtor.mock.calls[0][0]
-		expect(args.googleAuthOptions.credentials).toBeUndefined()
+		// With only a path-shaped vertexJsonCredentials (no vertexKeyFile),
+		// the ternary falls all the way through to the bare isVertex branch:
+		// new GoogleGenAI({ vertexai: true, project, location }) — no
+		// googleAuthOptions block.
+		expect(args.googleAuthOptions).toBeUndefined()
+		expect(args.vertexai).toBe(true)
+		// Generic "Error parsing JSON" must not fire for the path case.
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it("uses vertexKeyFile when vertexJsonCredentials is path-shaped AND vertexKeyFile is set", () => {
+		new GeminiHandler({
+			apiModelId: "gemini-2.0-flash-001",
+			vertexProjectId: "p",
+			vertexRegion: "us-central1",
+			vertexJsonCredentials: "C:\\Users\\dev\\sa.json",
+			vertexKeyFile: "my-key-file.json",
+			isVertex: true,
+		})
+
+		expect(googleGenAICtor).toHaveBeenCalledTimes(1)
+		const args = googleGenAICtor.mock.calls[0][0]
+		// The path-shaped input must not poison the JSON branch; the fallback
+		// to the vertexKeyFile branch must take effect.
+		expect(args.googleAuthOptions?.keyFile).toBe("my-key-file.json")
+		expect(args.googleAuthOptions?.credentials).toBeUndefined()
+		// The warning for the path-shaped input still fires.
+		expect(warnSpy).toHaveBeenCalledTimes(1)
 		// Generic "Error parsing JSON" must not fire for the path case.
 		expect(errorSpy).not.toHaveBeenCalled()
 	})
@@ -200,7 +228,7 @@ describe("VertexHandler inherits the path-shape guard from GeminiHandler", () =>
 		warnSpy.mockRestore()
 	})
 
-	it("warns and passes undefined credentials when the field looks like a POSIX path", () => {
+	it("warns and falls through past the JSON branch when the field looks like a POSIX path", () => {
 		new VertexHandler({
 			apiModelId: "gemini-2.0-flash-001",
 			vertexProjectId: "p",
@@ -210,7 +238,11 @@ describe("VertexHandler inherits the path-shape guard from GeminiHandler", () =>
 
 		expect(warnSpy).toHaveBeenCalledTimes(1)
 		const args = googleGenAICtor.mock.calls[0][0]
-		expect(args.googleAuthOptions.credentials).toBeUndefined()
+		// VertexHandler extends GeminiHandler with isVertex:true. With only a
+		// path-shaped vertexJsonCredentials, the ternary falls through to the
+		// bare isVertex branch with no googleAuthOptions.
+		expect(args.googleAuthOptions).toBeUndefined()
+		expect(args.vertexai).toBe(true)
 	})
 })
 
@@ -243,7 +275,7 @@ describe("AnthropicVertexHandler vertex credentials wiring", () => {
 		expect(args.credentials).toMatchObject({ type: "service_account" })
 	})
 
-	it("warns and passes undefined credentials when the field looks like a Windows path", () => {
+	it("warns and skips the GoogleAuth construction when the field looks like a Windows path", () => {
 		new AnthropicVertexHandler({
 			apiModelId: "claude-3-5-sonnet-v2@20241022",
 			vertexProjectId: "p",
@@ -252,9 +284,32 @@ describe("AnthropicVertexHandler vertex credentials wiring", () => {
 		})
 
 		expect(warnSpy).toHaveBeenCalledTimes(1)
+		// With only a path-shaped vertexJsonCredentials (no vertexKeyFile),
+		// every branch in the constructor falls through to the bare
+		// `new AnthropicVertex({ projectId, region })` and GoogleAuth is
+		// never instantiated.
+		expect(googleAuthCtor).not.toHaveBeenCalled()
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it("uses vertexKeyFile when vertexJsonCredentials is path-shaped AND vertexKeyFile is set", () => {
+		new AnthropicVertexHandler({
+			apiModelId: "claude-3-5-sonnet-v2@20241022",
+			vertexProjectId: "p",
+			vertexRegion: "us-east5",
+			vertexJsonCredentials: "C:\\Users\\dev\\sa.json",
+			vertexKeyFile: "my-key-file.json",
+		})
+
+		// The path-shaped input must not poison the JSON branch; the fallback
+		// to the vertexKeyFile branch must take effect.
 		expect(googleAuthCtor).toHaveBeenCalledTimes(1)
 		const args = googleAuthCtor.mock.calls[0][0]
+		expect(args.keyFile).toBe("my-key-file.json")
 		expect(args.credentials).toBeUndefined()
+		// The warning for the path-shaped input still fires.
+		expect(warnSpy).toHaveBeenCalledTimes(1)
+		// Generic "Error parsing JSON" must not fire for the path case.
 		expect(errorSpy).not.toHaveBeenCalled()
 	})
 

src/api/providers/anthropic-vertex.ts

@@ -23,7 +23,7 @@ import {
 } from "../../core/prompts/tools/native-tools/converters"
 
 import { BaseProvider } from "./base-provider"
-import { parseVertexJsonCredentials } from "./gemini"
+import { parseVertexJsonCredentials } from "./utils/vertex-credentials"
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata } from "../index"
 
 // https://docs.anthropic.com/en/api/claude-on-vertex-ai
@@ -40,13 +40,15 @@ export class AnthropicVertexHandler extends BaseProvider implements SingleComple
 		const projectId = this.options.vertexProjectId ?? "not-provided"
 		const region = this.options.vertexRegion ?? "us-east5"
 
-		if (this.options.vertexJsonCredentials) {
+		const parsedVertexCredentials = parseVertexJsonCredentials(this.options.vertexJsonCredentials)
+
+		if (parsedVertexCredentials) {
 			this.client = new AnthropicVertex({
 				projectId,
 				region,
 				googleAuth: new GoogleAuth({
 					scopes: ["https://www.googleapis.com/auth/cloud-platform"],
-					credentials: parseVertexJsonCredentials(this.options.vertexJsonCredentials),
+					credentials: parsedVertexCredentials,
 				}),
 			})
 		} else if (this.options.vertexKeyFile) {

src/api/providers/gemini.ts

@@ -7,16 +7,13 @@ import {
 	type GroundingMetadata,
 	FunctionCallingConfigMode,
 } from "@google/genai"
-import type { JWTInput } from "google-auth-library"
-
 import {
 	type ModelInfo,
 	type GeminiModelId,
 	geminiDefaultModelId,
 	geminiModels,
 	ApiProviderError,
 } from "@roo-code/types"
-import { safeJsonParse } from "@roo-code/core"
 import { TelemetryService } from "@roo-code/telemetry"
 
 import type { ApiHandlerOptions } from "../../shared/api"
@@ -28,43 +25,12 @@ import { getModelParams } from "../transform/model-params"
 
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata } from "../index"
 import { BaseProvider } from "./base-provider"
+import { parseVertexJsonCredentials } from "./utils/vertex-credentials"
 
 type GeminiHandlerOptions = ApiHandlerOptions & {
 	isVertex?: boolean
 }
 
-// Detects when the "Google Cloud Credentials" field has received a filesystem
-// path instead of the raw JSON contents of a service-account key file. Users
-// often confuse this with GOOGLE_APPLICATION_CREDENTIALS (which IS a path),
-// and the sibling "Google Cloud Key File Path" field is where a path belongs.
-// Returns the parsed credentials object when the input looks like JSON, or
-// undefined when the field is empty, path-shaped, or unparseable.
-export function parseVertexJsonCredentials(value: string | undefined): JWTInput | undefined {
-	const trimmed = value?.trim()
-	if (!trimmed) {
-		return undefined
-	}
-
-	const looksLikePath =
-		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
-		trimmed.startsWith("/") || // POSIX absolute: /home/...
-		trimmed.startsWith("~") || // POSIX home: ~/...
-		trimmed.startsWith(".") // POSIX relative: ./... or ../...
-
-	if (looksLikePath) {
-		const preview = trimmed.length > 40 ? `${trimmed.slice(0, 40)}…` : trimmed
-		console.warn(
-			`[Vertex] The 'Google Cloud Credentials' field appears to contain a file path ("${preview}"), ` +
-				"but this field expects the raw JSON contents of a service-account key file. " +
-				"If you have a path to the credentials file, paste it into the 'Google Cloud Key File Path' field instead, " +
-				"or leave both fields empty and use the GOOGLE_APPLICATION_CREDENTIALS environment variable.",
-		)
-		return undefined
-	}
-
-	return safeJsonParse<JWTInput>(trimmed, undefined, "Vertex credentials")
-}
-
 // Gemini documents function declaration schemas as a selected OpenAPI-style
 // subset with single-value `type` plus `nullable`. In practice, third-party
 // MCP schemas often include broader JSON Schema metadata/composition that has
@@ -222,13 +188,15 @@ export class GeminiHandler extends BaseProvider implements SingleCompletionHandl
 		const location = this.options.vertexRegion ?? "not-provided"
 		const apiKey = this.options.geminiApiKey ?? "not-provided"
 
-		this.client = this.options.vertexJsonCredentials
+		const parsedVertexCredentials = parseVertexJsonCredentials(this.options.vertexJsonCredentials)
+
+		this.client = parsedVertexCredentials
 			? new GoogleGenAI({
 					vertexai: true,
 					project,
 					location,
 					googleAuthOptions: {
-						credentials: parseVertexJsonCredentials(this.options.vertexJsonCredentials),
+						credentials: parsedVertexCredentials,
 					},
 				})
 			: this.options.vertexKeyFile

src/api/providers/utils/vertex-credentials.ts

@@ -0,0 +1,35 @@
+import type { JWTInput } from "google-auth-library"
+
+import { safeJsonParse } from "@roo-code/core"
+
+// Detects when the "Google Cloud Credentials" field has received a filesystem
+// path instead of the raw JSON contents of a service-account key file. Users
+// often confuse this with GOOGLE_APPLICATION_CREDENTIALS (which IS a path),
+// and the sibling "Google Cloud Key File Path" field is where a path belongs.
+// Returns the parsed credentials object when the input looks like JSON, or
+// undefined when the field is empty, path-shaped, or unparseable.
+export function parseVertexJsonCredentials(value: string | undefined): JWTInput | undefined {
+	const trimmed = value?.trim()
+	if (!trimmed) {
+		return undefined
+	}
+
+	const looksLikePath =
+		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
+		trimmed.startsWith("/") || // POSIX absolute: /home/...
+		trimmed.startsWith("~") || // POSIX home: ~/...
+		trimmed.startsWith(".") // POSIX relative: ./... or ../...
+
+	if (looksLikePath) {
+		const preview = trimmed.length > 40 ? `${trimmed.slice(0, 40)}…` : trimmed
+		console.warn(
+			`[Vertex] The 'Google Cloud Credentials' field appears to contain a file path ("${preview}"), ` +
+				"but this field expects the raw JSON contents of a service-account key file. " +
+				"If you have a path to the credentials file, paste it into the 'Google Cloud Key File Path' field instead, " +
+				"or leave both fields empty and use the GOOGLE_APPLICATION_CREDENTIALS environment variable.",
+		)
+		return undefined
+	}
+
+	return safeJsonParse<JWTInput>(trimmed, undefined, "Vertex credentials")
+}

webview-ui/src/components/settings/providers/Vertex.tsx

@@ -92,7 +92,11 @@ export const Vertex = ({ apiConfiguration, setApiConfigurationField }: VertexPro
 				<label className="block font-medium mb-1">{t("settings:providers.googleCloudCredentials")}</label>
 			</VSCodeTextField>
 			{credentialsLooksLikePath && (
-				<div data-testid="vertex-credentials-path-warning" className="text-sm text-vscode-errorForeground">
+				<div
+					data-testid="vertex-credentials-path-warning"
+					role="alert"
+					aria-live="polite"
+					className="text-sm text-vscode-errorForeground">
 					<Trans
 						i18nKey="settings:providers.googleCloudCredentialsPathWarning"
 						components={{