fix(vertex): warn when 'Google Cloud Credentials' field receives a file path

Users reported recurring "Error parsing JSON: Unexpected token 'C',
\"C:\\Users\\..\"" spam on every Task creation. Root cause: pasting a
filesystem path into the 'Google Cloud Credentials' field (which expects
raw JSON content), instead of the sibling 'Google Cloud Key File Path'
field. Google's own ecosystem uses GOOGLE_APPLICATION_CREDENTIALS for
paths, so "credentials = path to credentials file" is a natural mental
model that the field naming does not disambiguate.

Three pieces:

- gemini.ts and anthropic-vertex.ts: shape-check the field before
  parsing. If it looks like a path (Windows, POSIX absolute, ~/, ./),
  log a specific warning pointing at the Key File Path field and the
  GOOGLE_APPLICATION_CREDENTIALS env var. Skip the JSON.parse to
  avoid the generic 'Error parsing JSON' noise. The shared helper
  parseVertexJsonCredentials is exported from gemini.ts and reused
  from anthropic-vertex.ts so the Gemini-on-Vertex and Claude-on-Vertex
  paths behave identically.

- safeJsonParse: add an optional context arg so logs identify their
  source instead of being anonymous. Backward-compatible.

- Vertex.tsx: inline warning under the credentials field that fires
  on path-shaped input, naming the correct field to use instead. New
  i18n string propagated to all 18 locales.

Auth behavior is unchanged for users who configure the fields correctly
or use the env var. The only user-visible change is the new specific
warning replacing the previous generic spam.

Author: 0xMink

.changeset/vertex-credentials-field-validation.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Detect when the "Google Cloud Credentials" Vertex field has been given a filesystem path instead of the raw JSON contents of a service-account key file. The runtime now skips JSON.parse for path-shaped input, logs a single specific console warning naming the sibling "Google Cloud Key File Path" field and `GOOGLE_APPLICATION_CREDENTIALS` env var, and the settings UI shows an inline warning under the field while the input still looks like a path. Auth behavior is unchanged for correctly-configured users.

packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts

@@ -0,0 +1,43 @@
+// npx vitest run packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts
+
+import { safeJsonParse } from "../safeJsonParse.js"
+
+describe("safeJsonParse", () => {
+	let consoleErrorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		consoleErrorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		consoleErrorSpy.mockRestore()
+	})
+
+	it("returns the parsed value for valid JSON", () => {
+		expect(safeJsonParse<{ a: number }>('{"a":1}')).toEqual({ a: 1 })
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value for null, undefined, or empty input", () => {
+		expect(safeJsonParse<string>(null, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>(undefined, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>("", "fallback")).toBe("fallback")
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value and logs the generic message when no context is given (backward compatible)", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined)
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON:")
+	})
+
+	it("includes the context label in the error log when provided", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined, "foo")
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON (foo):")
+	})
+})

packages/core/src/message-utils/safeJsonParse.ts

@@ -3,9 +3,16 @@
  *
  * @param jsonString The string to parse
  * @param defaultValue Value to return if parsing fails
+ * @param context Optional label included in the error log so callers can be
+ *   identified when something other than valid JSON is supplied (e.g. a user
+ *   pasting a file path into a JSON field).
  * @returns Parsed JSON object or defaultValue if parsing fails
  */
-export function safeJsonParse<T>(jsonString: string | null | undefined, defaultValue?: T): T | undefined {
+export function safeJsonParse<T>(
+	jsonString: string | null | undefined,
+	defaultValue?: T,
+	context?: string,
+): T | undefined {
 	if (!jsonString) {
 		return defaultValue
 	}
@@ -14,7 +21,7 @@ export function safeJsonParse<T>(jsonString: string | null | undefined, defaultV
 		return JSON.parse(jsonString) as T
 	} catch (error) {
 		// Log the error to the console for debugging.
-		console.error("Error parsing JSON:", error)
+		console.error(`Error parsing JSON${context ? ` (${context})` : ""}:`, error)
 		return defaultValue
 	}
 }

src/api/providers/__tests__/vertex-credentials.spec.ts

@@ -0,0 +1,271 @@
+// npx vitest run src/api/providers/__tests__/vertex-credentials.spec.ts
+
+// Mock vscode first to avoid import errors when the provider stack pulls
+// transitive vscode-dependent modules during construction.
+vitest.mock("vscode", () => ({}))
+
+vitest.mock("@roo-code/telemetry", () => ({
+	TelemetryService: {
+		instance: {
+			captureException: vitest.fn(),
+		},
+	},
+}))
+
+// Capture the constructor args passed to GoogleGenAI so we can assert on the
+// credentials handed to GoogleAuth via googleAuthOptions.
+const googleGenAICtor = vitest.fn()
+vitest.mock("@google/genai", () => ({
+	GoogleGenAI: vitest.fn().mockImplementation((args: unknown) => {
+		googleGenAICtor(args)
+		return {
+			models: {
+				generateContentStream: vitest.fn(),
+				generateContent: vitest.fn(),
+			},
+		}
+	}),
+	FunctionCallingConfigMode: { AUTO: "AUTO", ANY: "ANY", NONE: "NONE" },
+}))
+
+// Capture the constructor args passed to GoogleAuth (Anthropic-on-Vertex path).
+const googleAuthCtor = vitest.fn()
+vitest.mock("google-auth-library", () => ({
+	GoogleAuth: vitest.fn().mockImplementation((args: unknown) => {
+		googleAuthCtor(args)
+		return {
+			/* GoogleAuth instance shape is opaque to these tests */
+		}
+	}),
+}))
+
+vitest.mock("@anthropic-ai/vertex-sdk", () => ({
+	AnthropicVertex: vitest.fn().mockImplementation(() => ({
+		messages: { create: vitest.fn() },
+	})),
+}))
+
+import { GeminiHandler, parseVertexJsonCredentials } from "../gemini"
+import { VertexHandler } from "../vertex"
+import { AnthropicVertexHandler } from "../anthropic-vertex"
+
+const VALID_CREDS_JSON = JSON.stringify({
+	type: "service_account",
+	client_email: "test@example.iam.gserviceaccount.com",
+	private_key: "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----\n",
+})
+
+describe("parseVertexJsonCredentials", () => {
+	let warnSpy: ReturnType<typeof vi.spyOn>
+	let errorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {})
+		errorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		warnSpy.mockRestore()
+		errorSpy.mockRestore()
+	})
+
+	it("returns undefined and does not warn for empty or whitespace input", () => {
+		expect(parseVertexJsonCredentials(undefined)).toBeUndefined()
+		expect(parseVertexJsonCredentials("")).toBeUndefined()
+		expect(parseVertexJsonCredentials("   ")).toBeUndefined()
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it("parses valid JSON credentials without warning", () => {
+		const result = parseVertexJsonCredentials(VALID_CREDS_JSON)
+		expect(result).toMatchObject({ type: "service_account" })
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it.each([
+		["Windows backslash path", "C:\\Users\\test\\creds.json"],
+		["Windows forward-slash path", "C:/Users/test/creds.json"],
+		["POSIX absolute path", "/home/test/creds.json"],
+		["POSIX home path", "~/creds.json"],
+		["POSIX relative ./", "./creds.json"],
+		["POSIX relative ../", "../secrets/creds.json"],
+	])("warns and returns undefined for %s", (_label, input) => {
+		const result = parseVertexJsonCredentials(input)
+		expect(result).toBeUndefined()
+		expect(warnSpy).toHaveBeenCalledTimes(1)
+		const [message] = warnSpy.mock.calls[0]
+		expect(message).toContain("Google Cloud Credentials")
+		expect(message).toContain("Google Cloud Key File Path")
+		expect(message).toContain("GOOGLE_APPLICATION_CREDENTIALS")
+		// Generic "Error parsing JSON" must not fire for the path case.
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it("trims surrounding whitespace before detecting path shape", () => {
+		expect(parseVertexJsonCredentials("  /tmp/creds.json  ")).toBeUndefined()
+		expect(warnSpy).toHaveBeenCalledTimes(1)
+	})
+
+	it("truncates long path previews in the warning", () => {
+		const longPath = "/" + "a".repeat(200)
+		parseVertexJsonCredentials(longPath)
+		const [message] = warnSpy.mock.calls[0]
+		expect(message).toContain("…")
+	})
+
+	it("falls back to the generic JSON parse error path for malformed but non-path input", () => {
+		const result = parseVertexJsonCredentials("not-json-and-not-a-path")
+		expect(result).toBeUndefined()
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(errorSpy).toHaveBeenCalledTimes(1)
+		const [message] = errorSpy.mock.calls[0]
+		expect(message).toBe("Error parsing JSON (Vertex credentials):")
+	})
+})
+
+describe("GeminiHandler vertex credentials wiring", () => {
+	let warnSpy: ReturnType<typeof vi.spyOn>
+	let errorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {})
+		errorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+		googleGenAICtor.mockClear()
+	})
+
+	afterEach(() => {
+		warnSpy.mockRestore()
+		errorSpy.mockRestore()
+	})
+
+	it("passes parsed JSON credentials through to GoogleGenAI", () => {
+		new GeminiHandler({
+			apiModelId: "gemini-2.0-flash-001",
+			vertexProjectId: "p",
+			vertexRegion: "us-central1",
+			vertexJsonCredentials: VALID_CREDS_JSON,
+			isVertex: true,
+		})
+
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(googleGenAICtor).toHaveBeenCalledTimes(1)
+		const args = googleGenAICtor.mock.calls[0][0]
+		expect(args.googleAuthOptions.credentials).toMatchObject({ type: "service_account" })
+	})
+
+	it("warns and passes undefined credentials when the field looks like a path", () => {
+		new GeminiHandler({
+			apiModelId: "gemini-2.0-flash-001",
+			vertexProjectId: "p",
+			vertexRegion: "us-central1",
+			vertexJsonCredentials: "C:\\Users\\dev\\sa.json",
+			isVertex: true,
+		})
+
+		expect(warnSpy).toHaveBeenCalledTimes(1)
+		expect(googleGenAICtor).toHaveBeenCalledTimes(1)
+		const args = googleGenAICtor.mock.calls[0][0]
+		expect(args.googleAuthOptions.credentials).toBeUndefined()
+		// Generic "Error parsing JSON" must not fire for the path case.
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it("does not warn or supply credentials when neither field is set", () => {
+		new GeminiHandler({
+			apiModelId: "gemini-2.0-flash-001",
+			vertexProjectId: "p",
+			vertexRegion: "us-central1",
+			isVertex: true,
+		})
+
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(googleGenAICtor).toHaveBeenCalledTimes(1)
+		const args = googleGenAICtor.mock.calls[0][0]
+		// In this branch the constructor builds GoogleGenAI without googleAuthOptions.
+		expect(args.googleAuthOptions).toBeUndefined()
+	})
+})
+
+describe("VertexHandler inherits the path-shape guard from GeminiHandler", () => {
+	let warnSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {})
+		googleGenAICtor.mockClear()
+	})
+
+	afterEach(() => {
+		warnSpy.mockRestore()
+	})
+
+	it("warns and passes undefined credentials when the field looks like a POSIX path", () => {
+		new VertexHandler({
+			apiModelId: "gemini-2.0-flash-001",
+			vertexProjectId: "p",
+			vertexRegion: "us-central1",
+			vertexJsonCredentials: "/home/dev/sa.json",
+		})
+
+		expect(warnSpy).toHaveBeenCalledTimes(1)
+		const args = googleGenAICtor.mock.calls[0][0]
+		expect(args.googleAuthOptions.credentials).toBeUndefined()
+	})
+})
+
+describe("AnthropicVertexHandler vertex credentials wiring", () => {
+	let warnSpy: ReturnType<typeof vi.spyOn>
+	let errorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {})
+		errorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+		googleAuthCtor.mockClear()
+	})
+
+	afterEach(() => {
+		warnSpy.mockRestore()
+		errorSpy.mockRestore()
+	})
+
+	it("passes parsed JSON credentials through to GoogleAuth", () => {
+		new AnthropicVertexHandler({
+			apiModelId: "claude-3-5-sonnet-v2@20241022",
+			vertexProjectId: "p",
+			vertexRegion: "us-east5",
+			vertexJsonCredentials: VALID_CREDS_JSON,
+		})
+
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(googleAuthCtor).toHaveBeenCalledTimes(1)
+		const args = googleAuthCtor.mock.calls[0][0]
+		expect(args.credentials).toMatchObject({ type: "service_account" })
+	})
+
+	it("warns and passes undefined credentials when the field looks like a Windows path", () => {
+		new AnthropicVertexHandler({
+			apiModelId: "claude-3-5-sonnet-v2@20241022",
+			vertexProjectId: "p",
+			vertexRegion: "us-east5",
+			vertexJsonCredentials: "C:\\Users\\dev\\sa.json",
+		})
+
+		expect(warnSpy).toHaveBeenCalledTimes(1)
+		expect(googleAuthCtor).toHaveBeenCalledTimes(1)
+		const args = googleAuthCtor.mock.calls[0][0]
+		expect(args.credentials).toBeUndefined()
+		expect(errorSpy).not.toHaveBeenCalled()
+	})
+
+	it("does not invoke GoogleAuth when neither credentials nor keyFile is set", () => {
+		new AnthropicVertexHandler({
+			apiModelId: "claude-3-5-sonnet-v2@20241022",
+			vertexProjectId: "p",
+			vertexRegion: "us-east5",
+		})
+
+		expect(warnSpy).not.toHaveBeenCalled()
+		expect(googleAuthCtor).not.toHaveBeenCalled()
+	})
+})

src/api/providers/anthropic-vertex.ts

@@ -1,6 +1,6 @@
 import { Anthropic } from "@anthropic-ai/sdk"
 import { AnthropicVertex } from "@anthropic-ai/vertex-sdk"
-import { GoogleAuth, JWTInput } from "google-auth-library"
+import { GoogleAuth } from "google-auth-library"
 
 import {
 	type ModelInfo,
@@ -10,7 +10,6 @@ import {
 	ANTHROPIC_DEFAULT_MAX_TOKENS,
 	VERTEX_1M_CONTEXT_MODEL_IDS,
 } from "@roo-code/types"
-import { safeJsonParse } from "@roo-code/core"
 
 import { ApiHandlerOptions } from "../../shared/api"
 
@@ -24,6 +23,7 @@ import {
 } from "../../core/prompts/tools/native-tools/converters"
 
 import { BaseProvider } from "./base-provider"
+import { parseVertexJsonCredentials } from "./gemini"
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata } from "../index"
 
 // https://docs.anthropic.com/en/api/claude-on-vertex-ai
@@ -46,7 +46,7 @@ export class AnthropicVertexHandler extends BaseProvider implements SingleComple
 				region,
 				googleAuth: new GoogleAuth({
 					scopes: ["https://www.googleapis.com/auth/cloud-platform"],
-					credentials: safeJsonParse<JWTInput>(this.options.vertexJsonCredentials, undefined),
+					credentials: parseVertexJsonCredentials(this.options.vertexJsonCredentials),
 				}),
 			})
 		} else if (this.options.vertexKeyFile) {