fix(vertex): warn when 'Google Cloud Credentials' field receives a file path (#294)

* fix(vertex): warn when 'Google Cloud Credentials' field receives a file path

Users reported recurring "Error parsing JSON: Unexpected token 'C',
\"C:\\Users\\..\"" spam on every Task creation. Root cause: pasting a
filesystem path into the 'Google Cloud Credentials' field (which expects
raw JSON content), instead of the sibling 'Google Cloud Key File Path'
field. Google's own ecosystem uses GOOGLE_APPLICATION_CREDENTIALS for
paths, so "credentials = path to credentials file" is a natural mental
model that the field naming does not disambiguate.

Three pieces:

- gemini.ts and anthropic-vertex.ts: shape-check the field before
  parsing. If it looks like a path (Windows, POSIX absolute, ~/, ./),
  log a specific warning pointing at the Key File Path field and the
  GOOGLE_APPLICATION_CREDENTIALS env var. Skip the JSON.parse to
  avoid the generic 'Error parsing JSON' noise. The shared helper
  parseVertexJsonCredentials is exported from gemini.ts and reused
  from anthropic-vertex.ts so the Gemini-on-Vertex and Claude-on-Vertex
  paths behave identically.

- safeJsonParse: add an optional context arg so logs identify their
  source instead of being anonymous. Backward-compatible.

- Vertex.tsx: inline warning under the credentials field that fires
  on path-shaped input, naming the correct field to use instead. New
  i18n string propagated to all 18 locales.

Auth behavior is unchanged for users who configure the fields correctly
or use the env var. The only user-visible change is the new specific
warning replacing the previous generic spam.

* fix(vertex): bind parsed credentials before truthiness check + extract shared util

Four review items from the PR review round:

- Precedence bug at gemini.ts:225-233 and anthropic-vertex.ts:43-50:
  the truthiness check was on the raw vertexJsonCredentials field,
  so path-shaped input (which parseVertexJsonCredentials correctly
  returns undefined for) still entered the JSON branch with
  credentials: undefined instead of falling through to vertexKeyFile.
  Bind parseVertexJsonCredentials's result first and branch on it.

- Extract parseVertexJsonCredentials from gemini.ts to a new
  utils/vertex-credentials.ts module. anthropic-vertex.ts previously
  imported from ./gemini, which pulled in the @google/genai runtime
  dependency unnecessarily. The shared util has no provider-specific
  imports.

- a11y on the Vertex.tsx warning: added role="alert" and
  aria-live="polite" so screen readers announce the dynamic
  warning when it appears.

- Mixed-input regression tests: added cases asserting that when
  vertexJsonCredentials is path-shaped AND vertexKeyFile is set,
  the GoogleAuth/GoogleGenAI client is constructed with the
  keyFile, not the (now undefined) credentials. Locks in the
  fallback contract. The pre-existing path-shape-only tests were
  also updated to match the corrected fallthrough: with no
  vertexKeyFile, neither GoogleAuth (anthropic-vertex) nor
  googleAuthOptions (gemini) is constructed.

* fix(a11y): use role="status" for the Vertex credentials path warning

role="alert" implies aria-live="assertive" by default, which mixed
awkwardly with the explicit aria-live="polite" override (urgent role
+ don't-interrupt liveness). For an informational warning that fires
as the user types into a settings field, role="status" is the
conventional pattern — implicitly polite, semantically correct for a
non-urgent dynamic message, and removes the role/live conflict.

* fix(vertex): drop path preview from warning + extract shared path-shape predicate

Three review items addressed:

- vertex-credentials.ts: removed the dynamic preview of the user's
  input from the warning message — leaking usernames and directory
  names into extension logs is mild PII. The static message still
  identifies the correct field and the env var to use.

- Extracted the path-shape predicate to @roo-code/types
  (packages/types/src/utils/looksLikeFilePath.ts) so the UI warning
  in Vertex.tsx and the runtime warning in parseVertexJsonCredentials
  share one implementation instead of drifting independently. Both
  call sites now import from the shared module; the predicate is
  pure, dep-free, regex-based, and covered by its own spec.

- Vertex.spec.tsx: the <Trans> mock now resolves keys against the
  real webview-ui English settings.json so the test asserts the
  rendered warning text. A future translation regression that
  dropped the 'Google Cloud Key File Path' field name or the
  GOOGLE_APPLICATION_CREDENTIALS env-var mention from the English
  copy would now be caught.

---------

Co-authored-by: 0xMink <260166390+0xMink@users.noreply.github.com>

Author: 0xMink

.changeset/vertex-credentials-field-validation.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Detect when the "Google Cloud Credentials" Vertex field has been given a filesystem path instead of the raw JSON contents of a service-account key file. The runtime now skips JSON.parse for path-shaped input, logs a single specific console warning naming the sibling "Google Cloud Key File Path" field and `GOOGLE_APPLICATION_CREDENTIALS` env var, and the settings UI shows an inline warning under the field while the input still looks like a path. Auth behavior is unchanged for correctly-configured users.

packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts

@@ -0,0 +1,43 @@
+// npx vitest run packages/core/src/message-utils/__tests__/safeJsonParse.spec.ts
+
+import { safeJsonParse } from "../safeJsonParse.js"
+
+describe("safeJsonParse", () => {
+	let consoleErrorSpy: ReturnType<typeof vi.spyOn>
+
+	beforeEach(() => {
+		consoleErrorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		consoleErrorSpy.mockRestore()
+	})
+
+	it("returns the parsed value for valid JSON", () => {
+		expect(safeJsonParse<{ a: number }>('{"a":1}')).toEqual({ a: 1 })
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value for null, undefined, or empty input", () => {
+		expect(safeJsonParse<string>(null, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>(undefined, "fallback")).toBe("fallback")
+		expect(safeJsonParse<string>("", "fallback")).toBe("fallback")
+		expect(consoleErrorSpy).not.toHaveBeenCalled()
+	})
+
+	it("returns the default value and logs the generic message when no context is given (backward compatible)", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined)
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON:")
+	})
+
+	it("includes the context label in the error log when provided", () => {
+		const result = safeJsonParse<{ a: number }>("not json", undefined, "foo")
+		expect(result).toBeUndefined()
+		expect(consoleErrorSpy).toHaveBeenCalledTimes(1)
+		const message = consoleErrorSpy.mock.calls[0]?.[0]
+		expect(message).toBe("Error parsing JSON (foo):")
+	})
+})

packages/core/src/message-utils/safeJsonParse.ts

@@ -3,9 +3,16 @@
  *
  * @param jsonString The string to parse
  * @param defaultValue Value to return if parsing fails
+ * @param context Optional label included in the error log so callers can be
+ *   identified when something other than valid JSON is supplied (e.g. a user
+ *   pasting a file path into a JSON field).
  * @returns Parsed JSON object or defaultValue if parsing fails
  */
-export function safeJsonParse<T>(jsonString: string | null | undefined, defaultValue?: T): T | undefined {
+export function safeJsonParse<T>(
+	jsonString: string | null | undefined,
+	defaultValue?: T,
+	context?: string,
+): T | undefined {
 	if (!jsonString) {
 		return defaultValue
 	}
@@ -14,7 +21,7 @@ export function safeJsonParse<T>(jsonString: string | null | undefined, defaultV
 		return JSON.parse(jsonString) as T
 	} catch (error) {
 		// Log the error to the console for debugging.
-		console.error("Error parsing JSON:", error)
+		console.error(`Error parsing JSON${context ? ` (${context})` : ""}:`, error)
 		return defaultValue
 	}
 }

packages/types/src/__tests__/looksLikeFilePath.spec.ts

@@ -0,0 +1,48 @@
+// npx vitest run src/__tests__/looksLikeFilePath.spec.ts
+
+import { looksLikeFilePath } from "../utils/looksLikeFilePath.js"
+
+describe("looksLikeFilePath", () => {
+	describe("nullish, empty, and whitespace-only input", () => {
+		it.each([
+			["undefined", undefined],
+			["null", null],
+			["empty string", ""],
+			["whitespace only", "   \t\n  "],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+
+	describe("path-shaped input", () => {
+		it.each([
+			["Windows backslash path", "C:\\Users\\dev\\sa.json"],
+			["Windows forward-slash path", "C:/Users/dev/sa.json"],
+			["Windows drive lowercase", "d:\\creds.json"],
+			["POSIX absolute path", "/home/dev/sa.json"],
+			["POSIX absolute root /tmp", "/tmp/creds.json"],
+			["POSIX home path", "~/sa.json"],
+			["POSIX relative ./", "./sa.json"],
+			["POSIX relative ../", "../secrets/sa.json"],
+		])("returns true for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(true)
+		})
+
+		it("returns true after trimming surrounding whitespace", () => {
+			expect(looksLikeFilePath("  /tmp/creds.json  ")).toBe(true)
+			expect(looksLikeFilePath("\tC:\\sa.json\n")).toBe(true)
+		})
+	})
+
+	describe("JSON-shaped or bare-token input", () => {
+		it.each([
+			["JSON object", '{"type":"service_account","client_email":"x@y.z"}'],
+			["JSON array", "[1,2,3]"],
+			["JSON with leading whitespace", '   {"type":"service_account"}'],
+			["bare token", "not-json-and-not-a-path"],
+			["service-account-style email", "sa@project.iam.gserviceaccount.com"],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+})

packages/types/src/index.ts

@@ -33,3 +33,5 @@ export * from "./vscode.js"
 export * from "./worktree.js"
 
 export * from "./providers/index.js"
+
+export * from "./utils/looksLikeFilePath.js"

packages/types/src/utils/looksLikeFilePath.ts

@@ -0,0 +1,24 @@
+// Returns true when a string is shaped like a filesystem path (Windows
+// drive-letter, POSIX absolute, POSIX home, POSIX relative). Pure and
+// dependency-free so it can be shared between the extension runtime (e.g.
+// parseVertexJsonCredentials) and the webview UI (e.g. the Vertex settings
+// warning), guaranteeing both surfaces agree on what "looks like a path"
+// means.
+//
+// Returns false for nullish, empty, and whitespace-only input — neither
+// call site should warn in those cases.
+export function looksLikeFilePath(value: string | null | undefined): boolean {
+	if (value == null) {
+		return false
+	}
+	const trimmed = value.trim()
+	if (!trimmed) {
+		return false
+	}
+	return (
+		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
+		trimmed.startsWith("/") || // POSIX absolute: /home/...
+		trimmed.startsWith("~") || // POSIX home: ~/...
+		trimmed.startsWith(".") // POSIX relative: ./... or ../...
+	)
+}