fix(vertex): drop path preview from warning + extract shared path-shape predicate

Three review items addressed:

- vertex-credentials.ts: removed the dynamic preview of the user's
  input from the warning message — leaking usernames and directory
  names into extension logs is mild PII. The static message still
  identifies the correct field and the env var to use.

- Extracted the path-shape predicate to @roo-code/types
  (packages/types/src/utils/looksLikeFilePath.ts) so the UI warning
  in Vertex.tsx and the runtime warning in parseVertexJsonCredentials
  share one implementation instead of drifting independently. Both
  call sites now import from the shared module; the predicate is
  pure, dep-free, regex-based, and covered by its own spec.

- Vertex.spec.tsx: the <Trans> mock now resolves keys against the
  real webview-ui English settings.json so the test asserts the
  rendered warning text. A future translation regression that
  dropped the 'Google Cloud Key File Path' field name or the
  GOOGLE_APPLICATION_CREDENTIALS env-var mention from the English
  copy would now be caught.

Author: 0xMink

packages/types/src/__tests__/looksLikeFilePath.spec.ts

@@ -0,0 +1,48 @@
+// npx vitest run src/__tests__/looksLikeFilePath.spec.ts
+
+import { looksLikeFilePath } from "../utils/looksLikeFilePath.js"
+
+describe("looksLikeFilePath", () => {
+	describe("nullish, empty, and whitespace-only input", () => {
+		it.each([
+			["undefined", undefined],
+			["null", null],
+			["empty string", ""],
+			["whitespace only", "   \t\n  "],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+
+	describe("path-shaped input", () => {
+		it.each([
+			["Windows backslash path", "C:\\Users\\dev\\sa.json"],
+			["Windows forward-slash path", "C:/Users/dev/sa.json"],
+			["Windows drive lowercase", "d:\\creds.json"],
+			["POSIX absolute path", "/home/dev/sa.json"],
+			["POSIX absolute root /tmp", "/tmp/creds.json"],
+			["POSIX home path", "~/sa.json"],
+			["POSIX relative ./", "./sa.json"],
+			["POSIX relative ../", "../secrets/sa.json"],
+		])("returns true for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(true)
+		})
+
+		it("returns true after trimming surrounding whitespace", () => {
+			expect(looksLikeFilePath("  /tmp/creds.json  ")).toBe(true)
+			expect(looksLikeFilePath("\tC:\\sa.json\n")).toBe(true)
+		})
+	})
+
+	describe("JSON-shaped or bare-token input", () => {
+		it.each([
+			["JSON object", '{"type":"service_account","client_email":"x@y.z"}'],
+			["JSON array", "[1,2,3]"],
+			["JSON with leading whitespace", '   {"type":"service_account"}'],
+			["bare token", "not-json-and-not-a-path"],
+			["service-account-style email", "sa@project.iam.gserviceaccount.com"],
+		])("returns false for %s", (_label, value) => {
+			expect(looksLikeFilePath(value)).toBe(false)
+		})
+	})
+})

packages/types/src/index.ts

@@ -33,3 +33,5 @@ export * from "./vscode.js"
 export * from "./worktree.js"
 
 export * from "./providers/index.js"
+
+export * from "./utils/looksLikeFilePath.js"

packages/types/src/utils/looksLikeFilePath.ts

@@ -0,0 +1,24 @@
+// Returns true when a string is shaped like a filesystem path (Windows
+// drive-letter, POSIX absolute, POSIX home, POSIX relative). Pure and
+// dependency-free so it can be shared between the extension runtime (e.g.
+// parseVertexJsonCredentials) and the webview UI (e.g. the Vertex settings
+// warning), guaranteeing both surfaces agree on what "looks like a path"
+// means.
+//
+// Returns false for nullish, empty, and whitespace-only input — neither
+// call site should warn in those cases.
+export function looksLikeFilePath(value: string | null | undefined): boolean {
+	if (value == null) {
+		return false
+	}
+	const trimmed = value.trim()
+	if (!trimmed) {
+		return false
+	}
+	return (
+		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
+		trimmed.startsWith("/") || // POSIX absolute: /home/...
+		trimmed.startsWith("~") || // POSIX home: ~/...
+		trimmed.startsWith(".") // POSIX relative: ./... or ../...
+	)
+}

src/api/providers/__tests__/vertex-credentials.spec.ts

@@ -109,11 +109,18 @@ describe("parseVertexJsonCredentials", () => {
 		expect(warnSpy).toHaveBeenCalledTimes(1)
 	})
 
-	it("truncates long path previews in the warning", () => {
-		const longPath = "/" + "a".repeat(200)
-		parseVertexJsonCredentials(longPath)
+	it("does not echo the user's path in the warning (no PII in extension logs)", () => {
+		const sensitivePath = "/home/somerealuser/secrets/sa-key.json"
+		parseVertexJsonCredentials(sensitivePath)
+		expect(warnSpy).toHaveBeenCalledTimes(1)
 		const [message] = warnSpy.mock.calls[0]
-		expect(message).toContain("…")
+		// The warning must identify the field and the env var, but must not
+		// interpolate the user's actual input — usernames and directory names
+		// would leak into extension logs otherwise.
+		expect(message).toContain("Google Cloud Credentials")
+		expect(message).toContain("GOOGLE_APPLICATION_CREDENTIALS")
+		expect(message).not.toContain(sensitivePath)
+		expect(message).not.toContain("somerealuser")
 	})
 
 	it("falls back to the generic JSON parse error path for malformed but non-path input", () => {

src/api/providers/utils/vertex-credentials.ts

@@ -1,5 +1,6 @@
 import type { JWTInput } from "google-auth-library"
 
+import { looksLikeFilePath } from "@roo-code/types"
 import { safeJsonParse } from "@roo-code/core"
 
 // Detects when the "Google Cloud Credentials" field has received a filesystem
@@ -8,22 +9,22 @@ import { safeJsonParse } from "@roo-code/core"
 // and the sibling "Google Cloud Key File Path" field is where a path belongs.
 // Returns the parsed credentials object when the input looks like JSON, or
 // undefined when the field is empty, path-shaped, or unparseable.
+//
+// The path-shape predicate is shared with the webview UI warning via
+// @roo-code/types/looksLikeFilePath so both surfaces stay in agreement.
 export function parseVertexJsonCredentials(value: string | undefined): JWTInput | undefined {
 	const trimmed = value?.trim()
 	if (!trimmed) {
 		return undefined
 	}
 
-	const looksLikePath =
-		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
-		trimmed.startsWith("/") || // POSIX absolute: /home/...
-		trimmed.startsWith("~") || // POSIX home: ~/...
-		trimmed.startsWith(".") // POSIX relative: ./... or ../...
-
-	if (looksLikePath) {
-		const preview = trimmed.length > 40 ? `${trimmed.slice(0, 40)}…` : trimmed
+	if (looksLikeFilePath(trimmed)) {
+		// Intentionally static — the user's actual value is not interpolated
+		// into the warning so usernames and directory names don't leak into
+		// extension logs. The message still identifies the correct field and
+		// the env var fallback.
 		console.warn(
-			`[Vertex] The 'Google Cloud Credentials' field appears to contain a file path ("${preview}"), ` +
+			"[Vertex] The 'Google Cloud Credentials' field appears to contain a file path, " +
 				"but this field expects the raw JSON contents of a service-account key file. " +
 				"If you have a path to the credentials file, paste it into the 'Google Cloud Key File Path' field instead, " +
 				"or leave both fields empty and use the GOOGLE_APPLICATION_CREDENTIALS environment variable.",

webview-ui/src/components/settings/providers/Vertex.tsx

@@ -3,30 +3,13 @@ import { Trans } from "react-i18next"
 import { Checkbox } from "vscrui"
 import { VSCodeLink, VSCodeTextField } from "@vscode/webview-ui-toolkit/react"
 
-import { type ProviderSettings, VERTEX_REGIONS, VERTEX_1M_CONTEXT_MODEL_IDS } from "@roo-code/types"
+import { type ProviderSettings, VERTEX_REGIONS, VERTEX_1M_CONTEXT_MODEL_IDS, looksLikeFilePath } from "@roo-code/types"
 
 import { useAppTranslation } from "@src/i18n/TranslationContext"
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@src/components/ui"
 
 import { inputEventTransform } from "../transforms"
 
-// Detects when the "Google Cloud Credentials" field has received a filesystem
-// path instead of the raw JSON contents of a service-account key file. Mirrors
-// the runtime guard in src/api/providers/gemini.ts so the warning the user
-// sees in the UI matches what the runtime would log.
-function looksLikeFilePath(value: string): boolean {
-	const trimmed = value.trim()
-	if (!trimmed) {
-		return false
-	}
-	return (
-		/^[A-Za-z]:[\\/]/.test(trimmed) || // Windows: C:\... or C:/...
-		trimmed.startsWith("/") || // POSIX absolute: /home/...
-		trimmed.startsWith("~") || // POSIX home: ~/...
-		trimmed.startsWith(".") // POSIX relative: ./... or ../...
-	)
-}
-
 type VertexProps = {
 	apiConfiguration: ProviderSettings
 	setApiConfigurationField: (field: keyof ProviderSettings, value: ProviderSettings[keyof ProviderSettings]) => void
@@ -54,7 +37,7 @@ export const Vertex = ({ apiConfiguration, setApiConfigurationField }: VertexPro
 	)
 
 	const credentialsLooksLikePath = useMemo(
-		() => looksLikeFilePath(apiConfiguration?.vertexJsonCredentials ?? ""),
+		() => looksLikeFilePath(apiConfiguration?.vertexJsonCredentials),
 		[apiConfiguration?.vertexJsonCredentials],
 	)
 

webview-ui/src/components/settings/providers/__tests__/Vertex.spec.tsx

@@ -2,6 +2,7 @@ import { render, screen } from "@testing-library/react"
 import { Vertex } from "../Vertex"
 import type { ProviderSettings } from "@roo-code/types"
 import { VERTEX_REGIONS } from "@roo-code/types"
+import enSettings from "@src/i18n/locales/en/settings.json"
 
 vi.mock("@vscode/webview-ui-toolkit/react", () => ({
 	VSCodeTextField: ({ children, value, onInput, type }: any) => (
@@ -27,10 +28,24 @@ vi.mock("@src/i18n/TranslationContext", () => ({
 }))
 
 // The component uses <Trans> for the path-shape warning so it can interpolate
-// <strong>/<code> elements. The mock just renders the i18n key so the spec
-// can assert on its presence without depending on the English copy.
+// <strong>/<code> elements. Resolve the i18n key against the real English
+// resource so the test fails if the warning copy drops the "Google Cloud Key
+// File Path" field name or the "GOOGLE_APPLICATION_CREDENTIALS" env var
+// mention — those are the actual remediation hints users need.
 vi.mock("react-i18next", () => ({
-	Trans: ({ i18nKey }: { i18nKey: string }) => <>{i18nKey}</>,
+	Trans: ({ i18nKey }: { i18nKey: string }) => {
+		// Keys are "<namespace>:<dotted.path>"; the spec only renders the
+		// settings namespace so resolve against the imported English bundle.
+		const [, dotted] = i18nKey.split(":")
+		const resolved = dotted
+			.split(".")
+			.reduce<unknown>(
+				(acc, segment) =>
+					acc && typeof acc === "object" ? (acc as Record<string, unknown>)[segment] : undefined,
+				enSettings,
+			)
+		return <>{typeof resolved === "string" ? resolved : i18nKey}</>
+	},
 }))
 
 vi.mock("@src/components/ui", () => ({
@@ -175,7 +190,11 @@ describe("Vertex", () => {
 
 			const warning = screen.getByTestId("vertex-credentials-path-warning")
 			expect(warning).toBeInTheDocument()
-			expect(warning.textContent).toContain("settings:providers.googleCloudCredentialsPathWarning")
+			// The warning resolves through the real English bundle, so a
+			// regression that dropped either of these remediation strings
+			// from the translation would be caught here.
+			expect(warning).toHaveTextContent(/Google Cloud Key File Path/)
+			expect(warning).toHaveTextContent(/GOOGLE_APPLICATION_CREDENTIALS/)
 		})
 	})
 })