fix: fill Vertex ADC static catalog auth

849261680 · 849261680 · commit 57784d65bd0c · 2026-06-05T19:33:42.000+08:00
diff --git a/extensions/google/index.test.ts b/extensions/google/index.test.ts
@@ -17,6 +17,7 @@ import type { RealtimeVoiceProviderPlugin } from "openclaw/plugin-sdk/realtime-v
 import { describe, expect, it, vi } from "vitest";
 import { registerGoogleGeminiCliProvider } from "./gemini-cli-provider.js";
 import googlePlugin from "./index.js";
+import googleProviderDiscovery from "./provider-discovery.js";
 import { registerGoogleProvider } from "./provider-registration.js";
 
 const googleProviderPlugin = {
@@ -207,6 +208,16 @@ describe("google provider plugin hooks", () => {
         },
       }),
     ).toBe("gcp-vertex-credentials");
+    expect(
+      googleProviderDiscovery.resolveConfigApiKey?.({
+        provider: "google-vertex",
+        env: {
+          GOOGLE_APPLICATION_CREDENTIALS: credentialsPath,
+          GOOGLE_CLOUD_PROJECT: "vertex-project",
+          GOOGLE_CLOUD_LOCATION: "global",
+        },
+      }),
+    ).toBe("gcp-vertex-credentials");
   });
 
   it("owns Gemini tool schema normalization for direct and CLI providers", async () => {
diff --git a/extensions/google/provider-discovery.ts b/extensions/google/provider-discovery.ts
@@ -4,12 +4,15 @@ import {
   buildGoogleStaticCatalogProvider,
   buildGoogleVertexStaticCatalogProvider,
 } from "./provider-catalog.js";
+import { resolveGoogleVertexConfigApiKey } from "./vertex-adc.js";
 
 const googleProviderDiscovery: ProviderPlugin = {
   id: "google",
   label: "Google AI Studio",
   docsPath: "/providers/models",
   auth: [],
+  resolveConfigApiKey: ({ provider, env }) =>
+    provider === "google-vertex" ? resolveGoogleVertexConfigApiKey(env) : undefined,
   staticCatalog: {
     order: "simple",
     run: async () => ({
diff --git a/src/agents/models-config.providers.implicit.discovery-scope.test.ts b/src/agents/models-config.providers.implicit.discovery-scope.test.ts
@@ -1,4 +1,7 @@
 // Exercises startup provider discovery scoping without loading real plugin manifests.
+import { mkdtemp, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { PluginMetadataSnapshotOwnerMaps } from "../plugins/plugin-metadata-snapshot.js";
 import type { ProviderPlugin } from "../plugins/types.js";
@@ -205,6 +208,38 @@ describe("resolveImplicitProviders startup discovery scope", () => {
     expect(mocks.runProviderCatalog).not.toHaveBeenCalled();
   });
 
+  it("fills missing static catalog apiKey from Google Vertex ADC auth evidence", async () => {
+    const tempDir = await mkdtemp(path.join(os.tmpdir(), "openclaw-google-vertex-adc-"));
+    const credentialsPath = path.join(tempDir, "application_default_credentials.json");
+    await writeFile(credentialsPath, JSON.stringify({ type: "authorized_user" }));
+    mocks.resolveRuntimePluginDiscoveryProviders.mockResolvedValue([
+      createStaticOnlyProvider("google"),
+    ]);
+    mocks.runProviderStaticCatalog.mockResolvedValue({
+      providers: {
+        "google-vertex": {
+          baseUrl: "https://aiplatform.googleapis.com",
+          api: "google-vertex" as const,
+          models: [createTextModel("gemini-3.1-pro-preview", "Gemini 3.1 Pro Preview")],
+        },
+      },
+    });
+
+    const providers = await resolveImplicitProviders({
+      agentDir: "/tmp/openclaw-agent",
+      config: {},
+      env: {
+        GOOGLE_APPLICATION_CREDENTIALS: credentialsPath,
+        GOOGLE_CLOUD_PROJECT: "vertex-project",
+        GOOGLE_CLOUD_LOCATION: "global",
+      } as NodeJS.ProcessEnv,
+      explicitProviders: {},
+      providerDiscoveryEntriesOnly: true,
+    });
+
+    expect(providers?.["google-vertex"]?.apiKey).toBe("gcp-vertex-credentials");
+  });
+
   it("falls back to static provider catalogs when runtime discovery has no rows", async () => {
     mocks.resolveRuntimePluginDiscoveryProviders.mockResolvedValue([
       createProviderWithStaticCatalog("minimax"),
diff --git a/src/agents/models-config.providers.implicit.ts b/src/agents/models-config.providers.implicit.ts
@@ -38,6 +38,7 @@ import type {
 import {
   createProviderApiKeyResolver,
   createProviderAuthResolver,
+  resolveMissingProviderApiKey,
 } from "./models-config.providers.secrets.js";
 
 const log = createSubsystemLogger("agents/model-providers");
@@ -293,6 +294,19 @@ function mergeImplicitProviderConfig(params: {
   };
 }
 
+function resolveImplicitProviderAuthMarker(params: {
+  ctx: ImplicitProviderContext;
+  providerId: string;
+  provider: ProviderConfig;
+}): ProviderConfig {
+  return resolveMissingProviderApiKey({
+    providerKey: params.providerId,
+    provider: params.provider,
+    env: params.ctx.env,
+    profileApiKey: undefined,
+  });
+}
+
 function resolveConfiguredImplicitProvider(params: {
   configuredProviders?: Record<string, ProviderConfig> | null;
   providerIds: readonly string[];
@@ -430,7 +444,7 @@ async function resolvePluginImplicitProviders(
       result,
     });
     for (const [providerId, implicitProvider] of Object.entries(normalizedResult)) {
-      discovered[providerId] = mergeImplicitProviderConfig({
+      const mergedProvider = mergeImplicitProviderConfig({
         providerId,
         existing:
           discovered[providerId] ??
@@ -449,6 +463,11 @@ async function resolvePluginImplicitProviders(
           providerId,
         }),
       });
+      discovered[providerId] = resolveImplicitProviderAuthMarker({
+        ctx,
+        providerId,
+        provider: mergedProvider,
+      });
     }
   }
   return Object.keys(discovered).length > 0 ? discovered : undefined;
