mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-08-26 00:53:48 +00:00
fd9c452dc8
* fix(auth): let Vertex AI authenticate with Application Default Credentials Vertex AI auth required an API key, so an ADC or service account setup could not start. Supplying a placeholder to satisfy the check made it worse: an explicitly passed key switches the Google SDK to Vertex Express mode, which clears the project and location and rejects the request with "API keys are not supported by this API". Treat a configured GOOGLE_CLOUD_PROJECT as sufficient credentials for the vertex-ai auth type, in both the CLI pre-flight check and the core model config validation, and leave the API key absent so the SDK resolves ADC itself. The missing-credentials errors now mention the keyless path instead of pointing only at envKey. Fixes #9016 * fix(auth): select Vertex mode explicitly and keep declared key vars authoritative Review follow-ups on the Vertex ADC change. Vertex mode no longer depends on the GOOGLE_GENAI_USE_VERTEXAI side effect. Only the CLI pre-flight check writes that variable, and the startup call to it sits under the sandbox branch, so a plain interactive or ACP session built a client pointed at the Gemini API endpoint instead of Vertex. The flag is now derived from the auth type at construction, and left untouched for the other auth types so the SDK keeps its own environment fallback there. An entry that declares its own key variable no longer falls through to ADC when that variable is unset. It keeps failing on the declared variable, so a secret that failed to inject cannot silently authenticate as a different principal. The keyless hint is suppressed for those entries as well, since it would be advice that cannot work. The ACP pre-flight cell reports an indeterminate state for a keyless Vertex setup rather than a confirmed token: a configured project is routing configuration, not evidence that a credential resolves. All three gates now share one definition of a configured project, so whitespace is handled the same way everywhere, and the CLI missing-key message carries the same keyless hint as the core errors. Docs corrected on two counts: the environment-only row now says a keyless setup must select the auth type explicitly, since it is not inferred from the project alone, and the provider note names every key source the resolver folds in. --------- Co-authored-by: Shaojin Wen <shaojin.wensj@alibaba-inc.com> |
||
|---|---|---|
| .. | ||
| assets | ||
| design | ||
| developers | ||
| e2e-tests | ||
| images | ||
| plans | ||
| superpowers | ||
| users | ||
| verification/abort-controller-refactor | ||
| _meta.ts | ||
| index.md | ||