@f5-sales-demo/pi-ai 21.4.0 → 21.5.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "21.4.0",
+	"version": "21.5.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "21.4.0",
+		"@f5-sales-demo/pi-utils": "21.5.1",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/auth-storage.ts

@@ -38,7 +38,7 @@ import { loginCloudflareAiGateway } from "./utils/oauth/cloudflare-ai-gateway";
 import { loginCursor } from "./utils/oauth/cursor";
 import { loginGitHubCopilot } from "./utils/oauth/github-copilot";
 import { loginGitLabDuo } from "./utils/oauth/gitlab-duo";
-import { loginAntigravity } from "./utils/oauth/google-antigravity";
+import { loginAntigravity, loginVertexWithAntigravityOAuth } from "./utils/oauth/google-antigravity";
 import { loginGeminiCli } from "./utils/oauth/google-gemini-cli";
 import { loginHuggingface } from "./utils/oauth/huggingface";
 import { loginKagi } from "./utils/oauth/kagi";
@@ -793,6 +793,12 @@ export class AuthStorage {
 					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
 				});
 				break;
+			case "google-vertex":
+				credentials = await loginVertexWithAntigravityOAuth({
+					...ctrl,
+					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
+				});
+				break;
 			case "google-antigravity":
 				credentials = await loginAntigravity({
 					...ctrl,

package/src/provider-models/google.ts

@@ -35,8 +35,8 @@ export function googleModelManagerOptions(
 export function googleVertexModelManagerOptions(
 	_config?: GoogleVertexModelManagerConfig,
 ): ModelManagerOptions<"google-vertex"> {
-	// Vertex AI uses Application Default Credentials (ADC) for authentication,
-	// which is handled at stream time rather than during model discovery.
+	// Vertex authentication is handled at stream time rather than during model
+	// discovery (standalone OAuth in xcsh, or explicit credentials for SDK users).
 	// Dynamic model discovery is not yet implemented for this provider.
 	return {
 		providerId: "google-vertex",

package/src/providers/google-vertex.ts

@@ -35,6 +35,8 @@ import {
 } from "./google-shared";
 
 export interface GoogleVertexOptions extends StreamOptions {
+	/** OAuth bearer token from the isolated Vertex credential namespace. */
+	apiKey?: string;
 	toolChoice?: "auto" | "none" | "any";
 	thinking?: {
 		enabled: boolean;
@@ -104,11 +106,11 @@ export const streamGoogleVertex: StreamFunction<"google-vertex"> = (
 		let rawRequestDump: RawHttpRequestDump | undefined;
 
 		try {
-			// Corporate Vertex is deliberately ADC-only.  In particular, do not let the
-			// generic agent API-key plumbing turn this route into Gemini consumer auth.
+			// apiKey is an isolated, short-lived OAuth bearer token for the Corporate
+			// Vertex route. It is never sourced from Gemini consumer credentials.
 			const project = await resolveGoogleVertexProject(options);
 			const location = resolveGoogleVertexLocation(options);
-			const client = createClient(model, project, location);
+			const client = createClient(model, project, location, options?.apiKey);
 			const params = buildGoogleVertexParams(model, context, options);
 			options?.onPayload?.(params);
 			rawRequestDump = {
@@ -331,13 +333,21 @@ function buildHttpOptions(model: Model<"google-vertex">): { headers?: Record<str
 	return { headers: { ...model.headers } };
 }
 
-function createClient(model: Model<"google-vertex">, project: string, location: string): GoogleGenAI {
+function createClient(
+	model: Model<"google-vertex">,
+	project: string,
+	location: string,
+	accessToken?: string,
+): GoogleGenAI {
 	return new GoogleGenAI({
 		vertexai: true,
 		project,
 		location,
 		apiVersion: API_VERSION,
-		httpOptions: buildHttpOptions(model),
+		httpOptions: {
+			...buildHttpOptions(model),
+			...(accessToken ? { headers: { ...model.headers, Authorization: `Bearer ${accessToken}` } } : {}),
+		},
 	});
 }
 

package/src/stream.ts

@@ -1,6 +1,3 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
 import { $env, $pickenv } from "@f5-sales-demo/pi-utils";
 import { getCustomApi } from "./api-registry";
 import type { Effort } from "./model-thinking";
@@ -37,22 +34,6 @@ import type {
 	ToolChoice,
 } from "./types";
 
-let cachedVertexAdcCredentialsExists: boolean | null = null;
-
-function hasVertexAdcCredentials(): boolean {
-	if (cachedVertexAdcCredentialsExists === null) {
-		const gacPath = $env.GOOGLE_APPLICATION_CREDENTIALS;
-		if (gacPath) {
-			cachedVertexAdcCredentialsExists = fs.existsSync(gacPath);
-		} else {
-			cachedVertexAdcCredentialsExists = fs.existsSync(
-				path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"),
-			);
-		}
-	}
-	return cachedVertexAdcCredentialsExists;
-}
-
 type KeyResolver = string | (() => string | undefined);
 
 function isFoundryEnabled(): boolean {
@@ -97,8 +78,6 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 			? $pickenv("ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY")
 			: $pickenv("ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"),
 	"gitlab-duo": "GITLAB_TOKEN",
-	// Corporate Vertex uses Application Default Credentials only.
-	"google-vertex": () => (hasVertexAdcCredentials() ? "<authenticated>" : undefined),
 	// Amazon Bedrock supports multiple credential sources:
 	// 1. AWS_PROFILE - named profile from ~/.aws/credentials
 	// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys
@@ -174,7 +153,7 @@ export function stream<TApi extends Api>(
 		});
 	}
 
-	// Vertex AI uses Application Default Credentials, not API keys
+	// Vertex accepts either existing ADC or the isolated OAuth bearer token.
 	if (model.api === "google-vertex") {
 		return streamGoogleVertex(model as Model<"google-vertex">, context, options as GoogleVertexOptions);
 	} else if (model.api === "bedrock-converse-stream") {
@@ -243,9 +222,10 @@ export function streamSimple<TApi extends Api>(
 		return customApiProvider.streamSimple(model, context, options);
 	}
 
-	// Vertex AI uses Application Default Credentials, not API keys
+	// Vertex receives a short-lived OAuth bearer token when available; otherwise
+	// the Google SDK performs normal ADC discovery.
 	if (model.api === "google-vertex") {
-		const providerOptions = mapOptionsForApi(model, options, undefined);
+		const providerOptions = mapOptionsForApi(model, options, options?.apiKey);
 		return stream(model, context, providerOptions);
 	} else if (model.api === "bedrock-converse-stream") {
 		// Bedrock doesn't have any API keys instead it sources credentials from standard AWS env variables or from given AWS profile.
@@ -401,7 +381,7 @@ function resolveOpenAiReasoningEffort<TApi extends Api>(
 
 const castApi = <TApi extends Api>(api: OptionsForApi<TApi>): OptionsForApi<Api> => api as OptionsForApi<Api>;
 
-function mapOptionsForApi<TApi extends Api>(
+export function mapOptionsForApi<TApi extends Api>(
 	model: Model<TApi>,
 	options?: SimpleStreamOptions,
 	apiKey?: string,
@@ -646,11 +626,16 @@ function mapOptionsForApi<TApi extends Api>(
 		}
 
 		case "google-vertex": {
+			const vertexBase = {
+				...base,
+				project: options?.project,
+				location: options?.location,
+			};
 			// Explicitly disable thinking when reasoning is not specified or model doesn't support it
 			const reasoning = options?.reasoning;
 			if (!reasoning || !model.reasoning) {
 				return castApi<"google-vertex">({
-					...base,
+					...vertexBase,
 					thinking: { enabled: false },
 					toolChoice: mapGoogleToolChoice(options?.toolChoice),
 				});
@@ -662,7 +647,7 @@ function mapOptionsForApi<TApi extends Api>(
 
 			if (geminiModel.thinking?.mode === "google-level") {
 				return castApi<"google-vertex">({
-					...base,
+					...vertexBase,
 					thinking: {
 						enabled: true,
 						level: mapEffortToGoogleThinkingLevel(geminiModel, effort),
@@ -672,7 +657,7 @@ function mapOptionsForApi<TApi extends Api>(
 			}
 
 			return castApi<"google-vertex">({
-				...base,
+				...vertexBase,
 				thinking: {
 					enabled: true,
 					budgetTokens: getGoogleBudget(geminiModel, effort, options?.thinkingBudgets),

package/src/types.ts

@@ -227,6 +227,10 @@ export interface StreamOptions {
 
 // Unified options with reasoning passed to streamSimple() and completeSimple()
 export interface SimpleStreamOptions extends StreamOptions {
+	/** Confirmed Google Cloud project for the Corporate Vertex transport. */
+	project?: string;
+	/** Google Cloud location for the Corporate Vertex transport. */
+	location?: string;
 	reasoning?: Effort;
 	/** Custom token budgets for thinking levels (token-based providers only) */
 	thinkingBudgets?: ThinkingBudgets;

package/src/utils/oauth/google-antigravity.ts

@@ -341,9 +341,9 @@ async function discoverProject(
 	}
 }
 
-async function getUserEmail(accessToken: string): Promise<string | undefined> {
+async function getUserEmail(accessToken: string, fetchImpl: typeof fetch = fetch): Promise<string | undefined> {
 	try {
-		const response = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
+		const response = await fetchImpl("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
 			headers: { Authorization: `Bearer ${accessToken}` },
 		});
 
@@ -357,6 +357,19 @@ async function getUserEmail(accessToken: string): Promise<string | undefined> {
 	return undefined;
 }
 
+function googleAuthUrl(state: string, redirectUri: string): string {
+	const authParams = new URLSearchParams({
+		client_id: CLIENT_ID,
+		response_type: "code",
+		redirect_uri: redirectUri,
+		scope: SCOPES.join(" "),
+		state,
+		access_type: "offline",
+		prompt: "consent",
+	});
+	return `${AUTH_URL}?${authParams.toString()}`;
+}
+
 class AntigravityOAuthFlow extends OAuthCallbackFlow {
 	#configuredProjectId: string | undefined;
 
@@ -366,18 +379,7 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
 	}
 
 	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
-		const authParams = new URLSearchParams({
-			client_id: CLIENT_ID,
-			response_type: "code",
-			redirect_uri: redirectUri,
-			scope: SCOPES.join(" "),
-			state,
-			access_type: "offline",
-			prompt: "consent",
-		});
-
-		const url = `${AUTH_URL}?${authParams.toString()}`;
-		return { url, instructions: "Complete the sign-in in your browser." };
+		return { url: googleAuthUrl(state, redirectUri), instructions: "Complete the sign-in in your browser." };
 	}
 
 	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
@@ -425,6 +427,52 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
 	}
 }
 
+export async function exchangeVertexOAuthCode(
+	code: string,
+	redirectUri: string,
+	fetchImpl: typeof fetch = fetch,
+): Promise<OAuthCredentials> {
+	const tokenResponse = await fetchImpl(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			client_secret: CLIENT_SECRET,
+			code,
+			grant_type: "authorization_code",
+			redirect_uri: redirectUri,
+		}),
+	});
+	if (!tokenResponse.ok) throw new Error(`Token exchange failed: ${await tokenResponse.text()}`);
+	const tokenData = (await tokenResponse.json()) as {
+		access_token: string;
+		refresh_token: string;
+		expires_in: number;
+	};
+	if (!tokenData.refresh_token) throw new Error("No refresh token received. Please try again.");
+	return {
+		refresh: tokenData.refresh_token,
+		access: tokenData.access_token,
+		expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000,
+		email: await getUserEmail(tokenData.access_token, fetchImpl),
+	};
+}
+
+class VertexAntigravityOAuthFlow extends OAuthCallbackFlow {
+	constructor(ctrl: OAuthController) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		return { url: googleAuthUrl(state, redirectUri), instructions: "Complete the sign-in in your browser." };
+	}
+
+	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		this.ctrl.onProgress?.("Exchanging authorization code for a Vertex credential...");
+		return exchangeVertexOAuthCode(code, redirectUri);
+	}
+}
+
 /**
  * Login with Antigravity OAuth
  */
@@ -439,6 +487,20 @@ export async function loginAntigravity(
 	return flow.login();
 }
 
+/**
+ * Authorized direct-Vertex login. This deliberately reuses only the approved
+ * Google OAuth client flow; it does not call Code Assist or share Antigravity
+ * credential/project state.
+ */
+export async function loginVertexWithAntigravityOAuth(ctrl: OAuthController): Promise<OAuthCredentials> {
+	return new VertexAntigravityOAuthFlow(ctrl).login();
+}
+
+export async function refreshVertexWithAntigravityOAuth(refreshToken: string): Promise<OAuthCredentials> {
+	const credentials = await refreshAntigravityToken(refreshToken, "");
+	return { ...credentials, projectId: undefined, tierId: undefined };
+}
+
 /**
  * Refresh Antigravity token
  */

package/src/utils/oauth/index.ts

@@ -5,7 +5,7 @@ import { refreshAnthropicToken } from "./anthropic";
 import { refreshCursorToken } from "./cursor";
 import { refreshGitHubCopilotToken } from "./github-copilot";
 import { refreshGitLabDuoToken } from "./gitlab-duo";
-import { refreshAntigravityToken } from "./google-antigravity";
+import { refreshAntigravityToken, refreshVertexWithAntigravityOAuth } from "./google-antigravity";
 import { refreshGoogleCloudToken } from "./google-gemini-cli";
 import { refreshKimiToken } from "./kimi";
 import { refreshOpenAICodexToken } from "./openai-codex";
@@ -66,7 +66,7 @@ export {
 // GitLab Duo
 export { loginGitLabDuo, refreshGitLabDuoToken } from "./gitlab-duo";
 // Google Antigravity
-export { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
+export { loginAntigravity, loginVertexWithAntigravityOAuth, refreshAntigravityToken } from "./google-antigravity";
 // Google Gemini CLI
 export { loginGeminiCli, refreshGoogleCloudToken } from "./google-gemini-cli";
 // Hugging Face Inference (API key)
@@ -393,6 +393,9 @@ export async function refreshOAuthToken(
 			}
 			newCredentials = await refreshGoogleCloudToken(credentials.refresh, credentials.projectId);
 			break;
+		case "google-vertex":
+			newCredentials = await refreshVertexWithAntigravityOAuth(credentials.refresh);
+			break;
 		case "google-antigravity":
 			if (!credentials.projectId) {
 				throw new Error("Antigravity credentials missing projectId");

package/src/utils/oauth/types.ts

@@ -18,6 +18,7 @@ export type OAuthProvider =
 	| "cursor"
 	| "github-copilot"
 	| "google-gemini-cli"
+	| "google-vertex"
 	| "google-antigravity"
 	| "google-antigravity-enterprise"
 	| "gitlab-duo"