@opencode/ai 0.0.0-dev-20791 → 0.0.0-dev-20794

package/dist/providers/google-vertex-shared.d.ts

@@ -1,4 +1,6 @@
+import type { AnyAuthClient } from "google-auth-library";
 import { Auth } from "../route/auth.js";
+export declare const loadADCClient: (project?: string) => Promise<AnyAuthClient>;
 export type OAuthOptions = {
     readonly accessToken?: string;
     readonly auth?: never;

package/dist/providers/google-vertex-shared.js

@@ -3,6 +3,32 @@ import { Auth, MissingCredentialError } from "../route/auth.js";
 import { ProviderConfigurationError, ProviderID } from "../schema/index.js";
 const SCOPE = "https://www.googleapis.com/auth/cloud-platform";
 const id = ProviderID.make("google-vertex");
+export const loadADCClient = async (project) => {
+    const { GoogleAuth } = await import("google-auth-library");
+    // google-auth-library 10.5.0 ignores CLOUDSDK_CONFIG during ADC file discovery.
+    // Fix this in shipped AI code: a repository-level Bun dependency patch would not
+    // reach npm or Bun consumers of the published @opencode/ai package.
+    // Override only the well-known-file lookup: keyFilename bypasses ADC's quota-project
+    // preparation. Keep explicit credentials and metadata fallback in Google's ADC chain.
+    class CloudSDKAuth extends GoogleAuth {
+        async _tryGetApplicationCredentialsFromWellKnownFile(options) {
+            const config = process.env.CLOUDSDK_CONFIG;
+            if (!config)
+                return super._tryGetApplicationCredentialsFromWellKnownFile(options);
+            // Keep local filesystem helpers lazy for explicitly authenticated Worker callers;
+            // this ADC-file lookup itself requires a Node-compatible filesystem.
+            const { existsSync } = await import("node:fs");
+            const { homedir } = await import("node:os");
+            const { join } = await import("node:path");
+            const directory = config === "~" ? homedir() : config.startsWith("~/") ? join(homedir(), config.slice(2)) : config;
+            const file = join(directory, "application_default_credentials.json");
+            if (!existsSync(file))
+                return null;
+            return this._getApplicationCredentialsFromFilePath(file, options);
+        }
+    }
+    return new CloudSDKAuth({ projectId: project, scopes: [SCOPE] }).getClient();
+};
 export const project = (value) => value ??
     process.env.GOOGLE_VERTEX_PROJECT ??
     process.env.GOOGLE_CLOUD_PROJECT ??
@@ -50,7 +76,7 @@ const adc = (project) => {
     const loadClient = () => {
         if (client)
             return client;
-        client = import("google-auth-library").then(({ GoogleAuth }) => new GoogleAuth({ projectId: project, scopes: [SCOPE] }).getClient());
+        client = loadADCClient(project);
         return client;
     };
     return Auth.effect(Effect.tryPromise({

package/package.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
-  "version": "0.0.0-dev-20791",
+  "version": "0.0.0-dev-20794",
   "name": "@opencode/ai",
   "type": "module",
   "license": "MIT",
@@ -34,7 +34,7 @@
   "devDependencies": {
     "@clack/prompts": "1.0.0-alpha.1",
     "@effect/platform-node": "4.0.0-rc.118",
-    "@opencode/http-recorder": "0.0.0-dev-20791",
+    "@opencode/http-recorder": "0.0.0-dev-20794",
     "@tsconfig/bun": "1.0.9",
     "@types/bun": "1.4.0",
     "@typescript/native-preview": "7.0.0-dev.20251207.1",
@@ -44,7 +44,7 @@
     "@aws-sdk/credential-providers": "3.1057.0",
     "@smithy/eventstream-codec": "4.2.14",
     "@smithy/util-utf8": "4.2.2",
-    "@opencode/schema": "0.0.0-dev-20791",
+    "@opencode/schema": "0.0.0-dev-20794",
     "aws4fetch": "1.0.20",
     "effect": "4.0.0-rc.118",
     "google-auth-library": "10.5.0"