Treat a Vertex service-account JSON as ADC

AIXGO_VERTEX_API_KEY may be a plain API key or the contents of a
service-account JSON. JSON is written to a temp file and exported as
GOOGLE_APPLICATION_CREDENTIALS so Gemini CLI authenticates with IAM
instead of an API token.

Author: charlesgreen

CHANGELOG.md

@@ -8,7 +8,10 @@ GitHub release notes for each tag.
 - **Gemini on Vertex AI** (`engine: gemini`). The loop, roles, and gate are
   unchanged. The adapter shells out to the Gemini CLI (`gemini -p`) and reads
   `AIXGO_VERTEX_PROJECT`, `AIXGO_VERTEX_LOCATION` (default `us-central1`), and
-  `AIXGO_VERTEX_API_KEY`. Azure credentials are not required on this path.
+  `AIXGO_VERTEX_API_KEY`. If that last value is a service-account JSON object
+  (`"type": "service_account"`), it is written to a temp file and exported as
+  `GOOGLE_APPLICATION_CREDENTIALS`; a plain API key is still passed as
+  `GOOGLE_API_KEY`. Azure credentials are not required on this path.
 - The reusable workflow accepts optional `vertex-project`, `vertex-location`,
   and `vertex-api-key`, and the Azure endpoint/key are no longer required
   inputs. A Codex adopter who already passes them is unchanged. A Gemini

docs/setup.md

@@ -289,7 +289,9 @@ engine: gemini
 ```sh
 export AIXGO_VERTEX_PROJECT="<project>"
 export AIXGO_VERTEX_LOCATION="us-central1"   # optional, this is the default
-export AIXGO_VERTEX_API_KEY="<key>"
+# Either a Vertex API key, or the contents of a service-account JSON key
+# (a value starting with {"type":"service_account"...} is used as ADC).
+export AIXGO_VERTEX_API_KEY="<key-or-sa.json-contents>"
 aixgo-code run owner/repo#123 --repo-dir .
 ```
 

internal/engine/gemini/gemini.go

@@ -12,6 +12,7 @@ package gemini
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -53,6 +54,12 @@ func (r *Runner) Run(ctx context.Context, req domain.RunRequest) (domain.RunResu
 		return domain.RunResult{Role: req.Role, Err: err}, err
 	}
 
+	credsPath, cleanup, err := materializeVertexCreds()
+	if err != nil {
+		return domain.RunResult{Role: req.Role, Err: err}, err
+	}
+	defer cleanup()
+
 	args := []string{"-p", req.Prompt, "--output-format", "text", "-y"}
 	model := req.Model
 	if model == "" {
@@ -64,7 +71,7 @@ func (r *Runner) Run(ctx context.Context, req domain.RunRequest) (domain.RunResu
 
 	cmd := exec.CommandContext(ctx, r.bin(), args...)
 	cmd.Dir = req.WorkDir
-	cmd.Env = r.childEnv(req.WorkDir)
+	cmd.Env = r.childEnv(req.WorkDir, credsPath)
 	out, runErr := cmd.CombinedOutput()
 
 	res := domain.RunResult{Role: req.Role, Summary: tail(strings.TrimSpace(string(out)), 40)}
@@ -78,10 +85,11 @@ func (r *Runner) Run(ctx context.Context, req domain.RunRequest) (domain.RunResu
 // childEnv builds the child environment. It mirrors the other adapters for the
 // Go caches, and translates the AIXGO_VERTEX_* names into the names the Gemini
 // CLI reads for Vertex.
-func (r *Runner) childEnv(workDir string) []string {
+func (r *Runner) childEnv(workDir, credsPath string) []string {
 	env := filterEnvKeys(os.Environ(),
 		"GOCACHE", "GOPATH", "GH_TOKEN", "GITHUB_TOKEN",
-		"GOOGLE_GENAI_USE_VERTEXAI", "GOOGLE_CLOUD_PROJECT", "GOOGLE_CLOUD_LOCATION", "GOOGLE_API_KEY",
+		"GOOGLE_GENAI_USE_VERTEXAI", "GOOGLE_CLOUD_PROJECT", "GOOGLE_CLOUD_LOCATION",
+		"GOOGLE_API_KEY", "GOOGLE_APPLICATION_CREDENTIALS",
 	)
 	env = append(env, r.ExtraEnv...)
 	if !hasEnvKey(r.ExtraEnv, "GOCACHE") {
@@ -103,12 +111,51 @@ func (r *Runner) childEnv(workDir string) []string {
 		loc = defaultLocation
 	}
 	env = append(env, "GOOGLE_CLOUD_LOCATION="+loc)
-	if k := strings.TrimSpace(os.Getenv("AIXGO_VERTEX_API_KEY")); k != "" {
+	if credsPath != "" {
+		env = append(env, "GOOGLE_APPLICATION_CREDENTIALS="+credsPath)
+	} else if k := strings.TrimSpace(os.Getenv("AIXGO_VERTEX_API_KEY")); k != "" {
 		env = append(env, "GOOGLE_API_KEY="+k)
 	}
 	return env
 }
 
+// materializeVertexCreds writes a service-account JSON from AIXGO_VERTEX_API_KEY
+// to a temp file outside the worktree. A plain API key is left in the env and
+// handled by childEnv. The file is 0600 and must be removed by the caller.
+func materializeVertexCreds() (string, func(), error) {
+	noop := func() {}
+	raw := strings.TrimSpace(os.Getenv("AIXGO_VERTEX_API_KEY"))
+	if raw == "" || !isServiceAccountJSON(raw) {
+		return "", noop, nil
+	}
+	f, err := os.CreateTemp("", "aixgo-vertex-sa-*.json")
+	if err != nil {
+		return "", noop, fmt.Errorf("gemini: write service account key: %w", err)
+	}
+	path := f.Name()
+	cleanup := func() { _ = os.Remove(path) }
+	if _, err := f.WriteString(raw); err != nil {
+		_ = f.Close()
+		cleanup()
+		return "", noop, fmt.Errorf("gemini: write service account key: %w", err)
+	}
+	if err := f.Close(); err != nil {
+		cleanup()
+		return "", noop, fmt.Errorf("gemini: write service account key: %w", err)
+	}
+	return path, cleanup, nil
+}
+
+func isServiceAccountJSON(s string) bool {
+	var doc struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal([]byte(s), &doc); err != nil {
+		return false
+	}
+	return doc.Type == "service_account"
+}
+
 func filterEnvKeys(env []string, keys ...string) []string {
 	out := make([]string, 0, len(env))
 	for _, e := range env {

internal/engine/gemini/gemini_test.go

@@ -116,6 +116,44 @@ func TestRunExportsVertexSettingsForTheGeminiCLI(t *testing.T) {
 	}
 }
 
+const echoADC = `#!/bin/sh
+printf '%s\n%s\n' "$GOOGLE_API_KEY" "$GOOGLE_APPLICATION_CREDENTIALS"
+if [ -n "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
+  cat "$GOOGLE_APPLICATION_CREDENTIALS"
+fi
+exit 0
+`
+
+const saJSON = `{"type":"service_account","project_id":"simplycubed-agents","client_email":"vertex@simplycubed-agents.iam.gserviceaccount.com"}`
+
+func TestRunTreatsServiceAccountJSONAsADC(t *testing.T) {
+	work := t.TempDir()
+	t.Setenv("AIXGO_VERTEX_PROJECT", "simplycubed-agents")
+	t.Setenv("AIXGO_VERTEX_API_KEY", saJSON)
+	r := New()
+	r.Bin = writeFakeGemini(t, echoADC)
+	res, err := r.Run(context.Background(), domain.RunRequest{
+		Role: domain.RoleImplementer, WorkDir: work, Prompt: "x",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	lines := strings.SplitN(res.Summary, "\n", 2)
+	if len(lines) < 2 {
+		t.Fatalf("summary = %q", res.Summary)
+	}
+	creds := lines[0]
+	if creds == "" || strings.HasPrefix(creds, "{") {
+		t.Fatalf("GOOGLE_APPLICATION_CREDENTIALS must be a file path, not the JSON, got %q", creds)
+	}
+	if strings.HasPrefix(creds, work) {
+		t.Fatalf("the key file must not live in the worktree, got %q", creds)
+	}
+	if !strings.Contains(lines[1], `"type":"service_account"`) {
+		t.Fatalf("the key file should contain the service account JSON, got %q", res.Summary)
+	}
+}
+
 func TestRunDefaultsLocationWhenUnset(t *testing.T) {
 	t.Setenv("AIXGO_VERTEX_PROJECT", "p")
 	t.Setenv("AIXGO_VERTEX_LOCATION", "")