Scion/opencode vertex auth

[ptone]

Fixes #<issue_number_goes_here>

It's a good idea to open an issue first for discussion.

• Tests pass
• Appropriate changes to documentation are included in the PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request adds support for Vertex AI authentication to the OpenCode harness. It updates the configuration to enable Vertex AI capabilities, defines required environment variables, and implements helper functions in provision.py to resolve secrets. It also updates the authentication selection logic to support explicit and auto-detected Vertex AI authentication. The review feedback suggests enforcing the GCP metadata block guard when Vertex AI is explicitly selected and improving compatibility with standard Google Cloud SDKs by populating standard environment variables alongside custom ones.

[gemini-code-assist]

When vertex-ai is explicitly selected, we should also respect the vertex_not_blocked guard (which checks gcp_metadata_mode). If GCP metadata access is blocked, we should raise an error immediately rather than attempting to proceed.

Suggested change

	if explicit == "vertex-ai":
	if not has_vertex_project or not has_vertex_location:
	raise ValueError(
	"opencode: auth type 'vertex-ai' selected but missing "
	"GOOGLE_CLOUD_PROJECT/VERTEXAI_PROJECT and/or "
	"GOOGLE_CLOUD_REGION/GOOGLE_CLOUD_LOCATION/VERTEX_LOCATION"
	)
	return "vertex-ai", ""
	if explicit == "vertex-ai":
	if not vertex_not_blocked:
	raise ValueError(
	"opencode: auth type 'vertex-ai' selected but GCP metadata access is blocked"
	)
	if not has_vertex_project or not has_vertex_location:
	raise ValueError(
	"opencode: auth type 'vertex-ai' selected but missing "
	"GOOGLE_CLOUD_PROJECT/VERTEXAI_PROJECT and/or "
	"GOOGLE_CLOUD_REGION/GOOGLE_CLOUD_LOCATION/VERTEX_LOCATION"
	)
	return "vertex-ai", ""

[gemini-code-assist]

To ensure compatibility with standard Google Cloud SDKs (which typically look for GOOGLE_CLOUD_PROJECT and GOOGLE_CLOUD_REGION rather than the custom VERTEXAI_PROJECT and VERTEX_LOCATION env vars), it is safer to populate both sets of environment variables in env_payload.

    if method == "vertex-ai":
        project = _resolve_secret(secret_files, "GOOGLE_CLOUD_PROJECT", "VERTEXAI_PROJECT")
        location = _resolve_secret(
            secret_files, "GOOGLE_CLOUD_REGION", "GOOGLE_CLOUD_LOCATION", "VERTEX_LOCATION"
        )
        if project:
            env_payload["VERTEXAI_PROJECT"] = project
            env_payload["GOOGLE_CLOUD_PROJECT"] = project
        if location:
            env_payload["VERTEX_LOCATION"] = location
            env_payload["GOOGLE_CLOUD_REGION"] = location