openclaw - 💡(How to fix) Fix google-vertex provider broken on Node 25+ and ADC credential handling [1 participants]

Summary

google-vertex provider broken on Node 25+ — @google/genai crashes with Cannot convert undefined or null to object on startup, and ADC credential marker leaks to downstream causing auth failures.

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Steps to reproduce

Bug 1 — node-fetch crash (Node 25+):

1. Run OpenClaw on Node v25.x (macOS).
2. Attempt any google-vertex request (e.g. gv-flash model).
3. Observe crash: Cannot convert undefined or null to object thrown from inside @google/genai/node_modules/gaxios.

Bug 2 — ADC marker leak:

1. Configure google-vertex provider with Application Default Credentials (ADC) in ~/.openclaw/.env.
2. Start gateway via LaunchAgent.
3. Attempt any google-vertex request.
4. Observe auth failure — x-goog-api-key header being constructed from the raw ADC marker string instead of being omitted.

Expected behavior

Bug 1: google-vertex requests work on Node 25+ without crashing — gaxios should use globalThis.fetch when available.

Bug 2: With valid ADC credentials, google-vertex requests succeed and the pi-ai provider passes vertexai: true to GoogleGenAI so requests go to the Vertex AI endpoint.

Actual behavior

Bug 1: @google/genai's nested gaxios dynamically imports node-fetch on Node 25+, which throws before any request is made.

Bug 2: model-auth-env returns the raw GCP_VERTEX_CREDENTIALS_MARKER constant instead of a resolved sentinel; gemini-auth helpers attempt to build x-goog-api-key from it; pi-ai does not set vertexai: true so even valid ADC requests go to the wrong endpoint.

OpenClaw version

latest (installed via npm global, /opt/homebrew/lib/node_modules/openclaw)

Operating system

macOS 25.x (arm64)

Install method

npm global

Model

google-vertex (effective model e.g. gemini-3.1-flash-lite-preview via Vertex AI)

Provider / routing chain

openclaw -> google-vertex (direct, ADC auth)

Additional provider/model setup details

Two separate patches were developed to work around both bugs locally.

Patch 1 — patch-vertex-node25-fetch.sh patches gaxios to prefer globalThis.fetch over node-fetch:

// Changed from:
static async #getFetch() {
    const hasWindow = typeof window !== "undefined" && !!window;
    this.#fetch ||= hasWindow
        ? window.fetch
        : (await import("node-fetch")).default;
    return this.#fetch;
}

// To:
static async #getFetch() {
    const hasWindow = typeof window !== "undefined" && !!window;
    const hasGlobalFetch = typeof globalThis.fetch === "function";
    this.#fetch ||= hasWindow
        ? window.fetch
        : hasGlobalFetch
            ? globalThis.fetch.bind(globalThis)
            : (await import("node-fetch")).default;
    return this.#fetch;
}

Patch 2 — patch-vertex-adc.updated.sh patches:

• model-auth-env-*.js: returns "<authenticated>" instead of raw marker constant
• gemini-auth-*.js: guards against placeholder strings in parseGeminiAuth
• pi-ai/dist/providers/google.js: sets vertexai: true + project/location when provider is google-vertex
• ~/.openclaw/.env and LaunchAgent plist: writes GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION

Logs, screenshots, and evidence

Bug 1 — node-fetch crash on Node 25:

$ node -e "import('@google/genai').then(async ({GoogleGenAI}) => { ... })"
Error: Cannot convert undefined or null to object
    at node-fetch/index.js:...

Bug 2 — ADC marker leak in gateway logs:

[model-auth-env] resolved=undefined source=gcloud-adc
# downstream receives GCP_VERTEX_CREDENTIALS_MARKER and fails

Impact and severity

Affected: Users of google-vertex provider on Node 25+ (latest macOS default) Severity: High — provider completely unusable on current Node version Frequency: 100% (always fails on Node 25+) Consequence: google-vertex requests crash; no workaround without patching

Additional information

Root causes:

1. gaxios inside @google/genai uses import("node-fetch") fallback unconditionally — Node 18+ has native globalThis.fetch but gaxios does not check for it.
2. model-auth-env exposes internal credential marker constant to downstream consumers instead of a resolved sentinel value.
3. pi-ai google provider does not detect google-vertex provider mode and fails to set vertexai: true on GoogleGenAI.
4. LaunchAgent plist EnvironmentVariables and OPENCLAW_SERVICE_MANAGED_ENV_KEYS drift apart on restart.

Temporary workaround: run the two local patch scripts at ~/gcDora/scripts/patch-vertex-adc.updated.sh and ~/gcDora/scripts/patch-vertex-node25-fetch.sh after each OpenClaw upgrade.