fix(google-vertex): write ADC env vars under env.vars for new config schema

koverholt · koverholt · commit a5c2b333db75 · 2026-07-23T13:14:25.000-05:00
Upstream restructured the top-level config env section into a strict object
that only allows shellEnv and vars keys (src/config/zod-schema.root-shape.ts).
The onboarding auth flow still wrote GOOGLE_CLOUD_PROJECT/GOOGLE_CLOUD_LOCATION
directly under env, so onboarding config validation failed with
'Unrecognized keys' after syncing to latest upstream.

Nest the ADC env vars under env.vars so they satisfy the new schema and are
picked up by collectConfigEnvVarsByTarget. Update the google-vertex docs
config examples and prose to the env.vars shape.
diff --git a/docs/providers/google-vertex.md b/docs/providers/google-vertex.md
@@ -142,8 +142,10 @@ After onboarding, your `openclaw.json` will include:
     },
   },
   env: {
-    GOOGLE_CLOUD_PROJECT: "your-project-id",
-    GOOGLE_CLOUD_LOCATION: "global",
+    vars: {
+      GOOGLE_CLOUD_PROJECT: "your-project-id",
+      GOOGLE_CLOUD_LOCATION: "global",
+    },
   },
 }
 ```
@@ -159,8 +161,8 @@ After onboarding, your `openclaw.json` will include:
 
 <Note>
   Environment variables can be set in your shell, in `openclaw.json` under the
-  `env` key, or in `~/.openclaw/.env`. When running the Gateway as a systemd
-  service, use the `env` key in `openclaw.json` since shell exports do not reach
+  `env.vars` key, or in `~/.openclaw/.env`. When running the Gateway as a systemd
+  service, use the `env.vars` key in `openclaw.json` since shell exports do not reach
   the service process.
 </Note>
 
@@ -184,18 +186,18 @@ Onboarding sets `gemini-3.5-flash` as the default model.
     provider. If it does, try running `openclaw onboard --auth-choice google-vertex-adc`
     again. For manual configurations, check:
 
-    1. `GOOGLE_CLOUD_PROJECT` is set (in env or `openclaw.json` `env` section).
+    1. `GOOGLE_CLOUD_PROJECT` is set (in env or `openclaw.json` `env.vars` section).
     2. On GCE/GKE: the metadata server is reachable.
     3. With gcloud CLI: you have run `gcloud auth application-default login`.
     4. With a service account: `GOOGLE_APPLICATION_CREDENTIALS` points to a valid JSON key file.
 
   </Accordion>
 
   <Accordion title="Vertex AI requires a project ID">
-    Set `GOOGLE_CLOUD_PROJECT` in the `env` section of `openclaw.json`:
+    Set `GOOGLE_CLOUD_PROJECT` in the `env.vars` section of `openclaw.json`:
 
     ```json5
-    { env: { GOOGLE_CLOUD_PROJECT: "your-project-id" } }
+    { env: { vars: { GOOGLE_CLOUD_PROJECT: "your-project-id" } } }
     ```
 
     Then restart the gateway: `openclaw gateway restart` or
@@ -217,7 +219,7 @@ Onboarding sets `gemini-3.5-flash` as the default model.
     specific region (e.g. `us-central1`), try switching to `global`:
 
     ```json5
-    { env: { GOOGLE_CLOUD_LOCATION: "global" } }
+    { env: { vars: { GOOGLE_CLOUD_LOCATION: "global" } } }
     ```
 
   </Accordion>
diff --git a/extensions/google/provider-contract-api.ts b/extensions/google/provider-contract-api.ts
@@ -126,8 +126,10 @@ export function createGoogleVertexProvider(): ProviderPlugin {
                 : [...existingModels, { id: defaultModelId, name: "Gemini 3.5 Flash" }];
               return {
                 env: {
-                  GOOGLE_CLOUD_PROJECT: project,
-                  GOOGLE_CLOUD_LOCATION: location,
+                  vars: {
+                    GOOGLE_CLOUD_PROJECT: project,
+                    GOOGLE_CLOUD_LOCATION: location,
+                  },
                 },
                 models: {
                   providers: {
