Summary

The OpenClaw 2026.5.3 config schema does not allow api: "google-vertex" in models.providers, which is required by the runtime createStreamFn to route requests through the Vertex AI transport instead of the AI Studio transport.

Environment

• OpenClaw version: 2026.5.3 (06d46f7)
• OS: Windows 11
• Node.js: v24.14.1
• GCP: ADC via gcloud auth application-default login

Root Cause

The createStreamFn in extensions/google/provider-registration.ts checks model.api === "google-vertex" to return the Vertex transport:

createStreamFn: ({ model }) => {
  if (model.api === "google-generative-ai")
    return createGoogleGenerativeAiTransportStreamFn();
  if (model.api === "google-vertex" && hasGoogleVertexAuthorizedUserAdcSync())
    return createGoogleVertexTransportStreamFn();
  return undefined;
}

However, the config schema only allows these values for provider/model api:
openai-completions | openai-responses | ... | google-generative-ai | ... | azure-openai-responses

"google-vertex" is not in the allowed enum.

Symptom

When adding api: "google-vertex" to models.providers.google-vertex, the gateway rejects the config with:
Invalid option: expected one of "openai-completions"|...|"azure-openai-responses"

Workaround Attempts (all failed)

1. Use api: "google-generative-ai" — createStreamFn routes to AI Studio transport, building /v1beta/models/... URLs instead of Vertex /v1beta1/projects/{project}/locations/{location}/publishers/google/models/... format. Result: 404.

2. Omit the provider entry, rely on hookAlias + template system — Template models cloned by resolveGoogleGeminiForwardCompatModel inherit api: "google-generative-ai", causing same routing issue.

3. Use auth.profiles["google-vertex:default"] — google-vertex provider contract has auth: [] (empty), profiles are silently ignored.

What Works Correctly

• ADC authentication via application_default_credentials.json (authorized_user type)
• GOOGLE_CLOUD_PROJECT / GOOGLE_CLOUD_LOCATION via openclaw.json env section
• Proxy routing via request.proxy + allowPrivateNetwork
• Model alias resolution (google-vertex/gemini-2.5-flash → gemini-2.5-flash)

Proposed Fix

Add "google-vertex" to the allowed enum values for the api field on both models.providers.<name> and models.providers.<name>.models[].

Debug Trail

1. fetch failed → DNS blocked (GFW), proxy added ✅
2. Blocked hostname or private IP → SSRF guard, added allowPrivateNetwork ✅
3. 404 from Google Vertex AI API → Wrong URL path format, root caused to schema bug
4. Confirmed via sub-agent test with google-vertex/gemini-2.5-flash