[FEATURE]: Add native Google Cloud Vertex AI provider with service account authentication

[foxlox]

Feature hasn't been suggested before.

• I have verified this feature hasn't been suggested before.

Category

Provider / Model

Description

CyberStrike currently detects GOOGLE_APPLICATION_CREDENTIALS environment variable but maps it exclusively to Anthropic Claude via Vertex AI Model Garden. There is no way to use Google's own Gemini models on Vertex AI with service account authentication.
This blocks enterprise GCP users who:

Must keep data within their own GCP project (data residency, compliance)
Use service account keys (not API keys) for authentication
Require the "no-training" guarantee that only applies when using Vertex AI within their own project

Behaviour
$ export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
$ cyberstrike auth list

┌ Environment
│
● Vertex (Anthropic) GOOGLE_APPLICATION_CREDENTIALS ← Only Claude, no Gemini
● Vertex GOOGLE_APPLICATION_CREDENTIALS ← Same
│
└ 2 environment variables

$ cyberstrike auth login "https://-aiplatform.googleapis.com/..."
Error: Failed to parse JSON

Proposal
// Pseudo-code for provider configuration
{
name: "vertex",
displayName: "Google Cloud Vertex AI",
baseUrlTemplate: "https://{location}-aiplatform.googleapis.com/v1/projects/{project}/locations/{location}/publishers/google/models/{model}",
authType: "service-account" | "adc" | "wif",
defaultModel: "gemini-2.5-flash-001",
models: [
"gemini-2.5-flash-001",
"gemini-2.5-pro-001",
"gemini-2.5-pro-preview-05-06"
],
requestFormat: "google-native", // not OpenAI-compatible
features: {
streaming: true,
toolUse: true,
systemInstruction: true,
longContext: true
}
}

Environment
CyberStrike version: 1.1.15
OS: Kali Linux
gcloud version: latest

[badchars]

Fix: Vertex AI Gemini + Service Account Authentication

Commit: c9be69c on dev

What changed

The google-vertex and google-vertex-anthropic custom loaders in provider.ts now support three authentication paths instead of one:

Before	After
Only GOOGLE_CLOUD_PROJECT (or GCP_PROJECT / GCLOUD_PROJECT)	Same + GOOGLE_VERTEX_PROJECT + GOOGLE_APPLICATION_CREDENTIALS
autoload: false if no project env	autoload: true if credentials file exists — SDK resolves project from service account JSON
GOOGLE_CLOUD_LOCATION / VERTEX_LOCATION only	Same + GOOGLE_VERTEX_LOCATION

How it works

The @ai-sdk/google-vertex SDK uses google-auth-library internally. When GOOGLE_APPLICATION_CREDENTIALS points to a service account JSON file, the library:

1. Reads the project_id field from the JSON for project resolution
2. Uses the private_key + client_email for authentication
3. Handles token refresh automatically

Previously, our loader gate required an explicit GOOGLE_CLOUD_PROJECT env var even though the SDK could resolve it from the credentials file. Now the loader autoloads when either a project env or GOOGLE_APPLICATION_CREDENTIALS is set.

How to use — 3 options

Option 1: Service account only (simplest)

export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
cyberstrike
# → Vertex AI (Gemini) and Vertex (Anthropic) both auto-detected

Option 2: Explicit project + ADC

export GOOGLE_CLOUD_PROJECT=my-gcp-project
# auth via: gcloud auth application-default login
cyberstrike

Option 3: Full explicit config

export GOOGLE_VERTEX_PROJECT=my-gcp-project
export GOOGLE_VERTEX_LOCATION=europe-west4
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json
cyberstrike

Supported env vars (checked in order)

Purpose	Env vars (priority order)
Project	GOOGLE_CLOUD_PROJECT → GCP_PROJECT → GCLOUD_PROJECT → GOOGLE_VERTEX_PROJECT
Location	GOOGLE_CLOUD_LOCATION → VERTEX_LOCATION → GOOGLE_VERTEX_LOCATION → us-east5 (Gemini) / global (Anthropic)
Auth	GOOGLE_APPLICATION_CREDENTIALS (service account JSON path) or Application Default Credentials via gcloud auth application-default login

What you'll see

$ cyberstrike auth list

┌  Environment
│
●  Vertex (Anthropic) GOOGLE_APPLICATION_CREDENTIALS
●  Vertex GOOGLE_APPLICATION_CREDENTIALS
│
└  2 environment variables

Both providers autoload with their full model catalogs (Gemini 2.5 Pro/Flash on google-vertex, Claude on google-vertex-anthropic).

EU/US data residency

For continental multi-regions, set location to eu or us:

export GOOGLE_VERTEX_LOCATION=eu

The Anthropic loader automatically switches to Regional Endpoint Platform domains (aiplatform.eu.rep.googleapis.com).

[badchars]

Fixed in 7ee8861 on dev. See detailed comment above for implementation details and usage guide.

[badchars]

Update: Amazon Bedrock Access Methods (Bedrock Mantle)

AWS now offers 5 API paths to access Bedrock models. CyberStrike supports all of them:

1. Traditional amazon-bedrock provider (Invoke/Converse API)

Uses @aws-sdk/credential-providers with the full AWS credential chain:

Method	Configuration
AWS Access Keys	AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
AWS Profiles	AWS_PROFILE=name → reads ~/.aws/credentials and ~/.aws/config
SSO / IAM Identity Center	SSO profile in ~/.aws/config, select via AWS_PROFILE
STS AssumeRole	Role chaining in ~/.aws/config with role_arn + source_profile
Web Identity (OIDC)	AWS_WEB_IDENTITY_TOKEN_FILE — EKS, GitHub Actions
Container Credentials	AWS_CONTAINER_CREDENTIALS_RELATIVE_URI — ECS/Fargate
EC2 Instance Metadata	Automatic fallback via IMDS IAM Role
Bearer Token	AWS_BEARER_TOKEN_BEDROCK or via CyberStrike UI
Custom Credential Process	credential_process in ~/.aws/config
Custom Endpoint / VPC	provider.amazon-bedrock.options.endpoint in cyberstrike.json
Cross-Region Inference	Automatic model ID prefixing (us., eu., jp., apac., au., global.)

2. Bedrock Mantle — Anthropic native SDK path (NEW)

AWS now exposes Bedrock through Bedrock Mantle gateway, allowing native Anthropic/OpenAI SDK access:

Anthropic Claude via Bedrock Mantle:

# Use CyberStrike's anthropic provider with Bedrock Mantle base URL
# In cyberstrike.json:
{
  "provider": {
    "anthropic": {
      "options": {
        "baseURL": "https://bedrock-mantle.<region>.api.aws/anthropic"
      }
    }
  }
}
# Set your Bedrock short-term API key as ANTHROPIC_API_KEY

3. Bedrock Mantle — OpenAI-compatible path (NEW)

# Use any OpenAI-compatible provider with Bedrock Mantle
# OPENAI_BASE_URL=https://bedrock-mantle.<region>.api.aws/v1
# OPENAI_API_KEY=<bedrock-api-key>

4. Short-term API Keys (NEW)

AWS Console → Bedrock → API Keys → Create short-term key. Use with AWS_BEARER_TOKEN_BEDROCK env var or enter via CyberStrike provider setup UI.

---

Reference: AWS Bedrock Quickstart

Enterprise users: If you already authenticate via ~/.aws/credentials profiles or SSO (same as boto3), just set AWS_PROFILE and run cyberstrike — the credential chain is identical to boto3's fromNodeProviderChain.