What
Lets the claude backend run Claude from Google Vertex AI (Anthropic's partner models in Model Garden).
Why
The claude backend reaches Claude through Claude Code, which already supports Vertex. But buildClaudeEnv's env allowlist forwards only the gateway/direct/OAuth credential vars, so the Vertex routing vars were stripped and never reached the spawned claude child. Running on Vertex was therefore impossible even with a fully configured machine.
Change
Forward the Vertex routing vars that Claude Code reads: CLAUDE_CODE_USE_VERTEX, ANTHROPIC_VERTEX_PROJECT_ID, GOOGLE_CLOUD_PROJECT, GCLOUD_PROJECT, CLOUD_ML_REGION, GOOGLE_APPLICATION_CREDENTIALS, CLOUDSDK_CONFIG, CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS, and the dynamic VERTEX_REGION_CLAUDE_* overrides. The allowlist stays tight: anything outside it (for example GITHUB_TOKEN) is still dropped.
Vertex authenticates with Google Application Default Credentials rather than an API key, so there is no credential to broker. This rides on the existing local route.
Usage
CLAUDE_CODE_USE_VERTEX=1 ANTHROPIC_VERTEX_PROJECT_ID=<project> CLOUD_ML_REGION=us-east5 \
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 \
npx deepsec init --yes --agent claude --model-auth local --model claude-sonnet-4-6Testing
- New unit test covering the forwarded vars and that non-allowlisted secrets stay dropped.
- Existing
buildClaudeEnvtests pass;biomelint andpnpm -r buildare clean. - Verified end to end on Vertex with
claude-sonnet-4-6: a smoke repo and a real Java package (commons-cli), both completing a full scan while authenticating through GCP ADC.
Docs: adds a 'Claude on Google Vertex AI' section to docs/models.md.
Notes
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 is required on Vertex, which rejects the Anthropic beta headers the SDK adds by default. A dedicated --model-auth vertex route (interactive prompt, preflight, auto-setting the beta flag) is a sensible follow-up; this PR is the minimal enabler.
Activity
4
auto-maintain[bot]24d ago🤖 auto-maintain review
Automated, advisory triage for @Nehanth's PR. Facts below are read from the GitHub API.
| Check | Result |
|---|---|
| Author's merged PRs (this repo) | 0 — ⚠️ first-time contributor |
| Account established | ✅ (age 3913d · 36 followers · 25 public repos) |
| Commits signed/verified | ⚠️ 0/1 |
Review panel: 🔴 high highest severity
deepsec maintainer code review: 🟡 medium
Vertex works for local auth, but ambient Vertex configuration can override deepsec's explicit model route.
- packages/processor/src/agents/claude-agent-sdk.ts:152 — Vertex routing is forwarded unconditionally. If `CLAUDE_CODE_USE_VERTEX=1` is ambient while deepsec explicitly selects a Gateway or direct-Anthropic route, Claude Code still switches to Vertex, bypassing the selected provider and potentially charging the wrong account. Gate these variables to the local route or clear them when applying another route.
General code review: 🔴 high
Vertex support introduces unconditional GCP credential exposure and leaves the standard Windows ADC flow broken.
- packages/processor/src/agents/claude-agent-sdk.ts:157 — `GOOGLE_APPLICATION_CREDENTIALS` and `CLOUDSDK_CONFIG` are forwarded for every Claude run, even without Vertex enabled. Since the agent has Bash access, an untrusted repository can expose ambient GCP credentials during unrelated gateway/direct runs. Gate credential forwarding on `CLAUDE_CODE_USE_VERTEX`.
- packages/processor/src/agents/claude-agent-sdk.ts:152 — The minimal child environment omits `APPDATA`, where Google ADC stores credentials on Windows. Consequently, the documented `gcloud auth application-default login` flow cannot discover ADC there unless users explicitly set `GOOGLE_APPLICATION_CREDENTIALS`.
Scanner and matcher quality: 🔴 high
The Vertex change creates a concrete GCP credential-exfiltration path when scanning untrusted repositories.
- packages/processor/src/agents/claude-agent-sdk.ts:157 — Forwarding GOOGLE_APPLICATION_CREDENTIALS exposes the service-account file path to the repo-driven Claude child, whose allowed Bash/Read tools can access and exfiltrate that long-lived GCP credential. Do not support static key files without isolating tool subprocesses from the auth environment/filesystem.
Sandbox and credential boundaries: 🟡 medium
Functional change is sound and the allowlist stays narrow, but the Vertex vars are forwarded on every route rather than only `local`, and forwarding GCP credential-file pointers meaningfully widens what an injected agent can exfiltrate; both should be addressed or consciously accepted before merge.
- packages/processor/src/agents/claude-agent-sdk.ts:152 — The Vertex vars are forwarded unconditionally, with nothing tying them to the `local` model route. A machine with an ambient `CLAUDE_CODE_USE_VERTEX=1` (common for day-to-day Claude Code users) now has it reach the spawned child even when the operator explicitly selected `--model-auth gateway`/direct, alongside the gateway `ANTHROPIC_AUTH_TOKEN`/`ANTHROPIC_BASE_URL` pair. Provider selection in the child then silently diverges from the route deepsec resolved: traffic and billing can land on the user's GCP project while deepsec still treats the run as gateway and appends gateway attribution headers (`isGatewayBaseUrl(env.ANTHROPIC_BASE_URL)` below). Gate the block on `route.mode === "local"`, or fail preflight when both a non-local route and `CLAUDE_CODE_USE_VERTEX` are set.
- packages/processor/src/agents/claude-agent-sdk.ts:157 — `GOOGLE_APPLICATION_CREDENTIALS` and `CLOUDSDK_CONFIG` put pointers to long-lived GCP credentials (service-account private key JSON; gcloud ADC refresh token + client secret) into the env of the child that runs with `allowedTools: ["Read","Glob","Grep","Bash"]` and `permissionMode: "dontAsk"` over untrusted scanned repositories, and `buildSandbox()` layers no filesystem restriction. Repo-content prompt injection can therefore do `cat $GOOGLE_APPLICATION_CREDENTIALS` and exfiltrate a project-scoped GCP key — a far larger blast radius than the model API token the allowlist was previously limited to. The allowlist comment still claims cloud creds are dropped. Consider forwarding only the routing vars (project/region/use-vertex) and relying on the default ADC discovery path, or documenting that a narrowly-scoped service account is required.
Durability and distributed state: 🟢 low
No durability or distributed-state defects found in the complete diff.
Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.
@Nehanth is attempting to deploy a commit to the Vercel Labs Team on Vercel.
A member of the Team first needs to authorize it.