Route Anthropic models on Vertex AI through the native endpoint

docs/providers/google/index.md

@@ -117,8 +117,14 @@ models:
 You can use non-Gemini models (e.g. Claude, Llama) hosted on Google Cloud's
 [Vertex AI Model Garden](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-partner-models)
 through the `google` provider. When a `publisher` is specified in `provider_opts`,
-requests are routed through Vertex AI's OpenAI-compatible endpoint instead of the
-Gemini SDK.
+requests are routed through the appropriate Vertex AI endpoint instead of the
+Gemini SDK:
+
+- **Anthropic Claude** (`publisher: anthropic`) uses the Anthropic-native
+  `:rawPredict` / `:streamRawPredict` endpoints. Claude models on Vertex AI do
+  not support the OpenAI `/chat/completions` path.
+- **Other publishers** (e.g. `meta`, `mistral`) use Vertex AI's
+  OpenAI-compatible `/chat/completions` endpoint.
 
 ### Authentication
 

go.mod

@@ -75,6 +75,7 @@ require (
 )
 
 require (
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.23 // indirect
 	github.com/danieljoos/wincred v1.2.2 // indirect
@@ -85,6 +86,8 @@ require (
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/pb33f/jsonpath v0.8.2 // indirect
 	github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
+	google.golang.org/api v0.252.0 // indirect
 )
 
 require (

go.sum

@@ -10,6 +10,8 @@ cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
 cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
 cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
@@ -164,6 +166,8 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/coder/acp-go-sdk v0.6.3 h1:LsXQytehdjKIYJnoVWON/nf7mqbiarnyuyE3rrjBsXQ=
 github.com/coder/acp-go-sdk v0.6.3/go.mod h1:yKzM/3R9uELp4+nBAwwtkS0aN1FOFjo11CNPy37yFko=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -216,6 +220,11 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o
 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
+github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
+github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -404,6 +413,8 @@ github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxu
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -506,6 +517,8 @@ go.etcd.io/bbolt v1.4.0 h1:TU77id3TnN/zKr7CO/uk+fBCwF2jGcMuw2B/FMAzYIk=
 go.etcd.io/bbolt v1.4.0/go.mod h1:AsD+OCi/qPN1giOX1aiLAha3o1U8rAz65bvN4j0sRuk=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
@@ -592,6 +605,8 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/adk v1.1.0 h1:UNyIb604EWWJTCsmKg5tuo/oaESGiR9DHgFzTICN3zM=
 google.golang.org/adk v1.1.0/go.mod h1:26tMHp0FXeHshfHACOuH1RZJgtZ06GPaReu20q70KMU=
+google.golang.org/api v0.252.0 h1:xfKJeAJaMwb8OC9fesr369rjciQ704AjU/psjkKURSI=
+google.golang.org/api v0.252.0/go.mod h1:dnHOv81x5RAmumZ7BWLShB/u7JZNeyalImxHmtTHxqw=
 google.golang.org/genai v1.54.0 h1:ZQCa70WMTJDI11FdqWCzGvZ5PanpcpfoO6jl/lrSnGU=
 google.golang.org/genai v1.54.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=

pkg/model/provider/anthropic/vertex.go

@@ -0,0 +1,101 @@
+package anthropic
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+
+	"github.com/anthropics/anthropic-sdk-go"
+	"github.com/anthropics/anthropic-sdk-go/option"
+	"github.com/anthropics/anthropic-sdk-go/vertex"
+	"golang.org/x/oauth2/google"
+
+	"github.com/docker/docker-agent/pkg/config/latest"
+	"github.com/docker/docker-agent/pkg/environment"
+	"github.com/docker/docker-agent/pkg/model/provider/base"
+	"github.com/docker/docker-agent/pkg/model/provider/options"
+)
+
+// vertexCloudPlatformScope is the OAuth2 scope required for Vertex AI API access.
+const vertexCloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform"
+
+// NewVertexClient creates a new Anthropic client that talks to Claude models
+// hosted on Google Cloud's Vertex AI via the Anthropic-native endpoints
+// (`:rawPredict` and `:streamRawPredict`), authenticated with Google
+// Application Default Credentials.
+//
+// This is required because Anthropic models on Vertex AI do not support the
+// OpenAI-compatible `/chat/completions` endpoint and fail with
+// `FAILED_PRECONDITION: The deployed model does not support ChatCompletions.`
+//
+// See: https://docs.anthropic.com/en/api/claude-on-vertex-ai
+func NewVertexClient(ctx context.Context, cfg *latest.ModelConfig, env environment.Provider, project, location string, opts ...options.Opt) (*Client, error) {
+	if cfg == nil {
+		return nil, errors.New("model configuration is required")
+	}
+	if env == nil {
+		return nil, errors.New("environment provider is required")
+	}
+	if project == "" {
+		return nil, errors.New("vertex AI requires a GCP project")
+	}
+	if location == "" {
+		return nil, errors.New("vertex AI requires a GCP location")
+	}
+
+	var globalOptions options.ModelOptions
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&globalOptions)
+		}
+	}
+
+	// Resolve GCP credentials up front so we can return a descriptive error
+	// instead of the panic that vertex.WithGoogleAuth would raise.
+	creds, err := google.FindDefaultCredentials(ctx, vertexCloudPlatformScope)
+	if err != nil {
+		return nil, fmt.Errorf("failed to obtain GCP credentials for Vertex AI: %w (run 'gcloud auth application-default login')", err)
+	}
+
+	slog.Debug("Creating Anthropic client for Vertex AI",
+		"project", project,
+		"location", location,
+		"model", cfg.Model,
+	)
+
+	// vertex.WithCredentials configures the base URL, Google-authenticated
+	// HTTP client, and middleware that rewrites /v1/messages requests to the
+	// Anthropic-native Vertex AI endpoints (`:rawPredict` / `:streamRawPredict`)
+	// and injects the `anthropic_version: vertex-2023-10-16` body field.
+	//
+	// The explicit option.WithAPIKey("") is REQUIRED (do not remove): the
+	// anthropic SDK's NewClient applies DefaultClientOptions() first, which
+	// auto-reads ANTHROPIC_API_KEY from the environment and sets the
+	// X-Api-Key header. On Vertex AI the request is authenticated with
+	// OAuth2 (via the google transport in vertex.WithCredentials), so we
+	// must clear the stray X-Api-Key header that would otherwise leak a
+	// direct-API credential into Google's infrastructure.
+	client := anthropic.NewClient(
+		vertex.WithCredentials(ctx, location, project, creds),
+		option.WithAPIKey(""),
+	)
+
+	anthropicClient := &Client{
+		Config: base.Config{
+			ModelConfig:  *cfg,
+			ModelOptions: globalOptions,
+			Env:          env,
+		},
+		clientFn: func(context.Context) (anthropic.Client, error) {
+			return client, nil
+		},
+	}
+
+	// File uploads via Anthropic's Files API are not supported on Vertex AI,
+	// but the FileManager is lazy and harmless if unused.
+	anthropicClient.fileManager = NewFileManager(anthropicClient.clientFn)
+
+	slog.Debug("Anthropic (Vertex AI) client created successfully", "model", cfg.Model)
+	return anthropicClient, nil
+}

pkg/model/provider/provider.go

@@ -244,7 +244,7 @@ func createDirectProvider(ctx context.Context, cfg *latest.ModelConfig, env envi
 		return anthropic.NewClient(ctx, enhancedCfg, env, opts...)
 	case "google":
 		// Route non-Gemini models on Vertex AI (Model Garden) through the
-		// OpenAI-compatible endpoint instead of the Gemini SDK.
+		// vertexai package, which picks the right endpoint per publisher.
 		if vertexai.IsModelGardenConfig(enhancedCfg) {
 			return vertexai.NewClient(ctx, enhancedCfg, env, opts...)
 		}