fix: Go ADK Vertex AI client sends requests to wrong endpoint (missing rawPredict URL rewrite)

[jon-waggoner]

Fixes #2315

Summary

Fix the Go ADK Anthropic Vertex AI client to correctly route requests to the Vertex AI rawPredict endpoint instead of the direct Anthropic API path /v1/messages.

Problem

When using Anthropic models via Vertex AI, the Go ADK runtime (golang-adk image) sends requests to the wrong URL:

POST "https://us-east5-aiplatform.googleapis.com/v1/messages": 401 Unauthorized

The correct Vertex AI endpoint should be:

POST https://{region}-aiplatform.googleapis.com/v1/projects/{project}/locations/{region}/publishers/anthropic/models/{model}:rawPredict

The Python runtime works correctly because the Python Anthropic SDK properly constructs the Vertex AI URL.

Root Cause

In NewAnthropicVertexAIModelWithLogger, the SDK options were applied in the wrong order:

// BEFORE (broken): WithGoogleAuth first, then WithHTTPClient overwrites it
opts := []option.RequestOption{
    vertex.WithGoogleAuth(ctx, region, projectID),  // sets up OAuth2 client + URL rewriting
}
httpClient, _ := BuildHTTPClient(config.TransportConfig)
opts = append(opts, option.WithHTTPClient(httpClient))  // OVERWRITES the OAuth2 client!

The vertex.WithGoogleAuth function (from anthropic-sdk-go) internally does three things via WithCredentials:

1. Sets WithBaseURL to the Vertex AI endpoint
2. Registers middleware that rewrites /v1/messages to the rawPredict path
3. Sets WithHTTPClient with an OAuth2-authenticated HTTP transport

When option.WithHTTPClient(httpClient) was appended after WithGoogleAuth, it replaced the OAuth2-authenticated client with a plain HTTP client (just TLS + headers + timeout). This meant:

• No OAuth2 token was attached to requests → 401 Unauthorized
• The Vertex AI URL rewriting middleware was ineffective

Fix

Reorder the options so WithHTTPClient is applied before vertex.WithGoogleAuth, allowing the Vertex option to take precedence:

// AFTER (fixed): WithHTTPClient first, then WithGoogleAuth overrides with OAuth2 client
var opts []option.RequestOption
httpClient, _ := BuildHTTPClient(config.TransportConfig)
opts = append(opts, option.WithHTTPClient(httpClient))           // plain client first
opts = append(opts, vertex.WithGoogleAuth(ctx, region, projectID)) // OAuth2 client overrides

This ensures the Vertex AI SDK's authenticated client, base URL, and URL-rewriting middleware all take effect.

[Copilot]

Pull request overview

This PR fixes the Go ADK Anthropic Vertex AI client setup so that requests are routed through Vertex AI’s authenticated client and request rewriting (e.g., /v1/messages → :rawPredict) instead of accidentally being sent via an unauthenticated plain http.Client.

Changes:

• Reorders option.WithHTTPClient(...) and vertex.WithGoogleAuth(...) so the Vertex option is applied last and cannot be overwritten.
• Adds detailed inline commentary explaining the ordering/root-cause to prevent regressions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jon-waggoner]

Good call -- the comment is over-specifying SDK internals that could drift as the anthropic-sdk-go evolves. I'll tighten both comments to focus on the ordering contract (last WithHTTPClient wins) rather than describing internal middleware behavior. Thanks for the suggestion.

[jon-waggoner]

Note: I considered adding a unit test for the option ordering fix but decided against it. The Anthropic SDK's option.RequestOption is opaque — there's no way to inspect which WithHTTPClient "won" without actually calling GCP auth, and vertex.WithGoogleAuth requires real Application Default Credentials. The existing Go model tests (bedrock, ollama, openai) test conversion logic and response mapping, not constructor option ordering. The inline comments documenting the ordering invariant are the appropriate safeguard here.

[mesutoezdil]

heads up, vertex.WithGoogleAuth builds its own http client n calls withhttpclient itself, so it wipes buildhttpclient's custom tls/headers client entirely not just the oauth part, so custom ca cert or headers on a vertex cfg would silently stop applying

[jon-waggoner]

see comment below. thanks for callout. #2314 (comment)

[jon-waggoner]

@mesutoezdil You were right — reversing the order swapped one bug for another: vertex.WithGoogleAuth installs its own option.WithHTTPClient, which wiped the custom TLS/headers/timeout stack from BuildHTTPClient. Fixed in 5db14c5 by composing them: resolve Google ADC ourselves, wrap the caller's *http.Client Transport with oauth2.Transport, then apply vertex.WithCredentials first (registers baseURL + URL-rewrite middleware) and option.WithHTTPClient(composed) last (overrides only the HTTPClient field; baseURL and middleware are stored separately and middleware is additive). Added unit tests around a new composeVertexHTTPClient helper covering OAuth2 header attachment, custom header preservation, base transport preservation, and timeout preservation.