Fix Gemini CLI Vertex routing and authentication

[kywch]

BenchFlow configured Gemini CLI's Vertex mode with the Gemini API endpoint setting. Vertex mode ignores that setting, so the CLI contacted Google Vertex directly using BenchFlow's internal gateway key. Google rejected that key with 401. This is a BenchFlow routing bug; no Gemini CLI change is required.

This fix sets the correct Vertex endpoint and enables LiteLLM's native Vertex passthrough:

Before: Gemini CLI -> Google Vertex with gateway key -> 401
After:  Gemini CLI -> BenchFlow gateway -> Google Vertex with ADC

The gateway authenticates the CLI, resolves the project/location, and supplies Google credentials upstream. Existing Gemini API and translated Vertex routes remain supported. Stale Vertex endpoint overrides are cleared before wiring the gateway. The Gemini API route also clears inherited bearer mode so the CLI uses the x-goog-api-key header expected by that endpoint.

Validation:

• 70 focused tests passed; Ruff and type checks passed. Routing coverage uses gemini-3.1-pro-preview, gemini-3.8-flash, and gemini-3.5-flash-lite. Stale-bearer regression failed in all three API cases before the fix and passes afterward.

• Full suite before the later test parameterization and stale-bearer follow-up: 6,003 passed, 48 skipped, 7 deselected; 3 failures reproduced on unchanged baseline. The baseline failures came from terminal-width wrapping and host Claude login detection; those 3 passed with an isolated home and wider terminal.

• Live canaries on gdoc-search-by-title all scored 1.0: Gemini CLI + google-vertex/gemini-3.1-flash-lite on Docker and Daytona; Gemini CLI + google/gemini-3.1-flash-lite on Docker; Claude ACP + anthropic-vertex/claude-sonnet-4-6 on Docker. Vertex used global and ADC; Gemini API credentials were tested separately.

• Artifact validator passed for all four canaries. Manual review found an existing Gemini training-export issue: tool-call ID matching drops tool responses despite intact raw captures. Reproduced on the earlier API route; outside this routing fix.

• Additional live Vertex/global calls returned HTTP 200 with matching model versions for Pro 3.1, Flash 3.8, and Flash-Lite 3.5. Docker task scores: Pro 1.0, Flash 1.0, Flash-Lite 0.0 (agent stopped early; no provider/auth error). These runs verified model execution before the API-only stale-bearer cleanup.

• Additional artifact checks: Pro and Flash-Lite passed the validator. Flash 3.8 completed the task but training export failed with missing_tool_defs. Successful model/auth execution does not imply training-export readiness; export issues remain outside this fix.

---

[devin-ai-integration]

Devin Review found 1 potential issue.

[bingran-you]

Thermo-nuclear review at exact head 1c2980e837f1d8b04958c850cfb5bdcadff7102f:

• The production change is small and correctly keeps Vertex-specific routing at the provider/proxy boundary: the stale direct endpoint is removed, the Gemini CLI is pointed at /vertex_ai, and LiteLLM owns the ADC exchange. I did not find an additional structural or behavioral defect in the diff.
• Exact-head local routing coverage: 70 passed; repository ty and Ruff checks also pass. GitHub's main-targeted test, parity, rollout-smoke, and fixture jobs are green at this head.
• I independently validated that the supplied service-account credential is syntactically live and can mint an OAuth token, but its project returns Vertex HTTP 403 because aiplatform.googleapis.com is disabled. Therefore I cannot truthfully count the PR author's reported reward-1 canaries as an independently reproduced final E2E gate from the supplied credentials.

Merge gate remains: one independent human approval plus either a reviewer-verifiable exact-head live artifact or Vertex-enabled credentials for a fresh exact-head run. I requested xdotli for the human-review gate. Until those are present, this is not ready to merge.