[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698YAXQHSJD8NWWH795C1JM":3,"skill-same:01M698YAXQHSJD8NWWH795C1JM":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":59,"ownerDescription":60,"updatedAt":61,"install":62,"resources":75},"01M698YAXQHSJD8NWWH795C1JM","agent-platform-inference",null,"Connects to and performs inference with Google Cloud Agent Platform GenAI models, including First-Party Gemini models and Third-Party OpenMaaS models (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a model a question, run a test prompt, execute chat completions, or generate code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK, OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and global\u002Fregional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400 User Validation, or 404 Not Found errors. Don't use for deploying models to endpoints or for running model evaluations.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",23830,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,9,37,38,39,40,41,42,43,44],"agent platform","agent platform inference","inference","platform","configure","when","for","errors","openai sdk","dsq","question","ask","model","openai","code","run","generate","troubleshoot","google cloud","genai","gemini","2026-11-10 10:12:30",false,"---\nname: agent-platform-inference\nmetadata:\n  version: \"1.0.1\"\n  category: AiAndMachineLearning\ndescription: >-\n  Connects to and performs inference with Google Cloud Agent Platform GenAI\n  models, including First-Party Gemini models and Third-Party OpenMaaS models\n  (Llama, DeepSeek, Qwen, etc.). Use when asked to perform inference, ask a\n  model a question, run a test prompt, execute chat completions, or generate\n  code for calling Gemini or OpenMaaS models, authenticate with GenAI SDK,\n  OpenAI SDK, or legacy Agent Platform SDK, configure base URLs and\n  global\u002Fregional endpoints, or troubleshoot 429 Resource Exhausted (DSQ), 400\n  User Validation, or 404 Not Found errors. Don't use for deploying models to\n  endpoints or for running model evaluations.\n---\n\n# Agent Platform GenAI Inference Skill\n\nThis skill provides instructions for authenticating and connecting to Google\nCloud Agent Platform to use Generative AI models. It covers:\n\n*   **First-Party publisher models** (Gemini) — section 2.\n*   **Third-Party publisher models** (OpenMaaS: Llama, DeepSeek, Qwen, etc.)\n    — section 3.\n*   **Custom endpoints** (any model on a numeric `projects\u002F...\u002Fendpoints\u002F\u003Cid>`\n    resource — tuned Gemini models, OSS LLMs self-deployed from Model Garden\n    via the `agent-platform-deploy` skill, and legacy custom models) —\n    section 4.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you MUST\nread [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION` and append the\nattribution suffix to `User-Agent` headers:\n\n```text\nCLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:agent-platform-inference)\"\nUser-Agent: \u003Cexisting_user_agent> agent-skills\u002F1.0 (skill:agent-platform-inference)\n```\n\n## Safety & Confirmation Tiers (CRITICAL)\n\nBefore executing any commands or scripts on behalf of the user, you must adhere\nto the following safety tiers based on the action requested. (The skill is\nread-only; other safety tiers are omitted):\n\n1.  **Tier R: Read-only \u002F Inference (`client.models.generate_content`,\n    `client.chat.completions.create`, `client.completions.create`,\n    `client.embeddings.create`)**\n    *   Requires **interactive confirmation** with 'Yes'\u002F 'No' options before\n        executing model inference on behalf of the user, to prevent unexpected\n        cost or quota consumption.\n    *   **Required Fields in Confirmation Card**: The confirmation prompt must\n        clearly explain the proposed inference execution and explicitly list all\n        of the following parameters:\n        *   **Project ID**: The Google Cloud project ID or number (e.g.\n            `123456789012`, `my-project`).\n        *   **Region \u002F Location**: The target region (e.g. `us-central1`,\n            `global`).\n        *   **Model ID**: The exact model ID (e.g. `gemini-2.5-flash`,\n            `deepseek-ai\u002Fdeepseek-v3.2-maas`).\n        *   **SDK**: The SDK choice (e.g. `Google GenAI SDK (google-genai)`,\n            `OpenAI SDK`).\n        *   **Input Prompt** (or **Input Image** \u002F **Input Media**): The prompt\n            text or media URI.\n        *   Any additional generation parameters (e.g. `max_output_tokens`,\n            `response_schema`) if specified.\n        Natural-language paraphrases without explicitly listing these\n        parameters are NOT sufficient.\n    *   **Same-turn restriction**: Do not execute the inference scripts or\n        commands in the same turn as presenting the confirmation prompt. Stop\n        and wait for the user's reply; only execute after explicit 'Yes' \u002F\n        approval.\n    *   **Gold Standard Example**:\n        > I will perform model inference with the following parameters. Please\n        > confirm this information before I proceed:\n        > * **Project ID**: `my-project`\n        > * **Region**: `us-central1`\n        > * **Model ID**: `gemini-2.5-pro`\n        > * **SDK**: Google GenAI SDK (`google-genai`)\n        > * **Input Prompt**: \"Summarize the plot of Hamlet in 3 sentences\"\n        >\n        > Do you confirm? [Yes\u002FNo]\n    *   **Post-Execution Response Grounding (CRITICAL)**:\n        After receiving explicit user approval and executing the inference call\n        via the SDK, the response returning the generated text **MUST\n        explicitly confirm the execution parameters** alongside the model's\n        output. Never return a bare model response alone. Always include:\n        *   **Model ID**: The exact model ID used (e.g. `gemini-2.5-pro`\n            or `\u003CMODEL_ID>`).\n        *   **SDK**: The SDK used (e.g. `Google GenAI SDK (google-genai)`\n            or `OpenAI SDK`).\n        *   **Project ID**: The Google Cloud project ID\u002Fnumber used.\n        *   **Region**: The region or endpoint location used (e.g. `global`\n            or `us-central1`).\n        *   **Generated Output**: The model's complete generated answer.\n\n## Phase 0: Environment Setup\n\n**CRITICAL**: Before running any of the Python sample scripts in the `scripts\u002F`\ndirectory (e.g., `scripts\u002Fopenmaas_openai_sdk.py`), you MUST ensure the\nenvironment is correctly initialized by following these steps:\n\n1.  **Google Cloud Authentication**: Authenticate with your Google Cloud\n    credentials and configure active Application Default Credentials (ADC) for\n    Agent Platform access:\n\n    ```bash\n    gcloud auth login\n    gcloud auth application-default login\n    ```\n\n2.  **Enable API** (if not already enabled):\n\n    ```bash\n    gcloud services enable aiplatform.googleapis.com\n    ```\n\n3.  **Python Dependencies**: The scripts import `vertexai` (from\n    `google-cloud-aiplatform`), `google-genai`, and `openai`. Do **not** create\n    a virtual environment — it starts empty and hides packages the environment\n    already provides, forcing a redundant install. Probe, and install only what\n    is missing:\n\n    ```bash\n    python3 -c \"import vertexai, google.genai, openai\" \\\n      || pip install -r scripts\u002Frequirements.txt\n    ```\n\n    `scripts\u002Frequirements.txt` is a fallback for an environment that does not\n    already provide these SDKs; do not install it on top of a working\n    environment.\n\n4.  **Verify Setup (Optional)**: Run all sample scripts at once to verify the\n    environment is working end-to-end:\n\n    ```bash\n    .\u002Fscripts\u002Fverify_all.sh\n    ```\n\n5.  **Execution**: Run the scripts with a plain `python3 scripts\u002F...`. There is\n    no environment to activate first.\n\n\n\n> [!IMPORTANT] **CRITICAL: Model IDs & Availability** * **Gemini Models**: See\n> [Gemini Models][gemini-models-docs] for valid Model IDs and Regions. *\n> **OpenMaaS Models**: See\n> [Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n> for Llama, DeepSeek, Qwen, etc. * **Incomplete Lists**: The Model IDs listed\n> in this skill are **examples only** and may be incomplete or outdated. *\n> **Action**: Always verify the Model ID and Region using the links above before\n> generating code.\n>\n> \\[gemini-models-docs]:\n> https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmigrate\n>\n\n## Parameter Grounding & Clarification Protocol (CRITICAL)\n\nBefore preparing code or presenting a Tier R confirmation card, you MUST ensure\nall necessary parameters are grounded:\n\n1.  **Missing Model ID, Model Family, or SDK (CRITICAL)**:\n    *   If the user has **NOT** specified which model or model family to use\n        (e.g., \"run a test prompt\", \"ask a generative AI model to...\", \"ask\n        DeepSeek a question\" without model version), or has not specified the\n        SDK preference:\n    *   **NEVER** guess, volunteer, or default to a model (such as\n        `gemini-2.5-flash`, `gemini-2.5-pro`, or `deepseek-v3.2-maas`).\n        Proposing a defaulted model in a confirmation card without asking\n        violates parameter grounding.\n    *   **YOU MUST STOP AND ASK THE USER**: \"Which model (or model family,\n        such as Gemini, Llama, DeepSeek, or Qwen) and SDK preference (such as\n        Google GenAI SDK or OpenAI SDK) would you like to use?\" and ask for the\n        target region and project ID if not specified.\n    *   Only after the user specifies the model (and any missing SDK preference)\n        should you proceed to prepare the execution and present the Tier R\n        confirmation prompt.\n\n2.  **Missing Project ID or Region**:\n    *   If the user's project ID or region is not specified in the prompt or\n        conversation context, **ASK** the user for the project ID and region\n        (e.g. \"Which project ID and region would you like to use?\"). Do not\n        silently assume a project or region.\n    *   **OpenMaaS Locations**: OpenMaaS publisher models are hosted on `global`\n        (e.g. `deepseek-ai\u002Fdeepseek-v3.2-maas`,\n        `meta\u002Fllama-3.3-70b-instruct-maas`) or regional endpoints such as\n        `us-central1` (e.g. `deepseek-ai\u002Fdeepseek-r1-0528-maas`).\n        When configuring inference for OpenMaaS models, use the appropriate\n        endpoint:\n\n        *   Global: `https:\u002F\u002Faiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002Fglobal\u002Fendpoints\u002Fopenapi`\n        *   Regional: `https:\u002F\u002F{REGION}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002F{REGION}\u002Fendpoints\u002Fopenapi`\n\n        and explicitly reflect the region in the confirmation card and final\n        response.\n\n3.  **SDK Choice**:\n    *   If the user specifies a model but does not specify an SDK, use the\n        preferred SDK for that model family (GenAI SDK `google-genai` for\n        Gemini, OpenAI SDK `openai` for OpenMaaS).\n\n4.  **Sandbox Execution via Python (CRITICAL)**:\n    *   When executing model inference in the sandbox via `run_command`,\n        **ALWAYS** run Python code using the official SDKs (e.g., writing and\n        running a Python script with `google-genai`, `openai`, or `vertexai`).\n        Do not use raw curl commands for final inference execution.\n\n## Workflow Decision Tree\n\n1.  **Model Specified?**\n    *   **No** (user omitted model name\u002Ffamily) -> **Ask the user** which model\n        or model family, target region, and SDK preference they want to use.\n    *   **Underspecified** (e.g., user said \"DeepSeek\" or \"Llama\" without\n        version) -> **Ask the user** which specific model version they prefer\n        (e.g., `deepseek-ai\u002Fdeepseek-r1-0528-maas`,\n        `deepseek-ai\u002Fdeepseek-v3.2-maas`, `meta\u002Fllama-3.3-70b-instruct-maas`).\n    *   **Yes** -> Proceed to Step 2.\n\n2.  **Model Family & SDK Selection**:\n    *   **Gemini** (e.g., `gemini-2.5-pro`, `gemini-2.5-flash`) -> Preferred:\n        **GenAI SDK** (`google-genai`). Proceed to [1. Gemini Models].\n    *   **OpenMaaS** (e.g., `deepseek-ai\u002F*`, `meta\u002Fllama-*`, `qwen\u002F*`) ->\n        Preferred: **OpenAI SDK** (`openai`). Proceed to [2. OpenMaaS Models].\n    *   **Custom Endpoint** (numeric endpoint ID\n        `projects\u002F...\u002Fendpoints\u002F\u003Cid>`) -> Proceed to [4. Custom Endpoints].\n\n3.  **Troubleshooting**: Is the user reporting an error (429 Resource Exhausted,\n    400 User Validation, 404 Not Found, empty response due to token limits,\n    etc.)?\n    *   **Yes** -> Proceed to [5. Troubleshooting & Common Error Codes].\n    *   **No** -> Present Tier R confirmation prompt with all required fields\n        (Project ID, Region, Model ID, SDK, Input Prompt), wait for user\n        confirmation, then execute via Python SDK.\n\n## 0.5 Region Availability Check for Publisher Endpoints (Gemini + LoRA base)\n\n> [!NOTE] **Skip this section** if either of these applies:\n>\n> - The user is calling a custom endpoint (§4) — a tuned Gemini model served on\n>   a numeric `projects\u002F...\u002Fendpoints\u002F\u003Cid>`, a self-deployed OSS LLM (Llama,\n>   DeepSeek, Qwen, Gemma, etc.), or a legacy custom model. Those requests hit\n>   a specific endpoint resource whose region is fixed at deploy time; if the\n>   caller-side region doesn't match, the endpoint lookup returns a clean 404\n>   without incurring inference cost. Go to §4.\n> - The user is calling an OpenMaaS publisher model (§2) — Llama, DeepSeek,\n>   Qwen, etc. served via the global `openapi` base URL. These don't have\n>   per-region availability restrictions in the same way first-party Gemini\n>   does. Go to §2.\n>\n> **Apply this section** only if the user is calling a first-party managed\n> Gemini model (`gemini-*`, via §1), including fine-tuned LoRA adapters on\n> top of Gemini — these route through a publisher endpoint whose regional\n> availability actually varies.\n\nBefore responding to any inference request that names a specific region for a\nfirst-party managed Gemini model (`gemini-*`) or a fine-tuned Gemini LoRA\nadapter (identified by numeric endpoint ID + user-stated base model), you\n**MUST** verify the model is actually available in that region by making a\nlive API call. Do not rely on Google Search, training-corpus knowledge, or\npublisher documentation for availability claims — regional availability\nchanges frequently and grounded text can be stale or wrong.\n\nProbe only the exact model and region the user asked about. Do not probe other\nmodels as a \"control\" — you cannot infer anything about model A's availability\nfrom model B's status, because a different model may itself be unavailable in\nthe reference region for unrelated reasons.\n\nFor first-party Gemini models, probe with a real `:generateContent` call using\na minimal valid payload:\n\n```bash\ncurl -sS -o \u002Fdev\u002Fnull -w \"%{http_code}\\n\" \\\n    -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002F${LOCATION_ID}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${LOCATION_ID}\u002Fpublishers\u002Fgoogle\u002F${MODEL_ID}:generateContent\" \\\n    -d \"{\\\"contents\\\":{\\\"role\\\":\\\"user\\\",\\\"parts\\\":{\\\"text\\\":\\\"${PROBE_TEXT:-hi}\\\"}}}\"\n```\n\nFor inference against a fine-tuned Gemini LoRA adapter, probe the **base\nmodel** in the target region using the same `:generateContent` call above with\n`${MODEL_ID}` set to the base (e.g. `gemini-2.5-flash` if the adapter was\ntuned on `gemini-2.5-flash`). The LoRA adapter cannot serve in a region where\nits base model isn't available.\n\nInterpret the probe result and act:\n\n-   **200** — model is available in that region. Proceed with the SDK setup in\n    §1.\n-   **404** — model is not available in that region. STOP. Tell the user\n    plainly that the model isn't offered in that region and list the regions\n    where it is available (from\n    [Gemini Models][gemini-models-docs] or `gcloud ai model-garden models list\n    --filter=\"name~$MODEL_NAME\"` without `--region`). Do not silently switch\n    regions. Do not proceed to write inference code or SDK initialization for\n    the unsupported region. Do not run additional \"control\" probes to\n    double-check the 404 — the target-region probe is authoritative.\n-   **Any other outcome** (permission denied, quota, transient failure, etc.)\n    — do not conclude the model is available or unavailable. Explain the\n    underlying cause in plain language (e.g. \"your account doesn't have access\n    to this project's Vertex AI API — enable it in the console or switch\n    projects\") and the concrete next action.\n\n## 1. Gemini Models\n\nFor Gemini models (e.g., `gemini-2.5-pro`, `gemini-3-flash-preview`), the\n**GenAI SDK** (`google-genai`) is the **PREFERRED** method. The legacy\n`vertexai` SDK is still supported but GenAI SDK is recommended for new projects.\n\n> [!IMPORTANT]\n> **Preview Models (including Gemini 3.1)** are often **ONLY** available in the\n> `global` region. Stable models are available in `us-central1` and other\n> regions.\n\n### Choosing the Right SDK\n\n*   **Gemini Models**: **GenAI SDK** (`google-genai`) is **PREFERRED**. Use\n    OpenAI SDK for compatibility, or Legacy SDK (`vertexai`) if needed.\n*   **OpenMaaS Models**: **OpenAI SDK** is **HIGHLY RECOMMENDED**. Use GenAI SDK\n    or Legacy SDK if you have specific infrastructure requirements.\n\n### Installation\n\n```bash\npip install google-genai\n```\n\n### Python Example (GenAI SDK - Preferred)\n\nSee [`scripts\u002Fgemini_genai_sdk.py`](scripts\u002Fgemini_genai_sdk.py) for the\ncomplete code.\n\n### Alternative: OpenAI SDK (Chat Completions)\n\nUse the standard OpenAI SDK with the Agent Platform endpoint. This is great for\ncross-compatibility.\n\nSee [`scripts\u002Fgemini_openai_sdk.py`](scripts\u002Fgemini_openai_sdk.py) for the\ncomplete code.\n\n### Legacy: Agent Platform SDK\n\nThe legacy `vertexai` SDK is still widely used but `google-genai` is preferred\nfor new Gemini projects.\n\nSee [`scripts\u002Fgemini_vertexai_sdk.py`](scripts\u002Fgemini_vertexai_sdk.py) for the\ncomplete code.\n\n**Documentation**:\n[Google GenAI SDK](https:\u002F\u002Fgithub.com\u002Fgoogleapis\u002Fpython-genai)\n\n**Documentation**:\n[Agent Platform Gemini Models](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fgoogle-models)\n\n## 2. OpenMaaS Models (Llama, DeepSeek, Qwen, etc.)\n\nFor OpenMaaS (Model-as-a-Service) models, the **HIGHLY RECOMMENDED** approach is\nto use the standard **OpenAI SDK** with a specific Vertex AI endpoint.\n\n> [!WARNING] While `GenerativeModel` *can* support some OpenMaaS models, it is\n> **discouraged**. Use the OpenAI SDK for best compatibility (especially for\n> Chat Completions).\n\n### Installation\n\n```bash\npip install openai google-auth\n```\n\n### Authentication for OpenAI SDK\n\nYou **MUST** use a Google Cloud OAuth access token as the API key for the OpenAI\nSDK.\n\n```python\nimport subprocess\n\ndef get_gcp_access_token():\n    return subprocess.check_output(\n        [\"gcloud\", \"auth\", \"print-access-token\"]\n    ).decode(\"utf-8\").strip()\n```\n\n> [!NOTE] Google Cloud access tokens typically expire after 1 hour. The\n> `get_gcp_access_token()` function above retrieves a *fresh* token at the time\n> it is called. For long-running\n> applications, you implement a refresh mechanism. See\n> [Refresh the access token](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmigrate\u002Fopenai\u002Fauth-and-credentials?hl=en#refresh_your_credentials)\n> for details.\n\n### Configuration (Base URL)\n\n\n\n-   **Global Endpoint** (Recommended for most models requiring global\n    availability):\n    `https:\u002F\u002Faiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002Fglobal\u002Fendpoints\u002Fopenapi`\n-   **Regional Endpoint**:\n    `https:\u002F\u002F{REGION}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002F{REGION}\u002Fendpoints\u002Fopenapi`\n\n\n### Python Example (OpenMaaS - Chat Completions)\n\nSee [`scripts\u002Fopenmaas_openai_sdk.py`](scripts\u002Fopenmaas_openai_sdk.py) for the\ncomplete code.\n\n> [!TIP] **Alternative: Environment Variables** You can set environment\n> variables in your shell instead of updating the code.\n>\n> **Alternative: Environment Variables** You can set environment variables in\n> your shell instead of updating the code.\n\n```bash\nexport OPENAI_BASE_URL=\"https:\u002F\u002Faiplatform.googleapis.com\u002Fv1\u002Fprojects\u002FYOUR_PROJECT_ID\u002Flocations\u002Fglobal\u002Fendpoints\u002Fopenapi\"\nexport OPENAI_API_KEY=\"$(gcloud auth application-default print-access-token)\"\n```\n> Then initialize the client without arguments: `client = OpenAI()`\n\n### Python Example (OpenMaaS - Completions API)\n\nThe following models support the legacy Completions API: `zai-org\u002Fglm-5-maas`,\n`moonshotai\u002Fkimi-k2-thinking-maas`, `minimaxai\u002Fminimax-m2-maas`,\n`deepseek-ai\u002Fdeepseek-v3.1-maas`, and `deepseek-ai\u002Fdeepseek-v3.2-maas`.\n\n```python\nresponse = client.completions.create(\n    model=\"deepseek-ai\u002Fdeepseek-v3.2-maas\",\n    prompt=\"Once upon a time\",\n    max_tokens=100\n)\nprint(response.choices[0].text)\n```\n\n### Python Example (OpenMaaS - Embeddings)\n\n```python\n# Verify specific Embedding Model ID on Model Garden (e.g., intfloat\u002Fmultilingual-e5-small)\nresponse = client.embeddings.create(\n    model=\"intfloat\u002Fmultilingual-e5-large-maas\",\n    input=\"The quick brown fox jumps over the lazy dog\",\n)\nprint(response.data[0].embedding)\n```\n\n### Alternative: GenAI SDK\n\nThe `google-genai` SDK can also access OpenMaaS models via the `vertexai`\nbackend.\n\nSee [`scripts\u002Fopenmaas_genai_sdk.py`](scripts\u002Fopenmaas_genai_sdk.py) for the\ncomplete code.\n\n> [!IMPORTANT]\n> **Model ID Format**: For GenAI SDK with OpenMaaS, you **MUST** use the full\n> path: `publishers\u002FPUBLISHER\u002Fmodels\u002FMODEL` (e.g.,\n> `publishers\u002Fzai-org\u002Fmodels\u002Fglm-5-maas`).\n\n### Legacy: Agent Platform SDK (OpenMaaS)\n\nFor OpenMaaS, you can also use `GenerativeModel` (if supported).\n\nSee [`scripts\u002Fopenmaas_vertexai_sdk.py`](scripts\u002Fopenmaas_vertexai_sdk.py) for\nthe complete code.\n\n> [!IMPORTANT] **Model ID Format**: For Agent Platform SDK with OpenMaaS, you\n> **MUST** use the full path: `publishers\u002FPUBLISHER\u002Fmodels\u002FMODEL`.\n\n### Model Reference & Availability\n\n**Documentation**:\n[Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n\n> [!TIP]\n> **Self-Deployment for Control**: If you need **dedicated hardware**\n> (GPUs\u002FTPUs), **guaranteed capacity**, or **specific regional placement** not\n> offered by MaaS, you can **Self-Deploy** these models to Agent Platform\n> Endpoints. Search for the model in Model Garden and click \"Deploy\" to select\n> your machine type. See the `agent-platform-deploy` skill for the deployment\n> workflow, and **section 4 of this skill** for how to invoke the resulting\n> self-deployed endpoint (use `\u002Fchat\u002Fcompletions` on the dedicated endpoint\n> DNS, NOT the OpenMaaS publisher URL above).\n\n> [!IMPORTANT] **Finding Inference Examples**: The list above is a starting\n> point. For the **definitive** inference snippets (especially for Chat\n> Completions payload structure): 1. Consult the\n> [Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n> list. 2. Click the link for your specific model (e.g., \"DeepSeek-V3\") to visit\n> its **Model Garden** page. 3. Look for the **\"Sample Code\"** or **\"Use this\n> model\"** button on the Model Garden page to get the exact `curl` or Python\n> code for that specific model version.\n\n> [!NOTE] This list is **INCOMPLETE**. See\n> [Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n> for the full list of supported models.\n\nModel Family  | Model ID Examples                              | Location      | Notes\n:------------ | :--------------------------------------------- | :------------ | :----\n**Llama 4**   | `meta\u002Fllama-4-maverick-17b-128e-instruct-maas` | `us-east5`    |\n**Llama 4**   | `meta\u002Fllama-4-scout-17b-16e-instruct-maas`     | `us-east5`    |\n**Llama 3.3** | `meta\u002Fllama-3.3-70b-instruct-maas`             | `us-central1` |\n**DeepSeek**  | `deepseek-ai\u002Fdeepseek-v3.2-maas`               | `global`      | Global ONLY\n**DeepSeek**  | `deepseek-ai\u002Fdeepseek-v3.1-maas`               | `us-west2`    | US-West2 ONLY\n**DeepSeek**  | `deepseek-ai\u002Fdeepseek-r1-0528-maas`            | `us-central1` |\n**Qwen 3**    | `qwen\u002Fqwen3-coder-480b-a35b-instruct-maas`     | `global`      |\n**Qwen 3**    | `qwen\u002Fqwen3-next-80b-a3b-instruct-maas`        | `global`      |\n**Kimi**      | `moonshotai\u002Fkimi-k2-thinking-maas`             | `global`      |\n**MiniMax**   | `minimaxai\u002Fminimax-m2-maas`                    | `global`      |\n**GLM**       | `zai-org\u002Fglm-4.7-maas`, `zai-org\u002Fglm-5-maas`   | `global`      |\n\n## 4. Custom Endpoints (tuned Gemini, self-deployed OSS LLM, legacy custom)\n\nThis section covers how to invoke a model on an Agent Platform\n**Endpoint** that belongs to your project — i.e., something with a\nnumeric resource name like\n`projects\u002F...\u002Fendpoints\u002F5875254126916403200`. This is distinct from\ncalling the publisher MaaS surfaces in sections 2 and 3 (which hit\n`publishers\u002F...\u002Fmodels\u002F...` or `endpoints\u002Fopenapi`, not your endpoint\nID).\n\n> [!IMPORTANT]\n>\n> **Publisher MaaS vs your endpoint (don't confuse them).** Section 3's\n> OpenMaaS examples (e.g. `meta\u002Fllama-3.3-70b-instruct-maas`) hit a\n> **shared publisher URL** at\n> `\u002Fv1\u002Fprojects\u002F...\u002Flocations\u002F...\u002Fendpoints\u002Fopenapi`. This section's\n> recipes hit **YOUR** endpoint at `\u002Fv1\u002Fprojects\u002F...\u002Fendpoints\u002F\u003Cid>`.\n> If you have a Llama \u002F Gemma \u002F etc. model deployed via Model Garden\n> \"Deploy\" (NOT the MaaS publisher product), follow this section — not\n> section 3.\n\n> [!IMPORTANT]\n>\n> **Active Endpoint Discovery & Single Source of Truth**:\n>\n> *   To check if a model or tuned Gemini adapter is deployed and ready for\n>     inference, run:\n>\n>     `gcloud ai endpoints list --project=\u003CPROJECT_ID> --region=\u003CREGION> --format=json`.\n>\n> *   **`gcloud ai endpoints list` is the ONLY authoritative source of active\n>     serving endpoints.**\n> *   Do NOT rely on historical `job.tunedModel.endpoint` identifiers from past\n>     `gcloud ai tuning-jobs list` records — those record where an endpoint was\n>     initially created during tuning, but if the endpoint was subsequently\n>     deleted, undeployed, or expired, it is no longer active.\n> *   If `gcloud ai endpoints list` returns empty `[]` or the requested tuned\n>     model is not deployed on any listed endpoint, report directly to the user\n>     that no active endpoint was found in that region and halt. **NEVER**\n>     hallucinate that historical\u002Fdeleted endpoints are ready, and **NEVER**\n>     silently substitute the base model without explicit user instruction and a\n>     fresh Tier R confirmation prompt.\n\n> [!IMPORTANT]\n>\n> **Two orthogonal axes determine the call shape:**\n>\n> **Axis 1 — model family** drives the RPC method and payload:\n>\n> | Endpoint serves | Method | Payload |\n> |---|---|---|\n> | A **tuned Gemini model** (output of Gemini tuning — the endpoint is already deployed for you) | `:generateContent` | `contents` \u002F `generationConfig` |\n> | A **self-deployed OSS LLM** (Llama, DeepSeek, Qwen, Gemma, Mistral, etc., deployed via Model Garden) | `\u002Fchat\u002Fcompletions` | OpenAI-compatible `messages` |\n> | A **legacy custom model** (classification, regression, custom-trained, embedding) | `:predict` | `instances` \u002F `parameters` |\n>\n> Run `gcloud ai endpoints describe \u003CENDPOINT_ID> --region=\u003CREGION>\n> --format=json` and inspect `deployedModels[].model` to decide:\n> contains `gemini` → tuned Gemini; matches an OSS publisher\n> (`meta\u002F`, `google\u002Fgemma-`, `deepseek-ai\u002F`, `qwen\u002F`, ...) → OSS LLM;\n> otherwise → likely legacy custom.\n>\n> **Axis 2 — endpoint type (shared vs dedicated)** drives the URL host:\n>\n> | `dedicatedEndpointEnabled` | Host |\n> |---|---|\n> | `false` (default — shared endpoint) | `\u003CREGION>-aiplatform.googleapis.com` |\n> | `true` (dedicated endpoint, has its own DNS) | the value of `dedicatedEndpointDns` (format: `\u003CENDPOINT_ID>.\u003CREGION>-\u003CPROJECT_NUM>.prediction.vertexai.goog`) |\n>\n> A dedicated endpoint **cannot** be reached via the shared\n> `\u003CREGION>-aiplatform.googleapis.com` host (per the\n> `Endpoint.dedicated_endpoint_enabled` proto: *\"Once you enabled\n> dedicated endpoint, you won't be able to send request to the shared\n> DNS\"*). Always check `dedicatedEndpointDns` in the describe output:\n> if it's set, use it as the host; otherwise use the shared host.\n>\n> **Path is always\n> `\u002Fv1\u002Fprojects\u002F...\u002Flocations\u002F...\u002Fendpoints\u002F\u003Cid>\u002F...`** on both hosts.\n> Both `\u002Fv1\u002F` (GA) and `\u002Fv1beta1\u002F` (beta) route to the same backend; the\n> recipes in this skill use `\u002Fv1\u002F`. The public\n> [Gemma deployment notebook](https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fvertex-ai-samples\u002Fblob\u002Fmain\u002Fnotebooks\u002Fcommunity\u002Fmodel_garden\u002Fmodel_garden_gemma_deployment_on_vertex.ipynb)\n> still uses `\u002Fv1beta1\u002F`, which also works.\n\n### 4a. REST recipe — tuned Gemini model\n\nOutput of Gemini tuning is always an endpoint that's already deployed for\nyou, reachable on the shared host with `:generateContent`.\n\n```bash\nPROJECT_ID=my-project\nENDPOINT_ID=5875254126916403200\nREGION=us-central1\nTOKEN=$(gcloud auth application-default print-access-token)\n\ncurl -sS -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  \"https:\u002F\u002F${REGION}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${REGION}\u002Fendpoints\u002F${ENDPOINT_ID}:generateContent\" \\\n  -d '{\n    \"contents\": [\n      {\"role\": \"user\", \"parts\": [{\"text\": \"Hello! Introduce yourself briefly.\"}]}\n    ],\n    \"generationConfig\": {\n      \"temperature\": 0.2\n    }\n  }'\n```\n\n> [!WARNING]\n>\n> **If you set `maxOutputTokens`, be generous for thinking models.**\n> Gemini 2.5 Pro (and other thinking-enabled models) emit \"thoughts\"\n> tokens that count against `maxOutputTokens` BEFORE any user-visible\n> text. With a small cap (e.g. 100), the entire budget is consumed by\n> thoughts and the response has empty `text` parts but a non-zero\n> `usageMetadata.candidatesTokenCount`.\n>\n> If you don't need to constrain output length, omit `maxOutputTokens`\n> entirely and let the model emit as much as it wants. If you do set\n> it: `>= 512` for any chat-like use, `>= 1024` for a paragraph of\n> output. If you see `finishReason: \"MAX_TOKENS\"` and no `text`\n> content in the response, your cap is too low.\n\n### 4b. REST recipe — self-deployed OSS LLM (Llama, DeepSeek, Qwen, Gemma, etc.)\n\nSelf-deployed OSS LLMs may be on a **shared** or **dedicated** endpoint\ndepending on how the deploy was configured (`dedicated_endpoint_enabled`\nat create time). The recipe below handles both cases by checking\n`dedicatedEndpointDns` in the describe output.\n\n```bash\nPROJECT_ID=my-project\nENDPOINT_ID=5875254126916403200\nREGION=us-central1\nTOKEN=$(gcloud auth application-default print-access-token)\n\n# Step 1: discover host. dedicatedEndpointDns is empty for shared endpoints.\nDEDICATED_DNS=$(gcloud ai endpoints describe \"$ENDPOINT_ID\" \\\n  --project=\"$PROJECT_ID\" --region=\"$REGION\" \\\n  --format=\"value(dedicatedEndpointDns)\")\n\nif [ -n \"$DEDICATED_DNS\" ]; then\n  HOST=\"$DEDICATED_DNS\"\nelse\n  HOST=\"${REGION}-aiplatform.googleapis.com\"\nfi\n\n# Step 2: call \u002Fchat\u002Fcompletions. Path is identical for both hosts.\ncurl -sS -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  \"https:\u002F\u002F${HOST}\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${REGION}\u002Fendpoints\u002F${ENDPOINT_ID}\u002Fchat\u002Fcompletions\" \\\n  -d '{\n    \"messages\": [\n      {\"role\": \"user\", \"content\": \"Hello! Introduce yourself briefly.\"}\n    ]\n  }'\n```\n\n> [!NOTE]\n>\n> -   `max_tokens` (NOT `maxOutputTokens`) — this is OpenAI-compatible\n>     vocabulary, not Vertex. Omit it entirely to let the model emit as\n>     much as it wants; set it explicitly only if you need to cap output.\n> -   The `\"model\"` field in the OpenAI-style payload can be omitted (or\n>     set to `\"\"`) for endpoint deployments — the endpoint already\n>     determines which model serves the request.\n> -   Same endpoint also exposes `\u002Fcompletions` (legacy text completion)\n>     and `\u002Fembeddings` for embedding models.\n> -   **Reasoning models** (DeepSeek-R1, Kimi-K2-Thinking, GLM-5 variants,\n>     etc.) emit thinking tokens that count against `max_tokens` BEFORE\n>     the final answer — same pathology as Gemini 2.5 Pro in section 4a.\n>     If you DO set `max_tokens` and get an empty\n>     `choices[0].message.content` or `finish_reason: \"length\"`, raise it\n>     (>= 1024 for chat, >= 2048 for longer thinking chains) or omit it.\n\nPython equivalent (OpenAI SDK) — mirrors the public\n[Gemma deployment notebook](https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fvertex-ai-samples\u002Fblob\u002Fmain\u002Fnotebooks\u002Fcommunity\u002Fmodel_garden\u002Fmodel_garden_gemma_deployment_on_vertex.ipynb):\n\n```python\nimport google.auth\nfrom google.auth.transport.requests import Request\nimport openai\n\nfrom google.cloud import aiplatform\n\nPROJECT_ID = \"my-project\"\nENDPOINT_ID = \"5875254126916403200\"\nREGION = \"us-central1\"\n\naiplatform.init(project=PROJECT_ID, location=REGION)\nendpoint = aiplatform.Endpoint(\n    f\"projects\u002F{PROJECT_ID}\u002Flocations\u002F{REGION}\u002Fendpoints\u002F{ENDPOINT_ID}\"\n)\nendpoint_resource_name = endpoint.resource_name  # full projects\u002F...\u002Fendpoints\u002F\u003Cid>\ndedicated_dns = endpoint.gca_resource.dedicated_endpoint_dns  # empty if shared\n\nhost = dedicated_dns if dedicated_dns else f\"{REGION}-aiplatform.googleapis.com\"\nbase_url = f\"https:\u002F\u002F{host}\u002Fv1\u002F{endpoint_resource_name}\"\n\nimport subprocess\n\ntoken = subprocess.check_output(\n    [\"gcloud\", \"auth\", \"print-access-token\"]\n).decode(\"utf-8\").strip()\n\nclient = openai.OpenAI(base_url=base_url, api_key=token)\nresponse = client.chat.completions.create(\n    model=\"\",  # endpoint determines the served model\n    messages=[{\"role\": \"user\", \"content\": \"Hello! Introduce yourself briefly.\"}],\n    # Omit max_tokens to let the model emit as much as it wants. Set it\n    # only if you need to cap output length (see notes above).\n)\nprint(response.choices[0].message.content)\n```\n\nSee also: `agent-platform-deploy` skill section 4 \"Verifying Deployment\",\nwhich uses the same pattern post-deploy.\n\n### 4c. REST recipe — legacy `:predict` (custom \u002F classification \u002F embedding)\n\nSame host-discovery logic as 4b (shared or dedicated based on\n`dedicatedEndpointDns`):\n\n```bash\nDEDICATED_DNS=$(gcloud ai endpoints describe \"$ENDPOINT_ID\" \\\n  --project=\"$PROJECT_ID\" --region=\"$REGION\" \\\n  --format=\"value(dedicatedEndpointDns)\")\nHOST=${DEDICATED_DNS:-${REGION}-aiplatform.googleapis.com}\n\ncurl -sS -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  \"https:\u002F\u002F${HOST}\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${REGION}\u002Fendpoints\u002F${ENDPOINT_ID}:predict\" \\\n  -d '{\n    \"instances\": [{\"key\": \"value\"}],\n    \"parameters\": {}\n  }'\n```\n\nThe exact `instances` shape is model-specific; consult the deployed\nmodel's documentation or the Model Garden card it was deployed from.\n\n### 4d. Python (Vertex AI SDK) — tuned Gemini model\n\n```python\nfrom google import genai\nimport google.auth\n\n_, project_id = google.auth.default()\nclient = genai.Client(vertexai=True, project=project_id, location=\"us-central1\")\n\nENDPOINT_ID = \"5875254126916403200\"\nresponse = client.models.generate_content(\n    model=f\"projects\u002F{project_id}\u002Flocations\u002Fus-central1\u002Fendpoints\u002F{ENDPOINT_ID}\",\n    contents=\"Hello! Introduce yourself briefly.\",\n    config={\"temperature\": 0.2},  # add max_output_tokens only if you need a cap\n)\nprint(response.text)\n```\n\n## 5. Troubleshooting & Common Error Codes\n\n### 429: Resource Exhausted\n\n*   **Cause**: OpenMaaS and Gemini models use **Dynamic Shared Quota (DSQ)**.\n    Resources are pooled and allocated dynamically based on availability. A 429\n    error indicates the shared pool is temporarily exhausted, not necessarily\n    that *your* specific project quota is hit (though it can be).\n*   **Solution**: Implement strict **exponential backoff and retry** strategies.\n*   **High Throughput**: For production workloads requiring high throughput or\n    guaranteed capacity, consider **Provisioned Throughput (PT)**.\n*   **Important**: Quota increases through normal cloud processes (Cloud\n    Console) are **NOT** applicable for DSQ constraints.\n*   **Documentation**:\n    [Quotas and limits (DSQ)](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fquotas)\n\n### 400: User Validation Error\n\n*   **Cause**: Invalid request format, unsupported parameter, or incorrect Model\n    ID.\n*   **Action**: Double-check your request payload and parameters. Verify the\n    Model ID and Region are correct.\n*   **Custom endpoints**: pick the right method + host per section 4's\n    decision tables:\n    *   Tuned Gemini + you called `:predict` → switch to `:generateContent`\n        (section 4a). Error mentions \"Required instances format mismatch\".\n    *   OSS LLM (Llama\u002FDeepSeek\u002FQwen\u002FGemma\u002Fetc.) + you called\n        `:generateContent` or `:predict` → switch to `\u002Fchat\u002Fcompletions`\n        (section 4b). Error may be 404, 405, or \"method not allowed\".\n    *   Legacy \u002F custom-trained + you called `:generateContent` or\n        `\u002Fchat\u002Fcompletions` → switch to `:predict` (section 4c).\n*   **Dedicated endpoint reached on the shared host (or vice versa)**:\n    *   Symptom: DNS resolution failure (`Could not resolve host`) or 404.\n    *   Cause: dedicated endpoints don't accept traffic on\n        `\u003CREGION>-aiplatform.googleapis.com`, and the dedicated DNS\n        (`*.prediction.vertexai.goog`) only exists when\n        `dedicatedEndpointEnabled` is true.\n    *   Action: re-check `gcloud ai endpoints describe ... --format=json`\n        for the `dedicatedEndpointDns` field; use it iff non-empty (per\n        the host-discovery snippets in section 4b\u002F4c).\n\n### Empty response text on Gemini deployed endpoints\n\n*   **Cause**: `maxOutputTokens` is set too low. Gemini 2.5 Pro and other\n    thinking models emit \"thoughts\" tokens that count against the budget\n    BEFORE any user-visible text. With a small cap (e.g. 100), the entire\n    budget is consumed by thoughts and the response has empty `text` parts\n    but a non-zero `usageMetadata.candidatesTokenCount` and\n    `finishReason: \"MAX_TOKENS\"`.\n*   **Action**: Omit `maxOutputTokens` entirely (let the model emit as much\n    as it wants), or raise it to >= 512 for chat-like use, >= 1024 for\n    longer output. See section 4 \"Custom Endpoints\" for details.\n\n### 404: Not Found \u002F Model Not Available\n\n*   **Cause**: The model is not enabled, or not available in the specified\n    project or region.\n*   **Action**:\n    1.  **Check Location Availability**:\n        *   **OpenMaaS**: Verify the model is available in your region. See\n            [Model Availability by Location](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fresources\u002Flocations#genai-open-models).\n        *   **Gemini**:\n            *   **Source of Truth**: Always check\n                [Gemini Model Locations](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fresources\u002Flocations#google-models)\n                for the authoritative list.\n            *   **Preview Models**: All Preview models (e.g., Gemini 3.1,\n                experimental versions) are often **ONLY** available in the\n                `us-central1` or `global` regions.\n            *   **Stable Models**: (e.g., Gemini 2.5 Pro) Available in\n                `us-central1`, `europe-west4`, and many other regions.\n            *   **Important**: If you get a 404\u002F400 error, try switching your\n                client location to `us-central1` or `global`.\n    2.  **Enable Llama Models**: For **Llama 3.3** and **Llama 4**, you **MUST**\n        enable the model in Model Garden before use. Go to the\n        [Model Garden](https:\u002F\u002Fconsole.cloud.google.com\u002Fagent-platform\u002Fmodel-garden),\n        search for the model card (e.g., \"Llama 3.3 API Service\"), and click\n        **Enable**. Only then can you make inference requests.\n","# Agent Platform GenAI Inference Skill\n\nThis skill provides instructions for authenticating and connecting to Google\nCloud Agent Platform to use Generative AI models. It covers:\n\n*   **First-Party publisher models** (Gemini) — section 2.\n*   **Third-Party publisher models** (OpenMaaS: Llama, DeepSeek, Qwen, etc.)\n    — section 3.\n*   **Custom endpoints** (any model on a numeric `projects\u002F...\u002Fendpoints\u002F\u003Cid>`\n    resource — tuned Gemini models, OSS LLMs self-deployed from Model Garden\n    via the `agent-platform-deploy` skill, and legacy custom models) —\n    section 4.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you MUST\nread [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION` and append the\nattribution suffix to `User-Agent` headers:\n\n```text\nCLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:agent-platform-inference)\"\nUser-Agent: \u003Cexisting_user_agent> agent-skills\u002F1.0 (skill:agent-platform-inference)\n```\n\n## Safety & Confirmation Tiers (CRITICAL)\n\nBefore executing any commands or scripts on behalf of the user, you must adhere\nto the following safety tiers based on the action requested. (The skill is\nread-only; other safety tiers are omitted):\n\n1.  **Tier R: Read-only \u002F Inference (`client.models.generate_content`,\n    `client.chat.completions.create`, `client.completions.create`,\n    `client.embeddings.create`)**\n    *   Requires **interactive confirmation** with 'Yes'\u002F 'No' options before\n        executing model inference on behalf of the user, to prevent unexpected\n        cost or quota consumption.\n    *   **Required Fields in Confirmation Card**: The confirmation prompt must\n        clearly explain the proposed inference execution and explicitly list all\n        of the following parameters:\n        *   **Project ID**: The Google Cloud project ID or number (e.g.\n            `123456789012`, `my-project`).\n        *   **Region \u002F Location**: The target region (e.g. `us-central1`,\n            `global`).\n        *   **Model ID**: The exact model ID (e.g. `gemini-2.5-flash`,\n            `deepseek-ai\u002Fdeepseek-v3.2-maas`).\n        *   **SDK**: The SDK choice (e.g. `Google GenAI SDK (google-genai)`,\n            `OpenAI SDK`).\n        *   **Input Prompt** (or **Input Image** \u002F **Input Media**): The prompt\n            text or media URI.\n        *   Any additional generation parameters (e.g. `max_output_tokens`,\n            `response_schema`) if specified.\n        Natural-language paraphrases without explicitly listing these\n        parameters are NOT sufficient.\n    *   **Same-turn restriction**: Do not execute the inference scripts or\n        commands in the same turn as presenting the confirmation prompt. Stop\n        and wait for the user's reply; only execute after explicit 'Yes' \u002F\n        approval.\n    *   **Gold Standard Example**:\n        > I will perform model inference with the following parameters. Please\n        > confirm this information before I proceed:\n        > * **Project ID**: `my-project`\n        > * **Region**: `us-central1`\n        > * **Model ID**: `gemini-2.5-pro`\n        > * **SDK**: Google GenAI SDK (`google-genai`)\n        > * **Input Prompt**: \"Summarize the plot of Hamlet in 3 sentences\"\n        >\n        > Do you confirm? [Yes\u002FNo]\n    *   **Post-Execution Response Grounding (CRITICAL)**:\n        After receiving explicit user approval and executing the inference call\n        via the SDK, the response returning the generated text **MUST\n        explicitly confirm the execution parameters** alongside the model's\n        output. Never return a bare model response alone. Always include:\n        *   **Model ID**: The exact model ID used (e.g. `gemini-2.5-pro`\n            or `\u003CMODEL_ID>`).\n        *   **SDK**: The SDK used (e.g. `Google GenAI SDK (google-genai)`\n            or `OpenAI SDK`).\n        *   **Project ID**: The Google Cloud project ID\u002Fnumber used.\n        *   **Region**: The region or endpoint location used (e.g. `global`\n            or `us-central1`).\n        *   **Generated Output**: The model's complete generated answer.\n\n## Phase 0: Environment Setup\n\n**CRITICAL**: Before running any of the Python sample scripts in the `scripts\u002F`\ndirectory (e.g., `scripts\u002Fopenmaas_openai_sdk.py`), you MUST ensure the\nenvironment is correctly initialized by following these steps:\n\n1.  **Google Cloud Authentication**: Authenticate with your Google Cloud\n    credentials and configure active Application Default Credentials (ADC) for\n    Agent Platform access:\n\n    ```bash\n    gcloud auth login\n    gcloud auth application-default login\n    ```\n\n2.  **Enable API** (if not already enabled):\n\n    ```bash\n    gcloud services enable aiplatform.googleapis.com\n    ```\n\n3.  **Python Dependencies**: The scripts import `vertexai` (from\n    `google-cloud-aiplatform`), `google-genai`, and `openai`. Do **not** create\n    a virtual environment — it starts empty and hides packages the environment\n    already provides, forcing a redundant install. Probe, and install only what\n    is missing:\n\n    ```bash\n    python3 -c \"import vertexai, google.genai, openai\" \\\n      || pip install -r scripts\u002Frequirements.txt\n    ```\n\n    `scripts\u002Frequirements.txt` is a fallback for an environment that does not\n    already provide these SDKs; do not install it on top of a working\n    environment.\n\n4.  **Verify Setup (Optional)**: Run all sample scripts at once to verify the\n    environment is working end-to-end:\n\n    ```bash\n    .\u002Fscripts\u002Fverify_all.sh\n    ```\n\n5.  **Execution**: Run the scripts with a plain `python3 scripts\u002F...`. There is\n    no environment to activate first.\n\n\n\n> [!IMPORTANT] **CRITICAL: Model IDs & Availability** * **Gemini Models**: See\n> [Gemini Models][gemini-models-docs] for valid Model IDs and Regions. *\n> **OpenMaaS Models**: See\n> [Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n> for Llama, DeepSeek, Qwen, etc. * **Incomplete Lists**: The Model IDs listed\n> in this skill are **examples only** and may be incomplete or outdated. *\n> **Action**: Always verify the Model ID and Region using the links above before\n> generating code.\n>\n> \\[gemini-models-docs]:\n> https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmigrate\n>\n\n## Parameter Grounding & Clarification Protocol (CRITICAL)\n\nBefore preparing code or presenting a Tier R confirmation card, you MUST ensure\nall necessary parameters are grounded:\n\n1.  **Missing Model ID, Model Family, or SDK (CRITICAL)**:\n    *   If the user has **NOT** specified which model or model family to use\n        (e.g., \"run a test prompt\", \"ask a generative AI model to...\", \"ask\n        DeepSeek a question\" without model version), or has not specified the\n        SDK preference:\n    *   **NEVER** guess, volunteer, or default to a model (such as\n        `gemini-2.5-flash`, `gemini-2.5-pro`, or `deepseek-v3.2-maas`).\n        Proposing a defaulted model in a confirmation card without asking\n        violates parameter grounding.\n    *   **YOU MUST STOP AND ASK THE USER**: \"Which model (or model family,\n        such as Gemini, Llama, DeepSeek, or Qwen) and SDK preference (such as\n        Google GenAI SDK or OpenAI SDK) would you like to use?\" and ask for the\n        target region and project ID if not specified.\n    *   Only after the user specifies the model (and any missing SDK preference)\n        should you proceed to prepare the execution and present the Tier R\n        confirmation prompt.\n\n2.  **Missing Project ID or Region**:\n    *   If the user's project ID or region is not specified in the prompt or\n        conversation context, **ASK** the user for the project ID and region\n        (e.g. \"Which project ID and region would you like to use?\"). Do not\n        silently assume a project or region.\n    *   **OpenMaaS Locations**: OpenMaaS publisher models are hosted on `global`\n        (e.g. `deepseek-ai\u002Fdeepseek-v3.2-maas`,\n        `meta\u002Fllama-3.3-70b-instruct-maas`) or regional endpoints such as\n        `us-central1` (e.g. `deepseek-ai\u002Fdeepseek-r1-0528-maas`).\n        When configuring inference for OpenMaaS models, use the appropriate\n        endpoint:\n\n        *   Global: `https:\u002F\u002Faiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002Fglobal\u002Fendpoints\u002Fopenapi`\n        *   Regional: `https:\u002F\u002F{REGION}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002F{REGION}\u002Fendpoints\u002Fopenapi`\n\n        and explicitly reflect the region in the confirmation card and final\n        response.\n\n3.  **SDK Choice**:\n    *   If the user specifies a model but does not specify an SDK, use the\n        preferred SDK for that model family (GenAI SDK `google-genai` for\n        Gemini, OpenAI SDK `openai` for OpenMaaS).\n\n4.  **Sandbox Execution via Python (CRITICAL)**:\n    *   When executing model inference in the sandbox via `run_command`,\n        **ALWAYS** run Python code using the official SDKs (e.g., writing and\n        running a Python script with `google-genai`, `openai`, or `vertexai`).\n        Do not use raw curl commands for final inference execution.\n\n## Workflow Decision Tree\n\n1.  **Model Specified?**\n    *   **No** (user omitted model name\u002Ffamily) -> **Ask the user** which model\n        or model family, target region, and SDK preference they want to use.\n    *   **Underspecified** (e.g., user said \"DeepSeek\" or \"Llama\" without\n        version) -> **Ask the user** which specific model version they prefer\n        (e.g., `deepseek-ai\u002Fdeepseek-r1-0528-maas`,\n        `deepseek-ai\u002Fdeepseek-v3.2-maas`, `meta\u002Fllama-3.3-70b-instruct-maas`).\n    *   **Yes** -> Proceed to Step 2.\n\n2.  **Model Family & SDK Selection**:\n    *   **Gemini** (e.g., `gemini-2.5-pro`, `gemini-2.5-flash`) -> Preferred:\n        **GenAI SDK** (`google-genai`). Proceed to [1. Gemini Models].\n    *   **OpenMaaS** (e.g., `deepseek-ai\u002F*`, `meta\u002Fllama-*`, `qwen\u002F*`) ->\n        Preferred: **OpenAI SDK** (`openai`). Proceed to [2. OpenMaaS Models].\n    *   **Custom Endpoint** (numeric endpoint ID\n        `projects\u002F...\u002Fendpoints\u002F\u003Cid>`) -> Proceed to [4. Custom Endpoints].\n\n3.  **Troubleshooting**: Is the user reporting an error (429 Resource Exhausted,\n    400 User Validation, 404 Not Found, empty response due to token limits,\n    etc.)?\n    *   **Yes** -> Proceed to [5. Troubleshooting & Common Error Codes].\n    *   **No** -> Present Tier R confirmation prompt with all required fields\n        (Project ID, Region, Model ID, SDK, Input Prompt), wait for user\n        confirmation, then execute via Python SDK.\n\n## 0.5 Region Availability Check for Publisher Endpoints (Gemini + LoRA base)\n\n> [!NOTE] **Skip this section** if either of these applies:\n>\n> - The user is calling a custom endpoint (§4) — a tuned Gemini model served on\n>   a numeric `projects\u002F...\u002Fendpoints\u002F\u003Cid>`, a self-deployed OSS LLM (Llama,\n>   DeepSeek, Qwen, Gemma, etc.), or a legacy custom model. Those requests hit\n>   a specific endpoint resource whose region is fixed at deploy time; if the\n>   caller-side region doesn't match, the endpoint lookup returns a clean 404\n>   without incurring inference cost. Go to §4.\n> - The user is calling an OpenMaaS publisher model (§2) — Llama, DeepSeek,\n>   Qwen, etc. served via the global `openapi` base URL. These don't have\n>   per-region availability restrictions in the same way first-party Gemini\n>   does. Go to §2.\n>\n> **Apply this section** only if the user is calling a first-party managed\n> Gemini model (`gemini-*`, via §1), including fine-tuned LoRA adapters on\n> top of Gemini — these route through a publisher endpoint whose regional\n> availability actually varies.\n\nBefore responding to any inference request that names a specific region for a\nfirst-party managed Gemini model (`gemini-*`) or a fine-tuned Gemini LoRA\nadapter (identified by numeric endpoint ID + user-stated base model), you\n**MUST** verify the model is actually available in that region by making a\nlive API call. Do not rely on Google Search, training-corpus knowledge, or\npublisher documentation for availability claims — regional availability\nchanges frequently and grounded text can be stale or wrong.\n\nProbe only the exact model and region the user asked about. Do not probe other\nmodels as a \"control\" — you cannot infer anything about model A's availability\nfrom model B's status, because a different model may itself be unavailable in\nthe reference region for unrelated reasons.\n\nFor first-party Gemini models, probe with a real `:generateContent` call using\na minimal valid payload:\n\n```bash\ncurl -sS -o \u002Fdev\u002Fnull -w \"%{http_code}\\n\" \\\n    -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002F${LOCATION_ID}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${LOCATION_ID}\u002Fpublishers\u002Fgoogle\u002F${MODEL_ID}:generateContent\" \\\n    -d \"{\\\"contents\\\":{\\\"role\\\":\\\"user\\\",\\\"parts\\\":{\\\"text\\\":\\\"${PROBE_TEXT:-hi}\\\"}}}\"\n```\n\nFor inference against a fine-tuned Gemini LoRA adapter, probe the **base\nmodel** in the target region using the same `:generateContent` call above with\n`${MODEL_ID}` set to the base (e.g. `gemini-2.5-flash` if the adapter was\ntuned on `gemini-2.5-flash`). The LoRA adapter cannot serve in a region where\nits base model isn't available.\n\nInterpret the probe result and act:\n\n-   **200** — model is available in that region. Proceed with the SDK setup in\n    §1.\n-   **404** — model is not available in that region. STOP. Tell the user\n    plainly that the model isn't offered in that region and list the regions\n    where it is available (from\n    [Gemini Models][gemini-models-docs] or `gcloud ai model-garden models list\n    --filter=\"name~$MODEL_NAME\"` without `--region`). Do not silently switch\n    regions. Do not proceed to write inference code or SDK initialization for\n    the unsupported region. Do not run additional \"control\" probes to\n    double-check the 404 — the target-region probe is authoritative.\n-   **Any other outcome** (permission denied, quota, transient failure, etc.)\n    — do not conclude the model is available or unavailable. Explain the\n    underlying cause in plain language (e.g. \"your account doesn't have access\n    to this project's Vertex AI API — enable it in the console or switch\n    projects\") and the concrete next action.\n\n## 1. Gemini Models\n\nFor Gemini models (e.g., `gemini-2.5-pro`, `gemini-3-flash-preview`), the\n**GenAI SDK** (`google-genai`) is the **PREFERRED** method. The legacy\n`vertexai` SDK is still supported but GenAI SDK is recommended for new projects.\n\n> [!IMPORTANT]\n> **Preview Models (including Gemini 3.1)** are often **ONLY** available in the\n> `global` region. Stable models are available in `us-central1` and other\n> regions.\n\n### Choosing the Right SDK\n\n*   **Gemini Models**: **GenAI SDK** (`google-genai`) is **PREFERRED**. Use\n    OpenAI SDK for compatibility, or Legacy SDK (`vertexai`) if needed.\n*   **OpenMaaS Models**: **OpenAI SDK** is **HIGHLY RECOMMENDED**. Use GenAI SDK\n    or Legacy SDK if you have specific infrastructure requirements.\n\n### Installation\n\n```bash\npip install google-genai\n```\n\n### Python Example (GenAI SDK - Preferred)\n\nSee [`scripts\u002Fgemini_genai_sdk.py`](scripts\u002Fgemini_genai_sdk.py) for the\ncomplete code.\n\n### Alternative: OpenAI SDK (Chat Completions)\n\nUse the standard OpenAI SDK with the Agent Platform endpoint. This is great for\ncross-compatibility.\n\nSee [`scripts\u002Fgemini_openai_sdk.py`](scripts\u002Fgemini_openai_sdk.py) for the\ncomplete code.\n\n### Legacy: Agent Platform SDK\n\nThe legacy `vertexai` SDK is still widely used but `google-genai` is preferred\nfor new Gemini projects.\n\nSee [`scripts\u002Fgemini_vertexai_sdk.py`](scripts\u002Fgemini_vertexai_sdk.py) for the\ncomplete code.\n\n**Documentation**:\n[Google GenAI SDK](https:\u002F\u002Fgithub.com\u002Fgoogleapis\u002Fpython-genai)\n\n**Documentation**:\n[Agent Platform Gemini Models](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fgoogle-models)\n\n## 2. OpenMaaS Models (Llama, DeepSeek, Qwen, etc.)\n\nFor OpenMaaS (Model-as-a-Service) models, the **HIGHLY RECOMMENDED** approach is\nto use the standard **OpenAI SDK** with a specific Vertex AI endpoint.\n\n> [!WARNING] While `GenerativeModel` *can* support some OpenMaaS models, it is\n> **discouraged**. Use the OpenAI SDK for best compatibility (especially for\n> Chat Completions).\n\n### Installation\n\n```bash\npip install openai google-auth\n```\n\n### Authentication for OpenAI SDK\n\nYou **MUST** use a Google Cloud OAuth access token as the API key for the OpenAI\nSDK.\n\n```python\nimport subprocess\n\ndef get_gcp_access_token():\n    return subprocess.check_output(\n        [\"gcloud\", \"auth\", \"print-access-token\"]\n    ).decode(\"utf-8\").strip()\n```\n\n> [!NOTE] Google Cloud access tokens typically expire after 1 hour. The\n> `get_gcp_access_token()` function above retrieves a *fresh* token at the time\n> it is called. For long-running\n> applications, you implement a refresh mechanism. See\n> [Refresh the access token](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmigrate\u002Fopenai\u002Fauth-and-credentials?hl=en#refresh_your_credentials)\n> for details.\n\n### Configuration (Base URL)\n\n\n\n-   **Global Endpoint** (Recommended for most models requiring global\n    availability):\n    `https:\u002F\u002Faiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002Fglobal\u002Fendpoints\u002Fopenapi`\n-   **Regional Endpoint**:\n    `https:\u002F\u002F{REGION}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F{PROJECT_ID}\u002Flocations\u002F{REGION}\u002Fendpoints\u002Fopenapi`\n\n\n### Python Example (OpenMaaS - Chat Completions)\n\nSee [`scripts\u002Fopenmaas_openai_sdk.py`](scripts\u002Fopenmaas_openai_sdk.py) for the\ncomplete code.\n\n> [!TIP] **Alternative: Environment Variables** You can set environment\n> variables in your shell instead of updating the code.\n>\n> **Alternative: Environment Variables** You can set environment variables in\n> your shell instead of updating the code.\n\n```bash\nexport OPENAI_BASE_URL=\"https:\u002F\u002Faiplatform.googleapis.com\u002Fv1\u002Fprojects\u002FYOUR_PROJECT_ID\u002Flocations\u002Fglobal\u002Fendpoints\u002Fopenapi\"\nexport OPENAI_API_KEY=\"$(gcloud auth application-default print-access-token)\"\n```\n> Then initialize the client without arguments: `client = OpenAI()`\n\n### Python Example (OpenMaaS - Completions API)\n\nThe following models support the legacy Completions API: `zai-org\u002Fglm-5-maas`,\n`moonshotai\u002Fkimi-k2-thinking-maas`, `minimaxai\u002Fminimax-m2-maas`,\n`deepseek-ai\u002Fdeepseek-v3.1-maas`, and `deepseek-ai\u002Fdeepseek-v3.2-maas`.\n\n```python\nresponse = client.completions.create(\n    model=\"deepseek-ai\u002Fdeepseek-v3.2-maas\",\n    prompt=\"Once upon a time\",\n    max_tokens=100\n)\nprint(response.choices[0].text)\n```\n\n### Python Example (OpenMaaS - Embeddings)\n\n```python\n# Verify specific Embedding Model ID on Model Garden (e.g., intfloat\u002Fmultilingual-e5-small)\nresponse = client.embeddings.create(\n    model=\"intfloat\u002Fmultilingual-e5-large-maas\",\n    input=\"The quick brown fox jumps over the lazy dog\",\n)\nprint(response.data[0].embedding)\n```\n\n### Alternative: GenAI SDK\n\nThe `google-genai` SDK can also access OpenMaaS models via the `vertexai`\nbackend.\n\nSee [`scripts\u002Fopenmaas_genai_sdk.py`](scripts\u002Fopenmaas_genai_sdk.py) for the\ncomplete code.\n\n> [!IMPORTANT]\n> **Model ID Format**: For GenAI SDK with OpenMaaS, you **MUST** use the full\n> path: `publishers\u002FPUBLISHER\u002Fmodels\u002FMODEL` (e.g.,\n> `publishers\u002Fzai-org\u002Fmodels\u002Fglm-5-maas`).\n\n### Legacy: Agent Platform SDK (OpenMaaS)\n\nFor OpenMaaS, you can also use `GenerativeModel` (if supported).\n\nSee [`scripts\u002Fopenmaas_vertexai_sdk.py`](scripts\u002Fopenmaas_vertexai_sdk.py) for\nthe complete code.\n\n> [!IMPORTANT] **Model ID Format**: For Agent Platform SDK with OpenMaaS, you\n> **MUST** use the full path: `publishers\u002FPUBLISHER\u002Fmodels\u002FMODEL`.\n\n### Model Reference & Availability\n\n**Documentation**:\n[Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n\n> [!TIP]\n> **Self-Deployment for Control**: If you need **dedicated hardware**\n> (GPUs\u002FTPUs), **guaranteed capacity**, or **specific regional placement** not\n> offered by MaaS, you can **Self-Deploy** these models to Agent Platform\n> Endpoints. Search for the model in Model Garden and click \"Deploy\" to select\n> your machine type. See the `agent-platform-deploy` skill for the deployment\n> workflow, and **section 4 of this skill** for how to invoke the resulting\n> self-deployed endpoint (use `\u002Fchat\u002Fcompletions` on the dedicated endpoint\n> DNS, NOT the OpenMaaS publisher URL above).\n\n> [!IMPORTANT] **Finding Inference Examples**: The list above is a starting\n> point. For the **definitive** inference snippets (especially for Chat\n> Completions payload structure): 1. Consult the\n> [Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n> list. 2. Click the link for your specific model (e.g., \"DeepSeek-V3\") to visit\n> its **Model Garden** page. 3. Look for the **\"Sample Code\"** or **\"Use this\n> model\"** button on the Model Garden page to get the exact `curl` or Python\n> code for that specific model version.\n\n> [!NOTE] This list is **INCOMPLETE**. See\n> [Use Open Models on Agent Platform](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fmaas\u002Fuse-open-models)\n> for the full list of supported models.\n\nModel Family  | Model ID Examples                              | Location      | Notes\n:------------ | :--------------------------------------------- | :------------ | :----\n**Llama 4**   | `meta\u002Fllama-4-maverick-17b-128e-instruct-maas` | `us-east5`    |\n**Llama 4**   | `meta\u002Fllama-4-scout-17b-16e-instruct-maas`     | `us-east5`    |\n**Llama 3.3** | `meta\u002Fllama-3.3-70b-instruct-maas`             | `us-central1` |\n**DeepSeek**  | `deepseek-ai\u002Fdeepseek-v3.2-maas`               | `global`      | Global ONLY\n**DeepSeek**  | `deepseek-ai\u002Fdeepseek-v3.1-maas`               | `us-west2`    | US-West2 ONLY\n**DeepSeek**  | `deepseek-ai\u002Fdeepseek-r1-0528-maas`            | `us-central1` |\n**Qwen 3**    | `qwen\u002Fqwen3-coder-480b-a35b-instruct-maas`     | `global`      |\n**Qwen 3**    | `qwen\u002Fqwen3-next-80b-a3b-instruct-maas`        | `global`      |\n**Kimi**      | `moonshotai\u002Fkimi-k2-thinking-maas`             | `global`      |\n**MiniMax**   | `minimaxai\u002Fminimax-m2-maas`                    | `global`      |\n**GLM**       | `zai-org\u002Fglm-4.7-maas`, `zai-org\u002Fglm-5-maas`   | `global`      |\n\n## 4. Custom Endpoints (tuned Gemini, self-deployed OSS LLM, legacy custom)\n\nThis section covers how to invoke a model on an Agent Platform\n**Endpoint** that belongs to your project — i.e., something with a\nnumeric resource name like\n`projects\u002F...\u002Fendpoints\u002F5875254126916403200`. This is distinct from\ncalling the publisher MaaS surfaces in sections 2 and 3 (which hit\n`publishers\u002F...\u002Fmodels\u002F...` or `endpoints\u002Fopenapi`, not your endpoint\nID).\n\n> [!IMPORTANT]\n>\n> **Publisher MaaS vs your endpoint (don't confuse them).** Section 3's\n> OpenMaaS examples (e.g. `meta\u002Fllama-3.3-70b-instruct-maas`) hit a\n> **shared publisher URL** at\n> `\u002Fv1\u002Fprojects\u002F...\u002Flocations\u002F...\u002Fendpoints\u002Fopenapi`. This section's\n> recipes hit **YOUR** endpoint at `\u002Fv1\u002Fprojects\u002F...\u002Fendpoints\u002F\u003Cid>`.\n> If you have a Llama \u002F Gemma \u002F etc. model deployed via Model Garden\n> \"Deploy\" (NOT the MaaS publisher product), follow this section — not\n> section 3.\n\n> [!IMPORTANT]\n>\n> **Active Endpoint Discovery & Single Source of Truth**:\n>\n> *   To check if a model or tuned Gemini adapter is deployed and ready for\n>     inference, run:\n>\n>     `gcloud ai endpoints list --project=\u003CPROJECT_ID> --region=\u003CREGION> --format=json`.\n>\n> *   **`gcloud ai endpoints list` is the ONLY authoritative source of active\n>     serving endpoints.**\n> *   Do NOT rely on historical `job.tunedModel.endpoint` identifiers from past\n>     `gcloud ai tuning-jobs list` records — those record where an endpoint was\n>     initially created during tuning, but if the endpoint was subsequently\n>     deleted, undeployed, or expired, it is no longer active.\n> *   If `gcloud ai endpoints list` returns empty `[]` or the requested tuned\n>     model is not deployed on any listed endpoint, report directly to the user\n>     that no active endpoint was found in that region and halt. **NEVER**\n>     hallucinate that historical\u002Fdeleted endpoints are ready, and **NEVER**\n>     silently substitute the base model without explicit user instruction and a\n>     fresh Tier R confirmation prompt.\n\n> [!IMPORTANT]\n>\n> **Two orthogonal axes determine the call shape:**\n>\n> **Axis 1 — model family** drives the RPC method and payload:\n>\n> | Endpoint serves | Method | Payload |\n> |---|---|---|\n> | A **tuned Gemini model** (output of Gemini tuning — the endpoint is already deployed for you) | `:generateContent` | `contents` \u002F `generationConfig` |\n> | A **self-deployed OSS LLM** (Llama, DeepSeek, Qwen, Gemma, Mistral, etc., deployed via Model Garden) | `\u002Fchat\u002Fcompletions` | OpenAI-compatible `messages` |\n> | A **legacy custom model** (classification, regression, custom-trained, embedding) | `:predict` | `instances` \u002F `parameters` |\n>\n> Run `gcloud ai endpoints describe \u003CENDPOINT_ID> --region=\u003CREGION>\n> --format=json` and inspect `deployedModels[].model` to decide:\n> contains `gemini` → tuned Gemini; matches an OSS publisher\n> (`meta\u002F`, `google\u002Fgemma-`, `deepseek-ai\u002F`, `qwen\u002F`, ...) → OSS LLM;\n> otherwise → likely legacy custom.\n>\n> **Axis 2 — endpoint type (shared vs dedicated)** drives the URL host:\n>\n> | `dedicatedEndpointEnabled` | Host |\n> |---|---|\n> | `false` (default — shared endpoint) | `\u003CREGION>-aiplatform.googleapis.com` |\n> | `true` (dedicated endpoint, has its own DNS) | the value of `dedicatedEndpointDns` (format: `\u003CENDPOINT_ID>.\u003CREGION>-\u003CPROJECT_NUM>.prediction.vertexai.goog`) |\n>\n> A dedicated endpoint **cannot** be reached via the shared\n> `\u003CREGION>-aiplatform.googleapis.com` host (per the\n> `Endpoint.dedicated_endpoint_enabled` proto: *\"Once you enabled\n> dedicated endpoint, you won't be able to send request to the shared\n> DNS\"*). Always check `dedicatedEndpointDns` in the describe output:\n> if it's set, use it as the host; otherwise use the shared host.\n>\n> **Path is always\n> `\u002Fv1\u002Fprojects\u002F...\u002Flocations\u002F...\u002Fendpoints\u002F\u003Cid>\u002F...`** on both hosts.\n> Both `\u002Fv1\u002F` (GA) and `\u002Fv1beta1\u002F` (beta) route to the same backend; the\n> recipes in this skill use `\u002Fv1\u002F`. The public\n> [Gemma deployment notebook](https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fvertex-ai-samples\u002Fblob\u002Fmain\u002Fnotebooks\u002Fcommunity\u002Fmodel_garden\u002Fmodel_garden_gemma_deployment_on_vertex.ipynb)\n> still uses `\u002Fv1beta1\u002F`, which also works.\n\n### 4a. REST recipe — tuned Gemini model\n\nOutput of Gemini tuning is always an endpoint that's already deployed for\nyou, reachable on the shared host with `:generateContent`.\n\n```bash\nPROJECT_ID=my-project\nENDPOINT_ID=5875254126916403200\nREGION=us-central1\nTOKEN=$(gcloud auth application-default print-access-token)\n\ncurl -sS -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  \"https:\u002F\u002F${REGION}-aiplatform.googleapis.com\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${REGION}\u002Fendpoints\u002F${ENDPOINT_ID}:generateContent\" \\\n  -d '{\n    \"contents\": [\n      {\"role\": \"user\", \"parts\": [{\"text\": \"Hello! Introduce yourself briefly.\"}]}\n    ],\n    \"generationConfig\": {\n      \"temperature\": 0.2\n    }\n  }'\n```\n\n> [!WARNING]\n>\n> **If you set `maxOutputTokens`, be generous for thinking models.**\n> Gemini 2.5 Pro (and other thinking-enabled models) emit \"thoughts\"\n> tokens that count against `maxOutputTokens` BEFORE any user-visible\n> text. With a small cap (e.g. 100), the entire budget is consumed by\n> thoughts and the response has empty `text` parts but a non-zero\n> `usageMetadata.candidatesTokenCount`.\n>\n> If you don't need to constrain output length, omit `maxOutputTokens`\n> entirely and let the model emit as much as it wants. If you do set\n> it: `>= 512` for any chat-like use, `>= 1024` for a paragraph of\n> output. If you see `finishReason: \"MAX_TOKENS\"` and no `text`\n> content in the response, your cap is too low.\n\n### 4b. REST recipe — self-deployed OSS LLM (Llama, DeepSeek, Qwen, Gemma, etc.)\n\nSelf-deployed OSS LLMs may be on a **shared** or **dedicated** endpoint\ndepending on how the deploy was configured (`dedicated_endpoint_enabled`\nat create time). The recipe below handles both cases by checking\n`dedicatedEndpointDns` in the describe output.\n\n```bash\nPROJECT_ID=my-project\nENDPOINT_ID=5875254126916403200\nREGION=us-central1\nTOKEN=$(gcloud auth application-default print-access-token)\n\n# Step 1: discover host. dedicatedEndpointDns is empty for shared endpoints.\nDEDICATED_DNS=$(gcloud ai endpoints describe \"$ENDPOINT_ID\" \\\n  --project=\"$PROJECT_ID\" --region=\"$REGION\" \\\n  --format=\"value(dedicatedEndpointDns)\")\n\nif [ -n \"$DEDICATED_DNS\" ]; then\n  HOST=\"$DEDICATED_DNS\"\nelse\n  HOST=\"${REGION}-aiplatform.googleapis.com\"\nfi\n\n# Step 2: call \u002Fchat\u002Fcompletions. Path is identical for both hosts.\ncurl -sS -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  \"https:\u002F\u002F${HOST}\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${REGION}\u002Fendpoints\u002F${ENDPOINT_ID}\u002Fchat\u002Fcompletions\" \\\n  -d '{\n    \"messages\": [\n      {\"role\": \"user\", \"content\": \"Hello! Introduce yourself briefly.\"}\n    ]\n  }'\n```\n\n> [!NOTE]\n>\n> -   `max_tokens` (NOT `maxOutputTokens`) — this is OpenAI-compatible\n>     vocabulary, not Vertex. Omit it entirely to let the model emit as\n>     much as it wants; set it explicitly only if you need to cap output.\n> -   The `\"model\"` field in the OpenAI-style payload can be omitted (or\n>     set to `\"\"`) for endpoint deployments — the endpoint already\n>     determines which model serves the request.\n> -   Same endpoint also exposes `\u002Fcompletions` (legacy text completion)\n>     and `\u002Fembeddings` for embedding models.\n> -   **Reasoning models** (DeepSeek-R1, Kimi-K2-Thinking, GLM-5 variants,\n>     etc.) emit thinking tokens that count against `max_tokens` BEFORE\n>     the final answer — same pathology as Gemini 2.5 Pro in section 4a.\n>     If you DO set `max_tokens` and get an empty\n>     `choices[0].message.content` or `finish_reason: \"length\"`, raise it\n>     (>= 1024 for chat, >= 2048 for longer thinking chains) or omit it.\n\nPython equivalent (OpenAI SDK) — mirrors the public\n[Gemma deployment notebook](https:\u002F\u002Fgithub.com\u002FGoogleCloudPlatform\u002Fvertex-ai-samples\u002Fblob\u002Fmain\u002Fnotebooks\u002Fcommunity\u002Fmodel_garden\u002Fmodel_garden_gemma_deployment_on_vertex.ipynb):\n\n```python\nimport google.auth\nfrom google.auth.transport.requests import Request\nimport openai\n\nfrom google.cloud import aiplatform\n\nPROJECT_ID = \"my-project\"\nENDPOINT_ID = \"5875254126916403200\"\nREGION = \"us-central1\"\n\naiplatform.init(project=PROJECT_ID, location=REGION)\nendpoint = aiplatform.Endpoint(\n    f\"projects\u002F{PROJECT_ID}\u002Flocations\u002F{REGION}\u002Fendpoints\u002F{ENDPOINT_ID}\"\n)\nendpoint_resource_name = endpoint.resource_name  # full projects\u002F...\u002Fendpoints\u002F\u003Cid>\ndedicated_dns = endpoint.gca_resource.dedicated_endpoint_dns  # empty if shared\n\nhost = dedicated_dns if dedicated_dns else f\"{REGION}-aiplatform.googleapis.com\"\nbase_url = f\"https:\u002F\u002F{host}\u002Fv1\u002F{endpoint_resource_name}\"\n\nimport subprocess\n\ntoken = subprocess.check_output(\n    [\"gcloud\", \"auth\", \"print-access-token\"]\n).decode(\"utf-8\").strip()\n\nclient = openai.OpenAI(base_url=base_url, api_key=token)\nresponse = client.chat.completions.create(\n    model=\"\",  # endpoint determines the served model\n    messages=[{\"role\": \"user\", \"content\": \"Hello! Introduce yourself briefly.\"}],\n    # Omit max_tokens to let the model emit as much as it wants. Set it\n    # only if you need to cap output length (see notes above).\n)\nprint(response.choices[0].message.content)\n```\n\nSee also: `agent-platform-deploy` skill section 4 \"Verifying Deployment\",\nwhich uses the same pattern post-deploy.\n\n### 4c. REST recipe — legacy `:predict` (custom \u002F classification \u002F embedding)\n\nSame host-discovery logic as 4b (shared or dedicated based on\n`dedicatedEndpointDns`):\n\n```bash\nDEDICATED_DNS=$(gcloud ai endpoints describe \"$ENDPOINT_ID\" \\\n  --project=\"$PROJECT_ID\" --region=\"$REGION\" \\\n  --format=\"value(dedicatedEndpointDns)\")\nHOST=${DEDICATED_DNS:-${REGION}-aiplatform.googleapis.com}\n\ncurl -sS -X POST \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  \"https:\u002F\u002F${HOST}\u002Fv1\u002Fprojects\u002F${PROJECT_ID}\u002Flocations\u002F${REGION}\u002Fendpoints\u002F${ENDPOINT_ID}:predict\" \\\n  -d '{\n    \"instances\": [{\"key\": \"value\"}],\n    \"parameters\": {}\n  }'\n```\n\nThe exact `instances` shape is model-specific; consult the deployed\nmodel's documentation or the Model Garden card it was deployed from.\n\n### 4d. Python (Vertex AI SDK) — tuned Gemini model\n\n```python\nfrom google import genai\nimport google.auth\n\n_, project_id = google.auth.default()\nclient = genai.Client(vertexai=True, project=project_id, location=\"us-central1\")\n\nENDPOINT_ID = \"5875254126916403200\"\nresponse = client.models.generate_content(\n    model=f\"projects\u002F{project_id}\u002Flocations\u002Fus-central1\u002Fendpoints\u002F{ENDPOINT_ID}\",\n    contents=\"Hello! Introduce yourself briefly.\",\n    config={\"temperature\": 0.2},  # add max_output_tokens only if you need a cap\n)\nprint(response.text)\n```\n\n## 5. Troubleshooting & Common Error Codes\n\n### 429: Resource Exhausted\n\n*   **Cause**: OpenMaaS and Gemini models use **Dynamic Shared Quota (DSQ)**.\n    Resources are pooled and allocated dynamically based on availability. A 429\n    error indicates the shared pool is temporarily exhausted, not necessarily\n    that *your* specific project quota is hit (though it can be).\n*   **Solution**: Implement strict **exponential backoff and retry** strategies.\n*   **High Throughput**: For production workloads requiring high throughput or\n    guaranteed capacity, consider **Provisioned Throughput (PT)**.\n*   **Important**: Quota increases through normal cloud processes (Cloud\n    Console) are **NOT** applicable for DSQ constraints.\n*   **Documentation**:\n    [Quotas and limits (DSQ)](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fmodels\u002Fquotas)\n\n### 400: User Validation Error\n\n*   **Cause**: Invalid request format, unsupported parameter, or incorrect Model\n    ID.\n*   **Action**: Double-check your request payload and parameters. Verify the\n    Model ID and Region are correct.\n*   **Custom endpoints**: pick the right method + host per section 4's\n    decision tables:\n    *   Tuned Gemini + you called `:predict` → switch to `:generateContent`\n        (section 4a). Error mentions \"Required instances format mismatch\".\n    *   OSS LLM (Llama\u002FDeepSeek\u002FQwen\u002FGemma\u002Fetc.) + you called\n        `:generateContent` or `:predict` → switch to `\u002Fchat\u002Fcompletions`\n        (section 4b). Error may be 404, 405, or \"method not allowed\".\n    *   Legacy \u002F custom-trained + you called `:generateContent` or\n        `\u002Fchat\u002Fcompletions` → switch to `:predict` (section 4c).\n*   **Dedicated endpoint reached on the shared host (or vice versa)**:\n    *   Symptom: DNS resolution failure (`Could not resolve host`) or 404.\n    *   Cause: dedicated endpoints don't accept traffic on\n        `\u003CREGION>-aiplatform.googleapis.com`, and the dedicated DNS\n        (`*.prediction.vertexai.goog`) only exists when\n        `dedicatedEndpointEnabled` is true.\n    *   Action: re-check `gcloud ai endpoints describe ... --format=json`\n        for the `dedicatedEndpointDns` field; use it iff non-empty (per\n        the host-discovery snippets in section 4b\u002F4c).\n\n### Empty response text on Gemini deployed endpoints\n\n*   **Cause**: `maxOutputTokens` is set too low. Gemini 2.5 Pro and other\n    thinking models emit \"thoughts\" tokens that count against the budget\n    BEFORE any user-visible text. With a small cap (e.g. 100), the entire\n    budget is consumed by thoughts and the response has empty `text` parts\n    but a non-zero `usageMetadata.candidatesTokenCount` and\n    `finishReason: \"MAX_TOKENS\"`.\n*   **Action**: Omit `maxOutputTokens` entirely (let the model emit as much\n    as it wants), or raise it to >= 512 for chat-like use, >= 1024 for\n    longer output. See section 4 \"Custom Endpoints\" for details.\n\n### 404: Not Found \u002F Model Not Available\n\n*   **Cause**: The model is not enabled, or not available in the specified\n    project or region.\n*   **Action**:\n    1.  **Check Location Availability**:\n        *   **OpenMaaS**: Verify the model is available in your region. See\n            [Model Availability by Location](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fresources\u002Flocations#genai-open-models).\n        *   **Gemini**:\n            *   **Source of Truth**: Always check\n                [Gemini Model Locations](https:\u002F\u002Fdocs.cloud.google.com\u002Fgemini-enterprise-agent-platform\u002Fresources\u002Flocations#google-models)\n                for the authoritative list.\n            *   **Preview Models**: All Preview models (e.g., Gemini 3.1,\n                experimental versions) are often **ONLY** available in the\n                `us-central1` or `global` regions.\n            *   **Stable Models**: (e.g., Gemini 2.5 Pro) Available in\n                `us-central1`, `europe-west4`, and many other regions.\n            *   **Important**: If you get a 404\u002F400 error, try switching your\n                client location to `us-central1` or `global`.\n    2.  **Enable Llama Models**: For **Llama 3.3** and **Llama 4**, you **MUST**\n        enable the model in Model Garden before use. Go to the\n        [Model Garden](https:\u002F\u002Fconsole.cloud.google.com\u002Fagent-platform\u002Fmodel-garden),\n        search for the model card (e.g., \"Llama 3.3 API Service\"), and click\n        **Enable**. Only then can you make inference requests.\n",{"name":5,"metadata":50,"description":7},{"version":51,"category":52},"1.0.1","AiAndMachineLearning","main","071c4f7eba880767a647ce778650db8dbf7e16fc","skills\u002Fcloud\u002Fagent-platform-inference",1991,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-11 03:08:50",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add google\u002Fskills --skill agent-platform-inference",{"tool":68,"command":69},"bunx","bunx skills add google\u002Fskills --skill agent-platform-inference",{"tool":71,"command":72},"pnpm","pnpm dlx skills add google\u002Fskills --skill agent-platform-inference","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002FSKILL.md",true,[76,82,88,92,96,100,104,108,112],{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fattribution.md","REFERENCE","参考文档",1946,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Freferences\u002Fattribution.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fgemini_genai_sdk.py","SCRIPT","脚本",505,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fgemini_genai_sdk.py",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"scripts\u002Fgemini_openai_sdk.py",875,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fgemini_openai_sdk.py",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"scripts\u002Fgemini_vertexai_sdk.py",425,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fgemini_vertexai_sdk.py",{"path":97,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fopenmaas_genai_sdk.py",607,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fopenmaas_genai_sdk.py",{"path":101,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fopenmaas_openai_sdk.py",917,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fopenmaas_openai_sdk.py",{"path":105,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fopenmaas_vertexai_sdk.py",527,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fopenmaas_vertexai_sdk.py",{"path":109,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Frequirements.txt",56,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Frequirements.txt",{"path":113,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fverify_all.sh",864,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-inference\u002Fscripts\u002Fverify_all.sh",[117,152,179,208,235,259],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":129,"publishedAt":45},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[123,126],{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[9,130,131,132,133,134,135,136,137,42,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"sign in with google web","sign","with","web","android","go","security","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":165,"publishedAt":45},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[158,159,160],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":161,"categoryName":162,"taxonomyType":163,"taxonomyTypeDesc":164},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[166,167,9,42,168,169,170,171,172,38,143,173,174,175,176,177,178,148,151,27,29],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","browser","loops","at","node","token","pair",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":191,"publishedAt":45},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[185,186,189,190],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":161,"categoryName":162,"taxonomyType":163,"taxonomyTypeDesc":164},[192,193,194,195,42,196,197,198,199,200,201,202,203,29,204,205,206,143,207,144],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":214,"publishedAt":45},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[215,216,217,218,219,220,221,222,140,223,224,225,226,227,228,201,229,230,231,29,232,233,206,234],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":244,"publishedAt":45},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[241,242,243],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":161,"categoryName":162,"taxonomyType":163,"taxonomyTypeDesc":164},[9,245,246,247,248,27,36,249,250,251,252,170,253,254,255,202,256,257,29,258,205],"finding google skills","storage","as","messaging","trade-offs","provider","answer","fit","catalog","up","decision","use","database","candidate",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":267,"publishedAt":45},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[265,266],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[268,269,147,270,9,195,271,42,196,272,273,274,275,29,276,205,143,277,278,279,39],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server"]