fix(zoo-gateway): dynamic dashboard URL and cached-token fallback

- Resolve ModelPicker serviceUrl from zooCodeBaseUrl so staging/dev
  environments link to the matching dashboard.
- Fall back to getCachedZooCodeToken() in the handler and model fetcher
  when the profile has not been seeded yet (auth before webview open).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: James Mtendamema

src/api/providers/fetchers/__tests__/zoo-gateway.spec.ts

@@ -5,6 +5,10 @@ import axios from "axios"
 import { getZooGatewayModels, parseZooGatewayModel } from "../zoo-gateway"
 
 vitest.mock("axios")
+vitest.mock("../../../../services/zoo-code-auth", () => ({
+	getCachedZooCodeToken: vitest.fn(() => ""),
+	getZooCodeBaseUrl: vitest.fn(() => "https://example.test"),
+}))
 const mockedAxios = axios as any
 
 describe("Zoo Gateway Fetchers", () => {

src/api/providers/fetchers/zoo-gateway.ts

@@ -3,7 +3,7 @@ import axios from "axios"
 import type { ModelInfo } from "@roo-code/types"
 
 import type { ApiHandlerOptions } from "../../../shared/api"
-import { getZooCodeBaseUrl } from "../../../services/zoo-code-auth"
+import { getCachedZooCodeToken, getZooCodeBaseUrl } from "../../../services/zoo-code-auth"
 
 // Reuse the same schemas and parsing logic from vercel-ai-gateway since the API format is identical
 import { type VercelAiGatewayModel, parseVercelAiGatewayModel } from "./vercel-ai-gateway"
@@ -63,10 +63,12 @@ export async function getZooGatewayModels(options?: ApiHandlerOptions): Promise<
 	const models: Record<string, ModelInfo> = {}
 	const baseURL = options?.zooGatewayBaseUrl ?? `${getZooCodeBaseUrl()}/api/gateway/v1`
 
-	// Build headers - Zoo Gateway requires authentication via the zoo_ext_ session token
+	// Build headers - Zoo Gateway requires authentication via the zoo_ext_ session token.
+	// Fall back to the secret-storage cache when the profile hasn't been seeded yet.
+	const sessionToken = options?.zooSessionToken || getCachedZooCodeToken()
 	const headers: Record<string, string> = {}
-	if (options?.zooSessionToken) {
-		headers["Authorization"] = `Bearer ${options.zooSessionToken}`
+	if (sessionToken) {
+		headers["Authorization"] = `Bearer ${sessionToken}`
 	}
 
 	try {

src/api/providers/zoo-gateway.ts

@@ -9,7 +9,7 @@ import {
 } from "@roo-code/types"
 
 import { ApiHandlerOptions } from "../../shared/api"
-import { getZooCodeBaseUrl } from "../../services/zoo-code-auth"
+import { getCachedZooCodeToken, getZooCodeBaseUrl } from "../../services/zoo-code-auth"
 import { Package } from "../../shared/package"
 
 import { ApiStream } from "../transform/stream"
@@ -29,10 +29,11 @@ export class ZooGatewayHandler extends RouterProvider implements SingleCompletio
 	constructor(options: ApiHandlerOptions) {
 		const baseURL = options.zooGatewayBaseUrl ?? `${getZooCodeBaseUrl()}/api/gateway/v1`
 
-		// Fail fast with a clear message instead of waiting for a 401.
-		// The token is set automatically by handleZooCodeCallback() after the user
-		// authenticates via the "Sign in with Zoo Code" flow in the extension.
-		if (!options.zooSessionToken) {
+		// Prefer the profile-persisted token; fall back to the secret-storage cache so
+		// requests work when the user is signed in but the profile hasn't been seeded yet
+		// (e.g. auth callback arrived before any webview instance was open).
+		const sessionToken = options.zooSessionToken || getCachedZooCodeToken()
+		if (!sessionToken) {
 			throw new Error("Zoo Gateway requires authentication. Please sign in to Zoo Code first.")
 		}
 
@@ -51,7 +52,7 @@ export class ZooGatewayHandler extends RouterProvider implements SingleCompletio
 			},
 			name: "zoo-gateway",
 			baseURL,
-			apiKey: options.zooSessionToken,
+			apiKey: sessionToken,
 			modelId: options.zooGatewayModelId,
 			defaultModelId: zooGatewayDefaultModelId,
 			defaultModelInfo: zooGatewayDefaultModelInfo,

webview-ui/src/components/settings/providers/ZooGateway.tsx

@@ -33,6 +33,9 @@ export const ZooGateway = ({
 		useExtensionState()
 
 	const authUrl = getZooCodeAuthUrl(uriScheme, zooCodeBaseUrl, deviceName)
+	// Resolve the dashboard link off the same base URL the auth/gateway flow uses,
+	// so non-prod environments (staging/dev) point at the matching dashboard.
+	const resolvedDashboardBase = zooCodeBaseUrl?.replace(/\/$/, "") || "https://www.zoocode.dev"
 
 	return (
 		<>
@@ -73,7 +76,7 @@ export const ZooGateway = ({
 				models={routerModels?.["zoo-gateway"] ?? {}}
 				modelIdKey="zooGatewayModelId"
 				serviceName="Zoo Gateway"
-				serviceUrl="https://www.zoocode.dev/dashboard/models"
+				serviceUrl={`${resolvedDashboardBase}/dashboard/models`}
 				organizationAllowList={organizationAllowList}
 				errorMessage={modelValidationError}
 				simplifySettings={simplifySettings}