fix(zoo-gateway): respect readonly client, real version header, safer fetch

- Stop reassigning RouterProvider.client; thread Zoo enrichment headers
  through openAiHeaders so a single OpenAI client is used.
- Replace npm_package_version (never populated at extension runtime)
  with Package.version from the shared package shim.
- Default the model list to [] on a structurally broken response so we
  log and recover instead of crashing on response.data.data being
  undefined.
- Bypass inFlightRefresh de-duplication for zoo-gateway: a refresh
  triggered after sign-out/sign-in must not return the previous user's
  in-flight response.
- Add fetcher unit tests covering auth header, timeout, error
  redaction, and bad-response handling.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: James Mtendamema

src/api/providers/fetchers/__tests__/zoo-gateway.spec.ts

@@ -0,0 +1,150 @@
+// npx vitest run src/api/providers/fetchers/__tests__/zoo-gateway.spec.ts
+
+import axios from "axios"
+
+import { getZooGatewayModels, parseZooGatewayModel } from "../zoo-gateway"
+
+vitest.mock("axios")
+const mockedAxios = axios as any
+
+describe("Zoo Gateway Fetchers", () => {
+	beforeEach(() => {
+		vitest.clearAllMocks()
+	})
+
+	describe("getZooGatewayModels", () => {
+		const baseUrl = "https://example.test/api/gateway/v1"
+		const token = "zoo_ext_test_token"
+
+		const mockResponse = {
+			data: {
+				object: "list",
+				data: [
+					{
+						id: "anthropic/claude-sonnet-4",
+						object: "model",
+						created: 1640995200,
+						owned_by: "anthropic",
+						name: "Claude Sonnet 4",
+						description: "Sonnet 4",
+						context_window: 200000,
+						max_tokens: 64000,
+						type: "language",
+						pricing: {
+							input: "3.00",
+							output: "15.00",
+							input_cache_write: "3.75",
+							input_cache_read: "0.30",
+						},
+					},
+					{
+						id: "image/dall-e-3",
+						object: "model",
+						created: 1640995200,
+						owned_by: "openai",
+						name: "DALL-E 3",
+						description: "Image",
+						context_window: 4000,
+						max_tokens: 1000,
+						type: "image",
+						pricing: { input: "40.00", output: "0.00" },
+					},
+				],
+			},
+		}
+
+		it("forwards the bearer token and timeout, filters non-language models", async () => {
+			mockedAxios.get.mockResolvedValueOnce(mockResponse)
+
+			const models = await getZooGatewayModels({
+				zooGatewayBaseUrl: baseUrl,
+				zooSessionToken: token,
+			} as any)
+
+			expect(mockedAxios.get).toHaveBeenCalledWith(
+				`${baseUrl}/models`,
+				expect.objectContaining({
+					headers: expect.objectContaining({ Authorization: `Bearer ${token}` }),
+					timeout: expect.any(Number),
+				}),
+			)
+			expect(Object.keys(models)).toHaveLength(1)
+			expect(models["anthropic/claude-sonnet-4"]).toBeDefined()
+		})
+
+		it("omits the Authorization header when no token is provided", async () => {
+			mockedAxios.get.mockResolvedValueOnce(mockResponse)
+
+			await getZooGatewayModels({ zooGatewayBaseUrl: baseUrl } as any)
+
+			const call = mockedAxios.get.mock.calls[0]
+			expect(call[1].headers.Authorization).toBeUndefined()
+		})
+
+		it("returns {} and never leaks the error object when the request fails", async () => {
+			const consoleErrorSpy = vitest.spyOn(console, "error").mockImplementation(() => {})
+			const failure: any = new Error("Network error")
+			// Simulate axios attaching the request config (which contains the bearer token).
+			failure.config = { headers: { Authorization: "Bearer should-never-be-logged" } }
+			failure.code = "ECONNRESET"
+			failure.response = { status: 502, statusText: "Bad Gateway" }
+			mockedAxios.get.mockRejectedValueOnce(failure)
+
+			const models = await getZooGatewayModels({
+				zooGatewayBaseUrl: baseUrl,
+				zooSessionToken: token,
+			} as any)
+
+			expect(models).toEqual({})
+			const logged = consoleErrorSpy.mock.calls.map((args) => String(args[0])).join("\n")
+			expect(logged).toContain("status=502")
+			expect(logged).toContain("code=ECONNRESET")
+			expect(logged).not.toContain("should-never-be-logged")
+			expect(logged).not.toContain("Authorization")
+			consoleErrorSpy.mockRestore()
+		})
+
+		it("returns {} on a structurally broken response instead of throwing", async () => {
+			const consoleErrorSpy = vitest.spyOn(console, "error").mockImplementation(() => {})
+			mockedAxios.get.mockResolvedValueOnce({ data: { unexpected: true } })
+
+			const models = await getZooGatewayModels({
+				zooGatewayBaseUrl: baseUrl,
+				zooSessionToken: token,
+			} as any)
+
+			expect(models).toEqual({})
+			expect(consoleErrorSpy).toHaveBeenCalled()
+			consoleErrorSpy.mockRestore()
+		})
+	})
+
+	describe("parseZooGatewayModel", () => {
+		it("delegates to the vercel-ai-gateway parser", () => {
+			const result = parseZooGatewayModel({
+				id: "anthropic/claude-sonnet-4",
+				model: {
+					id: "anthropic/claude-sonnet-4",
+					object: "model",
+					created: 0,
+					owned_by: "anthropic",
+					name: "Claude Sonnet 4",
+					description: "Sonnet",
+					context_window: 200000,
+					max_tokens: 64000,
+					type: "language",
+					pricing: {
+						input: "3.00",
+						output: "15.00",
+						input_cache_write: "3.75",
+						input_cache_read: "0.30",
+					},
+				} as any,
+			})
+
+			expect(result.contextWindow).toBe(200000)
+			expect(result.maxTokens).toBe(64000)
+			expect(result.supportsPromptCache).toBe(true)
+		})
+	})
+})

src/api/providers/fetchers/modelCache.ts

@@ -176,12 +176,17 @@ export const refreshModels = async (options: GetModelsOptions): Promise<ModelRec
 	// different authenticated user from cache.
 	const shouldSkipCache = provider === "zoo-gateway"
 
-	// Check if there's already an in-flight refresh for this provider
+	// Check if there's already an in-flight refresh for this provider.
 	// This prevents race conditions where multiple concurrent refreshes might
-	// overwrite each other's results
-	const existingRequest = inFlightRefresh.get(provider)
-	if (existingRequest) {
-		return existingRequest
+	// overwrite each other's results. Skip de-duplication for auth-scoped
+	// providers because two concurrent calls may carry different tokens
+	// (e.g., after a sign-out/sign-in within the same session) and we must
+	// not return the first caller's results to the second caller.
+	if (!shouldSkipCache) {
+		const existingRequest = inFlightRefresh.get(provider)
+		if (existingRequest) {
+			return existingRequest
+		}
 	}
 
 	// Create the refresh promise and track it
@@ -229,12 +234,16 @@ export const refreshModels = async (options: GetModelsOptions): Promise<ModelRec
 			return getModelsFromCache(provider) || {}
 		} finally {
 			// Always clean up the in-flight tracking
-			inFlightRefresh.delete(provider)
+			if (!shouldSkipCache) {
+				inFlightRefresh.delete(provider)
+			}
 		}
 	})()
 
-	// Track the in-flight request
-	inFlightRefresh.set(provider, refreshPromise)
+	// Track the in-flight request (auth-scoped providers are excluded; see above).
+	if (!shouldSkipCache) {
+		inFlightRefresh.set(provider, refreshPromise)
+	}
 
 	return refreshPromise
 }

src/api/providers/fetchers/zoo-gateway.ts

@@ -75,7 +75,10 @@ export async function getZooGatewayModels(options?: ApiHandlerOptions): Promise<
 			timeout: MODEL_DISCOVERY_TIMEOUT_MS,
 		})
 		const result = zooGatewayModelsResponseSchema.safeParse(response.data)
-		const data = result.success ? result.data.data : response.data.data
+
+		// Fall back to the raw response only when it looks structurally sound; otherwise return
+		// an empty list rather than crashing on `response.data.data` being undefined.
+		const data = result.success ? result.data.data : Array.isArray(response.data?.data) ? response.data.data : []
 
 		if (!result.success) {
 			console.error(`Zoo Gateway models response is invalid ${JSON.stringify(result.error.format())}`)

src/api/providers/zoo-gateway.ts

@@ -10,6 +10,7 @@ import {
 
 import { ApiHandlerOptions } from "../../shared/api"
 import { getZooCodeBaseUrl } from "../../services/zoo-code-auth"
+import { Package } from "../../shared/package"
 
 import { ApiStream } from "../transform/stream"
 import { convertToOpenAiMessages } from "../transform/openai-format"
@@ -18,8 +19,6 @@ import { addCacheBreakpoints } from "../transform/caching/vercel-ai-gateway"
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata } from "../index"
 import { RouterProvider } from "./router-provider"
 
-import { DEFAULT_HEADERS } from "./constants"
-
 // Extend OpenAI's CompletionUsage to include Zoo Gateway specific fields (same as Vercel AI Gateway)
 interface ZooGatewayUsage extends OpenAI.CompletionUsage {
 	cache_creation_input_tokens?: number
@@ -37,37 +36,26 @@ export class ZooGatewayHandler extends RouterProvider implements SingleCompletio
 			throw new Error("Zoo Gateway requires authentication. Please sign in to Zoo Code first.")
 		}
 
+		// Merge Zoo-specific enrichment headers into openAiHeaders so they flow through
+		// the parent's single OpenAI client. We avoid reassigning `this.client` (which
+		// is declared readonly on RouterProvider) and the wasted client allocation it
+		// caused. Per-request headers (task id / mode) are set in createMessage below.
 		super({
-			options,
+			options: {
+				...options,
+				openAiHeaders: {
+					"X-Zoo-Editor": "vscode",
+					"X-Zoo-Extension-Version": Package.version,
+					...(options.openAiHeaders || {}),
+				},
+			},
 			name: "zoo-gateway",
 			baseURL,
 			apiKey: options.zooSessionToken,
 			modelId: options.zooGatewayModelId,
 			defaultModelId: zooGatewayDefaultModelId,
 			defaultModelInfo: zooGatewayDefaultModelInfo,
 		})
-
-		// Override the client to add Zoo-specific enrichment headers
-		// These headers help with request tracking and analytics
-		const enrichmentHeaders: Record<string, string> = {}
-
-		// Note: These headers will be populated per-request in createMessage
-		// For now we just set static headers that are always available
-		if (typeof process !== "undefined" && process.env?.npm_package_version) {
-			enrichmentHeaders["X-Zoo-Extension-Version"] = process.env.npm_package_version
-		}
-		enrichmentHeaders["X-Zoo-Editor"] = "vscode"
-
-		// Recreate client with enrichment headers
-		;(this as any).client = new OpenAI({
-			baseURL,
-			apiKey: options.zooSessionToken,
-			defaultHeaders: {
-				...DEFAULT_HEADERS,
-				...enrichmentHeaders,
-				...(options.openAiHeaders || {}),
-			},
-		})
 	}
 
 	override async *createMessage(