fix: address observability review comments

Author: doctarock

src/core/task/Task.ts

@@ -3156,6 +3156,8 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 									cost: tokens.total ?? costResult.totalCost,
 								})
 
+								const mode = await this.getTaskMode().catch(() => defaultModeSlug)
+
 								// Zoo Code observability telemetry
 								import("../../services/zoo-telemetry")
 									.then(({ sendLlmTelemetry }) =>
@@ -3165,7 +3167,7 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 											model: this.apiConfiguration
 												? (getModelId(this.apiConfiguration) ?? "unknown")
 												: "unknown",
-											mode: this.taskMode,
+											mode,
 											inputTokens: costResult.totalInputTokens,
 											outputTokens: costResult.totalOutputTokens,
 											cacheReadTokens: tokens.cacheRead ?? 0,

src/core/webview/ClineProvider.ts

@@ -2166,6 +2166,35 @@ export class ClineProvider
 		const mergedDeniedCommands = this.mergeDeniedCommands(deniedCommands)
 		const cwd = this.cwd
 		const currentTask = this.getCurrentTask()
+		let zooCodeState: {
+			zooCodeIsAuthenticated: boolean
+			zooCodeUserName: string | undefined
+			zooCodeUserEmail: string | undefined
+			zooCodeUserImage: string | undefined
+			zooCodeBaseUrl: string
+		} = {
+			zooCodeIsAuthenticated: false,
+			zooCodeUserName: undefined,
+			zooCodeUserEmail: undefined,
+			zooCodeUserImage: undefined,
+			zooCodeBaseUrl: "https://www.zoocode.dev",
+		}
+
+		try {
+			const { isZooCodeAuthenticated, getCachedZooCodeUserInfo, getZooCodeBaseUrl } = await import(
+				"../../services/zoo-code-auth"
+			)
+			const userInfo = getCachedZooCodeUserInfo()
+			zooCodeState = {
+				zooCodeIsAuthenticated: await isZooCodeAuthenticated(),
+				zooCodeUserName: userInfo?.name,
+				zooCodeUserEmail: userInfo?.email,
+				zooCodeUserImage: userInfo?.image,
+				zooCodeBaseUrl: getZooCodeBaseUrl(),
+			}
+		} catch {
+			// Keep unauthenticated defaults if the optional auth service is unavailable.
+		}
 
 		return {
 			version: this.context.extension?.packageJSON?.version ?? "",
@@ -2289,33 +2318,7 @@ export class ClineProvider
 					return false
 				}
 			})(),
-			zooCodeIsAuthenticated: await (async () => {
-				try {
-					const { isZooCodeAuthenticated } = await import("../../services/zoo-code-auth")
-					return await isZooCodeAuthenticated()
-				} catch {
-					return false
-				}
-			})(),
-			...(() => {
-				try {
-					const { getCachedZooCodeUserInfo, getZooCodeBaseUrl } = require("../../services/zoo-code-auth")
-					const userInfo = getCachedZooCodeUserInfo()
-					return {
-						zooCodeUserName: userInfo.name,
-						zooCodeUserEmail: userInfo.email,
-						zooCodeUserImage: userInfo.image,
-						zooCodeBaseUrl: getZooCodeBaseUrl(),
-					}
-				} catch {
-					return {
-						zooCodeUserName: undefined,
-						zooCodeUserEmail: undefined,
-						zooCodeUserImage: undefined,
-						zooCodeBaseUrl: "https://www.zoocode.dev",
-					}
-				}
-			})(),
+			...zooCodeState,
 			debug: vscode.workspace.getConfiguration(Package.name).get<boolean>("debug", false),
 		}
 	}

src/services/__tests__/zoo-code-auth.test.ts

@@ -8,6 +8,7 @@ import {
 	setZooCodeToken,
 	clearZooCodeToken,
 	getZooCodeBaseUrl,
+	handleAuthCallback,
 } from "../zoo-code-auth"
 
 // Mock vscode
@@ -20,6 +21,17 @@ vi.mock("vscode", () => ({
 			}),
 		})),
 	},
+	window: {
+		showErrorMessage: vi.fn(),
+		showInformationMessage: vi.fn(),
+	},
+	env: {
+		asExternalUri: vi.fn(async (uri: any) => uri),
+		openExternal: vi.fn(),
+	},
+	Uri: {
+		parse: vi.fn((value: string) => ({ toString: () => value })),
+	},
 }))
 
 // Mock fetch
@@ -190,6 +202,43 @@ describe("zoo-code-auth subscription checking", () => {
 		})
 	})
 
+	describe("handleAuthCallback", () => {
+		it("does not persist invalid prefixed tokens", async () => {
+			await initZooCodeAuth(mockContext)
+
+			mockFetch.mockResolvedValueOnce({
+				ok: true,
+				json: async () => ({ valid: false }),
+			})
+
+			const success = await handleAuthCallback("zoo_ext_fake_token")
+
+			expect(success).toBe(false)
+			expect(getCachedZooCodeToken()).toBe("")
+			expect(mockSecrets.store).not.toHaveBeenCalledWith("zoo-code-session-token", "zoo_ext_fake_token")
+		})
+
+		it("persists token only after backend verification succeeds", async () => {
+			await initZooCodeAuth(mockContext)
+
+			mockFetch
+				.mockResolvedValueOnce({
+					ok: true,
+					json: async () => ({ valid: true }),
+				})
+				.mockResolvedValueOnce({
+					ok: true,
+					json: async () => ({ isSubscriber: true }),
+				})
+
+			const success = await handleAuthCallback("zoo_ext_real_token")
+
+			expect(success).toBe(true)
+			expect(getCachedZooCodeToken()).toBe("zoo_ext_real_token")
+			expect(mockSecrets.store).toHaveBeenCalledWith("zoo-code-session-token", "zoo_ext_real_token")
+		})
+	})
+
 	describe("clearZooCodeToken", () => {
 		it("should reset subscription status when token is cleared", async () => {
 			await initZooCodeAuth(mockContext)

src/services/zoo-code-auth.ts

@@ -206,7 +206,9 @@ export async function startZooCodeAuth(): Promise<void> {
 	const editor = "VS Code"
 	const version = Package.version
 
-	const callbackUri = await vscode.env.asExternalUri(vscode.Uri.parse("vscode://zoo-code.zoo-code/auth-callback"))
+	const callbackUri = await vscode.env.asExternalUri(
+		vscode.Uri.parse(`vscode://${Package.publisher}.${Package.name}/auth-callback`),
+	)
 
 	const authUrl = `${baseUrl}/dashboard/connect?device=${encodeURIComponent(deviceName)}&editor=${encodeURIComponent(editor)}&version=${encodeURIComponent(version)}&callback_uri=${encodeURIComponent(callbackUri.toString())}`
 
@@ -219,6 +221,12 @@ export async function handleAuthCallback(token: string): Promise<boolean> {
 		return false
 	}
 
+	const isValid = await verifyZooCodeTokenValue(token)
+	if (!isValid) {
+		vscode.window.showErrorMessage("Zoo Code: Authentication failed. Please try signing in again.")
+		return false
+	}
+
 	await setZooCodeToken(token)
 
 	// Check subscription status after successful auth
@@ -236,21 +244,27 @@ export async function verifyZooCodeToken(): Promise<boolean> {
 
 	const baseUrl = getZooCodeBaseUrl()
 
+	const isValid = await verifyZooCodeTokenValue(token, baseUrl)
+	if (!isValid) {
+		await clearZooCodeToken()
+		return false
+	}
+
+	return true
+}
+
+async function verifyZooCodeTokenValue(token: string, baseUrl = getZooCodeBaseUrl()): Promise<boolean> {
 	try {
 		const response = await fetch(`${baseUrl}/api/extension/auth/verify`, {
 			headers: { Authorization: `Bearer ${token}` },
 			signal: AbortSignal.timeout(10_000),
 		})
 
 		if (!response.ok) {
-			await clearZooCodeToken()
 			return false
 		}
 
 		const data = (await response.json()) as { valid?: boolean }
-		if (!data.valid) {
-			await clearZooCodeToken()
-		}
 		return data.valid === true
 	} catch {
 		return false

src/services/zoo-telemetry.ts

@@ -48,7 +48,7 @@ export async function sendLlmTelemetry(payload: LlmTelemetryPayload): Promise<vo
 		editor: "vscode",
 	}
 
-	await fetch(`${baseUrl}/api/observability/events`, {
+	void fetch(`${baseUrl}/api/observability/events`, {
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",