[Improve] Show Zoo Code in outbound provider activity logs (#219)

* improve: update outbound request identity to Zoo Code

* fix: address remaining outbound identity review feedback

* fix: rename remaining Roo→Zoo identity strings

* test(e2e): add outbound identity smoke tests for OpenRouter and Bedrock

---------

Co-authored-by: Roomote <roomote@roocode.com>
Co-authored-by: Elliott de Launay <edelauna@gmail.com>

Author: 3 people

apps/vscode-e2e/fixtures/bedrock.json

@@ -0,0 +1,18 @@
+{
+	"fixtures": [
+		{
+			"match": {
+				"userMessage": "bedrock-identity-smoke"
+			},
+			"response": {
+				"toolCalls": [
+					{
+						"name": "attempt_completion",
+						"arguments": "{\"result\":\"4\"}",
+						"id": "call_bedrock_identity_001"
+					}
+				]
+			}
+		}
+	]
+}

apps/vscode-e2e/fixtures/openrouter.json

@@ -0,0 +1,18 @@
+{
+	"fixtures": [
+		{
+			"match": {
+				"userMessage": "openrouter-identity-smoke"
+			},
+			"response": {
+				"toolCalls": [
+					{
+						"name": "attempt_completion",
+						"arguments": "{\"result\":\"4\"}",
+						"id": "call_openrouter_identity_001"
+					}
+				]
+			}
+		}
+	]
+}

apps/vscode-e2e/src/bedrock-mock-server.ts

@@ -0,0 +1,152 @@
+import * as http2 from "http2"
+import * as net from "net"
+import { crc32 } from "zlib"
+
+export interface BedrockMockServer {
+	url: string
+	/** Headers from the most recent converse-stream request (populated after first call). */
+	lastRequestHeaders: http2.IncomingHttpHeaders | undefined
+	close(): Promise<void>
+}
+
+// AWS binary event stream encoder — matches the real Bedrock wire format.
+// Derived from the live converse-stream capture:
+//   { contentBlockDelta: { contentBlockIndex: 0, delta: { toolUse: { input: "..." } } } }
+// aimock's builder nests the payload one level too deep (contentBlockDelta inside contentBlockDelta),
+// causing the AWS SDK deserializer's take() to miss the delta field entirely.
+function encodeHeaders(headers: Record<string, string>): Buffer {
+	const parts: Buffer[] = []
+	for (const [name, value] of Object.entries(headers)) {
+		const nameBytes = Buffer.from(name, "utf8")
+		const valueBytes = Buffer.from(value, "utf8")
+		const buf = Buffer.alloc(1 + nameBytes.length + 1 + 2 + valueBytes.length)
+		let off = 0
+		buf.writeUInt8(nameBytes.length, off)
+		off += 1
+		nameBytes.copy(buf, off)
+		off += nameBytes.length
+		buf.writeUInt8(7, off)
+		off += 1 // type 7 = string
+		buf.writeUInt16BE(valueBytes.length, off)
+		off += 2
+		valueBytes.copy(buf, off)
+		parts.push(buf)
+	}
+	return Buffer.concat(parts)
+}
+
+function encodeFrame(eventType: string, payload: object): Buffer {
+	const hdrs = encodeHeaders({
+		":content-type": "application/json",
+		":event-type": eventType,
+		":message-type": "event",
+	})
+	const body = Buffer.from(JSON.stringify(payload), "utf8")
+	const total = 12 + hdrs.length + body.length + 4
+	const frame = Buffer.alloc(total)
+	let off = 0
+	frame.writeUInt32BE(total, off)
+	off += 4
+	frame.writeUInt32BE(hdrs.length, off)
+	off += 4
+	frame.writeUInt32BE(crc32(frame.subarray(0, 8)) >>> 0, off)
+	off += 4
+	hdrs.copy(frame, off)
+	off += hdrs.length
+	body.copy(frame, off)
+	off += body.length
+	frame.writeUInt32BE(crc32(frame.subarray(0, total - 4)) >>> 0, off)
+	return frame
+}
+
+function buildToolCallFrames(toolName: string, toolUseId: string, argsJson: string): Buffer[] {
+	const frames: Buffer[] = []
+	frames.push(encodeFrame("messageStart", { role: "assistant" }))
+	frames.push(
+		encodeFrame("contentBlockStart", {
+			contentBlockIndex: 0,
+			start: { toolUse: { name: toolName, toolUseId } },
+		}),
+	)
+	const CHUNK = 20
+	for (let i = 0; i < argsJson.length; i += CHUNK) {
+		frames.push(
+			encodeFrame("contentBlockDelta", {
+				contentBlockIndex: 0,
+				delta: { toolUse: { input: argsJson.slice(i, i + CHUNK) } },
+			}),
+		)
+	}
+	frames.push(encodeFrame("contentBlockStop", { contentBlockIndex: 0 }))
+	frames.push(encodeFrame("messageStop", { stopReason: "tool_use" }))
+	frames.push(
+		encodeFrame("metadata", {
+			metrics: { latencyMs: 1 },
+			usage: { inputTokens: 100, outputTokens: 10, totalTokens: 110, serverToolUsage: {} },
+		}),
+	)
+	return frames
+}
+
+export async function startBedrockMockServer(): Promise<BedrockMockServer> {
+	// HTTP/2 cleartext (h2c) — matches what @aws-sdk/client-bedrock-runtime uses by default.
+	const server = http2.createServer()
+	let lastRequestHeaders: http2.IncomingHttpHeaders | undefined
+	const sessions = new Set<http2.ServerHttp2Session>()
+
+	server.on("session", (session) => {
+		sessions.add(session)
+		session.on("close", () => sessions.delete(session))
+	})
+
+	server.on("stream", (stream, headers) => {
+		const path = headers[":path"] as string
+		const method = headers[":method"] as string
+
+		if (!path?.includes("converse-stream") || method !== "POST") {
+			stream.respond({ ":status": 404 })
+			stream.end(JSON.stringify({ error: { message: "Not found", type: "not_found" } }))
+			return
+		}
+
+		lastRequestHeaders = headers
+
+		// Drain the request body before responding (AWS SDK sends the full request before reading).
+		stream.resume()
+		stream.on("end", () => {
+			stream.respond({
+				":status": 200,
+				"content-type": "application/vnd.amazon.eventstream",
+			})
+			const frames = buildToolCallFrames(
+				"attempt_completion",
+				"tooluse_bedrock_mock_001",
+				JSON.stringify({ result: "4" }),
+			)
+			for (const frame of frames) {
+				stream.write(frame)
+			}
+			stream.end()
+		})
+	})
+
+	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
+	const addr = server.address() as net.AddressInfo
+	const url = `http://127.0.0.1:${addr.port}`
+
+	return {
+		url,
+		get lastRequestHeaders() {
+			return lastRequestHeaders
+		},
+		close: () => {
+			// Destroy all open HTTP/2 sessions first so server.close() resolves immediately
+			// instead of waiting for the extension's retry loop to exhaust itself.
+			for (const session of sessions) {
+				session.destroy()
+			}
+			sessions.clear()
+			return new Promise<void>((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())))
+		},
+	}
+}

apps/vscode-e2e/src/runTest.ts

@@ -26,12 +26,21 @@ function isDeepSeekTargetedRun(testFile?: string, testGrep?: string) {
 	return testGrep?.toLowerCase().includes("deepseek") ?? false
 }
 
+function isBedrockTargetedRun(testFile?: string, testGrep?: string) {
+	if (testFile?.toLowerCase().includes("bedrock.test")) {
+		return true
+	}
+
+	return testGrep?.toLowerCase().includes("bedrock") ?? false
+}
+
 async function main() {
 	const isRecord = process.env.AIMOCK_RECORD === "true"
 	const testGrep = getCliFlagValue("--grep") || process.env.TEST_GREP
 	const testFile = getCliFlagValue("--file") || process.env.TEST_FILE
 	const isDeepSeekTest = isDeepSeekTargetedRun(testFile, testGrep)
 	const isGeminiTest = testFile?.toLowerCase().includes("gemini.test") ?? false
+	const isBedrockTest = isBedrockTargetedRun(testFile, testGrep)
 
 	if (isRecord && isDeepSeekTest && !process.env.DEEPSEEK_API_KEY) {
 		throw new Error("AIMOCK_RECORD=true requires DEEPSEEK_API_KEY to record DeepSeek fixtures")
@@ -49,7 +58,9 @@ async function main() {
 	// Replay mode starts aimock when no real API key is present or USE_MOCK is forced.
 	const hasRealApiKey = isDeepSeekTest
 		? !!process.env.DEEPSEEK_API_KEY
-		: !!(process.env.OPENROUTER_API_KEY || process.env.ANTHROPIC_API_KEY)
+		: isBedrockTest
+			? true // Bedrock test starts its own binary-event-stream mock server when no real token
+			: !!(process.env.OPENROUTER_API_KEY || process.env.ANTHROPIC_API_KEY)
 	const useMock = isRecord || !hasRealApiKey || process.env.USE_MOCK === "true"
 
 	let mock: InstanceType<typeof LLMock> | undefined

apps/vscode-e2e/src/suite/providers/bedrock.test.ts

@@ -0,0 +1,94 @@
+import * as assert from "assert"
+
+import { startBedrockMockServer, type BedrockMockServer } from "../../bedrock-mock-server"
+import { setDefaultSuiteTimeout } from "../test-utils"
+import { waitUntilCompleted } from "../utils"
+
+const AWS_BEARER_TOKEN_BEDROCK = process.env.AWS_BEARER_TOKEN_BEDROCK
+const BEDROCK_REGION = process.env.BEDROCK_REGION ?? "us-east-1"
+// Use a cross-region inference profile so the token works without per-region model access.
+const BEDROCK_MODEL_ID = process.env.BEDROCK_MODEL_ID ?? "us.anthropic.claude-haiku-4-5-20251001-v1:0"
+const BEDROCK_LIVE_E2E = process.env.BEDROCK_LIVE_E2E === "true"
+
+suite("Bedrock provider", function () {
+	setDefaultSuiteTimeout(this)
+	this.timeout(3 * 60_000)
+
+	let mockServer: BedrockMockServer | undefined
+
+	suiteSetup(async function () {
+		const aimockUrl = process.env.AIMOCK_URL
+
+		if (!aimockUrl && BEDROCK_LIVE_E2E && AWS_BEARER_TOKEN_BEDROCK) {
+			// Live mode — explicitly opted into real AWS credentials, no aimock intercepting traffic.
+			await globalThis.api.setConfiguration({
+				apiProvider: "bedrock" as const,
+				awsUseApiKey: true,
+				awsApiKey: AWS_BEARER_TOKEN_BEDROCK,
+				awsRegion: BEDROCK_REGION,
+				apiModelId: BEDROCK_MODEL_ID,
+			})
+		} else {
+			// Mock mode — use our custom binary-event-stream server because aimock's
+			// converse-stream builder nests payloads one level too deep, causing the AWS SDK
+			// deserializer to drop the delta field (take() reads top-level only).
+			mockServer = await startBedrockMockServer()
+			await globalThis.api.setConfiguration({
+				apiProvider: "bedrock" as const,
+				awsUseApiKey: true,
+				awsApiKey: "mock-key",
+				awsRegion: BEDROCK_REGION,
+				apiModelId: BEDROCK_MODEL_ID,
+				awsBedrockEndpoint: mockServer.url,
+				awsBedrockEndpointEnabled: true,
+			})
+		}
+	})
+
+	suiteTeardown(async () => {
+		// Restore the default provider first so the extension stops using the Bedrock
+		// endpoint. Only then close the mock server — closing it first leaves any
+		// in-flight retry loop hitting ECONNREFUSED and the after-all hook times out.
+		const aimockUrl = process.env.AIMOCK_URL
+		const isRecord = process.env.AIMOCK_RECORD === "true"
+		await globalThis.api.setConfiguration({
+			apiProvider: "openrouter" as const,
+			openRouterApiKey: aimockUrl && !isRecord ? "mock-key" : process.env.OPENROUTER_API_KEY!,
+			openRouterModelId: "openai/gpt-4.1",
+			...(aimockUrl && { openRouterBaseUrl: `${aimockUrl}/v1` }),
+		})
+
+		if (mockServer) {
+			// Brief pause so the extension picks up the provider switch before the
+			// h2c listener closes.
+			await new Promise<void>((resolve) => setTimeout(resolve, 500))
+			await mockServer.close()
+			mockServer = undefined
+		}
+	})
+
+	test("Should complete a task end-to-end via AWS Bedrock with ZooCode# user-agent", async () => {
+		const api = globalThis.api
+		const taskId = await api.startNewTask({
+			configuration: { mode: "ask", autoApprovalEnabled: true },
+			text: "bedrock-identity-smoke: what is 2+2? Reply with only the number.",
+		})
+
+		await waitUntilCompleted({ api, taskId })
+
+		if (mockServer) {
+			// Verify the AWS SDK transmitted the ZooCode# userAgentAppId.
+			// In Node.js mode the SDK appends "app/<appId>" to the full sdkUserAgentValue
+			// and writes it to the "user-agent" header. The "x-amz-user-agent" header only
+			// carries aws-sdk-* segments and never contains the app ID.
+			const userAgent = mockServer.lastRequestHeaders?.["user-agent"] as string | undefined
+			assert.ok(userAgent, "Bedrock request should include user-agent header")
+			assert.ok(userAgent.includes("ZooCode#"), `user-agent should contain "ZooCode#" — got: ${userAgent}`)
+		} else {
+			// Live mode: a successful round-trip proves the identity change didn't break
+			// SDK auth or request formation. The x-amzn-user-agent header is not visible
+			// to us without intercepting at the TLS layer.
+			assert.ok(true, "Task completed successfully via Bedrock with ZooCode# userAgentAppId")
+		}
+	})
+})