Describe the bug
Opening Zoo Code provider settings sends unfiltered model-catalog requests to optional third-party providers that the user has not selected or configured. For example, Zoo Code requests GET https://kenari.id/v1/models even when another provider is selected and no Kenari API key exists. This exposes normal connection metadata such as the user IP address to an unrelated provider and can trigger endpoint reputation alerts.
To Reproduce
- Install or update to Zoo Code 3.80.0 with no Kenari configuration.
- Select a provider other than Kenari.
- Monitor extension-host network traffic.
- Open Zoo Code Settings and view the Providers section.
- Observe a request to
https://kenari.id/v1/models.
Expected behavior
Zoo Code should retrieve a dynamic provider model catalog only when that provider is selected, configured, or explicitly refreshed. Selecting another provider must not contact Kenari.
Acceptance criteria
- Provider settings request models only for the currently selected dynamic provider.
- Static providers do not trigger aggregate router-model requests.
- Selecting Kenari still loads its public model catalog.
- A regression test proves an unselected Kenari provider is not requested.
- Provider documentation discloses when the Kenari catalog request occurs.
What version of zoo are you running
3.80.0
Additional context
The extension host already supports provider-filtered requestRouterModels messages, and useSelectedModel already uses that filtered path. ApiOptions currently calls useRouterModels() without a provider, which causes the aggregate request. VS Code recommends user-initiated model access and respecting the selected model: https://code.visualstudio.com/api/extension-guides/ai/language-model
Describe the bug
Opening Zoo Code provider settings sends unfiltered model-catalog requests to optional third-party providers that the user has not selected or configured. For example, Zoo Code requests
GET https://kenari.id/v1/modelseven when another provider is selected and no Kenari API key exists. This exposes normal connection metadata such as the user IP address to an unrelated provider and can trigger endpoint reputation alerts.To Reproduce
https://kenari.id/v1/models.Expected behavior
Zoo Code should retrieve a dynamic provider model catalog only when that provider is selected, configured, or explicitly refreshed. Selecting another provider must not contact Kenari.
Acceptance criteria
What version of zoo are you running
3.80.0
Additional context
The extension host already supports provider-filtered
requestRouterModelsmessages, anduseSelectedModelalready uses that filtered path.ApiOptionscurrently callsuseRouterModels()without a provider, which causes the aggregate request. VS Code recommends user-initiated model access and respecting the selected model: https://code.visualstudio.com/api/extension-guides/ai/language-model