[ARC345]

Problem

Model discovery for the zed-hosted provider always failed in the dashboard — refreshing the
model list returned 401 Invalid Authorization header and the connection was left with no
catalog.

Root cause

zed-hosted ships models: [] + modelsUrl: "https://cloud.zed.dev/models" in the registry
(open-sse/config/providers/registry/zed-hosted/index.ts), so the route fell through to
deriveConfigFromRegistryModelsUrl(). That generic path hardcodes Authorization: Bearer <accessToken>.

Zed's catalog endpoint does not accept the account access token. It requires an LLM token
minted by POST /client/llm_tokens, which is itself authorized with Zed's own
<userId> <accessToken> scheme — a two-step exchange the generic path cannot express, because
ProviderModelsConfigEntry.buildHeaders is synchronous and the mint is async.

Fix

A dedicated provider === "zed-hosted" branch in src/app/api/providers/[id]/models/route.ts
that reuses the executor's own resolveZedModels() from open-sse/shared/zedAuth.ts — the same
code path the completion executor already uses, so discovery and execution can no longer
disagree about how to authenticate. It handles the providerSpecificData string/object shape,
maps the Zed catalog onto the route's model shape, and on failure degrades to the cached/local
catalog instead of surfacing a raw error.

Validation (Hard Rule #18)

tests/unit/zed-hosted-models-discovery-route.test.ts — 3 cases, verified red before the fix
and green after (fix reverted in place with git checkout HEAD~1 -- <route>, same worktree):

Case	pre-fix	post-fix
mints LLM token, lists live catalog	✖ 401 !== 200	✔
resolves org via /client/users/me when connection has none	✖	✔
degrades to local catalog when Zed rejects the token	✖ 500	✔

The first case asserts the catalog request carries the minted Bearer <llmToken> and never
the account access token — that assertion is what reproduces the reported bug.

Regression suites (zed-*, mitm-handler-zed, provider-models-route,
provider-models-route-codex, provider-models-discovery-split, provider-models-config):
161 / 162 pass. The single failure is provider models route retries Antigravity discovery endpoints before returning remote models, which fails identically with this fix reverted — see
inherited base-red below.

typecheck:core: 8 errors, all in untouched open-sse/ files, none in the changed route.
ESLint on the changed route: 1 error, the pre-existing @/lib/localDb barrel import at line 14
(frozen in config/quality/eslint-suppressions.json). Prettier clean.

⚠️ base-red inherited: #9298

release/v3.8.50 is not green. Two inherited failures show up on this branch and are not
introduced by it:

1. Migration version collision — 134_ccr_blocks.sql vs 134_proxy_logs_egress_ip.sql
   (added by fix(sse): back the CCR block store with a durable tier (#9061) #9198 and fix(db): persist account egress IP into proxy_logs #9291). getMigrationFiles() throws on the collision, so every
   DB-touching unit test aborts before its first assertion. Reproducing the test results above
   required renaming one file locally; that rename is deliberately not part of this PR — per
   the base-green policy a base-red fix belongs in its own freeze-gated
   fix/release-v3.8.50-basereds PR.
2. Antigravity discovery retry test — pre-existing, fails with this fix reverted.

Notes

• The branch was cut from an older base that still carried the 135_/136_ collision fixed by
  f2e36ad; release/v3.8.50 has been merged in, so this branch now only carries the 134_
  collision above.