fix: use x-goog-api-key header instead of URL query param for Gemini API

[continue]

Summary

This PR fixes a security issue where the Gemini API key was being passed as a URL query parameter when fetching available models, and also fixes a CI failure caused by a deprecated Anthropic model.

Changes

1. Security Fix: Gemini API Key Exposure (Medium Severity)

File: core/llm/fetchModels.ts:181-182

Before (Insecure)

const url = new URL("models", base);
url.searchParams.set("key", apiKey ?? "");
const response = await fetch(url);

After (Secure)

const url = new URL("models", base);
const response = await fetch(url, {
  headers: {
    "x-goog-api-key": apiKey ?? "",
  },
});

Why This Matters

API keys in URL query strings can be exposed through:

• Server access logs
• Browser history
• HTTP Referer headers
• Proxy logs
• Error reporting services

The x-goog-api-key header is the secure method used elsewhere in this codebase (see packages/openai-adapters/src/apis/Gemini.ts) and is the recommended authentication method for Google APIs.

2. CI Fix: Update Deprecated Anthropic Model

File: extensions/cli/src/smoke-api/smoke-api-helpers.ts

Updated the default smoke test model from claude-3-haiku-20240307 (deprecated, returns not_found_error) to claude-3-5-haiku-latest.

---

Generated with Continue

Co-authored-by: bekah-hawrot-weigel bekah@continue.dev

[continue]

Docs Review

No documentation updates needed for this PR.

Reason: This is an internal security fix that changes how the Gemini API key is transmitted (from URL query parameter to x-goog-api-key header). This implementation detail is not exposed to users—they still configure their API key the same way, and there are no changes to user-facing configuration, behavior, or setup steps.

Good security improvement! 🔐

[cubic-dev-ai]

No issues found across 1 file

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="extensions/cli/src/smoke-api/smoke-api-helpers.ts">

<violation number="1" location="extensions/cli/src/smoke-api/smoke-api-helpers.ts:51">
P3: The fallback-model comment no longer matches the actual default value, which can mislead future maintenance and debugging.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}