[Bug] Linux: POST /api/v1/oauth/token returns 500 {"code":2007,"msg":"http error"} on every authorization-code exchange — desktop login impossible

提交前确认 · Pre-submission checklist

• 我已搜索过现有 issue，确认这不是重复 / I searched existing issues and confirmed this isn't a duplicate. (Closest is #116, deliberately distinguished below.)
• 我已阅读 CONTRIBUTING.md / I've read CONTRIBUTING.md.

问题类别 · Category

账号 / 登录 · Account / Login

涉及的 Agent 框架 · Agent framework

不涉及框架 · Not framework-specific

严重程度 · Severity

阻塞使用 · Blocking (无法使用核心功能 / core function unusable)

复现频率 · Reproducibility

必现 · Always

问题描述 · Description

On Linux, POST https://zcode.z.ai/api/v1/oauth/token returns HTTP 500 with body
{"code":2007,"msg":"http error"} for every OAuth authorization-code exchange, so desktop
login can never complete. 7 attempts today, 7 × 500, 0 successes.

This is not #116. There, the first token exchange succeeds (code 0) and the business-token
step fails with zai_oauth_required. Here the first exchange itself 500s, so
exchangeBusinessToken is never reached with a valid token.

Deep-link handling is confirmed healthy on this machine: the zcode://oauth/callback URL routes to
the correct window and the OAuth state validates. The flow dies solely on the server's response.

Notable: the same 500 + code 2007 is returned for a deliberately invalid code, where
400 invalid_grant would be expected. That suggests an unhandled exception in the handler rather
than credential rejection — "http error" reads like a failed internal upstream call.

复现步骤 · Steps to reproduce

1. Install ZCode 3.11.2 .deb on Linux; ensure only one install is present.
2. Launch /opt/ZCode/zcode as a normal user (not sudo).
3. Click "Connect to Z.ai" and complete Google sign-in in the browser.
4. Browser reports authorization successful and hands back to zcode://oauth/callback.
5. Observe in ~/.zcode/v2/logs/<date>.log that the callback routes correctly and the state matches.
6. Observe the token POST return 500 and login fail.

Also reproducible without any account, straight from the shell:

curl -X POST https://zcode.z.ai/api/v1/oauth/token -H 'Content-Type: application/json' \
  -d '{"provider":"zai","code":"probe","state":"p","redirect_uri":"https://zcode.z.ai/app/oauth/login?redirect=zcode%3A%2F%2Foauth%2Fcallback&app_version=3.11.2"}'
→ HTTP 500  {"code":2007,"msg":"http error"}

期望表现 · Expected behavior

The token endpoint exchanges a valid authorization code for a token set and login completes.
An invalid code should return a 4xx OAuth error, not 500.

实际表现 · Actual behavior

Every exchange returns HTTP 500 {"code":2007,"msg":"http error"}; the app stays logged out.
API-key login works, so the account and the network path are both fine.

ZCode 版本 · ZCode version

v3.11.2 (3.11.2-6792) [.deb]

设备 / 系统 / 浏览器 · Device / OS / Browser

Linux (Ubuntu-based), x64, Google Chrome as system browser

截图 / 录屏 / 日志 · Screenshots / Recordings / Logs

Two representative attempts (redacted codes, log timestamps local):

[deep-link] OAuth 回调路由成功 {"state":"cf54c5d0…","windowId":1,"provider":"zai","completed":true}
[zaiOAuth]  token request  {"method":"POST","url":"https://zcode.z.ai/api/v1/oauth/token",
             "body":{"provider":"zai","code":"code...4440","codeLength":17,
             "redirect_uri":"https://zcode.z.ai/app/oauth/login?redirect=zcode%3A%2F%2Foauth%2Fcallback&app_version=3.11.2",
             "state":"cf54c5d0…"}}
[zaiOAuth]  token response error {"status":500,"x-request-id":"20260904233304e2a6cb523d69f5438922"}
oauth.handleCallback FAIL {"name":"ApiError","message":"http error"}

x-request-ids for server-side tracing (all HTTP 500 on /api/v1/oauth/token):

#	x-request-id	note
1	202609041621175609c477aa7f0a897621	real login attempt
2	20260904162144614ba4361564e7d677ff	real login attempt
3	20260904162257f44d669f5923c2e0caf3	real login attempt
4	202609041623512e0af380475dc293015c	real login attempt
5	202609041628280b4715c68da127e93d97	real login attempt
6	202609042332195d3f3275cea7aa1fec28	state verified matching
7	20260904233304e2a6cb523d69f5438922	state verified matching
8	202609042334469f8f42aedfaa95c34087	invalid code — still 500, expected 4xx

Connectivity ruled out: zcode.z.ai is IPv4-only here and answers in 28 ms; the 500 is a real
server response carrying an x-request-id, not a transport failure.

---

Separate note for maintainers, in case it helps others on Linux: before reaching this, login
failed earlier with OAuth state 不匹配或已过期. Cause was three colliding installs (deb +
AppImage + a hand-copied AppImage at /usr/bin/zcode) sharing ~/.config/ZCode, so
xdg-open zcode:// launched a different binary than the running instance and the callback was
handed to a stale singleton owner. Consolidating to one install fixed that. It may be worth
having the app warn when the registered x-scheme-handler/zcode target differs from
process.execPath.

Start by reproducing the POST /api/v1/oauth/token failure with the provided curl request, then correlate the returned x-request-id values with server-side logs. Verify the authorization-code exchange for valid codes and the 4xx response for invalid codes; done means Linux desktop login completes successfully without the HTTP 500 response.