GLM Coding Plan login broken: POST /api/v1/oauth/token returns HTTP 500 {"code":2007,"msg":"http error"} for ALL code exchanges (incl. invalid codes) — ZCode Desktop 3.11.2, Linux

Summary

Sign-in to the GLM Coding Plan from ZCode Desktop fails on every attempt. Browser authentication completes ("Sign-In Complete"), the zcode://oauth/callback deep link is routed correctly and the OAuth state matches, but the app's exchange request POST https://zcode.z.ai/api/v1/oauth/token receives HTTP 500 with empty body, and the UI shows "Login failed, please try again".

The endpoint appears broken server-side for all code-exchange attempts, not account-specific: a minimal curl reproduction with an obviously invalid code returns the same 500, while parameter validation still works (empty body → clean 400).

Environment

• ZCode Desktop 3.11.2, official .deb (zcode 3.11.2-6792), single installation, Linux
• Debian 13 (kernel 6.12.0-1-amd64, x64), no proxy, zcode.z.ai reachable, normal TLS
• z.ai API-key mode works fine on the same machine/network — only coding-plan OAuth fails
• Account has an active paid subscription (details shared privately via user_feedback@z.ai)

Reproduction A — in-app

1. Settings → connect GLM Coding Plan (z.ai global) → Login
2. Complete browser sign-in ("Sign-In Complete")
3. Redirect to zcode://oauth/callback arrives, state matches (app log: OAuth 回调路由成功 ... completed: true)
4. App sends POST https://zcode.z.ai/api/v1/oauth/token → HTTP 500 → "Login failed, please try again"

Happens on 100% of attempts today (2026-09-08, ~15+ attempts between 13:27 and 14:45 UTC+3).

Reproduction B — minimal curl, no account, no client

curl -sS -X POST -H "Content-Type: application/json" \
  -d '{"provider":"zai","code":"AAAAAAAAAAAAAAAAA","codeLength":17,"redirect_uri":"https://zcode.z.ai/app/oauth/login?redirect=zcode%3A%2F%2Foauth%2Fcallback&app_version=3.11.2","state":"00000000000000000000000000000000"}' \
  https://zcode.z.ai/api/v1/oauth/token

Actual result:

HTTP 500
{"code":2007,"msg":"http error"}

Expected: a clean 4xx (e.g. invalid_code / invalid_grant) for a garbage code.

Control case showing the endpoint itself is alive and validates parameters:

curl -sS -X POST -H "Content-Type: application/json" -d '{}' https://zcode.z.ai/api/v1/oauth/token
# HTTP 400 {"code":3001,"msg":"parameter error"}

So the failure (error code 2007, "http error") sits in the exchange handling — likely an upstream call from the API failing — before any account or code validation.

Server request IDs from real login attempts

• 2026090811450158b0f7ab82adc6c4d9ba — 2026-09-08 11:45:02 UTC
• 20260908113701813e652be62b2ecacc9d — 2026-09-08 11:37:01 UTC

Client log evidence (2026-09-08 14:45 UTC+3)

[oauthService][trace:OAuth polling flow started] {"expiresInMs":299516,"pollIntervalMs":2000,"provider":"zai"}
[deep-link] OAuth 回调路由成功 { state: '5aa97af1…', windowId: 1, provider: 'zai', completed: true }
[zaiOAuth] token request {"method":"POST","url":"https://zcode.z.ai/api/v1/oauth/token","headers":{"Content-Type":"application/json"},"body":{"provider":"zai","code":"code…2ebd","codeLength":17,"redirect_uri":"https://zcode.z.ai/app/oauth/login?redirect=zcode%3A%2F%2Foauth%2Fcallback&app_version":"3.11.2","state":"5aa97af1…"}}
[zaiOAuth] token response error {"method":"POST","url":"https://zcode.z.ai/api/v1/oauth/token","status":500,"responseHeaders":{"x-request-id":"2026090811450158b0f7ab82adc6c4d9ba"}}
[rpc:call] oauth.handleCallback FAIL (667.4ms) {"name":"ApiError","message":"http error", …}

Notes

• Possibly related: #116 — but that report's token response succeeded (code 0) and the failure was in ZaiBusinessTokenResolver.exchangeBusinessToken; here the token endpoint itself 500s for everyone, which may be the upstream cause of that symptom.
• Earlier "OAuth state mismatch" failures were caused by a coexisting AppImage + .deb fighting over the zcode:// handler; resolved by removing the AppImage. The HTTP 500 is independent of that and remains.

Happily provide full logs or run any server-side-adjacent diagnostics you need.

No repository files or tests are identified in the report. Start by reproducing the POST /api/v1/oauth/token behavior with the supplied curl cases and use the request IDs to trace the exchange handling; done means valid exchanges succeed and invalid codes return a clean 4xx instead of HTTP 500.