Improved compliance

Author: TriDefender

config.example.yaml

@@ -53,8 +53,8 @@ models:
 identity:
   # Mirrors process.env.ZCODE_APP_VERSION in the ZCode bundle.
   # Must be printable ASCII; non-conforming values fall back to the default.
-  # Default: "3.12.3" (current ZCode release). Override to match your real client.
-  appVersion: "3.12.3"
+  # Default: "3.14.0" (current ZCode release). Override to match your real client.
+  appVersion: "3.14.0"
   # X-Title suffix → "Z Code@{sourceTitle}". Default "cli".
   sourceTitle: "cli"
   # HTTP-Referer URL. Default "https://zcode.z.ai".

src/auth/oauth.test.ts

@@ -175,7 +175,7 @@ describe("ZaiOAuthClient (server-mediated cli login)", () => {
       expect(interstitial).toStartWith("https://zcode.z.ai/app/oauth/login?");
       const inner = new URL(interstitial);
       expect(inner.searchParams.get("redirect")).toBe("zcode://oauth/callback");
-      expect(inner.searchParams.get("app_version")).toBe("3.12.3");
+      expect(inner.searchParams.get("app_version")).toBe("3.14.0");
     } finally {
       await client.close();
     }
@@ -256,7 +256,7 @@ describe("BigmodelPollOAuthClient (server-mediated cli login)", () => {
       expect(url.origin + url.pathname).toBe("https://bigmodel.cn/login");
       const interstitial = url.searchParams.get("redirect") ?? "";
       expect(interstitial).toStartWith("https://zcode.z.ai/app/oauth/login?");
-      expect(new URL(interstitial).searchParams.get("app_version")).toBe("3.12.3");
+      expect(new URL(interstitial).searchParams.get("app_version")).toBe("3.14.0");
       expect(url.searchParams.get("redirect_uri")).toBeNull();
       expect(started.callbackUrl).toBe("");
     } finally {

src/config/loader.test.ts

@@ -377,7 +377,7 @@ models:
     const path = writeYaml(`
 `);
     const cfg = loadConfig(path);
-    expect(cfg.identity.appVersion).toBe("3.12.3");
+    expect(cfg.identity.appVersion).toBe("3.14.0");
     expect(cfg.identity.sourceTitle).toBe("cli");
     expect(cfg.identity.refererOrigin).toBe("https://zcode.z.ai");
   });
@@ -411,6 +411,6 @@ identity:
   appVersion: "v3.3.3-中文"
 `);
     const cfg = loadConfig(path);
-    expect(cfg.identity.appVersion).toBe("3.12.3");
+    expect(cfg.identity.appVersion).toBe("3.14.0");
   });
 });

src/config/loader.ts

@@ -28,7 +28,7 @@ const ENV = {
 
 /** Mirrors the ZCode desktop release (`_reverse/NOTEPAD.md`); bump per client
  *  release or User-Agent/X-ZCode-App-Version become distinguishable. */
-export const DEFAULT_APP_VERSION = "3.12.3";
+export const DEFAULT_APP_VERSION = "3.14.0";
 
 const DEFAULTS = {
   PORT: 8080,

src/config/template.ts

@@ -62,8 +62,8 @@ models:
 identity:
   # Mirrors process.env.ZCODE_APP_VERSION in the ZCode bundle.
   # Must be printable ASCII; non-conforming values fall back to the default.
-  # Default: "3.11.2" (current ZCode release). Override to match your real client.
-  appVersion: "3.11.2"
+  # Default: "3.14.0" (current ZCode release). Override to match your real client.
+  appVersion: "3.14.0"
   # X-Title suffix → "Z Code@{sourceTitle}". Default "cli".
   sourceTitle: "cli"
   # HTTP-Referer URL. Default "https://zcode.z.ai".

src/proxy/identity.test.ts

@@ -146,20 +146,22 @@ describe("buildIdentityHeaders", () => {
 
   // --- New behaviour matching `pio` in the current ZCode bundle ---
 
-  it("emits headers in the exact `TV` order", () => {
+  it("emits headers in the exact `TV` runtime insertion order", () => {
     // Clear env-gated headers so the order assertion is deterministic;
     // X-Client-Language/X-Client-Timezone are always present (unknown fallback).
+    // Order = spread-base {User-Agent, HTTP-Referer, X-Title} + appended keys
+    // (NOTEPAD §E correction — overrides keep their base positions).
     const savedRC = process.env.ZCODE_IDENTITY_RELEASE_CHANNEL;
     const savedDM = process.env.ZCODE_IDENTITY_DEVICE_MID;
     delete process.env.ZCODE_IDENTITY_RELEASE_CHANNEL;
     delete process.env.ZCODE_IDENTITY_DEVICE_MID;
     try {
       const h = buildIdentityHeaders(BASE);
       expect(Object.keys(h)).toEqual([
-        "HTTP-Referer",
         "User-Agent",
-        "X-ZCode-App-Version",
+        "HTTP-Referer",
         "X-Title",
+        "X-ZCode-App-Version",
         "X-Platform",
         "X-Release-Channel",
         "X-Client-Language",

src/proxy/identity.ts

@@ -156,28 +156,34 @@ export function buildLlmIdentityHeaders(id: ProxyIdentity): Record<string, strin
 }
 
 /**
- * Context-shaped identity headers — mirrors the 3.12.3 host builder `TV`
+ * Context-shaped identity headers — mirrors the host builder
+ * `TV` (3.12.3 chunk-ZH56ETHO) / `c5` (3.14.0 chunk-WFF5YMZO) / bundle `IJt`
  * (buildZCodeSourceHeadersFromContext), reached via the endpoint-routing
- * source-headers factory (`V6n`). 3.12.3 changes vs 3.11: X-ZCode-Agent is
- * GONE from this plane, and language/timezone are always present with the
- * "unknown" fallback. Consumers: endpoint-routing.ts (source headers),
- * claim/client.ts, routes-quota.ts, async bridge.
+ * source-headers factory (`V6n`). X-ZCode-Agent is GONE from this plane, and
+ * language/timezone are always present with the "unknown" fallback. Consumers:
+ * endpoint-routing.ts (source headers), claim/client.ts, routes-quota.ts,
+ * async bridge.
  *
- * Order (bundle `TV`):
- *   HTTP-Referer, User-Agent, [X-ZCode-App-Version], X-Title, [X-Platform],
+ * Order — RUNTIME INSERTION order, not source written order (2026-09-19
+ * correction, `_reverse/NOTEPAD.md` §E): the official builder spreads a
+ * 3-key base first (`yE`/`cU`/`Llr` = `{"User-Agent","HTTP-Referer","X-Title"}`)
+ * and then overrides/adds keys. JS spread semantics keep overridden keys at
+ * their base positions, so the wire order is:
+ *   User-Agent, HTTP-Referer, X-Title, [X-ZCode-App-Version], [X-Platform],
  *   [X-Release-Channel], X-Client-Language, X-Client-Timezone,
  *   [X-Os-Category], [X-Os-Version], [X-Device-Mid]
+ * (verified byte-level against both the 3.12.3 and 3.14.0 bundles/hosts).
  *
  * Returns `Record<string, string>` rather than a fixed interface because
  * several headers are conditionally omitted.
  */
 export function buildIdentityHeaders(id: ProxyIdentity): Record<string, string> {
   const v = resolveIdentityValues(id);
   return {
-    "HTTP-Referer": id.refererOrigin,
     "User-Agent": `ZCode/${v.n ?? "unknown"}`,
-    ...(v.n ? { "X-ZCode-App-Version": v.n } : {}),
+    "HTTP-Referer": id.refererOrigin,
     "X-Title": `Z Code@${id.sourceTitle}`,
+    ...(v.n ? { "X-ZCode-App-Version": v.n } : {}),
     ...(v.platform && v.arch ? { "X-Platform": `${v.platform}-${v.arch}` } : {}),
     ...(v.releaseChannel ? { "X-Release-Channel": v.releaseChannel } : {}),
     "X-Client-Language": v.clientLanguage ?? "unknown",