@agent-proxy/zcode 0.17.0 → 0.19.0

package/dist/config.d.ts

@@ -52,6 +52,8 @@ export interface ZcodeCacheDependencies {
     onSelectionChange?: () => void;
     /** 内存快照（渠道/套餐/模型集合/凭据）变化后触发，用于重建对外目录。 */
     onSnapshotChange?: (snapshot: ZcodeProviderSnapshot) => void;
+    /** 个人套餐项目令牌签发上报的客户端版本；缺省按 unknown 上报。 */
+    clientVersion?: string;
 }
 export interface ZcodePlanSelections {
     /** 当前渠道（providerFamilyDomain）；失败根因优先取它的解析错误。 */

package/dist/config.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { decryptZcodeCredential } from "./credential-cipher.js";
 import { readZcodeIndividualCredential } from "./individual-credentials.js";
+import { readZcodeIndividualProjectLocation, resolveZcodeIndividualApiKey, zcodeIndividualTokenFingerprint, ZcodeProjectTokenError, } from "./individual-project-token.js";
 import { readZcodeTeamCredentialInputs, resolveZcodeTeamApiKey, } from "./team-credentials.js";
 export class ZcodeConfigError extends Error {
 }
@@ -95,6 +96,18 @@ function startPlanApiKey(credentials, _family, env = process.env) {
         invalid("Start Plan 凭据解密失败");
     }
 }
+/** 个人套餐项目令牌签发的登录态来源；解密失败必须明确报错，不能静默降级。 */
+function oauthAccessToken(credentials, family, env = process.env) {
+    const value = credentials[`oauth:${family}:access_token`];
+    if (typeof value !== "string" || !value.trim())
+        return "";
+    try {
+        return decryptZcodeCredential(value, env).trim();
+    }
+    catch {
+        invalid("ZCode 个人套餐 OAuth 凭据解密失败；请在 ZCode 中重新登录当前账号");
+    }
+}
 /**
  * ZCode 3.12.3 起切换套餐只写 `providerFamilyConnectionSelections[family].kind`，
  * legacy `modelProviderFamilySelectedKeys` 已冻结。在入口把已知 kind 归一化为与 legacy
@@ -461,6 +474,13 @@ export function createZcodeConfigCache(homeDirectory, dependencies = {}) {
     let teamCredential;
     let teamCredentialFingerprint;
     let teamForceRefresh = false;
+    /** 个人套餐项目令牌（ZCode 3.16+）：落盘 Key 缺失时按 OAuth 在线签发并缓存。 */
+    let individualMint;
+    let individualMintFingerprint = "";
+    let individualMintMode = false;
+    let individualIdentity = "";
+    let individualOauth = "";
+    let individualLocation;
     let credentialGeneration = 0;
     let resolving;
     let firstEventAt;
@@ -520,6 +540,12 @@ export function createZcodeConfigCache(homeDirectory, dependencies = {}) {
                     teamCredential = undefined;
                     teamCredentialFingerprint = "";
                     teamForceRefresh = false;
+                    individualMint = undefined;
+                    individualMintFingerprint = "";
+                    individualMintMode = false;
+                    individualIdentity = "";
+                    individualOauth = "";
+                    individualLocation = undefined;
                     credential = undefined;
                     snapshot = undefined;
                     expiryCheckedKey = undefined;
@@ -650,6 +676,12 @@ export function createZcodeConfigCache(homeDirectory, dependencies = {}) {
                     teamCredential = undefined;
                     teamCredentialFingerprint = "";
                     teamForceRefresh = false;
+                    individualMint = undefined;
+                    individualMintFingerprint = "";
+                    individualMintMode = false;
+                    individualIdentity = "";
+                    individualOauth = "";
+                    individualLocation = undefined;
                     credential = undefined;
                     snapshot = undefined;
                     expiryCheckedKey = undefined;
@@ -680,28 +712,47 @@ export function createZcodeConfigCache(homeDirectory, dependencies = {}) {
                         const individual = selection.kind === "individual-coding-plan"
                             ? readZcodeIndividualCredential(credentials, selection.family, dependencies.env)
                             : undefined;
-                        const key = individual?.state === "available"
-                            ? individual.apiKey
-                            : individual?.state === "unavailable"
-                                ? ""
+                        if (individual?.state === "unavailable") {
+                            // ZCode 3.16 起个人套餐 Key 不再落盘 credentials.json：账号身份与
+                            // OAuth 登录态仍可解析时改为在线签发项目令牌；镜像回退禁令不变，
+                            // config.json 里的旧 Key 可能属于上一账号。
+                            const identity = individual.identity ?? "";
+                            const oauth = identity ? oauthAccessToken(credentials, selection.family, dependencies.env) : "";
+                            if (identity && oauth) {
+                                individualMintMode = true;
+                                individualIdentity = identity;
+                                individualOauth = oauth;
+                                individualLocation = readZcodeIndividualProjectLocation(credentials, selection.family, identity, dependencies.env);
+                                const nextFingerprint = zcodeIndividualTokenFingerprint(oauth, identity, individualLocation);
+                                const mintChanged = individualMintFingerprint !== nextFingerprint;
+                                individualMintFingerprint = nextFingerprint;
+                                const projection = JSON.stringify(["project-token", nextFingerprint]);
+                                oauthChanged = mintChanged || projection !== oauthProjection;
+                                oauthProjection = projection;
+                            }
+                            else {
+                                individualMintMode = false;
+                                throw new ZcodeConfigError("ZCode 个人套餐凭据不可用；请在 ZCode 中重新连接当前账号");
+                            }
+                        }
+                        else {
+                            individualMintMode = false;
+                            const key = individual?.state === "available"
+                                ? individual.apiKey
                                 : selection.kind === "start-plan"
                                     ? startPlanApiKey(credentials, selection.family, dependencies.env)
                                     : "";
-                        // 账号身份存在却拿不到该账号的 Key 时禁止镜像回退：切换账号后
-                        // config.json 里的旧 Key 可能属于上一账号。
-                        if (individual?.state === "unavailable") {
-                            throw new ZcodeConfigError("ZCode 个人套餐凭据不可用；请在 ZCode 中重新连接当前账号");
+                            personalApiKey = key || undefined;
+                            const projection = JSON.stringify([
+                                credentials[`oauth:${selection.family}:access_token`],
+                                credentials[`oauth:${selection.family}:refresh_token`],
+                                credentials.zcodejwttoken,
+                                individual?.state === "available" ? individual.identity : individual?.state ?? null,
+                                key,
+                            ]);
+                            oauthChanged = projection !== oauthProjection;
+                            oauthProjection = projection;
                         }
-                        personalApiKey = key || undefined;
-                        const projection = JSON.stringify([
-                            credentials[`oauth:${selection.family}:access_token`],
-                            credentials[`oauth:${selection.family}:refresh_token`],
-                            credentials.zcodejwttoken,
-                            individual?.state === "available" ? individual.identity : individual?.state ?? null,
-                            key,
-                        ]);
-                        oauthChanged = projection !== oauthProjection;
-                        oauthProjection = projection;
                     }
                 }
                 catch (error) {
@@ -816,6 +867,77 @@ export function createZcodeConfigCache(homeDirectory, dependencies = {}) {
                 armExpiry();
                 return;
             }
+            if (selection.kind === "individual-coding-plan" && individualMintMode) {
+                // ZCode 3.16 个人套餐项目令牌：OAuth/账号/指针指纹变化或到期时重签；
+                // 机制与团队套餐一致（resolving 代际隔离 + 到期定时器）。
+                const fingerprint = individualMintFingerprint;
+                const expired = credential?.expiresAt !== undefined && credential.expiresAt <= now();
+                const mustResolve = !individualMint
+                    || individualMint.identity !== individualIdentity
+                    || individualMint.fingerprint !== fingerprint
+                    || expired;
+                if (resolving) {
+                    snapshot = undefined;
+                    return;
+                }
+                if (mustResolve) {
+                    const generation = ++credentialGeneration;
+                    const oauth = individualOauth;
+                    const mintIdentity = individualIdentity;
+                    const location = individualLocation;
+                    snapshot = undefined;
+                    credential = undefined;
+                    expiryCheckedKey = undefined;
+                    clearTimeout(expiryTimer);
+                    const promise = (async () => {
+                        try {
+                            const minted = await resolveZcodeIndividualApiKey(selection.family, { accessToken: oauth, identity: mintIdentity, fingerprint }, location, { fetch: dependencies.fetch, env: dependencies.env, clientVersion: dependencies.clientVersion, now });
+                            if (credentialGeneration !== generation || selection.kind !== "individual-coding-plan")
+                                return;
+                            dependencies.onCredentialBuild?.();
+                            credential = { apiKey: minted.apiKey, expiresAt: minted.expiresAt };
+                            individualMint = { identity: mintIdentity, fingerprint, apiKey: minted.apiKey, expiresAt: minted.expiresAt };
+                            const currentRoute = route;
+                            if (!currentRoute)
+                                invalid("ZCode 当前路由不可用");
+                            snapshot = Object.freeze({ ...currentRoute, apiKey: minted.apiKey, expiresAt: minted.expiresAt });
+                            failure = undefined;
+                            armExpiry();
+                        }
+                        catch (error) {
+                            if (credentialGeneration !== generation)
+                                return;
+                            snapshot = undefined;
+                            credential = undefined;
+                            individualMint = undefined;
+                            failure = error instanceof ZcodeProjectTokenError || error instanceof ZcodeConfigError
+                                ? new ZcodeConfigError(error.message)
+                                : new ZcodeConfigError("无法签发 ZCode 个人套餐项目令牌；请在 ZCode 中重新登录当前账号后重试");
+                            clearTimeout(expiryTimer);
+                        }
+                        finally {
+                            if (credentialGeneration === generation)
+                                resolving = undefined;
+                            finish();
+                        }
+                    })();
+                    resolving = { generation, promise };
+                    return;
+                }
+                const cachedMint = individualMint;
+                if (!cachedMint)
+                    invalid("ZCode 个人套餐项目令牌不可用");
+                credential = { apiKey: cachedMint.apiKey, ...(cachedMint.expiresAt === undefined ? {} : { expiresAt: cachedMint.expiresAt }) };
+                if (cachedMint.expiresAt !== undefined && cachedMint.expiresAt <= now()) {
+                    expiryCheckedKey = cachedMint.apiKey;
+                    invalid("ZCode 当前业务 Key 已过期");
+                }
+                snapshot = Object.freeze({ ...next, apiKey: cachedMint.apiKey,
+                    ...(cachedMint.expiresAt === undefined ? {} : { expiresAt: cachedMint.expiresAt }) });
+                failure = undefined;
+                armExpiry();
+                return;
+            }
             // start-plan：上次套餐凭据优先于镜像 JWT（镜像只是无 zcodejwttoken 时的引导回退），
             // 否则不重读凭据的检查轮次会把 key 静默换成可能冻结的镜像值。
             const routeApiKey = personalApiKey

package/dist/index.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { isIP } from "node:net";
 import { resolvePaths } from "@agent-proxy/plugin-api";
 import { createZcodeConfigCache, readZcodeAPIKeyProviders, zcodeConfigPresent, ZcodeConfigError } from "./config.js";
-import { clearModelsCacheEntries, invalidateModelsCache, withAgentSystemPrompt } from "@agent-proxy/plugin-api";
+import { clearModelsCacheEntries, invalidateModelsCache } from "@agent-proxy/plugin-api";
 import { buildZcodeVendorCatalog, createZcodeCatalog, isZcodeModel, writeZcodeServedCatalog, zcodeAPIProviderIDFromModel, zcodeModelPlan, zcodeUpstreamModel, } from "./catalog.js";
 import { translateZcodeRequest, ZcodeRequestError } from "./request.js";
 import { createZcodeClientResponse } from "./response.js";
@@ -11,7 +11,7 @@ import { executeZcodeAnalyzeImage, matchZcodeAnalyzeImage } from "./vision.js";
 import { ZcodeEndpointRouting } from "./endpoint-routing.js";
 import { clientSigningVerifyRejection, ZcodeClientSigning } from "./client-signing.js";
 import { isZcodeRecord } from "./wire.js";
-import { buildZcodeModelHeaders, createZcodeContexts, decorateZcodeBody, readZcodeIdentity, zcodePlan, ZCODE_AGENT_SYSTEM_PROMPT } from "./request-context.js";
+import { buildZcodeModelHeaders, createZcodeContexts, decorateZcodeBody, readZcodeIdentity, zcodePlan } from "./request-context.js";
 import { localTime, logExchange, logGroupFromPath, requestLogDir } from "@agent-proxy/plugin-api";
 import { logGatewayError, logRequestSummary } from "@agent-proxy/plugin-api";
 export function validateZcodeConfig(config) {
@@ -52,10 +52,10 @@ function buildZcodeAdapter(config, dependencies = {}) {
         return clearModelsCacheEntries(dependencies.codexModelsCacheFile, (slug) => isZcodeModel(slug) && !current.has(slug.toLowerCase()));
     };
     const publishServedCatalog = (catalog) => {
-        // 系统提示词在发布成品时替换（含 model_messages 模板）：zcode-catalog.json 落盘即终态，
-        // 与其它适配器的合成期替换对齐；Codex 客户端优先按模板渲染系统提示词，只改
-        // base_instructions 无效（2026-10-09 实测）。
-        servedCatalog = { models: catalog.models.map((entry) => withAgentSystemPrompt(entry, ZCODE_AGENT_SYSTEM_PROMPT)) };
+        // 目录条目保持 vendor 预设基底（base_instructions 为空串、无 model_messages 模板）；
+        // 官方 ZCode 提示词由请求转换层整体注入（request.ts，任何客户端协议进入均生效），
+        // catalog 不再改写提示词。
+        servedCatalog = { models: catalog.models };
         const changed = writeZcodeServedCatalog(servedCatalogFile, servedCatalog);
         if (!changed || !dependencies.codexModelsCacheFile)
             return;
@@ -67,6 +67,7 @@ function buildZcodeAdapter(config, dependencies = {}) {
         { plan: "individual-coding-plan" },
         { plan: "team-coding-plan" },
     ];
+    const identity = dependencies.identity ?? readZcodeIdentity();
     let synchronizeAPIKeyRoutes = () => { };
     const republishFromPlans = (force = false) => {
         const current = planRoutes.map((route) => route.snapshot);
@@ -99,6 +100,8 @@ function buildZcodeAdapter(config, dependencies = {}) {
             ?? (injected ? undefined : createZcodeConfigCache(home, {
                 plan: route.plan,
                 refreshOnStart: false,
+                // 个人套餐项目令牌签发按官方客户端上报版本。
+                clientVersion: identity.appVersion,
                 // 选择变化只撤下本套餐的快照并重发并集；另一个套餐的条目不受影响。
                 onSelectionChange: () => {
                     if (manual)
@@ -183,7 +186,6 @@ function buildZcodeAdapter(config, dependencies = {}) {
     }
     const fetchUpstream = dependencies.fetch ?? ((url, init) => fetch(url, init));
     const activeRequests = new Set();
-    const identity = dependencies.identity ?? readZcodeIdentity();
     const endpointRouting = dependencies.endpointRouting !== null
         ? dependencies.endpointRouting ?? new ZcodeEndpointRouting({
             identity,

package/dist/individual-project-token.d.ts

@@ -0,0 +1,39 @@
+import type { ZcodeFamily } from "./config.ts";
+/** 项目令牌签发失败；消息面向用户，可直接透传为配置错误。 */
+export declare class ZcodeProjectTokenError extends Error {
+}
+export interface ZcodeIndividualProjectLocation {
+    organizationId: string;
+    projectId: string;
+    apiKeyId: string;
+}
+export interface ZcodeIndividualTokenInputs {
+    accessToken: string;
+    identity: string;
+    fingerprint: string;
+}
+export interface ZcodeIndividualTokenDependencies {
+    fetch?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+    clientVersion?: string;
+    now?: () => number;
+}
+export interface ZcodeIndividualApiKey {
+    apiKey: string;
+    expiresAt: number;
+}
+/**
+ * ZCode 3.16 起个人套餐业务 Key 不再落盘，credentials.json 只保留指向
+ * `organization/project/apiKey` 的指针（按账号隔离）。这里按当前账号身份与
+ * 渠道解析同账号、非团队、Coding Plan 场景的指针；无法解密或形状不符按缺失
+ * 处理，交给发现流程重建，与官方客户端的可恢复语义一致。
+ */
+export declare function readZcodeIndividualProjectLocation(credentials: Record<string, unknown>, family: ZcodeFamily, identity: string, env?: NodeJS.ProcessEnv): ZcodeIndividualProjectLocation | undefined;
+/** 令牌签发输入的指纹：OAuth、账号身份或指针任一变化都需要重新签发。 */
+export declare function zcodeIndividualTokenFingerprint(accessToken: string, identity: string, location: ZcodeIndividualProjectLocation | undefined): string;
+/**
+ * 复刻 ZCode 3.16 客户端的个人套餐项目令牌签发：优先按 credentials.json 的
+ * 指针签发短时令牌；指针缺失或失效（404）时经 getCustomerInfo → 项目 API Key
+ * 列表发现兜底。签发全程不落盘，结果由调用方缓存并按过期时间重签。
+ */
+export declare function resolveZcodeIndividualApiKey(family: ZcodeFamily, inputs: ZcodeIndividualTokenInputs, location: ZcodeIndividualProjectLocation | undefined, dependencies?: ZcodeIndividualTokenDependencies): Promise<ZcodeIndividualApiKey>;

package/dist/individual-project-token.js

@@ -0,0 +1,196 @@
+import { createHash } from "node:crypto";
+import { decryptZcodeCredential } from "./credential-cipher.js";
+const REQUEST_TIMEOUT_MS = 15_000;
+const LOCATION_PREFIX = "project-key-location:v1:";
+/** 指针元数据里 Coding Plan 场景的固定序号（客户端 di.CODING_PLAN）。 */
+const CODING_PLAN_SCENE = 1;
+const NON_TEAM_SELECTION = "non-team";
+const API_KEY_TYPE = 2;
+/** 项目令牌签发失败；消息面向用户，可直接透传为配置错误。 */
+export class ZcodeProjectTokenError extends Error {
+}
+function invalid(message) {
+    throw new ZcodeProjectTokenError(message);
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function host(family) {
+    return family === "zai" ? "https://api.z.ai" : "https://open.bigmodel.cn";
+}
+/**
+ * ZCode 3.16 起个人套餐业务 Key 不再落盘，credentials.json 只保留指向
+ * `organization/project/apiKey` 的指针（按账号隔离）。这里按当前账号身份与
+ * 渠道解析同账号、非团队、Coding Plan 场景的指针；无法解密或形状不符按缺失
+ * 处理，交给发现流程重建，与官方客户端的可恢复语义一致。
+ */
+export function readZcodeIndividualProjectLocation(credentials, family, identity, env = process.env) {
+    if (!identity)
+        return undefined;
+    const expected = host(family);
+    for (const key of Object.keys(credentials)) {
+        if (!key.startsWith(LOCATION_PREFIX))
+            continue;
+        let meta;
+        try {
+            meta = JSON.parse(decodeURIComponent(key.slice(LOCATION_PREFIX.length)));
+        }
+        catch {
+            continue;
+        }
+        if (!Array.isArray(meta) || meta.length !== 6)
+            continue;
+        const [origin, metaFamily, accountId, team, scene, selection] = meta;
+        if (origin !== expected || metaFamily !== family || accountId !== identity)
+            continue;
+        if (team !== null || scene !== CODING_PLAN_SCENE || selection !== NON_TEAM_SELECTION)
+            continue;
+        const value = credentials[key];
+        if (typeof value !== "string" || !value.trim())
+            continue;
+        let decoded;
+        try {
+            decoded = JSON.parse(decryptZcodeCredential(value, env));
+        }
+        catch {
+            continue;
+        }
+        if (!isRecord(decoded))
+            continue;
+        const organizationId = typeof decoded.organizationId === "string" ? decoded.organizationId.trim() : "";
+        const projectId = typeof decoded.projectId === "string" ? decoded.projectId.trim() : "";
+        const apiKeyId = typeof decoded.apiKeyId === "string" ? decoded.apiKeyId.trim() : "";
+        if (organizationId && projectId && apiKeyId)
+            return { organizationId, projectId, apiKeyId };
+    }
+    return undefined;
+}
+/** 令牌签发输入的指纹：OAuth、账号身份或指针任一变化都需要重新签发。 */
+export function zcodeIndividualTokenFingerprint(accessToken, identity, location) {
+    return createHash("sha256").update(JSON.stringify([accessToken, identity, location ?? null])).digest("hex");
+}
+async function requestJson(url, init, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    }
+    catch {
+        throw new Error("无法访问 ZCode 个人套餐令牌接口");
+    }
+    if (!response.ok)
+        throw new Error("ZCode 个人套餐令牌接口请求失败");
+    let value;
+    try {
+        value = await response.json();
+    }
+    catch {
+        throw new Error("ZCode 个人套餐令牌接口响应无效");
+    }
+    if (!isRecord(value))
+        throw new Error("ZCode 个人套餐令牌接口响应无效");
+    return value;
+}
+function envelopeCode(envelope) {
+    const code = envelope.code;
+    return typeof code === "number" && Number.isFinite(code) ? code : undefined;
+}
+function responseData(envelope) {
+    const code = envelopeCode(envelope);
+    if (envelope.success === false || (code !== undefined && code !== 0 && code !== 200)) {
+        const message = typeof envelope.msg === "string" && envelope.msg.trim() ? `：${envelope.msg.trim().slice(0, 120)}` : "";
+        throw new ZcodeProjectTokenError(`ZCode 个人套餐令牌接口返回业务错误（code ${code ?? "unknown"}）${message}`);
+    }
+    if (envelope.success !== true && !Object.hasOwn(envelope, "data")) {
+        throw new Error("ZCode 个人套餐令牌接口响应缺少数据");
+    }
+    return envelope.data;
+}
+async function mintProjectToken(family, inputs, location, dependencies) {
+    const fetchImpl = dependencies.fetch ?? fetch;
+    const now = dependencies.now ?? Date.now;
+    const url = `${host(family)}/api/biz/v1/organization/${encodeURIComponent(location.organizationId)}`
+        + `/projects/${encodeURIComponent(location.projectId)}`
+        + `/api_keys/${encodeURIComponent(location.apiKeyId)}/access_tokens`;
+    const envelope = await requestJson(url, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${inputs.accessToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ clientType: "zcode", clientVersion: dependencies.clientVersion ?? "unknown" }),
+    }, fetchImpl);
+    if (envelopeCode(envelope) === 404)
+        invalid("ZCODE_PROJECT_KEY_UNAVAILABLE");
+    const data = responseData(envelope);
+    // 与官方客户端一致：data 缺省 enable 字段时按已启用处理，显式 false 才是停用。
+    if (!isRecord(data) || data.enable === false)
+        throw new Error("ZCode 个人套餐项目令牌未启用");
+    const token = typeof data.accessToken === "string" ? data.accessToken.trim() : "";
+    if (!token)
+        throw new Error("ZCode 个人套餐项目令牌响应缺少 accessToken");
+    const nowMs = now();
+    const relative = typeof data.expiresIn === "number" && Number.isFinite(data.expiresIn) && data.expiresIn > 0
+        ? nowMs + data.expiresIn * 1000 : undefined;
+    const absolute = typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt) ? data.expiresAt * 1000 : undefined;
+    const expiresAt = [relative, absolute].filter((value) => value !== undefined)
+        .reduce((left, right) => Math.min(left, right), Number.POSITIVE_INFINITY);
+    if (!Number.isFinite(expiresAt) || expiresAt <= nowMs)
+        throw new Error("ZCode 个人套餐项目令牌过期时间无效");
+    return { apiKey: token, expiresAt };
+}
+async function discoverProjectLocation(family, accessToken, dependencies) {
+    const fetchImpl = dependencies.fetch ?? fetch;
+    const apiHost = host(family);
+    const customer = await requestJson(`${apiHost}/api/biz/customer/getCustomerInfo`, {
+        method: "GET",
+        headers: { Authorization: accessToken, "Content-Type": "application/json" },
+    }, fetchImpl);
+    const data = responseData(customer);
+    const organizations = isRecord(data) && Array.isArray(data.organizations) ? data.organizations : [];
+    const projectIdOf = (item) => isRecord(item) && typeof item.projectId === "string" ? item.projectId.trim() : "";
+    // 个人（非团队）场景：与客户端一致取默认机构下第一个业务类型项目，无类型标注时取首个项目。
+    const project = organizations.flatMap((organization) => {
+        if (!isRecord(organization))
+            return [];
+        const organizationId = typeof organization.organizationId === "string" ? organization.organizationId.trim() : "";
+        const projects = Array.isArray(organization.projects) ? organization.projects.filter(isRecord) : [];
+        const selected = projects.find((item) => projectIdOf(item) && String(item.projectType ?? "").trim())
+            ?? projects.find((item) => projectIdOf(item));
+        const projectId = selected ? projectIdOf(selected) : "";
+        return organizationId && projectId ? [{ organizationId, projectId }] : [];
+    })[0];
+    if (!project)
+        invalid("ZCode 个人套餐缺少可用的默认项目；请在 ZCode 中打开一次个人套餐");
+    const list = await requestJson(`${apiHost}/api/biz/v1/organization/${encodeURIComponent(project.organizationId)}`
+        + `/projects/${encodeURIComponent(project.projectId)}/api_keys`, {
+        method: "GET",
+        headers: { Authorization: accessToken, "Content-Type": "application/json" },
+    }, fetchImpl);
+    const keys = responseData(list);
+    const entries = Array.isArray(keys) ? keys.filter(isRecord) : [];
+    const keyEntry = entries.find((item) => item.keyType === API_KEY_TYPE
+        && typeof item.apiKey === "string" && item.apiKey.trim());
+    const apiKeyId = typeof keyEntry?.apiKey === "string" ? keyEntry.apiKey.trim() : "";
+    if (!apiKeyId)
+        invalid("ZCode 个人套餐项目缺少可用的 API Key；请在 ZCode 中打开一次个人套餐重建");
+    return { ...project, apiKeyId };
+}
+/**
+ * 复刻 ZCode 3.16 客户端的个人套餐项目令牌签发：优先按 credentials.json 的
+ * 指针签发短时令牌；指针缺失或失效（404）时经 getCustomerInfo → 项目 API Key
+ * 列表发现兜底。签发全程不落盘，结果由调用方缓存并按过期时间重签。
+ */
+export async function resolveZcodeIndividualApiKey(family, inputs, location, dependencies = {}) {
+    if (location) {
+        try {
+            return await mintProjectToken(family, inputs, location, dependencies);
+        }
+        catch (error) {
+            if (error instanceof ZcodeProjectTokenError && error.message === "ZCODE_PROJECT_KEY_UNAVAILABLE") {
+                // 指针已失效（服务端 404）：与客户端一致转入发现流程重建。
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+    const discovered = await discoverProjectLocation(family, inputs.accessToken, dependencies);
+    return mintProjectToken(family, inputs, discovered, dependencies);
+}

package/dist/request.js

@@ -1,5 +1,6 @@
-import { BridgeConversionError, convertRequest, normalizeResponsesToolDeclarations } from "@agent-proxy/llm-bridge";
+import { BridgeConversionError, convertRequest, normalizeResponsesToolDeclarations, stripClientSystemPrompt } from "@agent-proxy/llm-bridge";
 import { createHash } from "node:crypto";
+import { ZCODE_AGENT_SYSTEM_PROMPT } from "./request-context.js";
 import { decodeZcodeThinking, isZcodeRecord } from "./wire.js";
 import { ANALYZE_IMAGE_SYSTEM_NOTE, ANALYZE_IMAGE_TOOL_DECLARATION, ANALYZE_IMAGE_TOOL_NAME, collectZcodeImages } from "./vision.js";
 /**
@@ -267,6 +268,9 @@ export async function translateZcodeRequest(body, upstreamModel, to = "responses
     }
     if (body.instructions !== undefined && typeof body.instructions !== "string")
         fail("instructions 必须是字符串");
+    // 官方 ZCode 提示词整体替换客户端系统内容（catalog 不再注入，任何客户端协议
+    // 进入都在转换层统一注入）：入口先剥离 instructions 与 system/developer 内容。
+    body = stripClientSystemPrompt(to, body);
     // 上游 token 上限按来源取参：responses 用 max_output_tokens，chat-completions /
     // anthropic 用 max_tokens，gemini 用 generationConfig.maxOutputTokens；缺省走服务默认 16384。
     const sourceLimit = to === "responses"
@@ -281,9 +285,9 @@ export async function translateZcodeRequest(body, upstreamModel, to = "responses
     const clientModel = body.model === undefined ? upstreamModel : string(body.model, "model");
     const identities = new Map();
     const messages = [];
-    const system = [];
-    if (typeof body.instructions === "string" && body.instructions)
-        system.push(body.instructions);
+    // 官方 ZCode 提示词为上游系统槽唯一基底；客户端系统内容已入口剥离，
+    // 网关旁白（dropped 工具通告、视觉适配说明）随后拼装。
+    const system = [ZCODE_AGENT_SYSTEM_PROMPT];
     let passthroughChoice;
     let passthroughStopSequences;
     let passthroughTools;
@@ -301,8 +305,6 @@ export async function translateZcodeRequest(body, upstreamModel, to = "responses
                 identities.set(mapped, identity);
             for (const message of anthropicMessagesOf(converted))
                 addMessage(messages, message.role, message.content);
-            if (typeof converted.body.system === "string" && converted.body.system)
-                system.push(converted.body.system);
             passthroughTools = Array.isArray(converted.body.tools) ? converted.body.tools.filter(record) : undefined;
             passthroughChoice = converted.body.tool_choice;
             if (Array.isArray(converted.body.stop_sequences) && converted.body.stop_sequences.every((entry) => typeof entry === "string")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-proxy/zcode",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Agent Proxy zcode 插件；保留基线转换行为。",
   "type": "module",
   "exports": {
@@ -35,11 +35,11 @@
     "url": "git+https://github.com/aceHubert/codex-cliproxy-gateway.git"
   },
   "devDependencies": {
-    "@agent-proxy/models": "0.17.0"
+    "@agent-proxy/models": "0.19.0"
   },
   "dependencies": {
-    "@agent-proxy/llm-bridge": "0.17.0",
-    "@agent-proxy/plugin-api": "0.17.0"
+    "@agent-proxy/llm-bridge": "0.19.0",
+    "@agent-proxy/plugin-api": "0.19.0"
   },
-  "gitHead": "7dc26953606d78cc982692de2f830f9f92061adc"
+  "gitHead": "20dff92139f68670155c173ba94849415c7ef21e"
 }