[Bug] z.ai web pages build Aliyun captcha URL with unset region: requests go to undefined.captcha-open-b.aliyuncs.com (blocked by AV) #1267

提交前确认 · Pre-submission checklist

• 我已搜索过现有 issue，确认这不是重复 / I searched existing issues and confirmed this isn't a duplicate.
• 我已阅读 CONTRIBUTING.md / I've read CONTRIBUTING.md.

问题类别 · Category

UI / 界面体验 · UI / UX

涉及的 Agent 框架 · Agent framework

ZCode Agent（自研）

严重程度 · Severity

轻微 · Minor (小问题不影响主流程 / minor, no impact on main flow)

复现频率 · Reproducibility

必现 · Always

问题描述 · Description

On web pages that ZCode Desktop opens in its embedded browser (z.ai account login, promo pages), the Aliyun Captcha SDK builds its API endpoint from an unset region variable, producing the malformed host undefined.captcha-open-b.aliyuncs.com (IP 106.14.127.86, Alibaba Cloud Shanghai). The request is junk and gets blocked by third-party antivirus (ESET Internet Security, "Address has been blocked" popup), which looks alarming to users. Seen 8+ times on one machine.

复现步骤 · Steps to reproduce

1. Open ZCode Desktop and use the "Sign in with z.ai" flow (or any z.ai web page shown in the embedded browser, e.g. promo/campaign pages)
2. The page loads the Aliyun Captcha SDK
3. The SDK issues a request to https://undefined.captcha-open-b.aliyuncs.com/... (note the literal "undefined" subdomain)
4. Antivirus (ESET Internet Security) blocks it: "Address has been blocked", IP 106.14.127.86

期望表现 · Expected behavior

The captcha SDK should call a valid regional endpoint (e.g. captcha-open-b.aliyuncs.com or a properly configured region host) with no "undefined" subdomain, so requests are not flagged by security software.

实际表现 · Actual behavior

Requests go to the malformed host undefined.captcha-open-b.aliyuncs.com; ESET blocks each one and shows repeated "Address has been blocked" popups (8 messages in a row). Users may suspect malware; captcha verification may also fail under strict AV rules.

ZCode 版本 · ZCode version

3.16.3.8992

设备 / 系统 / 浏览器 · Device / OS / Browser

Windows 10 Pro x64 (build 19045) / ZCode Desktop (Electron embedded browser)

截图 / 录屏 / 日志 · Screenshots / Recordings / Logs

ESET Internet Security popup:
"Address has been blocked.
URL address: https://undefined.captcha-open-b.aliyuncs.com
IP address: 106.14.127.86"