@oneciel-ai/ciel-runtime 0.2.28 → 0.2.29

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 This file records stable Ciel Runtime releases. Changes are grouped by user-visible
 capability, followed by the complete commit ledger merged into each release.
 
+## 0.2.29 — 2026-08-24
+
+- Split Z.AI general API, Coding Plan, and Start Plan into independent provider
+  profiles so OAuth login never overwrites the legacy/manual `zai` API key.
+- Added the verified general API and Coding Plan OpenAI/Anthropic endpoints and
+  plan-scoped `zai-oauth --profile coding-plan|start-plan` credential handling.
+- Added official GLM-5.1, GLM-5.2, and GLM-5.3 context/output profiles.
+- Registered the installed ZCode Start Plan endpoints and JWT credential shape,
+  but fail launch explicitly because a live request proved that the private
+  runtime's fresh Aliyun CAPTCHA header is required; Ciel does not fabricate or
+  bypass it.
+
 ## 0.2.28 — 2026-08-24
 
 - Replaced manual `zcode://` callback pasting in the Z.AI authorization-code

package/README.md

@@ -164,7 +164,7 @@ Common commands:
 ciel-runtimectl provider [NAME]
 ciel-runtimectl models [PROVIDER]
 ciel-runtimectl model MODEL_ID
-ciel-runtimectl zai-oauth login
+ciel-runtimectl zai-oauth login --profile coding-plan
 ciel-runtimectl status
 ciel-runtimectl remote-memory
 ciel-runtimectl transcript-events

package/ciel_runtime.py

@@ -3160,7 +3160,7 @@ portable_language_menu = _CONFIGURATION_CLI_API.portable_language_menu
 
 def credential_cli_controller() -> CredentialCliController:
     return CredentialCliController(
-        policy=CredentialCliPolicy(frozenset({"anthropic", "ollama-cloud", "deepseek", "opencode", "opencode-go", "kimi", "nvidia-hosted", "openrouter", "fireworks"})),
+        policy=CredentialCliPolicy(frozenset({"anthropic", "ollama-cloud", "deepseek", "opencode", "opencode-go", "kimi", "nvidia-hosted", "openrouter", "fireworks", "zai", "zai-api", "zai-coding-plan", "zai-start-plan"})),
         ports=CredentialCliPorts(normalize_provider, load_config, provider_api_key_count, provider_primary_api_key, mask_secret, secret_fingerprint,
                                  api_key_clear_requested, clear_api_key_config, store_api_key_input_config, store_api_keys_config),
         io=CredentialCliIO(sys.stdin.isatty, getpass.getpass, print),
@@ -3238,7 +3238,7 @@ def cmd_ollama_native(args: argparse.Namespace) -> None: provider_option_cli_con
 def provider_option_policy() -> ProviderOptionPolicy: return ProviderOptionPolicy(normalize_claude_code_supported_capabilities, normalize_ip_family, normalize_model_id, normalize_opencode_endpoint_kind, parse_bool, parse_config_value, positive_int, ProviderSamplingPolicy())
 def apply_ollama_option(pcfg: dict[str, Any], token: str) -> None: mutate_ollama_option(pcfg, token, policy=provider_option_policy())
 def cmd_ollama_options(args: argparse.Namespace) -> None: provider_option_cli_controller().ollama_options(args)
-PROVIDER_OPTION_PROVIDERS = ("anthropic", "agy", "codex", "vllm", "lm-studio", "nvidia-hosted", "self-hosted-nim", "ollama", "ollama-cloud", "deepseek", "opencode", "opencode-go", "kimi", "openrouter", "fireworks", "zai")
+PROVIDER_OPTION_PROVIDERS = ("anthropic", "agy", "codex", "vllm", "lm-studio", "nvidia-hosted", "self-hosted-nim", "ollama", "ollama-cloud", "deepseek", "opencode", "opencode-go", "kimi", "openrouter", "fireworks", "zai", "zai-api", "zai-coding-plan", "zai-start-plan")
 PROVIDER_SAMPLING_OPTION_PROVIDERS = ("vllm", "lm-studio", "nvidia-hosted", "self-hosted-nim", "openrouter")
 PROVIDER_SAMPLING_OPTIONS = ("temperature", "top_p", "top_k")
 def sampling_option_key(key: str) -> str | None: return ProviderSamplingPolicy().option_key(key)

package/ciel_runtime_support/claude_environment.py

@@ -222,7 +222,11 @@ class ClaudeModelAliasPolicy:
         ):
             selected = ""
             selected_from_config = False
-            configured = str(config.get(f"{family}_model") or "").strip() if provider == "zai" else ""
+            configured = (
+                str(config.get(f"{family}_model") or "").strip()
+                if provider in {"zai", "zai-api", "zai-coding-plan", "zai-start-plan"}
+                else ""
+            )
             if configured:
                 selected = self._ports.normalize_model_id(provider, configured)
                 selected_from_config = bool(selected)

package/ciel_runtime_support/cli_parser.py

@@ -147,6 +147,11 @@ def build_cli_parser(services: CliParserServices) -> argparse.ArgumentParser:
         default="status",
     )
     zai_oauth.add_argument("--no-browser", action="store_true")
+    zai_oauth.add_argument(
+        "--profile",
+        choices=("coding-plan", "start-plan"),
+        default="coding-plan",
+    )
     zai_oauth.set_defaults(func=services.provider.oauth["zai"])
     _add_values_command(commands, "model", services.models.model, argument_name="value")
     _add_values_command(commands, "advisor-model", services.models.advisor_model, argument_name="value")

package/ciel_runtime_support/managed_mcp_config.py

@@ -67,7 +67,7 @@ class ManagedMcpConfigService:
         return path
 
     def write_zai(self, provider: str, provider_config: dict[str, Any]) -> Path | None:
-        if provider != "zai" or not bool(provider_config.get("managed_mcp", True)):
+        if provider not in {"zai", "zai-api", "zai-coding-plan"} or not bool(provider_config.get("managed_mcp", True)):
             return None
         key = self.ports.primary_api_key(provider, provider_config)
         if not self.ports.meaningful_key(key):
@@ -93,7 +93,7 @@ class ManagedMcpConfigService:
         return self.paths.zai
 
     def reset_zai_if_inactive(self, provider: str) -> None:
-        if provider == "zai":
+        if provider in {"zai", "zai-api", "zai-coding-plan"}:
             return
         try:
             self.paths.zai.unlink()

package/ciel_runtime_support/prelaunch.py

@@ -577,8 +577,16 @@ def run_prelaunch_menu(passthrough: list[str] | None = None,
                         panel_rows, panel_values = api_key_panel_rows(provider, pcfg)
                         panel_idx = 0
                     elif value.startswith("zai-oauth-"):
+                        oauth_value = value.removeprefix("zai-oauth-")
+                        profile = "start-plan" if oauth_value.startswith("start-plan-") else "coding-plan"
+                        action = oauth_value.removeprefix("start-plan-")
                         messages = guarded_zai_oauth_action(
-                            value.removeprefix("zai-oauth-"), zai_oauth_action
+                            action,
+                            (
+                                (lambda selected_action: zai_oauth_action(selected_action, profile=profile))
+                                if profile == "start-plan"
+                                else zai_oauth_action
+                            ),
                         )
                         refresh_checks()
                         cfg = load_config()

package/ciel_runtime_support/prelaunch_panel_context.py

@@ -247,29 +247,32 @@ class PrelaunchPanelContext:
     def api_key_panel_rows(
         self, provider: str, provider_config: dict[str, Any] | None = None
     ) -> PanelRows:
-        if provider == "zai":
+        if provider in {"zai", "zai-coding-plan", "zai-start-plan"}:
             config = provider_config or {}
             source = str(config.get("credential_source") or "").strip()
             configured = bool(self.configuration.api_key_count(provider, config))
             status = "connected" if configured and source == "zai-oauth" else (
                 "API key configured" if configured else "login required"
             )
+            profile = "start-plan" if provider == "zai-start-plan" else "coding-plan"
+            action_prefix = "zai-oauth-start-plan-" if profile == "start-plan" else "zai-oauth-"
+            label = "Start Plan" if profile == "start-plan" else "Coding Plan"
             rows, values = self.configuration_panel_projection().api_key_rows(
                 provider, provider_config
             )
             return (
                 [
-                    f"Z.AI OAuth: {status}",
-                    "Login with Z.AI OAuth (shared by all runtimes)",
-                    "Refresh Z.AI OAuth status",
-                    "Logout shared Z.AI OAuth credential",
+                    f"Z.AI OAuth {label}: {status}",
+                    f"Login with Z.AI OAuth ({label})",
+                    f"Refresh Z.AI OAuth {label} status",
+                    f"Logout Z.AI OAuth {label} credential",
                     *rows,
                 ],
                 [
                     "__info__",
-                    "zai-oauth-login",
-                    "zai-oauth-status",
-                    "zai-oauth-logout",
+                    f"{action_prefix}login",
+                    f"{action_prefix}status",
+                    f"{action_prefix}logout",
                     *values,
                 ],
             )

package/ciel_runtime_support/provider_adapters.py

@@ -25,7 +25,12 @@ from .providers.nim import SelfHostedNimProviderAdapter
 from .providers.nvidia import NvidiaHostedProviderAdapter
 from .providers.vllm import VllmProviderAdapter
 from .providers.deepseek import DeepSeekProviderAdapter
-from .providers.zai import ZaiProviderAdapter
+from .providers.zai import (
+    ZaiApiProviderAdapter,
+    ZaiCodingPlanProviderAdapter,
+    ZaiProviderAdapter,
+    ZaiStartPlanProviderAdapter,
+)
 from .providers.kimi import KimiProviderAdapter
 from .providers.fireworks import FireworksProviderAdapter
 from .providers.meta import MetaModelProviderAdapter
@@ -60,6 +65,24 @@ PROVIDER_DESCRIPTORS = ProviderDescriptorRegistry(
         ProviderDescriptor("opencode-go", "OpenCode Go", OpenCodeGoProviderAdapter),
         ProviderDescriptor("kimi", "Kimi.com", KimiProviderAdapter),
         ProviderDescriptor("zai", "Z.AI GLM", ZaiProviderAdapter),
+        ProviderDescriptor(
+            "zai-api",
+            "Z.AI Model API (API Key)",
+            ZaiApiProviderAdapter,
+            aliases=("zai-general", "zai-payg"),
+        ),
+        ProviderDescriptor(
+            "zai-coding-plan",
+            "Z.AI Coding Plan",
+            ZaiCodingPlanProviderAdapter,
+            aliases=("zai-coding",),
+        ),
+        ProviderDescriptor(
+            "zai-start-plan",
+            "Z.AI Start Plan",
+            ZaiStartPlanProviderAdapter,
+            aliases=("zai-start",),
+        ),
         ProviderDescriptor("vllm", "vLLM", VllmProviderAdapter),
         ProviderDescriptor("lm-studio", "LM Studio", LMStudioProviderAdapter),
         ProviderDescriptor("nvidia-hosted", "Nvidia Hosted", NvidiaHostedProviderAdapter),
@@ -192,5 +215,8 @@ __all__ = [
     "VllmProviderAdapter",
     "XaiProviderAdapter",
     "ZaiProviderAdapter",
+    "ZaiApiProviderAdapter",
+    "ZaiCodingPlanProviderAdapter",
+    "ZaiStartPlanProviderAdapter",
     "ZAI_MODEL_FALLBACK_IDS",
 ]

package/ciel_runtime_support/provider_administration_context.py

@@ -70,13 +70,23 @@ class ProviderAdministrationContext:
         for line in self.run_copilot_oauth_action(args.action):
             self.infrastructure.output(line, flush=True)
 
-    def run_zai_oauth_action(self, action: str, *, no_browser: bool = False) -> list[str]:
-        return self.infrastructure.zai_oauth().action(action, no_browser=no_browser)
+    def run_zai_oauth_action(
+        self,
+        action: str,
+        *,
+        no_browser: bool = False,
+        profile: str = "coding-plan",
+    ) -> list[str]:
+        return self.infrastructure.zai_oauth().action(
+            action, no_browser=no_browser, profile=profile
+        )
 
     def cmd_zai_oauth(self, args: argparse.Namespace) -> None:
         try:
             lines = self.run_zai_oauth_action(
-                args.action, no_browser=bool(getattr(args, "no_browser", False))
+                args.action,
+                no_browser=bool(getattr(args, "no_browser", False)),
+                profile=str(getattr(args, "profile", "coding-plan")),
             )
         except RuntimeError as exc:
             raise SystemExit(f"Z.AI OAuth failed: {exc}") from exc
@@ -161,8 +171,16 @@ class ProviderAdministrationCompatibilityApi:
     def cmd_copilot_oauth(self, args: argparse.Namespace) -> None:
         self.context().cmd_copilot_oauth(args)
 
-    def run_zai_oauth_action(self, action: str, *, no_browser: bool = False) -> list[str]:
-        return self.context().run_zai_oauth_action(action, no_browser=no_browser)
+    def run_zai_oauth_action(
+        self,
+        action: str,
+        *,
+        no_browser: bool = False,
+        profile: str = "coding-plan",
+    ) -> list[str]:
+        return self.context().run_zai_oauth_action(
+            action, no_browser=no_browser, profile=profile
+        )
 
     def cmd_zai_oauth(self, args: argparse.Namespace) -> None:
         self.context().cmd_zai_oauth(args)

package/ciel_runtime_support/provider_compatibility.py

@@ -154,6 +154,18 @@ PROVIDER_COMPATIBILITY = ProviderCompatibilityRegistry(
             auto_web_search=_zai_auto_web_search,
             tool_use_blocker=_zai_tool_use_blocker,
         ),
+        "zai-api": ProviderCompatibilityPolicy(
+            auto_web_search=_zai_auto_web_search,
+            tool_use_blocker=_zai_tool_use_blocker,
+        ),
+        "zai-coding-plan": ProviderCompatibilityPolicy(
+            auto_web_search=_zai_auto_web_search,
+            tool_use_blocker=_zai_tool_use_blocker,
+        ),
+        "zai-start-plan": ProviderCompatibilityPolicy(
+            auto_web_search=_zai_auto_web_search,
+            tool_use_blocker=_zai_tool_use_blocker,
+        ),
     }
 )
 

package/ciel_runtime_support/provider_runtime_modes.py

@@ -144,7 +144,7 @@ def build_default_native_compatibility_policy(
             "deepseek": frozenset({"deepseek"}),
             "opencode": frozenset(OPENCODE_PROVIDER_NAMES),
             "kimi": frozenset({"kimi"}),
-            "zai": frozenset({"zai"}),
+            "zai": frozenset({"zai", "zai-coding-plan", "zai-start-plan"}),
             "fireworks": frozenset({"fireworks"}),
         },
     )

package/ciel_runtime_support/providers/__init__.py

@@ -17,7 +17,12 @@ from .nvidia import NvidiaHostedProviderAdapter
 from .vllm import VllmProviderAdapter
 from .deepseek import DeepSeekProviderAdapter
 from .fireworks import FireworksProviderAdapter
-from .zai import ZaiProviderAdapter
+from .zai import (
+    ZaiApiProviderAdapter,
+    ZaiCodingPlanProviderAdapter,
+    ZaiProviderAdapter,
+    ZaiStartPlanProviderAdapter,
+)
 from .kimi import KimiProviderAdapter
 from .opencode import OpenCodeProviderAdapter
 from .opencode_go import OpenCodeGoProviderAdapter
@@ -65,6 +70,9 @@ __all__ = [
     "DeepSeekProviderAdapter",
     "FireworksProviderAdapter",
     "ZaiProviderAdapter",
+    "ZaiApiProviderAdapter",
+    "ZaiCodingPlanProviderAdapter",
+    "ZaiStartPlanProviderAdapter",
     "KimiProviderAdapter",
     "OpenCodeProviderAdapter",
     "OpenCodeGoProviderAdapter",

package/ciel_runtime_support/providers/constants.py

@@ -14,6 +14,9 @@ PROVIDER_DEFAULT_BASE_URLS: dict[str, str] = {
     "opencode-go": "https://opencode.ai/zen/go",
     "kimi": "https://api.kimi.com/coding",
     "zai": "https://api.z.ai/api/anthropic",
+    "zai-api": "https://api.z.ai/api/paas/v4",
+    "zai-coding-plan": "https://api.z.ai/api/coding/paas/v4",
+    "zai-start-plan": "https://zcode.z.ai/api/v1/zcode-plan",
     "vllm": "http://127.0.0.1:8000",
     "lm-studio": "http://127.0.0.1:1234/v1",
     "nvidia-hosted": "https://integrate.api.nvidia.com/v1",

package/ciel_runtime_support/providers/zai.py

@@ -11,6 +11,7 @@ from ..architecture import (
     ProviderOptionPresentationPolicy,
     ProviderRequestPolicy,
     ProviderStatusPolicy,
+    MessageProtocol,
 )
 from .base import HttpBearerProviderAdapter, provider_configuration
 from .constants import PROVIDER_DEFAULT_BASE_URLS, ZAI_MODEL_FALLBACK_IDS
@@ -85,19 +86,37 @@ class ZaiProviderAdapter(HttpBearerProviderAdapter):
         self, config: ProviderConfig
     ) -> tuple[Mapping[str, Any], str | None]:
         model = self.normalize_model_id(config.model).split("[", 1)[0].lower()
-        if model != "glm-5.3":
+        documented_profiles: dict[str, tuple[int, str]] = {
+            "glm-5.1": (200_000, "200K"),
+            "glm-5.2": (1_000_000, "1M"),
+            "glm-5.3": (1_000_000, "1M"),
+        }
+        documented = documented_profiles.get(model)
+        if documented is None:
             return {}, None
+        context_window, context_label = documented
+        profile: dict[str, Any] = {
+            "context_window": context_window,
+            "max_model_len": context_window,
+            "auto_compact_window": context_window,
+            "max_output_tokens": 131_072,
+            "context_reserve_tokens": 131_072,
+            "model_profile": f"{model}-{context_label.lower()}",
+        }
+        if model == "glm-5.3":
+            profile["effort_level"] = "max"
+            notice = (
+                "GLM-5.3 profile applied: 1M context, 128K maximum output, "
+                "and max reasoning effort. Start a new session."
+            )
+        else:
+            notice = (
+                f"{model.upper()} profile applied: {context_label} context and "
+                "128K maximum output. Start a new session."
+            )
         return (
-            {
-                "context_window": 1_000_000,
-                "max_model_len": 1_000_000,
-                "auto_compact_window": 1_000_000,
-                "max_output_tokens": 131_072,
-                "context_reserve_tokens": 131_072,
-                "effort_level": "max",
-                "model_profile": "glm-5.3-1m",
-            },
-            "GLM-5.3 profile applied: 1M context, 128K maximum output, and max reasoning effort. Start a new session.",
+            profile,
+            notice,
         )
 
     def normalize_request_options(
@@ -165,4 +184,163 @@ class ZaiProviderAdapter(HttpBearerProviderAdapter):
         )
 
 
-__all__ = ["ZaiProviderAdapter"]
+@dataclass(frozen=True)
+class ZaiApiProviderAdapter(ZaiProviderAdapter):
+    """General pay-as-you-go Z.AI API using the documented OpenAI surface."""
+
+    name: str = "zai-api"
+    base_url: str = PROVIDER_DEFAULT_BASE_URLS["zai-api"]
+    include_x_api_key: bool = False
+    capabilities_value: ProviderCapabilities = field(
+        default_factory=lambda: ProviderCapabilities(
+            upstream_protocol="openai_chat",
+            supports_thinking=True,
+            requires_api_key=True,
+        )
+    )
+    request_policy_value: ProviderRequestPolicy = field(
+        default_factory=lambda: ProviderRequestPolicy(
+            chat_path="/chat/completions", models_path="/models"
+        )
+    )
+    api_key_display_name_value: str = "Z.AI Model API"
+    api_key_launch_error_value: str = (
+        "Launch blocked: Z.AI Model API requires a pay-as-you-go API key."
+    )
+
+    def supported_protocols(
+        self, config: ProviderConfig, model: str | None = None
+    ) -> frozenset[MessageProtocol]:
+        del config, model
+        return frozenset({"openai_chat"})
+
+    def select_protocol(
+        self,
+        operation: MessageProtocol,
+        config: ProviderConfig,
+        model: str | None = None,
+    ) -> MessageProtocol:
+        del operation, config, model
+        return "openai_chat"
+
+    def router_native_anthropic_enabled(
+        self, config: ProviderConfig, model: str | None = None
+    ) -> bool:
+        del config, model
+        return False
+
+
+@dataclass(frozen=True)
+class ZaiCodingPlanProviderAdapter(ZaiApiProviderAdapter):
+    """Explicit Coding Plan profile with distinct OpenAI and Anthropic URLs."""
+
+    name: str = "zai-coding-plan"
+    base_url: str = PROVIDER_DEFAULT_BASE_URLS["zai-coding-plan"]
+    include_x_api_key: bool = True
+    configuration_defaults_value: dict = field(
+        default_factory=lambda: {
+            **ZaiProviderAdapter().configuration_defaults_value,
+            "native_compat": True,
+            "plan_type": "coding-plan",
+        }
+    )
+    api_key_display_name_value: str = "Z.AI Coding Plan"
+    api_key_launch_error_value: str = (
+        "Launch blocked: Z.AI Coding Plan requires a Coding Plan API key or OAuth login."
+    )
+
+    def supported_protocols(
+        self, config: ProviderConfig, model: str | None = None
+    ) -> frozenset[MessageProtocol]:
+        del model
+        protocols: set[MessageProtocol] = {"openai_chat"}
+        if bool(config.options.get("native_compat", True)):
+            protocols.add("anthropic_messages")
+        return frozenset(protocols)
+
+    def select_protocol(
+        self,
+        operation: MessageProtocol,
+        config: ProviderConfig,
+        model: str | None = None,
+    ) -> MessageProtocol:
+        return (
+            "anthropic_messages"
+            if operation == "anthropic_messages"
+            and "anthropic_messages" in self.supported_protocols(config, model)
+            else "openai_chat"
+        )
+
+    def anthropic_base_url(self, config: ProviderConfig) -> str:
+        del config
+        return PROVIDER_DEFAULT_BASE_URLS["zai"]
+
+    def router_native_anthropic_enabled(
+        self, config: ProviderConfig, model: str | None = None
+    ) -> bool:
+        del model
+        return bool(config.options.get("native_compat", True))
+
+
+@dataclass(frozen=True)
+class ZaiStartPlanProviderAdapter(ZaiCodingPlanProviderAdapter):
+    """ZCode Start Plan gateway profile backed by an OAuth JWT."""
+
+    name: str = "zai-start-plan"
+    base_url: str = PROVIDER_DEFAULT_BASE_URLS["zai-start-plan"]
+    include_x_api_key: bool = False
+    configuration_defaults_value: dict = field(
+        default_factory=lambda: {
+            **ZaiProviderAdapter().configuration_defaults_value,
+            "native_compat": True,
+            "plan_type": "start-plan",
+            "zcode_app_version": "3.8.1",
+        }
+    )
+    api_key_display_name_value: str = "Z.AI Start Plan OAuth"
+    api_key_launch_error_value: str = (
+        "Launch blocked: Z.AI Start Plan requires its own OAuth login."
+    )
+
+    def anthropic_base_url(self, config: ProviderConfig) -> str:
+        del config
+        return "https://zcode.z.ai/api/v1/zcode-plan/anthropic"
+
+    def build_headers(
+        self, config: ProviderConfig, api_key: str | None
+    ) -> Mapping[str, str]:
+        headers = dict(super().build_headers(config, api_key))
+        version = str(config.options.get("zcode_app_version") or "3.8.1").strip()
+        headers.update(
+            {
+                "User-Agent": f"ZCode/{version}",
+                "HTTP-Referer": "https://zcode.z.ai",
+                "X-ZCode-App-Version": version,
+                "X-ZCode-Agent": "glm",
+                "X-Title": "Z Code@cli",
+            }
+        )
+        return headers
+
+    def build_model_headers(
+        self, config: ProviderConfig, api_key: str | None
+    ) -> Mapping[str, str]:
+        return self.build_headers(config, api_key)
+
+    def launch_api_key_error(self, config: ProviderConfig) -> str | None:
+        if not config.api_keys:
+            return self.api_key_launch_error_value
+        return (
+            "Launch blocked: Z.AI Start Plan requires a fresh Aliyun CAPTCHA "
+            "runtime header before each model request. The installed ZCode "
+            "runtime provides that private interactive flow; Ciel Runtime does "
+            "not bypass or fabricate it for routed clients."
+        )
+
+
+__all__ = [
+    "ZaiApiProviderAdapter",
+    "ZaiCodingPlanProviderAdapter",
+    "ZaiProviderAdapter",
+    "ZaiStartPlanProviderAdapter",
+]

package/ciel_runtime_support/runtime_constants.py

@@ -87,7 +87,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.28"
+VERSION = "0.2.29"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11
@@ -135,9 +135,19 @@ CODEX_OPENAI_COMPATIBLE_ROUTER_PROVIDERS = (
     *OPENAI_COMPATIBLE_ROUTER_PROVIDERS,
     "kimi",
     "fireworks",
+    "zai-api",
+    "zai-coding-plan",
+    "zai-start-plan",
 )
 AUTO_DETECT_NATIVE_COMPAT_PROVIDERS = ("vllm", "lm-studio", "self-hosted-nim")
-CLAUDE_ANTHROPIC_ENDPOINT_PROVIDERS = ("deepseek", "kimi", "zai", "fireworks")
+CLAUDE_ANTHROPIC_ENDPOINT_PROVIDERS = (
+    "deepseek",
+    "kimi",
+    "zai",
+    "zai-coding-plan",
+    "zai-start-plan",
+    "fireworks",
+)
 ROUTED_COMPAT_PROMPT = (
     "You are running inside Claude Code through the ciel-runtime router. Do not stop after announcing what you plan to do. "
     "When the user asks you to create, edit, or run code, immediately use the available Claude Code tools such as Write, Edit, Read, and Bash as appropriate, "

package/ciel_runtime_support/zai_oauth.py

@@ -1,8 +1,9 @@
-"""Z.AI CLI OAuth and Coding Plan API-key resolution.
+"""Z.AI CLI OAuth with plan-scoped credential storage.
 
 The wire contract mirrors the cross-platform init/poll flow exposed by the
-ZCode runtime.  Ciel stores only the final Coding Plan API key; transient OAuth
-access tokens and ZCode JWTs are deliberately kept in memory.
+ZCode runtime. Coding Plan stores its resolved API key, while Start Plan stores
+the ZCode JWT required by its separate gateway. Credentials are never written
+into the legacy/manual ``zai`` provider profile.
 """
 
 from __future__ import annotations
@@ -55,6 +56,8 @@ class ZaiOAuthInit:
 class ZaiOAuthResult:
     api_key: str
     user_id: str
+    access_token: str = ""
+    jwt_token: str = ""
 
 
 class ZaiOAuthHttp:
@@ -337,7 +340,13 @@ class ZaiOAuthService:
     random_token: Callable[[], str] = lambda: secrets.token_hex(32)
     timeout_seconds: float = ZAI_OAUTH_TIMEOUT_SECONDS
 
-    def login(self, *, no_browser: bool = False, on_authorize_url: Callable[[str], None]) -> ZaiOAuthResult:
+    def login(
+        self,
+        *,
+        no_browser: bool = False,
+        on_authorize_url: Callable[[str], None],
+        profile: str = "coding-plan",
+    ) -> ZaiOAuthResult:
         poll_token = self.random_token()
         try:
             initialized = self.client.initialize(poll_token)
@@ -348,6 +357,7 @@ class ZaiOAuthService:
                 state=poll_token,
                 no_browser=no_browser,
                 on_authorize_url=on_authorize_url,
+                profile=profile,
             )
         on_authorize_url(initialized.authorize_url)
         if not no_browser:
@@ -359,7 +369,7 @@ class ZaiOAuthService:
             if status == "failed":
                 raise ZaiOAuthError("Z.AI OAuth authorization was denied or failed.")
             if status == "ready":
-                return self._resolve_result(result)
+                return self._resolve_result(result, profile=profile)
             self.sleep(min(initialized.poll_interval_seconds, max(0.0, deadline - self.now())))
         raise ZaiOAuthError("Z.AI OAuth authorization timed out.")
 
@@ -369,6 +379,7 @@ class ZaiOAuthService:
         state: str,
         no_browser: bool,
         on_authorize_url: Callable[[str], None],
+        profile: str,
     ) -> ZaiOAuthResult:
         try:
             with self.callback_receiver_factory(state, self.timeout_seconds) as receiver:
@@ -385,10 +396,13 @@ class ZaiOAuthService:
                 callback_url,
                 state,
                 redirect_uri=redirect_uri,
-            )
+            ),
+            profile=profile,
         )
 
-    def _resolve_result(self, result: Mapping[str, Any]) -> ZaiOAuthResult:
+    def _resolve_result(
+        self, result: Mapping[str, Any], *, profile: str
+    ) -> ZaiOAuthResult:
         zai = result.get("zai")
         access_token = (
             str(zai.get("access_token") or "").strip()
@@ -401,12 +415,27 @@ class ZaiOAuthService:
             if isinstance(user, Mapping)
             else ""
         )
-        if not access_token or not user_id:
+        jwt_token = str(result.get("token") or "").strip()
+        if not access_token or not jwt_token or not user_id:
             raise ZaiOAuthError(
                 "Z.AI OAuth ready response is missing credentials or user identity."
             )
+        if profile == "start-plan":
+            return ZaiOAuthResult(
+                api_key=jwt_token,
+                user_id=user_id,
+                access_token=access_token,
+                jwt_token=jwt_token,
+            )
+        if profile != "coding-plan":
+            raise ZaiOAuthError(f"Unsupported Z.AI OAuth profile: {profile}")
         api_key = self.client.resolve_coding_plan_api_key(access_token)
-        return ZaiOAuthResult(api_key=api_key, user_id=user_id)
+        return ZaiOAuthResult(
+            api_key=api_key,
+            user_id=user_id,
+            access_token=access_token,
+            jwt_token=jwt_token,
+        )
 
 
 @dataclass(frozen=True, slots=True)
@@ -424,19 +453,35 @@ class ZaiOAuthRuntime:
     service: ZaiOAuthService
     ports: ZaiOAuthRuntimePorts
 
-    def token(self) -> str:
+    @staticmethod
+    def _provider_id(profile: str) -> str:
+        normalized = str(profile or "coding-plan").strip().lower()
+        if normalized == "coding-plan":
+            return "zai-coding-plan"
+        if normalized == "start-plan":
+            return "zai-start-plan"
+        raise ZaiOAuthError(f"Unsupported Z.AI OAuth profile: {profile}")
+
+    def token(self, profile: str = "coding-plan") -> str:
         config = self.ports.load_config()
-        provider = config.get("providers", {}).get("zai", {})
+        provider = config.get("providers", {}).get(self._provider_id(profile), {})
         if provider.get("credential_source") != "zai-oauth":
             return ""
         return str(provider.get("api_key") or "").strip()
 
-    def import_api_key(self, api_key: str, *, source: str = "zcode") -> list[str]:
+    def import_api_key(
+        self,
+        api_key: str,
+        *,
+        source: str = "zcode",
+        profile: str = "coding-plan",
+    ) -> list[str]:
         key = str(api_key or "").strip()
         if not key:
             return ["Z.AI OAuth import skipped: no Coding Plan API key was found."]
         config = self.ports.load_config()
-        provider = config.setdefault("providers", {}).setdefault("zai", {})
+        provider_id = self._provider_id(profile)
+        provider = config.setdefault("providers", {}).setdefault(provider_id, {})
         if (
             str(provider.get("api_key") or "").strip() == key
             and provider.get("credential_source") == "zai-oauth"
@@ -447,7 +492,7 @@ class ZaiOAuthRuntime:
         provider["credential_source"] = "zai-oauth"
         provider["oauth_authenticated_at"] = datetime.now(timezone.utc).isoformat()
         provider["oauth_import_source"] = str(source or "zcode")
-        config["current_provider"] = "zai"
+        config["current_provider"] = provider_id
         self.ports.save_config(config)
         self.ports.clear_model_cache()
         return [
@@ -455,25 +500,34 @@ class ZaiOAuthRuntime:
             f"Credential: {self.ports.mask(key)}; fp {self.ports.fingerprint(key)}",
         ]
 
-    def action(self, action: str, *, no_browser: bool = False) -> list[str]:
+    def action(
+        self,
+        action: str,
+        *,
+        no_browser: bool = False,
+        profile: str = "coding-plan",
+    ) -> list[str]:
+        provider_id = self._provider_id(profile)
+        profile_label = "Coding Plan" if profile == "coding-plan" else "Start Plan"
         if action == "status":
-            token = self.token()
+            token = self.token(profile)
             if not token:
-                return ["Z.AI OAuth: not connected."]
+                return [f"Z.AI OAuth {profile_label}: not connected."]
             return [
-                "Z.AI OAuth: connected (Coding Plan API key).",
+                f"Z.AI OAuth {profile_label}: connected.",
                 f"Credential: {self.ports.mask(token)}; fp {self.ports.fingerprint(token)}",
             ]
         if action == "logout":
             config = self.ports.load_config()
-            provider = config.get("providers", {}).get("zai", {})
+            provider = config.get("providers", {}).get(provider_id, {})
             if provider.get("credential_source") != "zai-oauth":
-                return ["Z.AI OAuth: no OAuth-derived local credential to clear."]
+                return [f"Z.AI OAuth {profile_label}: no OAuth-derived local credential to clear."]
             provider.pop("api_key", None)
             provider.pop("api_keys", None)
             provider.pop("credential_source", None)
             provider.pop("oauth_authenticated_at", None)
             provider.pop("oauth_user_id", None)
+            provider.pop("oauth_access_token", None)
             self.ports.save_config(config)
             self.ports.clear_model_cache()
             return ["Z.AI OAuth-derived local credential cleared. Remote authorization was not revoked."]
@@ -481,24 +535,30 @@ class ZaiOAuthRuntime:
             return [f"Unsupported Z.AI OAuth action: {action}"]
         result = self.service.login(
             no_browser=no_browser,
+            profile=profile,
             on_authorize_url=lambda url: self.ports.output(
                 f"Open this URL to authorize Z.AI:\n{url}", flush=True
             ),
         )
         config = self.ports.load_config()
-        provider = config.setdefault("providers", {}).setdefault("zai", {})
+        provider = config.setdefault("providers", {}).setdefault(provider_id, {})
         provider["api_key"] = result.api_key
         provider.pop("api_keys", None)
         provider["credential_source"] = "zai-oauth"
         provider["oauth_authenticated_at"] = datetime.now(timezone.utc).isoformat()
         provider["oauth_user_id"] = result.user_id
-        config["current_provider"] = "zai"
+        config["current_provider"] = provider_id
         self.ports.save_config(config)
         self.ports.clear_model_cache()
-        return [
-            "Z.AI OAuth login completed; the resolved Coding Plan API key is active.",
+        lines = [
+            f"Z.AI OAuth login completed; the {profile_label} credential is active.",
             f"Credential: {self.ports.mask(result.api_key)}; fp {self.ports.fingerprint(result.api_key)}",
         ]
+        if profile == "start-plan":
+            lines.append(
+                "Start Plan routed launch remains blocked because ZCode requires a fresh interactive CAPTCHA runtime header for model requests."
+            )
+        return lines
 
 
 __all__ = [

package/ciel_runtime_support/zcode_runtime_context.py

@@ -104,10 +104,21 @@ class ZcodeRuntimeContext:
             return "logout"
         return None
 
+    @staticmethod
+    def _shared_oauth_profile(argv: list[str]) -> str:
+        for index, value in enumerate(argv):
+            if value.startswith("--profile="):
+                return value.split("=", 1)[1].strip() or "coding-plan"
+            if value == "--profile" and index + 1 < len(argv):
+                return str(argv[index + 1]).strip() or "coding-plan"
+        return "coding-plan"
+
     def _run_shared_oauth(self, action: str, argv: list[str]) -> int:
         try:
             lines = self.lifecycle.oauth_action(
-                action, no_browser="--no-browser" in argv
+                action,
+                no_browser="--no-browser" in argv,
+                profile=self._shared_oauth_profile(argv),
             )
         except RuntimeError as exc:
             self.process.print_line(f"Z.AI OAuth failed: {exc}", flush=True)

package/docs/CLI-Reference.md

@@ -44,13 +44,16 @@ Codex 런처는 `~/.codex/config.toml`을 수정하지 않는다. 실행 시점
 ciel-runtime zcode
 ciel-runtime --ca-runtime zcode -- --continue
 ciel-runtimectl launch-zcode --prompt "작업 내용"
+ciel-runtime zcode login --oauth --profile coding-plan
+ciel-runtime zcode login --oauth --profile start-plan
 ```
 
 ZCode는 워크스페이스별 Ciel 관리 홈과 `ZCODE_STORAGE_DIR`을 사용한다. 선택된
 provider/model은 로컬 Anthropic Router 설정으로 투영되며 사용자의 일반
 `%USERPROFILE%\.zcode` 또는 `~/.zcode` 설정은 덮어쓰지 않는다. `ciel-runtime
-zcode login --oauth`와 API-key 패널의 Z.AI OAuth는 Ciel 공용 credential store에
-Coding Plan 키를 저장하므로 다른 런타임도 같은 키를 사용한다.
+zcode login --oauth`와 API-key 패널의 Z.AI OAuth는 별도 `zai-coding-plan`
+profile에 Coding Plan 키를 저장하므로 다른 routed runtime도 같은 키를 사용한다.
+기존 `zai` 수동 키는 변경하지 않는다.
 
 ---
 
@@ -112,21 +115,27 @@ ciel-runtimectl base-url ollama http://remote-server:11434
 #### `zai-oauth`
 
 ```bash
-ciel-runtimectl zai-oauth login
-ciel-runtimectl zai-oauth login --no-browser
-ciel-runtimectl zai-oauth status
-ciel-runtimectl zai-oauth logout
+ciel-runtimectl zai-oauth login --profile coding-plan
+ciel-runtimectl zai-oauth login --profile coding-plan --no-browser
+ciel-runtimectl zai-oauth status --profile coding-plan
+ciel-runtimectl zai-oauth logout --profile coding-plan
+ciel-runtimectl zai-oauth login --profile start-plan
+ciel-runtimectl zai-oauth status --profile start-plan
+ciel-runtimectl zai-oauth logout --profile start-plan
 ```
 
-ZCode CLI의 Z.AI init/poll OAuth 흐름으로 로그인하고 Coding Plan API key를
-발급한다. init endpoint가 404이면 공개 ZCode 래퍼와 동일한 authorization-code
+기본 profile은 `coding-plan`이다. ZCode CLI의 Z.AI init/poll OAuth 흐름으로
+로그인하고 Coding Plan API key를 발급한다. init endpoint가 404이면 확인된
+authorization-code
 계약으로 전환하며, `http://localhost:9899/callback`의 일회성 loopback listener가
 브라우저 콜백을 자동으로 수신한다. `--no-browser`는 브라우저를 자동으로 열지
 않지만 동일한 listener에서 기다린다. 브라우저와 Ciel Runtime이 서로 다른
 머신이면 먼저 `ssh -L 9899:127.0.0.1:9899 user@runtime-host`처럼 callback port를
-전달해야 한다. Ciel은 OAuth access token이나 ZCode JWT를 디스크에 저장하지
-않는다. `logout`은 OAuth로 만든 로컬 API key만 지우며 원격 승인을 철회하지
-않는다.
+전달해야 한다. Coding Plan은 최종 API key만 저장한다. Start Plan은 별도
+`zai-start-plan` profile에 ZCode JWT만 저장하고 OAuth access token은 저장하지
+않는다. Start Plan의 모델 요청은 fresh Aliyun CAPTCHA runtime header가 필요하다는
+실제 응답이 확인되어 routed launch가 차단된다. `logout`은 선택한 profile의 로컬
+credential만 지우며 원격 승인을 철회하지 않는다.
 
 #### `api-key`
 ```bash

package/docs/Installation.md

@@ -127,9 +127,13 @@ ciel-runtime zcode --continue
 
 ZCode가 없으면 `zcode-app-cli`를 npm으로 설치한다. 실행 시 워크스페이스별
 Ciel 관리 홈을 사용하고 선택된 provider/model을 로컬 Router로 연결한다.
-Z.AI OAuth는 `ciel-runtimectl zai-oauth login` 또는 `ciel-runtime zcode login
---oauth`로 등록하며, 최종 Coding Plan API key만 Ciel의 공용 provider 설정에
-저장되어 Claude, Codex, AGY, ZCode 등 routed client가 함께 사용한다.
+Z.AI Coding Plan OAuth는 `ciel-runtimectl zai-oauth login --profile coding-plan`
+또는 `ciel-runtime zcode login --oauth`로 등록한다. 최종 Coding Plan API key는
+별도 `zai-coding-plan` provider 설정에 저장되어 Claude, Codex, AGY, ZCode 등
+routed client가 함께 사용하며 기존 `zai` 수동 API key를 덮어쓰지 않는다.
+`--profile start-plan`은 별도 JWT를 저장하지만, Start Plan 모델 요청에 필요한
+fresh Aliyun CAPTCHA runtime header를 Ciel이 생성하지 않으므로 routed launch는
+명시적으로 차단한다.
 
 ---
 

package/docs/Providers.md

@@ -16,6 +16,9 @@
 | `opencode-go` | OpenCode Go | Anthropic Messages / OpenAI Chat | `https://opencode.ai/zen/go` |
 | `kimi` | Kimi.com | Anthropic Messages / OpenAI Chat | `https://api.kimi.com/coding` |
 | `zai` | Z.AI GLM | Anthropic Messages | `https://api.z.ai/api/anthropic` |
+| `zai-api` | Z.AI Model API (API Key) | OpenAI Chat | `https://api.z.ai/api/paas/v4` |
+| `zai-coding-plan` | Z.AI Coding Plan | Anthropic Messages / OpenAI Chat | `https://api.z.ai/api/coding/paas/v4` |
+| `zai-start-plan` | Z.AI Start Plan | 프로필 등록됨, routed launch 차단 | `https://zcode.z.ai/api/v1/zcode-plan` |
 | `vllm` | vLLM | OpenAI Chat | 로컬/원격 vLLM |
 | `lm-studio` | LM Studio | OpenAI Chat | 로컬 LM Studio |
 | `nvidia-hosted` | Nvidia Hosted | OpenAI Chat | NVIDIA NIM Cloud |
@@ -181,20 +184,48 @@ Anthropic thinking 객체나 문서로 확인되지 않은 GLM-5.2 effort 문자
 
 ## ZAI (Z.AI GLM)
 
-- GLM 시리즈 모델 제공.
+Z.AI의 API key, Coding Plan, Start Plan을 서로 다른 provider profile로 보존한다.
+기존 `zai` provider와 그 수동 API key는 마이그레이션하거나 덮어쓰지 않는다.
+
+| profile | 인증 | Ciel OpenAI 경로 | Anthropic 경로 |
+|---------|------|------------------|----------------|
+| `zai` | 기존 수동 API key | 해당 없음 | `https://api.z.ai/api/anthropic` |
+| `zai-api` | 일반 종량제 API key | `https://api.z.ai/api/paas/v4` | 공식 모델 문서에서 일반 API용 별도 Anthropic URL을 확인하지 못했으므로 사용하지 않음 |
+| `zai-coding-plan` | Coding Plan API key 또는 `--profile coding-plan` OAuth | `https://api.z.ai/api/coding/paas/v4` | `https://api.z.ai/api/anthropic` |
+| `zai-start-plan` | `--profile start-plan` OAuth JWT | `https://zcode.z.ai/api/v1/zcode-plan` | `https://zcode.z.ai/api/v1/zcode-plan/anthropic` |
+
+Coding Plan의 OpenAI Chat/Anthropic URL은 Z.AI 공식 Tool Integration 문서에
+기재된 값이다. Start Plan URL과 JWT 저장 형태는 설치된 ZCode 3.8.1-15 runtime의
+provider 설정에서 확인했다. 그러나 실제 Start Plan JWT 요청은 fresh
+`x-aliyun-captcha-verify-param`이 없으면 `400`, provider code `3007`,
+`captcha verify failed`로 거절됐다. 이 값은 ZCode의 대화형 private runtime이
+요청마다 갱신한다. Ciel은 CAPTCHA를 우회하거나 값을 위조하지 않으며, 따라서
+`zai-start-plan`을 routed client로 실행하려 하면 원인을 표시하고 launch를 차단한다.
+
+```bash
+ciel-runtimectl zai-oauth login --profile coding-plan
+ciel-runtimectl zai-oauth status --profile coding-plan
+ciel-runtimectl zai-oauth login --profile start-plan
+ciel-runtimectl zai-oauth status --profile start-plan
+```
+
+Coding Plan 로그인은 최종 plan API key만 `zai-coding-plan`에 저장한다. Start Plan
+로그인은 ZCode JWT만 `zai-start-plan`에 저장하며 OAuth access token은 저장하지
+않는다. 두 로그인 모두 기존 `zai` credential을 변경하지 않는다.
+
 - 기본 모델: `glm-5.3[1m]`
-- ZCode CLI의 init/poll 및 localhost:9899 authorization-code fallback OAuth 흐름: `ciel-runtimectl zai-oauth login`
-- OAuth access token과 ZCode JWT는 메모리에만 유지하고, 최종 Coding Plan API key만 기존 Ciel credential 규칙으로 저장한다.
 - GLM-5.3은 reasoning을 끌 수 없으며 `low`, `high`, `max` effort만 사용한다.
-- Managed MCP 서버 포함: `web-search-prime`, `web-reader`, `zread`
-- 컨텍스트 힌트:
-
-| 모델 접두사 | 컨텍스트 |
-|-----------|---------|
-| `glm-5.3` | 1,000,000 |
-| `glm-5.2` | 1,000,000 |
-| `glm-5-turbo` | 200,000 |
-| `glm-4.7` | 200,000 |
+- `zai`, `zai-api`, `zai-coding-plan`은 Managed MCP 서버 `web-search-prime`,
+  `web-reader`, `zread`를 사용할 수 있다.
+- 공식 모델 한도:
+
+| 모델 접두사 | 컨텍스트 | 최대 출력 |
+|-----------|---------:|----------:|
+| `glm-5.3` | 1,000,000 | 131,072 |
+| `glm-5.2` | 1,000,000 | 131,072 |
+| `glm-5.1` | 200,000 | 131,072 |
+| `glm-5-turbo` | 200,000 | 모델별 동적 값 |
+| `glm-4.7` | 200,000 | 모델별 동적 값 |
 
 ---
 

package/docs/journal/2026/08/24/mia-zai-plan-profile-429-diagnosis.okf

@@ -0,0 +1,101 @@
+okf_version: "1.0"
+knowledge:
+  task:
+    id: mia-zai-plan-profile-429-diagnosis-20260824
+    date: "2026-08-24"
+    objective: >-
+      Determine how Z.AI Start Plan, Coding Plan, and general API usage are
+      distinguished and identify the evidence-backed cause of Mia's OAuth-login
+      success followed by HTTP 429.
+    status: diagnosis-complete
+
+  observed_runtime:
+    host: mia@100.95.132.58
+    provider: zai
+    model: glm-5.3
+    request_endpoint: https://api.z.ai/api/anthropic
+    error:
+      http_status: 429
+      provider_code: "1113"
+      provider_message: Insufficient balance or no resource package. Please recharge.
+    credential_status_text: connected (Coding Plan API key)
+
+  provider_evidence:
+    official_zai:
+      coding_plan_anthropic_endpoint: https://api.z.ai/api/anthropic
+      coding_plan_openai_endpoint: https://api.z.ai/api/coding/paas/v4
+      general_api_endpoint: https://api.z.ai/api/paas/v4
+      quota_probe_endpoint: https://api.z.ai/api/monitor/usage/quota/limit
+      mia_quota_probe:
+        code: 500
+        message: 当前用户不存在coding plan
+        translated_fact: current user has no Coding Plan
+        limits: []
+    installed_zcode:
+      package: zcode-app-cli
+      version: 3.8.1-15
+      provider_ids:
+        start_plan: builtin:zai-start-plan
+        coding_plan: builtin:zai-coding-plan
+        general_api: builtin:zai
+      start_plan_anthropic_endpoint: https://zcode.z.ai/api/v1/zcode-plan/anthropic
+      coding_plan_openai_endpoint: https://api.z.ai/api/coding/paas/v4
+      general_api_openai_endpoint: https://api.z.ai/api/paas/v4
+      start_plan_runtime_requirements:
+        - provider runtime headers refreshed before each request
+        - fresh x-aliyun-captcha-verify-param request header
+        - dedicated zcode-plan routes
+      start_plan_model_paths_signing:
+        required: false
+        evidence: >-
+          Installed ZCode source explicitly excludes the Start Plan Anthropic
+          and OpenAI model paths from client signing.
+
+  ciel_implementation_evidence:
+    result_fields_retained:
+      - api_key
+      - user_id
+    oauth_resolution: >-
+      The OAuth access token is unconditionally converted to a business API key
+      named zcode-api-key.
+    stored_provider: zai
+    stored_credential_source: zai-oauth
+    plan_identity_persisted: false
+    start_plan_access_token_persisted: false
+    zcode_jwt_persisted: false
+    status_entitlement_probe: false
+
+  direct_start_plan_probe:
+    credential_type: ZCode JWT
+    endpoint: https://zcode.z.ai/api/v1/zcode-plan/anthropic/v1/messages
+    authorization_bearer_result:
+      http_status: 400
+      provider_code: "3007"
+      provider_message: captcha verify failed
+    x_api_key_result:
+      http_status: 401
+    confirmed_boundary: >-
+      A Start Plan JWT and endpoint are insufficient for routed requests. A
+      fresh Aliyun CAPTCHA verification header is required by the observed
+      gateway response.
+
+  conclusion:
+    confirmed: >-
+      Ciel Runtime currently cannot distinguish the authorization page's Start
+      Plan selection from Coding Plan. OAuth success proves identity
+      authorization only. The resulting API key is routed to the Coding Plan
+      endpoint, while Z.AI's quota API says the Mia credential has no Coding
+      Plan. This mismatch produced provider code 1113 and the observed HTTP 429.
+    not_claimed: >-
+      The available evidence does not identify a documented public API that maps
+      the authorization-page selection directly to a stable plan identifier.
+
+  implementation_follow_up:
+    provider_profiles:
+      - zai-api
+      - zai-coding-plan
+      - zai-start-plan
+    legacy_zai_credential_preserved: true
+    coding_plan_oauth_target: zai-coding-plan
+    start_plan_oauth_target: zai-start-plan
+    start_plan_routed_launch: blocked-with-evidence

package/docs/journal/2026/08/24/zai-localhost-oauth-callback.okf

@@ -68,3 +68,15 @@ knowledge:
           tests: 255
           skipped: 12
       full_test_exit_code: 0
+    deployment:
+      functional_commit: d4ce317d36eba4cc91a3b852a217fbea2852bffb
+      main_ci: success
+      nightly_ci: success
+      main_publish: success
+      nightly_publish: success
+      npm_latest: 0.2.28
+      npm_nightly: 0.2.28-nightly.20260824-070710.d4ce317
+      registry_package_smoke_version: 0.2.28
+      mia_installed_version: 0.2.28-nightly.20260824-070710.d4ce317
+      mia_callback_http_status: 200
+      mia_callback_uri: http://localhost:9899/callback

package/docs/journal/2026/08/24/zai-plan-provider-login-separation.okf

@@ -0,0 +1,96 @@
+okf_version: "1.0"
+knowledge:
+  task:
+    id: zai-plan-provider-login-separation-20260824
+    date: "2026-08-24"
+    objective: >-
+      Separate Z.AI general API, Coding Plan, and Start Plan provider and OAuth
+      state while preserving the existing manual Z.AI API-key profile.
+    status: release-pending
+
+  evidence:
+    official_model_docs:
+      glm_5_1:
+        url: https://docs.z.ai/guides/llm/glm-5.1
+        model_id: glm-5.1
+        general_openai_base_url: https://api.z.ai/api/paas/v4
+        context_tokens: 200000
+        maximum_output_tokens: 131072
+      glm_5_2:
+        url: https://docs.z.ai/guides/llm/glm-5.2
+        model_id: glm-5.2
+        general_openai_base_url: https://api.z.ai/api/paas/v4
+        context_tokens: 1000000
+        maximum_output_tokens: 131072
+      glm_5_3:
+        url: https://docs.z.ai/guides/llm/glm-5.3
+        model_id: glm-5.3
+        context_tokens: 1000000
+        maximum_output_tokens: 131072
+    official_coding_plan:
+      url: https://docs.z.ai/devpack/tool/others
+      openai_chat_base_url: https://api.z.ai/api/coding/paas/v4
+      openai_responses_base_url: https://api.z.ai/api/v1
+      anthropic_base_url: https://api.z.ai/api/anthropic
+    installed_zcode_3_8_1_15:
+      start_openai_base_url: https://zcode.z.ai/api/v1/zcode-plan
+      start_anthropic_base_url: https://zcode.z.ai/api/v1/zcode-plan/anthropic
+      start_credential_type: ZCode OAuth JWT
+      model_paths_exempt_from_client_signing: true
+    live_start_probe:
+      bearer_jwt_http_status: 400
+      bearer_jwt_provider_code: "3007"
+      bearer_jwt_provider_message: captcha verify failed
+      x_api_key_http_status: 401
+
+  implementation:
+    profiles:
+      legacy_manual: zai
+      general_api_key: zai-api
+      coding_plan: zai-coding-plan
+      start_plan: zai-start-plan
+    oauth:
+      default_profile: coding-plan
+      accepted_profiles:
+        - coding-plan
+        - start-plan
+      legacy_manual_key_overwritten: false
+      oauth_access_token_persisted: false
+    safety_boundary:
+      start_plan_routed_launch: blocked
+      reason: fresh Aliyun CAPTCHA runtime header is unavailable
+      bypass_or_fabrication_implemented: false
+
+  validation:
+    targeted_zai_tests:
+      status: passed
+      count: 44
+    full_test_suite:
+      status: passed
+      unit:
+        passed: 1174
+        skipped: 44
+      router:
+        passed: 947
+      channel:
+        passed: 381
+        skipped: 80
+      runtime:
+        passed: 255
+        skipped: 12
+    static_checks:
+      ruff: passed
+      project_metadata: passed
+      diff_check: passed
+      main_module_line_count: 4980
+    package:
+      dry_run_version: 0.2.29
+    local_deployment:
+      installed_home: C:\Users\djlov\.local\share\ciel-runtime
+      version: 0.2.29
+      cli_profile_help_verified: true
+      provider_catalog_verified:
+        - zai-api
+        - zai-coding-plan
+    remaining:
+      - stable and nightly release verification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",