@oneciel-ai/ciel-runtime 0.2.32 → 0.2.33

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 This file records stable Ciel Runtime releases. Changes are grouped by user-visible
 capability, followed by the complete commit ledger merged into each release.
 
+## 0.2.33 — 2026-08-24
+
+- Send `User-Agent: ZCode/<configured app version>` for every Z.AI provider
+  profile, not only Start Plan.
+- Match ZCode's Anthropic Start Plan authentication wire contract by sending
+  the same credential in both `Authorization: Bearer` and `x-api-key`.
+- Allow an explicitly configured remote CAPTCHA receiver port to be reused by
+  consecutive model requests after the prior receiver shuts down.
+
 ## 0.2.32 — 2026-08-24
 
 - Keep Z.AI Start Plan wire identity aligned with the installed ZCode app:

package/ciel_runtime_support/providers/zai.py

@@ -42,6 +42,7 @@ class ZaiProviderAdapter(HttpBearerProviderAdapter):
             haiku_model="glm-4.7",
             subagent_model="glm-5.3[1m]",
             managed_mcp=True,
+            zcode_app_version="3.8.1",
         )
     )
     send_placeholder_key: bool = True
@@ -70,6 +71,19 @@ class ZaiProviderAdapter(HttpBearerProviderAdapter):
     def normalize_model_id(self, model_id: str) -> str:
         return str(model_id or "").strip()
 
+    def build_headers(
+        self, config: ProviderConfig, api_key: str | None
+    ) -> Mapping[str, str]:
+        headers = dict(super().build_headers(config, api_key))
+        version = str(config.options.get("zcode_app_version") or "3.8.1").strip()
+        headers["User-Agent"] = f"ZCode/{version}"
+        return headers
+
+    def build_model_headers(
+        self, config: ProviderConfig, api_key: str | None
+    ) -> Mapping[str, str]:
+        return self.build_headers(config, api_key)
+
     def upstream_api_model_id(self, model_id: str) -> str:
         return super().normalize_model_id(model_id)
 
@@ -289,7 +303,7 @@ class ZaiStartPlanProviderAdapter(ZaiCodingPlanProviderAdapter):
 
     name: str = "zai-start-plan"
     base_url: str = PROVIDER_DEFAULT_BASE_URLS["zai-start-plan"]
-    include_x_api_key: bool = False
+    include_x_api_key: bool = True
     capabilities_value: ProviderCapabilities = field(
         default_factory=lambda: ProviderCapabilities(
             upstream_protocol="anthropic_messages",

package/ciel_runtime_support/runtime_constants.py

@@ -87,7 +87,7 @@ OPENCODE_ENDPOINT_ALIASES = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.32"
+VERSION = "0.2.33"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/zai_start_plan_captcha.py

@@ -69,7 +69,7 @@ class ZaiStartPlanCaptchaConfig:
 
 class _LoopbackCaptchaServer(ThreadingHTTPServer):
     daemon_threads = True
-    allow_reuse_address = False
+    allow_reuse_address = True
 
 
 @dataclass(slots=True)

package/docs/Configuration.md

@@ -414,6 +414,10 @@ Z.AI Start Plan은 모델 요청 전에 공식 Aliyun CAPTCHA의 일회성 결
 있습니다. 브라우저가 없는 원격 호스트에서는 `provider-options`로 운영자
 브라우저가 접근할 callback origin을 설정할 수 있습니다.
 
+모든 Z.AI 프로필은 `zcode_app_version`에 맞춘
+`User-Agent: ZCode/<version>`을 전송합니다. Start Plan의 Anthropic 요청은 ZCode와
+동일하게 같은 OAuth JWT를 `Authorization: Bearer`와 `x-api-key`에 함께 넣습니다.
+
 ```bash
 ciel-runtimectl provider-options zai-start-plan \
   captcha_bind_host=100.95.132.58 \

package/docs/journal/2026/08/24/mia-zai-start-plan-auth-ua-wire-verification.okf

@@ -15,6 +15,10 @@ knowledge:
       app_version: 3.8.1
       header_builder_observation: >-
         The bundled ZCode runtime constructs User-Agent as ZCode/<appVersion>.
+      anthropic_auth_observation: >-
+        The bundled runtime's Anthropic factory adds Authorization: Bearer with
+        the provider credential and the Anthropic SDK also sends x-api-key with
+        that same credential.
     mia_installed_ciel_runtime:
       version: 0.2.31-nightly.20260824-143754.e0bf793
       provider: zai-start-plan
@@ -24,7 +28,7 @@ knowledge:
         authorization_present: true
         authorization_scheme: Bearer
         authorization_token_matches_configured_credential: true
-        x_api_key_present: false
+        x_api_key_present_before_0_2_33: false
       secret_handling: >-
         The credential value was not printed; verification used equality and
         scheme checks only.
@@ -42,9 +46,27 @@ knowledge:
       screenshot_observation: >-
         The official Aliyun SDK displayed a human slider puzzle; changing UA or
         running headed Chrome did not turn it into a traceless pass.
+    post_captcha_upstream:
+      endpoint: https://zcode.z.ai/api/v1/zcode-plan/anthropic/v1/messages
+      invalid_captcha_result: "HTTP 400, provider code 3007"
+      fresh_captcha_result: "HTTP 405, provider code 3012"
+      exact_zcode_identity_headers_tested: true
+      bearer_and_x_api_key_tested: true
+      model_tested: GLM-5.2
+      conclusion: >-
+        The remaining 3012 response occurs after CAPTCHA verification and is
+        not evidence of a missing User-Agent or missing credential header. Its
+        upstream cause is not yet established.
+    fixed_port_reuse:
+      mia_observation: >-
+        A consecutive request on configured port 42121 failed to bind with
+        Linux errno 98 while the previous connection was in TIME_WAIT.
 
   implementation:
-    auth_and_ua_behavior_change: none
+    auth_and_ua_behavior_change: >-
+      All Z.AI profiles now send User-Agent ZCode/<configured app version>.
+      Start Plan now sends its OAuth JWT in both Authorization: Bearer and
+      x-api-key, matching the installed ZCode Anthropic adapter.
     remote_captcha_callback:
       default_bind_host: 127.0.0.1
       configurable_fields:
@@ -59,7 +81,10 @@ knowledge:
       file: tests/test_zai_provider.py
       assertion: >-
         A real loopback HTTP request must retain User-Agent ZCode/3.8.1 and the
-        OAuth Bearer token and must not add X-Api-Key.
+        OAuth credential in both Authorization and X-Api-Key.
+    fixed_port_reuse_change: >-
+      The CAPTCHA HTTP server enables address reuse so an explicitly configured
+      port can serve consecutive request-scoped receivers.
 
   verification:
     completed:
@@ -70,6 +95,10 @@ knowledge:
       - remote callback GET 200 and state-bound result POST 204 from operator host
       - operator Chrome traceless verification completed with a 280-byte result
       - verification completion screenshot captured
+      - exact x-api-key-only live request returned HTTP 401
+      - exact Bearer plus x-api-key live request passed CAPTCHA and returned
+        upstream HTTP 405 / code 3012
+      - focused Z.AI regression tests: 55 passed
     pending:
-      - real Z.AI model response after CAPTCHA
+      - establish the upstream reason for provider code 3012
       - main, nightly, npm, and local deployment verification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, ZCode, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",