OAuth login succeeds but model calls fail with "captcha verify failed" — trial quota unreachable via CLI

[c2b247007]

Hi — love the project, but I'm hitting a wall with the Z.AI OAuth flow and the free "ZCode Start Plan" trial that comes with a new Z.ai account.

Setup:

Fresh Z.ai account, macOS
Ran zcode login → OAuth completed successfully (Login successful as )
Credentials saved to ~/.zcode/v2/credentials.json (oauth access token + JWT)
What happens:

zcode --prompt "reply exactly: ok" → ProviderBusinessError: captcha verify failed (error code 3007)
The account HAS the trial: balance API shows GLM-5.3: 3,000,000 + GLM-5-Turbo: 2,000,000 (ZCode Start Plan, active, daily reset)
The desktop app can use it fine — I saw no captcha in the desktop app
What I expected:

After OAuth, the CLI would use the session to hit the trial endpoint (https://zcode.z.ai/api/v1/zcode-plan/anthropic) with the trial quota — same as the desktop app
Questions:

Is the free "ZCode Start Plan" trial quota reachable through the CLI at all, or is it desktop-app-only?
The CLI's OAuth flow creates a session, but model calls go to api.z.ai/api/anthropic (the API-key path) instead of zcode.z.ai/api/v1/zcode-plan/anthropic (the trial path). Is there a config to point the CLI at the start-plan endpoint?
Is captcha verify failed (3007) something the CLI is supposed to handle? Is there a way for a human to solve it once (like the desktop app does)?
When I set provider.zai.options.baseURL to https://zcode.z.ai/api/v1/zcode-plan/anthropic with the OAuth JWT as apiKey, I get the same captcha verify failed — am I missing a header/cookie the desktop sends?

[kingsword09]

Thanks for the detailed report — I digged into this by reverse-engineering the desktop app and its bundled
runtime, and I can now explain exactly what's going on. TL;DR: the trial quota is attached to your account
by login, but consuming it is gated behind a per-request Aliyun captcha that only the desktop app can
satisfy. This is by design on the server side, and it's out of scope for this project to replicate.

What actually happens

• The "ZCode Start Plan" trial lives on a separate service endpoint:
  https://zcode.z.ai/api/v1/zcode-plan/anthropic (paid Coding Plan / API-key traffic goes to api.z.ai
  instead). Your OAuth login does attach the trial to your account — the balance endpoint confirms it.
• However, every model request to the zcode-plan endpoint must carry a valid X-Aliyun-Captcha-Verify-Param
  header (an Aliyun captcha token). Without it the gateway rejects the request with exactly what you saw:
  {"code":3007,"msg":"captcha verify failed"}.
• The desktop app can produce that token because it's an Electron app with a browser environment: before
  each model request, the runtime asks the desktop host to refresh provider runtime headers, the renderer
  loads the Aliyun captcha web SDK and passes verification silently (traceless mode) — that's why you
  never see a captcha in the desktop app. A plain terminal CLI has no browser to run that JS and no host
  to answer that handshake, so it can never mint the token.

Your questions

1. The trial is consumable through the desktop app only; there is no CLI path to it in the official
   runtime.
2. No supported config exists. Pointing provider.zai.options.baseURL at the start-plan endpoint (which you
   tried) cannot work — see below.
3. 3007 is not something the CLI can handle; solving the captcha requires a browser UI. What the CLI does
   use your OAuth login for is resolving a Coding Plan API key and calling api.z.ai/api/anthropic.
4. You were missing more than a header — the captcha token is minted per request by the desktop's embedded
   browser; a bare JWT is not enough (we reproduced the same 3007 with a valid JWT and no captcha param).

Transparency about testing: I don't currently have a trial-bearing account, so I couldn't verify the
"captcha solved → 200 completion" segment end-to-end. What I did verify against production: the JWT from
zcode login authenticates fine (the balance endpoint returns 200), and the zcode-plan messages endpoint
returns code 3007 for any request without a captcha param — which matches your report precisely.

Project scope: to set expectations — this project primarily maintains the capabilities of the official
runtime as shipped (TUI, plugins, OAuth login, Coding Plan providers, etc.). The Start Plan trial path
depends on desktop-only host machinery (browser-hosted captcha + per-request header injection), so it is
not part of what this CLI provides, and we don't plan to reverse-engineer it into the core.

What works today: subscribe to a Coding Plan (Lite/Pro/Max) or use a pay-as-you-go Z.ai API key — the key
your zcode login already produced will work as soon as the account has a plan attached. For the free
trial, please use the desktop app.