Environment

• OpenClaw version: 2026.6.8 (844f405)
• Provider: zai (api.z.ai, Coding Plan endpoint https://api.z.ai/api/coding/paas/v4)
• Model: glm-5.2

What Works

• ✅ Direct API call to api.z.ai with the configured key → 200 OK
• ✅ Main session using GLM-5.2 (session_status(model="zai/glm-5.2")) → auth resolves, responses returned
• ✅ Sub-agents with other providers (e.g. DeepSeek V4 Pro) → flawless

What Fails

• ❌ All GLM-5.2 sub-agent / embedded runs → HTTP 401 every time
• ❌ context="fork" sub-agents from a GLM main session → same 401
• ❌ After gateway restart, config change, doctor --fix, SQLite auth table clears → same 401

Root Cause

The Gateway's embedded runtime caches a stale auth profile (sha256:118886372c36) that does NOT match the current configured API key. This profile hash doesn't match SHA256 or MD5 of the current key, suggesting it was generated from a different credential (likely from the initial onboarding wizard session).

Remediation Attempted (All Failed)

1. Updated env.ZAI_API_KEY in config → no change
2. Added key to LaunchAgent plist EnvironmentVariables → no change
3. Cleared SQLite auth_profile_stores, auth_profile_state, device_auth_tokens → no change
4. Full LaunchAgent unload/reload → no change
5. Removed provider from config → restart → re-added → restart → no change
6. doctor --fix → updated gateway service config but did not clear/regenerate the auth profile
7. Attempted fresh provider ID (zai-fresh) → rejected by validator (custom providers must declare models)
8. 19 failures across 6+ hours, all with same profileId: sha256:118886372c36

Gateway Log Excerpt (most recent run, 2026-06-27 15:43 ET)

{
  "embedded_run_failover_decision": {
    "runId": "2893fba9-f93e-4de2-ac1a-a9ce3f5c4b9d",
    "stage": "assistant",
    "decision": "surface_error",
    "failoverReason": "auth",
    "provider": "zai",
    "model": "glm-5.2",
    "profileId": "sha256:118886372c36",
    "rawErrorPreview": "401 token expired or incorrect",
    "providerRuntimeFailureKind": "auth_invalid_token",
    "fallbackConfigured": false
  }
}

{
  "auth_profile_failure_state_updated": {
    "profileId": "sha256:118886372c36",
    "provider": "zai",
    "reason": "auth",
    "windowType": "cooldown",
    "previousErrorCount": 1,
    "errorCount": 1,
    "cooldownUntil": 1782589416691
  }
}

{
  "model_fallback_decision": {
    "decision": "candidate_failed",
    "requestedProvider": "zai",
    "status": 401,
    "errorPreview": "401 token expired or incorrect",
    "fallbackStepFinalOutcome": "chain_exhausted"
  }
}

Expected Behavior

• Auth profile should be regenerated when the API key changes in config
• Auth profile should use the current config key, not a stale cached credential
• SQLite auth table clearing + restart should produce a fresh profile
• doctor --fix should detect and resolve stale provider auth profiles
• Main session and sub-agent/embedded runs should use the same auth resolution path

Current Workaround

• Use GLM-5.2 only from main sessions (auth works there)
• Use DeepSeek V4 Pro for all sub-agent/cron/embedded runs
• Do not route GLM-5.2 to cron jobs or sub-agents