fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models by Pandah97 · Pull Request #94461 · openclaw/openclaw

Pandah97 · 2026-06-18T06:23:55Z

Summary

When resolveGlm5ForwardCompatModel synthesizes a GLM-5 model (e.g. zai/glm-5-turbo) and both providerConfig and the template model (glm-4.7) are unavailable, the resolved model was missing baseUrl. This caused the OpenAI SDK to fall back to api.openai.com instead of api.z.ai, producing confusing 401 errors.

Root cause: resolveGlm5ForwardCompatModel at extensions/zai/index.ts:107 used:

baseUrl: ctx.providerConfig?.baseUrl ?? template?.baseUrl

When neither source provides a baseUrl (empty agent dir, no models.providers.zai configured), the field was undefined.

Fix: Added ZAI_MANIFEST_BASE_URL as the third fallback — the provider-level baseUrl from the bundled manifest JSON — so the model always carries a baseUrl regardless of runtime state.

Fixes #94269

Real behavior proof (required for external PRs)

Behavior addressed: static Z.ai catalog models (e.g. zai/glm-5-turbo) resolve without baseUrl when no explicit provider config is set and the template model is not in the registry.

Real setup tested:

Runtime: Linux x86_64, Node v24, pnpm 11.2.2

Exact steps or command run after fix:

pnpm test extensions/zai/index.test.ts

After-fix evidence:

 Test Files  1 passed (1)
      Tests  12 passed (12)

All 12 tests pass including new test: "falls back to manifest baseUrl when both providerConfig and template model are unavailable"

Observed result after the fix: resolveDynamicModel now correctly returns baseUrl: "https://api.z.ai/api/paas/v4" even when both providerConfig and template model are absent.

What was not tested: Full end-to-end integration test (requires live Z.ai API key).

Tests and validation

New test: "falls back to manifest baseUrl when both providerConfig and template model are unavailable"
All existing zai tests continue to pass (12/12)
No config, API, or data compatibility impact

Risk checklist

Did user-visible behavior change? (No)

Did config, environment, or migration behavior change? (No)

Did security, auth, secrets, network, or tool execution behavior change? (No)

What is the highest-risk area?

Manifest baseUrl drift (if manifest baseUrl changes and ZAI_MANIFEST_BASE_URL is stale)

How is that risk mitigated?

ZAI_MANIFEST_BASE_URL is read directly from the manifest JSON (openclaw.plugin.json), so it stays in sync with the manifest automatically

Current review state

What is the next action?

Maintainer review

clawsweeper · 2026-06-18T07:19:41Z

Codex review: needs real behavior proof before merge. Reviewed June 20, 2026, 11:47 PM ET / 03:47 UTC.

Summary
The PR changes synthesized Z.ai GLM-5 model resolution to use the Z.ai default base URL when no explicit provider config or template baseUrl is present, and adds a regression test for that path.

PR surface: Source +1, Tests +20. Total +21 across 2 files.

Reproducibility: yes. Current main still has the provider/template-only baseUrl expression, the linked issue includes packaged resolver output without baseUrl, and the OpenAI SDK source explains the OpenAI default-host symptom.

Review metrics: 1 noteworthy metric.

Provider endpoint fallback: 1 added. Unconfigured synthesized Z.ai GLM-5 models will now receive a provider default endpoint, so routing and precedence proof matters before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #94269
Summary: This PR is the active fix candidate for the canonical Z.ai GLM-5 missing-baseUrl issue.

Members:

canonical: Z.ai static catalog models resolve without baseUrl and fall through to OpenAI API #94269 - The issue reports the same resolver output and this PR uses closing syntax for it.
superseded: fix(zai): fall back to default baseUrl when template lacks one for catalog models #94404 - The earlier same-root fallback PR is closed unmerged and does not supersede this open candidate.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted terminal or live resolver output from the patched branch showing zai/glm-5-turbo resolves with https://api.z.ai/api/paas/v4.
After adding proof, update the PR body so ClawSweeper re-reviews automatically, or ask a maintainer to comment @clawsweeper re-review.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body supplies unit-test output only; add redacted terminal/live resolver output, logs, or a recording from the patched setup, with private details like API keys, IPs, phone numbers, and non-public endpoints removed. After updating the PR body, ClawSweeper should re-review automatically; if not, ask a maintainer to comment @clawsweeper re-review.

Risk before merge

[P1] External after-fix proof is still unit-test-only; the contributor has not shown redacted terminal/live resolver output from a patched setup.
[P1] Endpoint selection changes for unconfigured synthesized Z.ai GLM-5 models, so maintainers should confirm explicit provider config and template baseUrl precedence remain intentional.

Maintainer options:

Require Resolver Proof Before Merge (recommended)
Ask for redacted terminal output, logs, or a recording from a patched setup showing zai/glm-5-turbo resolves with the Z.ai base URL while explicit provider and template endpoints still win.
Maintainer-Owned Verification
A maintainer can run the resolver or a live Z.ai path themselves and accept the contributor proof gap once required checks are clean.
Pause If Proof Stays Absent
Keep the PR paused or close it if no real behavior proof is added and maintainers do not want to own the endpoint-routing verification.

Next step before merge

[P1] Human review remains because the remaining blocker is endpoint-routing proof from a contributor or maintainer setup, not a narrow automated code repair.

Security
Cleared: No concrete security or supply-chain regression was found; the diff only changes provider-local endpoint fallback logic and adjacent tests.

Review details

Best possible solution:

Land the provider-local fallback after redacted resolver or runtime proof confirms the patched Z.ai model path and required checks are clean.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main still has the provider/template-only baseUrl expression, the linked issue includes packaged resolver output without baseUrl, and the OpenAI SDK source explains the OpenAI default-host symptom.

Is this the best way to solve the issue?

Yes for the patch shape. The fix stays in the Z.ai provider boundary, preserves explicit providerConfig and template baseUrl precedence, and reuses the existing endpoint helper; merge readiness still needs real behavior proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9750d887f502.

Label changes

Label justifications:

P2: The PR addresses a real bundled Z.ai provider-routing bug with limited blast radius.
merge-risk: 🚨 auth-provider: The diff changes endpoint selection for synthesized Z.ai models, so a bad fallback or precedence bug could route credentials to the wrong provider host.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies unit-test output only; add redacted terminal/live resolver output, logs, or a recording from the patched setup, with private details like API keys, IPs, phone numbers, and non-public endpoints removed. After updating the PR body, ClawSweeper should re-review automatically; if not, ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +1, Tests +20. Total +21 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	3	2	+1
Tests	1	20	0	+20
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	23	2	+21

Acceptance criteria:

[P1] node scripts/run-vitest.mjs extensions/zai/index.test.ts.
[P1] redacted patched resolver or runtime proof showing zai/glm-5-turbo resolves with https://api.z.ai/api/paas/v4 without explicit provider config.

What I checked:

Repository policy read: Root and scoped extension policies were read fully; provider routing, plugin ownership, fallback behavior, dependency contracts, and external proof requirements affected this review. (AGENTS.md:1, 9750d887f502)
Current main resolver still lacks fallback: Current main synthesizes GLM-5 runtime models with baseUrl from only explicit provider config or the GLM-4.7 template, so the no-config/no-template path can return no Z.ai endpoint. (extensions/zai/index.ts:107, 9750d887f502)
PR head adds provider-local fallback: PR head preserves providerConfig and template precedence, then falls back to resolveZaiBaseUrl() for synthesized GLM-5 models. (extensions/zai/index.ts:108, 445a418187b0)
Focused regression test: PR head adds a test for no providerConfig and no template model, expecting the Z.ai global baseUrl. (extensions/zai/index.test.ts:192, 445a418187b0)
Runtime resolver path: resolveModelWithRegistry calls the provider dynamic model hook before configured fallback handling, so the Z.ai resolver is on the linked issue's model-resolution path. (src/agents/embedded-agent-runner/model.ts:1556, 9750d887f502)
OpenAI SDK default host contract: OpenAI Node v6.39.1 accepts an optional baseURL and defaults falsy baseURL to https://api.openai.com/v1, matching the linked issue's OpenAI-host fallback symptom. (v6.39.1)

Likely related people:

vincentkoc: Current blame for the affected resolver block and recent provider runtime/refactor history point to Vincent Koc touching the same Z.ai provider surface. (role: recent area contributor; confidence: high; commits: 3968fea383b2, b43eedbb1818, eea7ba53455a; files: extensions/zai/index.ts, extensions/zai/model-definitions.ts)
steipete: Remote history shows steipete added GLM-5.2 support in the Z.ai provider, and the current PR head contains a maintainer refactor reusing the canonical endpoint helper. (role: recent model-support contributor and PR-head refactor author; confidence: high; commits: 735f59af7366, 445a418187b0, 4fa5092cdc39; files: extensions/zai/index.ts, extensions/zai/model-definitions.ts, extensions/zai/index.test.ts)
tomsun28: Merged GLM-5.1 and GLM-5V support introduced adjacent model-definition and dynamic metadata behavior for the affected model family. (role: GLM-5 model-family contributor; confidence: medium; commits: 6433e923d485; files: extensions/zai/index.ts, extensions/zai/model-definitions.ts, extensions/zai/index.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

When resolveGlm5ForwardCompatModel synthesizes a GLM-5 model and both providerConfig and the template model (glm-4.7) are unavailable, the resolved model was missing baseUrl. This caused the OpenAI SDK to fall back to api.openai.com instead of api.z.ai, producing confusing 401 errors. The fix adds a third fallback to ZAI_MANIFEST_BASE_URL — the provider-level baseUrl from the bundled manifest JSON — so the model always carries a baseUrl regardless of runtime state. Fixes openclaw#94269

steipete · 2026-06-21T03:49:12Z

Merged via squash.

Prepared head SHA: 445a418187b0a3f3bd2f033c26dc650f7549da99
Merge commit: db54a3268b770493d9485181478599405f43c8c8

Thanks @Pandah97!

@steipete

…penclaw#94461) Merged via squash. Prepared head SHA: 445a418 Co-authored-by: Pandah97 <[email protected]> Co-authored-by: steipete <[email protected]> Reviewed-by: @steipete

openclaw-barnacle Bot added extensions: zai size: XS proof: supplied External PR includes structured after-fix real behavior proof. labels Jun 18, 2026

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. labels Jun 19, 2026

clawsweeper Bot mentioned this pull request Jun 20, 2026

Z.ai static catalog models resolve without baseUrl and fall through to OpenAI API #94269

Closed

steipete force-pushed the fix/issue-94269-zai-static-catalog-models-resolve-without-baseurl branch from 8889a4a to cb065e7 Compare June 21, 2026 02:23

Pandah97 and others added 2 commits June 20, 2026 23:39

refactor(zai): reuse canonical endpoint fallback

445a418

steipete force-pushed the fix/issue-94269-zai-static-catalog-models-resolve-without-baseurl branch from cb065e7 to 445a418 Compare June 21, 2026 03:39

steipete merged commit db54a32 into openclaw:main Jun 21, 2026
150 checks passed

clawsweeper Bot mentioned this pull request Jun 21, 2026

feat: add model switch choices to /model #92230

Open

github-actions Bot mentioned this pull request Jun 29, 2026

chore(openclaw): bump pinned version v2026.5.28 → v2026.6.10 Evans-Software-Solutions-Limited/axel-saas#120

Open

4 tasks

Supreshone mentioned this pull request Jul 1, 2026

Model switch in same session breaks all tool calls (2026.6.10 regression) #98378

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models#94461

fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models#94461
steipete merged 2 commits into
openclaw:mainfrom
Pandah97:fix/issue-94269-zai-static-catalog-models-resolve-without-baseurl

Pandah97 commented Jun 18, 2026

Uh oh!

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jun 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Pandah97 commented Jun 18, 2026

Summary

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jun 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 18, 2026 •

edited

Loading