Z.ai Open-Sources ZCode: Full AI Coding Workbench After Trust Crisis — Audit Needed

The Backstory: A Trust Crisis Triggered Open-Sourcing

In mid-September, users discovered that ZCode's codebase indexing feature was enabled by default, uploading local code to servers. The issue was reported by media outlets like Huxiu around September 21, prompting Zhipu AI to apologize, fix the default behavior, and announce the open-sourcing of the codebase. The timeline suggests the open-source move was a crisis-response tactic: when trust cracks, the fastest patch is to open the doors for inspection. However, as the Huxiu article noted, open source only solves "can we see the code," not "where does the code actually go." Enterprise customers should verify whether the open-source repository matches the distributed binaries, whether builds are reproducible, and whether network requests are transparent.

Repository Structure: A Complete pnpm Monorepo

The repository (zai-org/ZCode) is a pnpm monorepo with the following packages: packages/desktop — Electron desktop application (Main, Host, Renderer processes) packages/web + packages/server — Web client and HTTP/WebSocket backend packages/ui — Shared React components and Zustand state management packages/rpc + packages/client — RPC framework and Agent client SDK packages/provider — Model provider abstraction layer apps/zcode-cli — Agent CLI, TUI, runtime, and tools

This structure provides a rare, production-grade sample for studying how a programming agent is implemented end-to-end. For comparison, when Claude Code accidentally leaked 510,000 lines of source code in March due to a source-map packaging error, developers scrambled to examine its harness implementation — agent loop, context compression, tool scheduling. ZCode now officially offers an equivalent codebase plus desktop and server components that Claude Code has not open-sourced.

Notable Features

Goal-Based Long-Running Task Management

Complex goals are decomposed into continuous planning, execution, and verification loops. Because the agent retains context across multiple steps, it avoids repeatedly re-supplying background — a capability powered by GLM-5.3's long-context window.

Bot Control via WeChat, Feishu, and Telegram

Users can send messages on WeChat, Feishu, or Telegram to remotely trigger ZCode tasks, enabling work dispatch without being at the computer. The author notes this is the first domestic programming tool to integrate both Feishu and WeChat.

Model Strategy: Deep GLM-5.3 Binding with BYOK Escape Hatch

ZCode is tightly coupled to GLM-5.3, with multimodal support from GLM-5.3-Flash for out-of-the-box screenshot understanding. A Bring-Your-Own-Key (BYOK) option allows connecting third-party services compatible with Anthropic or OpenAI protocols, as well as self-hosted channels. Subscribers also get an "idle-time task" queue: non-urgent jobs are scheduled during spare compute capacity and run without consuming plan quotas.

Low-Barrier Custom Sub-Agents

Creating a custom sub-agent only requires writing a Markdown file with YAML frontmatter and placing it in ~/.zcode/agents/; the agent can then be invoked in chat with an @ mention.

Installation Guide

Local builds require Node.js 24.14.0 and pnpm 10.33.2 (pinned in mise.toml). Initialize with: pnpm bootstrap Run desktop development: pnpm dev:desktop Run web development (starts frontend on port 5173 and backend on port 3030): pnpm dev:web For CLI usage without Electron, the zcode command covers both TUI and web modes:

# Terminal interactive UI
zcode

# Web UI with project directory and port
zcode --web --workspace /path/to/project --port 3030

On macOS, locally built packages are unsigned. If Gatekeeper blocks the first launch, run:

sudo xattr -rd com.apple.quarantine /Applications/ZCode.app

Critical Assessment: Open Source ≠ Trust Restored

The author raises three concrete concerns:

Data trust requires independent audit. The code-upload controversy ended only days ago; no third party has systematically audited whether the distributed binaries match the open-source code, nor have public network-traffic analyses been published. Enterprises considering adoption should conduct their own traffic audits rather than treating the apology letter as a security report.

GLM binding is tighter than advertised; BYOK has pitfalls. The BYOK documentation reveals several issues: third-party deployments of same-named models may have different thinking-intensity tiers than official endpoints; DeepSeek V4 series returns 400 errors when the highest tier is selected; GLM's clear_thinking and MiniMax's adaptive thinking modes are not configurable; custom request parameters in options are silently ignored without error. Teams planning to use non-GLM models should expect integration friction.

Competitive landscape is intensifying. Alibaba has Qoder, ByteDance has Trae, and MiniMax open-sourced MiniMax Code on September 18. Domestic model vendors are treating programming tools as a frontline battleground for developers, and open-sourcing is becoming a standard weapon in this arena.

ZCode's open-sourcing was motivated by crisis PR, yet the community gains a valuable reference implementation. For engineers wanting to dissect a production-grade programming agent, this is one of the few complete, accessible codebases — far more legitimate than reverse-engineering leaked Claude Code sources. For Zhipu AI, whether open source translates into trust depends not on star count, but on whether independent audits of its distribution artifacts occur and whether the project withstands that scrutiny.

Open-source repository: https://github.com/zai-org/ZCode