@0xgeorgemathew/zcode 0.3.0

package/lib/isolation.js

@@ -0,0 +1,313 @@
+'use strict';
+// Scratch-HOME isolation (DESIGN §6): the engine runs with HOME pointed at a
+// copy we own (~/.zcode/home, mode 700) so the live ~/.zcode — which the
+// desktop app is actively using — is never written by us, and the user's
+// OAuth credentials.json is never copied.
+//
+// Invariant (§6.4): zcode performs no writes to the live ~/.zcode. The
+// fallback ladder NEVER re-adds credentials.json.
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+
+const LIVE_ZCODE = path.join(os.homedir(), '.zcode');
+const LIVE_V2 = path.join(LIVE_ZCODE, 'v2');
+
+// v2 top-level entries we deliberately never copy.
+const V2_EXCLUDE_FILES = new Set(['credentials.json', '.DS_Store']);
+function isV2Excluded(name) {
+  return (
+    V2_EXCLUDE_FILES.has(name) || name.startsWith('tasks-index.sqlite')
+  );
+}
+
+const keySha256 = (key) =>
+  crypto.createHash('sha256').update(key).digest('hex');
+
+// --- source inventory -------------------------------------------------------
+
+// Files the scratch copy depends on: every source path + mtimeMs. A change
+// in the set, an mtime, or the key fingerprint invalidates the stamp.
+function sourceInventory() {
+  const sources = [];
+  const pushFile = (abs) => {
+    try {
+      sources.push({ file: abs, mtimeMs: fs.statSync(abs).mtimeMs });
+    } catch {
+      /* source vanished — not copied */
+    }
+  };
+  try {
+    for (const entry of fs.readdirSync(LIVE_V2, { withFileTypes: true })) {
+      if (!entry.isFile() || isV2Excluded(entry.name)) continue;
+      pushFile(path.join(LIVE_V2, entry.name));
+    }
+  } catch {
+    /* no live v2 — synthesized path */
+  }
+  pushFile(path.join(LIVE_ZCODE, 'cli', 'config.json'));
+  pushFile(path.join(LIVE_ZCODE, 'AGENTS.md'));
+  try {
+    for (const entry of fs.readdirSync(path.join(LIVE_ZCODE, 'skills'), {
+      withFileTypes: true,
+    })) {
+      if (entry.isDirectory()) {
+        pushFile(path.join(LIVE_ZCODE, 'skills', entry.name, 'SKILL.md'));
+      }
+    }
+  } catch {
+    /* no skills dir */
+  }
+  try {
+    for (const entry of fs.readdirSync(path.join(LIVE_ZCODE, 'agents'), {
+      withFileTypes: true,
+    })) {
+      if (entry.isFile() && entry.name.endsWith('.md')) {
+        pushFile(path.join(LIVE_ZCODE, 'agents', entry.name));
+      }
+    }
+  } catch {
+    /* no agents dir */
+  }
+  return sources;
+}
+
+// --- build ------------------------------------------------------------------
+
+function writeJson600(file, value) {
+  fs.writeFileSync(file, JSON.stringify(value, null, 2) + '\n', {
+    mode: 0o600,
+  });
+  fs.chmodSync(file, 0o600);
+}
+
+function copyFileTo(src, destDir) {
+  fs.mkdirSync(destDir, { recursive: true });
+  const dest = path.join(destDir, path.basename(src));
+  fs.copyFileSync(src, dest);
+  return dest;
+}
+
+// Prune to exactly the zai-api rule and swap in the package key (§6.2 item 2).
+function rewriteProviderConfig(target, key) {
+  const parsed = JSON.parse(fs.readFileSync(target, 'utf8'));
+  const rules =
+    parsed.config &&
+    parsed.config.providerConfigRules &&
+    parsed.config.providerConfigRules.providerRules;
+  if (!Array.isArray(rules)) {
+    throw new Error(`unexpected provider_config.json shape at ${target}`);
+  }
+  const zaiRules = rules.filter((r) => r && r.providerId === 'zai-api');
+  if (zaiRules.length === 0) {
+    throw new Error(
+      `no zai-api rule found in provider_config.json at ${target}`
+    );
+  }
+  const rule = zaiRules[0];
+  rule.config = rule.config || {};
+  rule.config.group = rule.config.group || 'standard-personal';
+  rule.config.access = {
+    type: 'api-key',
+    apiKey: key,
+  };
+  parsed.config.providerConfigRules.providerRules = [rule];
+  writeJson600(target, parsed);
+}
+
+// Overwrite builtin:zai apiKey with the package key (§6.2 item 3).
+function rewriteCliConfig(target, key) {
+  const parsed = JSON.parse(fs.readFileSync(target, 'utf8'));
+  const zai = parsed.provider && parsed.provider['builtin:zai'];
+  if (zai) {
+    zai.options = zai.options || {};
+    zai.options.apiKey = key;
+  }
+  writeJson600(target, parsed);
+}
+
+function synthesizedProviderConfig(key) {
+  return {
+    schemaVersion: 1,
+    config: {
+      providerConfigRules: {
+        providerRules: [
+          {
+            providerId: 'zai-api',
+            templateId: 'zai-api',
+            config: {
+              group: 'standard-personal',
+              access: { type: 'api-key', apiKey: key },
+            },
+          },
+        ],
+      },
+    },
+  };
+}
+
+// Tier (a), the review-proven recipe: top-level v2 files, no directories, no
+// credentials.json, no sqlite. Fresh machines (no live v2) synthesize instead.
+function buildScratch(home, key) {
+  fs.rmSync(home, { recursive: true, force: true });
+  const scratchV2 = path.join(home, '.zcode', 'v2');
+  fs.mkdirSync(scratchV2, { recursive: true });
+
+  let mode = 'synthesized';
+  let copied = 0;
+  try {
+    const entries = fs.readdirSync(LIVE_V2, { withFileTypes: true });
+    const files = entries.filter(
+      (e) => e.isFile() && !isV2Excluded(e.name)
+    );
+    if (files.length > 0 || fs.existsSync(path.join(LIVE_V2, 'provider_config.json'))) {
+      mode = 'copied-v2-top-level';
+    }
+    for (const entry of files) {
+      const dest = copyFileTo(path.join(LIVE_V2, entry.name), scratchV2);
+      if (entry.name === 'provider_config.json') {
+        rewriteProviderConfig(dest, key);
+      }
+      copied++;
+    }
+  } catch {
+    /* no live v2 at all */
+  }
+
+  const scratchProviderConfig = path.join(scratchV2, 'provider_config.json');
+  if (!fs.existsSync(scratchProviderConfig)) {
+    writeJson600(scratchProviderConfig, synthesizedProviderConfig(key));
+  } else {
+    // Ensure key swap even when the copy step found an unexpected shape.
+    rewriteProviderConfig(scratchProviderConfig, key);
+  }
+
+  const liveCliConfig = path.join(LIVE_ZCODE, 'cli', 'config.json');
+  if (fs.existsSync(liveCliConfig)) {
+    const dest = copyFileTo(liveCliConfig, path.join(home, '.zcode', 'cli'));
+    rewriteCliConfig(dest, key);
+  }
+
+  const liveAgents = path.join(LIVE_ZCODE, 'agents');
+  if (fs.existsSync(liveAgents)) {
+    for (const entry of fs.readdirSync(liveAgents, { withFileTypes: true })) {
+      if (entry.isFile() && entry.name.endsWith('.md')) {
+        copyFileTo(path.join(liveAgents, entry.name), path.join(home, '.zcode', 'agents'));
+      }
+    }
+  }
+  const liveAgentsMd = path.join(LIVE_ZCODE, 'AGENTS.md');
+  if (fs.existsSync(liveAgentsMd)) {
+    copyFileTo(liveAgentsMd, path.join(home, '.zcode'));
+  }
+
+  // Skills: copy each <name>/SKILL.md dir from the live user scope so the
+  // engine (running under this scratch HOME) sees the same skills as the
+  // desktop. Project skills (<cwd>/.zcode/skills) need no copy — the engine
+  // reads them from the real workspace.
+  let skillsCopied = 0;
+  const liveSkills = path.join(LIVE_ZCODE, 'skills');
+  if (fs.existsSync(liveSkills)) {
+    for (const entry of fs.readdirSync(liveSkills, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      if (!fs.existsSync(path.join(liveSkills, entry.name, 'SKILL.md'))) continue;
+      fs.cpSync(
+        path.join(liveSkills, entry.name),
+        path.join(home, '.zcode', 'skills', entry.name),
+        { recursive: true }
+      );
+      skillsCopied++;
+    }
+  }
+
+  return { mode, copied, skillsCopied };
+}
+
+// --- public API -------------------------------------------------------------
+
+function rootDir(env = process.env) {
+  return env.ZAI_CODE_HOME || path.join(os.homedir(), '.zcode');
+}
+
+// Ensures the scratch HOME exists and is current. Returns
+// {root, home, mode, built, stamp}.
+function ensureIsolation(key, { fresh = false, env = process.env } = {}) {
+  const root = rootDir(env);
+  fs.mkdirSync(root, { recursive: true });
+  fs.chmodSync(root, 0o700);
+  const home = path.join(root, 'home');
+  const stampFile = path.join(root, 'build-stamp.json');
+
+  const sources = sourceInventory();
+  const fingerprint = keySha256(key);
+  const desired = {
+    version: 1,
+    keySha256: fingerprint,
+    sources,
+  };
+
+  if (!fresh && fs.existsSync(home) && fs.existsSync(stampFile)) {
+    try {
+      const stamp = JSON.parse(fs.readFileSync(stampFile, 'utf8'));
+      const sameSources =
+        Array.isArray(stamp.sources) &&
+        stamp.sources.length === desired.sources.length &&
+        stamp.sources.every(
+          (s, i) =>
+            s.file === desired.sources[i].file && s.mtimeMs === desired.sources[i].mtimeMs
+        );
+      if (stamp.keySha256 === fingerprint && sameSources) {
+        return {
+          root,
+          home,
+          mode: stamp.mode,
+          built: false,
+          stamp,
+        };
+      }
+    } catch {
+      /* corrupt stamp — rebuild */
+    }
+  }
+
+  const { mode, copied, skillsCopied } = buildScratch(home, key);
+  fs.chmodSync(home, 0o700);
+  const stamp = {
+    ...desired,
+    mode,
+    copiedFiles: copied,
+    skillsCopied,
+    builtAt: new Date().toISOString(),
+  };
+  writeJson600(stampFile, stamp);
+  return { root, home, mode, built: true, stamp };
+}
+
+// Env for the engine child process (§6.3): HOME=scratch, pinned builtin
+// config, and the uncontrolled overrides deleted. cwd is untouched here —
+// the caller sets it to the user's real workspace.
+function engineEnv({ home, builtinProviderConfig, parentEnv = process.env }) {
+  const childEnv = { ...parentEnv };
+  childEnv.HOME = home;
+  childEnv.ZCODE_BUILTIN_PROVIDER_CONFIG_FILE = builtinProviderConfig;
+  for (const name of [
+    'ZCODE_STORAGE_DIR',
+    'ZCODE_DATA_BASE_DIR',
+    'ZCODE_PERSONAL_PROVIDER_CONFIG_FILE',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_BASE_URL',
+  ]) {
+    delete childEnv[name];
+  }
+  return childEnv;
+}
+
+module.exports = {
+  ensureIsolation,
+  engineEnv,
+  rootDir,
+  keySha256,
+  LIVE_ZCODE,
+  LIVE_V2,
+};

package/lib/key.js

@@ -0,0 +1,51 @@
+'use strict';
+// API key resolution (DESIGN §5): ZAI_API_KEY env → ~/.zcode/credentials.json
+// ({"apiKey":"…"}, mode 600, written by `zcode login`). The key is never
+// printed, logged, or echoed by anything in this package.
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+// Root of zcode's own state (scratch HOME lives under <root>/home).
+function rootDir(env = process.env) {
+  return env.ZAI_CODE_HOME || path.join(os.homedir(), '.zcode');
+}
+
+function credentialsPath(env = process.env) {
+  return path.join(rootDir(env), 'credentials.json');
+}
+
+class NoKeyError extends Error {
+  constructor() {
+    super('No API key configured. Run "zcode login" or set ZAI_API_KEY.');
+    this.code = 'ZAI_NO_KEY';
+  }
+}
+
+// Reads {"apiKey": ...} from the credentials file; returns '' when absent.
+function readCredentialsKey(file) {
+  let text;
+  try {
+    text = fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed.apiKey === 'string' ? parsed.apiKey : '';
+  } catch {
+    return '';
+  }
+}
+
+// Sources, in order: ZAI_API_KEY (non-empty) → credentials.json.
+// Throws NoKeyError when neither holds a key.
+function resolveKey(env = process.env) {
+  const fromEnv = (env.ZAI_API_KEY || '').trim();
+  if (fromEnv) return fromEnv;
+  const fromFile = readCredentialsKey(credentialsPath(env));
+  if (fromFile) return fromFile;
+  throw new NoKeyError();
+}
+
+module.exports = { resolveKey, credentialsPath, rootDir, NoKeyError };

package/lib/models.js

@@ -0,0 +1,53 @@
+'use strict';
+// The ONLY place model ids are chosen (DESIGN §7). The wrapper constructs
+// every engine request itself, so nothing outside this allowlist can reach
+// the wire.
+
+const DEFAULT_MODEL = 'GLM-5.3-Flash';
+
+// Case-insensitive aliases → official ids (exact ids pass through verbatim;
+// they are exactly "GLM-5.3" / "GLM-5.3-Flash").
+const ALIASES = new Map([
+  ['glm-5.3', 'GLM-5.3'],
+  ['5.3', 'GLM-5.3'],
+  ['53', 'GLM-5.3'],
+  ['glm-5.3-flash', 'GLM-5.3-Flash'],
+  ['5.3-flash', 'GLM-5.3-Flash'],
+  ['flash', 'GLM-5.3-Flash'],
+  ['53f', 'GLM-5.3-Flash'],
+]);
+
+const SUPPORTED = ['glm-5.3', 'glm-5.3-flash'];
+
+// Effort enum per the bundle's schema (DESIGN §8). `max` is the default and
+// the only guaranteed-portable choice across both models.
+const EFFORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
+
+function normalizeEffort(input) {
+  const raw = String(input ?? '').trim().toLowerCase();
+  return EFFORT_LEVELS.includes(raw) ? raw : null;
+}
+
+// Returns the official model id, or null when input is not allowed.
+function normalizeModel(input) {
+  const raw = String(input ?? '').trim();
+  if (!raw) return null;
+  return ALIASES.get(raw.toLowerCase()) ?? null;
+}
+
+function unknownModelMessage(input) {
+  return (
+    `unknown model "${input}". zcode supports only ` +
+    `${SUPPORTED[0]} and ${SUPPORTED[1]} ` +
+    `(official ids: GLM-5.3, GLM-5.3-Flash).`
+  );
+}
+
+module.exports = {
+  DEFAULT_MODEL,
+  normalizeModel,
+  unknownModelMessage,
+  normalizeEffort,
+  EFFORT_LEVELS,
+  SUPPORTED,
+};

package/lib/overlay.js

@@ -0,0 +1,138 @@
+'use strict';
+// Per-run overlays on the scratch HOME (DESIGN §6 extension): MCP servers
+// and extra skills. Both are recomputed from read-only live sources plus the
+// caller's flags on EVERY run, so the scratch never leaks a previous run's
+// additions — the default state is always "what the desktop has".
+const fs = require('node:fs');
+const path = require('node:path');
+const { LIVE_ZCODE } = require('./isolation.js');
+
+// --- MCP ---------------------------------------------------------------------
+
+// Base servers: the live desktop config, read-only, honoring `enabled`.
+function liveMcpServers() {
+  try {
+    const cfg = JSON.parse(
+      fs.readFileSync(path.join(LIVE_ZCODE, 'cli', 'config.json'), 'utf8')
+    );
+    const servers = cfg && cfg.mcp && cfg.mcp.servers;
+    if (!servers || typeof servers !== 'object') return {};
+    const out = {};
+    for (const [name, def] of Object.entries(servers)) {
+      if (!def || typeof def !== 'object') continue;
+      if (def.enabled === false) continue;
+      out[name] = def;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+// Effective set for one run. Hermetic by default: ONLY the caller's --mcp
+// servers. --mcp-inherit pulls in the desktop's enabled servers as a base
+// (specs still win by name). Hermetic default is deliberate: the desktop
+// set includes OAuth servers that can never complete headless and stall
+// the engine's connect pool, starving later servers nondeterministically.
+function effectiveMcpServers({ inherit = false, mcpSpecs = [] } = {}) {
+  const servers = inherit ? liveMcpServers() : {};
+  for (const spec of mcpSpecs) {
+    for (const [name, def] of Object.entries(spec)) {
+      servers[name] = def;
+    }
+  }
+  return servers;
+}
+
+// Writes the effective set into the scratch cli config so the engine child
+// picks it up at session start. Creates a minimal config when the scratch
+// has none (fresh-machine synthesized path).
+function applyMcpOverlay({ home, inherit = false, mcpSpecs = [] }) {
+  const servers = effectiveMcpServers({ inherit, mcpSpecs });
+  // Names the caller explicitly added — the CLI waits for these to settle
+  // (connected or failed) before sending the prompt, so an explicit server
+  // is never lost to a slow stdio spawn. Inherited servers are best-effort.
+  const added = mcpSpecs.flatMap((spec) => Object.keys(spec));
+  const configPath = path.join(home, '.zcode', 'cli', 'config.json');
+  let cfg = {};
+  try {
+    cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    if (!cfg || typeof cfg !== 'object') cfg = {};
+  } catch {
+    cfg = {};
+  }
+  cfg.mcp = { ...(cfg.mcp || {}), servers };
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
+  fs.chmodSync(configPath, 0o600);
+  return { servers, count: Object.keys(servers).length, added };
+}
+
+// --- skills ------------------------------------------------------------------
+
+const MANIFEST = 'injected-skills.json';
+
+function readManifest(rootDir) {
+  try {
+    const m = JSON.parse(fs.readFileSync(path.join(rootDir, MANIFEST), 'utf8'));
+    return Array.isArray(m.skills) ? m : { skills: [] };
+  } catch {
+    return { skills: [] };
+  }
+}
+
+// A --skills dir is either one skill (<dir>/SKILL.md) or a skills root
+// (<dir>/<name>/SKILL.md). Returns [{name, dir}] of copyable skills.
+function discoverSkillDirs(dir) {
+  const found = [];
+  if (fs.existsSync(path.join(dir, 'SKILL.md'))) {
+    found.push({ name: path.basename(path.resolve(dir)), dir });
+    return found;
+  }
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    if (fs.existsSync(path.join(dir, entry.name, 'SKILL.md'))) {
+      found.push({ name: entry.name, dir: path.join(dir, entry.name) });
+    }
+  }
+  return found;
+}
+
+// Removes skills injected by a previous run, copies this run's extras in,
+// records them in the manifest. --no-skills empties the scratch skills dir
+// entirely (per-run hermetic mode).
+function applySkillsOverlay({ rootDir, home, skillsDirs = [], noSkills = false }) {
+  const scratchSkills = path.join(home, '.zcode', 'skills');
+  const previous = readManifest(rootDir);
+  for (const name of previous.skills) {
+    fs.rmSync(path.join(scratchSkills, name), { recursive: true, force: true });
+  }
+
+  if (noSkills) {
+    fs.rmSync(scratchSkills, { recursive: true, force: true });
+    fs.mkdirSync(scratchSkills, { recursive: true });
+    fs.writeFileSync(
+      path.join(rootDir, MANIFEST),
+      JSON.stringify({ skills: [] }, null, 2) + '\n',
+      { mode: 0o600 }
+    );
+    return { injected: [] };
+  }
+
+  const injected = [];
+  for (const dir of skillsDirs) {
+    for (const { name, dir: skillDir } of discoverSkillDirs(dir)) {
+      fs.rmSync(path.join(scratchSkills, name), { recursive: true, force: true });
+      fs.cpSync(skillDir, path.join(scratchSkills, name), { recursive: true });
+      injected.push(name);
+    }
+  }
+  fs.writeFileSync(
+    path.join(rootDir, MANIFEST),
+    JSON.stringify({ skills: injected }, null, 2) + '\n',
+    { mode: 0o600 }
+  );
+  return { injected };
+}
+
+module.exports = { effectiveMcpServers, applyMcpOverlay, applySkillsOverlay, discoverSkillDirs };

package/lib/ui.js

@@ -0,0 +1,105 @@
+'use strict';
+// Plain-mode terminal UI (lib/ui.js): one place for the "live feed" an
+// operator watches on stderr while stdout carries only the answer.
+//
+// Visual contract (deliberate, terminal-native):
+//   thinking   │ dimmed, every line prefixed "│ " - a quote block, clearly
+//               not the answer
+//   tool calls → started / ✓ ok / ✗ error, dimmed, one line each
+//   mcp status ◇ connected / ✗ failed, dimmed
+//   footer     one dimmed status line (model, effort, tool calls, time,
+//               session) - the session id is there so a plain-mode caller
+//               can pass it to --session without re-running with --json
+//
+// stdout is NEVER touched here. --quiet silences the whole feed.
+
+function makePlainReporter({ quiet = false } = {}) {
+  const tty = process.stderr.isTTY;
+  const dim = (t) => (tty ? `\x1b[2m${t}\x1b[0m` : t);
+
+  let thinkingOpen = false; // a thinking block is being streamed
+  let atLineStart = true; // no "│ " written for this line yet
+
+  const closeThinking = () => {
+    if (thinkingOpen) {
+      thinkingOpen = false;
+      atLineStart = true;
+      process.stderr.write('\n');
+    }
+  };
+
+  const writeThinking = (delta) => {
+    if (!thinkingOpen) {
+      thinkingOpen = true;
+      atLineStart = true;
+    }
+    for (const ch of delta) {
+      if (atLineStart) {
+        process.stderr.write(dim('│ '));
+        atLineStart = false;
+      }
+      if (ch === '\n') {
+        process.stderr.write('\n');
+        atLineStart = true;
+      } else {
+        process.stderr.write(dim(ch));
+      }
+    }
+  };
+
+  const toolLine = (name, phase) => {
+    if (phase === 'started' || phase === 'scheduled') {
+      process.stderr.write(dim(`→ ${name} started\n`));
+    } else if (phase === 'result') {
+      process.stderr.write(dim(`✓ ${name} ok\n`));
+    } else if (phase === 'error') {
+      process.stderr.write(dim(`✗ ${name} error\n`));
+    }
+  };
+
+  const mcpLine = (ev) => {
+    if (ev.status === 'connected') {
+      process.stderr.write(dim(`◇ mcp ${ev.name} connected\n`));
+    } else if (ev.status === 'failed' || ev.status === 'timeout') {
+      process.stderr.write(
+        dim(`✗ mcp ${ev.name} ${ev.status}${ev.error ? ` (${ev.error})` : ''}\n`)
+      );
+    }
+  };
+
+  const onEvent = (ev) => {
+    if (quiet) return;
+    if (ev.type === 'stream' && ev.kind === 'reasoning_delta' && ev.delta) {
+      writeThinking(ev.delta);
+      return;
+    }
+    closeThinking();
+    if (ev.type === 'stream' && ev.kind === 'text_delta' && ev.delta) {
+      return; // the answer streams to stdout, not here
+    }
+    if (ev.type === 'tool' && ev.name) {
+      toolLine(ev.name, ev.phase);
+      return;
+    }
+    if (ev.type === 'mcp') {
+      mcpLine(ev);
+    }
+  };
+
+  const footer = ({ model, effort, toolCalls, durationMs, sessionId }) => {
+    if (quiet) return;
+    closeThinking();
+    const parts = [
+      model,
+      `effort ${effort}`,
+      typeof toolCalls === 'number' ? `${toolCalls} tool call${toolCalls === 1 ? '' : 's'}` : null,
+      `${(durationMs / 1000).toFixed(1)}s`,
+      sessionId ? sessionId.slice(0, 16) : null,
+    ].filter(Boolean);
+    process.stderr.write(dim(`  ${parts.join('  ·  ')}\n`));
+  };
+
+  return { onEvent, closeThinking, footer };
+}
+
+module.exports = { makePlainReporter };

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@0xgeorgemathew/zcode",
+  "version": "0.3.0",
+  "description": "Headless GLM-5.3 / GLM-5.3-Flash coding CLI for agents: streaming thinking, subagents, MCP servers, skills, session continuity. Wraps the ZCode engine. Zero dependencies.",
+  "license": "MIT",
+  "private": false,
+  "bin": {
+    "zcode": "bin/zcode.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {},
+  "files": [
+    "bin",
+    "lib",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test --test-concurrency=1 \"test/**/*.test.js\"",
+    "prepublishOnly": "npm test",
+    "accept:flash": "node scripts/accept.js flash",
+    "accept:subagent": "node scripts/accept.js subagent",
+    "accept:53": "node scripts/accept.js glm53"
+  },
+  "keywords": [
+    "glm",
+    "glm-5.3",
+    "zai",
+    "zcode",
+    "cli",
+    "coding-agent",
+    "agent",
+    "llm",
+    "mcp",
+    "subagent",
+    "headless",
+    "ndjson"
+  ]
+}