@gajae-code/ai 0.6.4 → 0.7.0

package/src/model-thinking.ts

@@ -404,13 +404,11 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 	if (model.provider === "zai" && model.id === "glm-5.2") {
 		model.contextWindow = 1_000_000;
 	}
-	// MiniMax-M3: official MiniMax docs (platform.minimax.io/docs/guides/models-intro)
-	// document a 1M context window, but models.dev and the bundled catalog both report
-	// 512K. The stale 512K survives generate-models (provider-scoped models bypass the
-	// models.dev refresh in applyGlobalModelsDevFallback), tripping auto-compaction /
-	// context-cap thresholds 2x early on MiniMax sessions. Pin to the true 1M.
+	// MiniMax-M3: MiniMax exposes a 1M context tier, but usage beyond 512K is
+	// billed separately. Keep bundled/default metadata at the billing-safe 512K
+	// unless an explicit paid-tier contract is added.
 	if (model.provider !== "opencode-go" && model.id === "minimax-m3") {
-		model.contextWindow = 1_000_000;
+		model.contextWindow = 512_000;
 	}
 }
 
@@ -455,10 +453,13 @@ function inferGeneratedApplyPatchToolType(
 }
 
 function applyGpt55ContextWindow(model: ApiModel<Api>, parsedModel: OpenAIModel): boolean {
-	// gpt-5.5 is a 400K-context model. OpenAI code backend discovery can omit the
-	// context window, falling back to the 272K default, which incorrectly trips
-	// context-cap / auto-promote thresholds (a ~272K session would look over-cap
-	// and demote to gpt-5.4). Pin gpt-5.5 to its true 400K window.
+	// OpenAI Codex reports GPT-5.5 with a 272K prompt budget. Keep the generated
+	// bundle aligned with the backend limit so compaction fires before the prompt
+	// crosses the usable Codex window instead of trusting stale 400K snapshots.
+	if (model.provider === "openai-codex" && parsedModel.variant === "base" && semverEqual(parsedModel.version, "5.5")) {
+		model.contextWindow = 272000;
+		return true;
+	}
 	if (parsedModel.variant === "base" && semverEqual(parsedModel.version, "5.5")) {
 		model.contextWindow = 400000;
 		return true;

package/src/models.json

@@ -10486,6 +10486,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"gemini-3.5-flash": {
+			"id": "gemini-3.5-flash",
+			"name": "Gemini 3.5 Flash",
+			"api": "google-gemini-cli",
+			"provider": "google-gemini-cli",
+			"baseUrl": "https://cloudcode-pa.googleapis.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 1.5,
+				"output": 9,
+				"cacheRead": 0.15,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1048576,
+			"maxTokens": 65536,
+			"thinking": {
+				"mode": "google-level",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"gemini-3-flash-preview": {
 			"id": "gemini-3-flash-preview",
 			"name": "Gemini 3 Flash Preview",
@@ -37453,7 +37478,7 @@
 				"cacheRead": 0.12,
 				"cacheWrite": 0
 			},
-			"contextWindow": 1000000,
+			"contextWindow": 512000,
 			"maxTokens": 128000,
 			"thinking": {
 				"mode": "budget",
@@ -37673,7 +37698,7 @@
 				"cacheRead": 0.12,
 				"cacheWrite": 0
 			},
-			"contextWindow": 1000000,
+			"contextWindow": 512000,
 			"maxTokens": 128000,
 			"thinking": {
 				"mode": "budget",
@@ -37965,7 +37990,7 @@
 				"cacheRead": 0,
 				"cacheWrite": 0
 			},
-			"contextWindow": 1000000,
+			"contextWindow": 512000,
 			"maxTokens": 128000,
 			"compat": {
 				"supportsStore": false,
@@ -38300,7 +38325,7 @@
 				"cacheRead": 0,
 				"cacheWrite": 0
 			},
-			"contextWindow": 1000000,
+			"contextWindow": 512000,
 			"maxTokens": 128000,
 			"compat": {
 				"supportsStore": false,
@@ -56285,7 +56310,7 @@
 				"cacheRead": 0.5,
 				"cacheWrite": 0
 			},
-			"contextWindow": 400000,
+			"contextWindow": 272000,
 			"maxTokens": 128000,
 			"preferWebsockets": true,
 			"priority": 9,
@@ -68507,7 +68532,7 @@
 				"cacheRead": 0,
 				"cacheWrite": 0
 			},
-			"contextWindow": 1000000,
+			"contextWindow": 512000,
 			"maxTokens": 128000,
 			"compat": {
 				"supportsUsageInStreaming": false
@@ -75673,6 +75698,39 @@
 			}
 		}
 	},
+	"glm-zcode": {
+		"glm-5.2": {
+			"id": "glm-5.2",
+			"name": "GLM-5.2 (ZCode)",
+			"api": "anthropic-messages",
+			"provider": "glm-zcode",
+			"baseUrl": "https://zcode.z.ai/api/v1/zcode-plan/anthropic",
+			"headers": {
+				"User-Agent": "ZCode/1.0.0",
+				"HTTP-Referer": "https://zcode.z.ai",
+				"X-Title": "Z Code@electron",
+				"X-ZCode-App-Version": "1.0.0",
+				"X-ZCode-Agent": "glm"
+			},
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0,
+				"output": 0,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 131072,
+			"thinking": {
+				"mode": "budget",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		}
+	},
 	"zenmux": {
 		"anthropic/claude-3.5-haiku": {
 			"id": "anthropic/claude-3.5-haiku",
@@ -79707,4 +79765,4 @@
 			}
 		}
 	}
-}
+}

package/src/models.ts

@@ -33,14 +33,21 @@ function getProviderModels(provider: GeneratedProvider): Map<string, Model<Api>>
  * Mythos rejecting forced tool use) without a full regeneration.
  */
 function applyBundledCompatDefaults(model: Model<Api>): Model<Api> {
+	let normalized = model;
+	if (normalized.id === "minimax-m3" && normalized.name === "MiniMax M3") {
+		normalized = { ...normalized, name: "MiniMax-M3" };
+	}
 	if (
-		(model.api === "anthropic-messages" || model.api === "bedrock-converse-stream") &&
-		isClaudeForcedToolChoiceIncapableModelId(model.id) &&
-		(model.compat as { toolChoiceSupport?: string } | undefined)?.toolChoiceSupport === undefined
+		(normalized.api === "anthropic-messages" || normalized.api === "bedrock-converse-stream") &&
+		isClaudeForcedToolChoiceIncapableModelId(normalized.id) &&
+		(normalized.compat as { toolChoiceSupport?: string } | undefined)?.toolChoiceSupport === undefined
 	) {
-		return { ...model, compat: { ...(model.compat ?? {}), toolChoiceSupport: "auto" } as Model<Api>["compat"] };
+		return {
+			...normalized,
+			compat: { ...(normalized.compat ?? {}), toolChoiceSupport: "auto" } as Model<Api>["compat"],
+		};
 	}
-	return model;
+	return normalized;
 }
 
 export type GeneratedProvider = keyof typeof MODELS;

package/src/provider-models/descriptors.ts

@@ -43,7 +43,7 @@ import {
 	xiaomiModelManagerOptions,
 	zenmuxModelManagerOptions,
 } from "./openai-compat";
-import { cursorModelManagerOptions, zaiModelManagerOptions } from "./special";
+import { cursorModelManagerOptions, glmZcodeModelManagerOptions, zaiModelManagerOptions } from "./special";
 
 /** Catalog discovery configuration for providers that support endpoint-based model listing. */
 export interface CatalogDiscoveryConfig {
@@ -299,6 +299,12 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		catalog("ZenMux", ["ZENMUX_API_KEY"]),
 	),
 	catalogDescriptor("zai", "glm-5.2", config => zaiModelManagerOptions(config), catalog("zAI", ["ZAI_API_KEY"])),
+	catalogDescriptor(
+		"glm-zcode",
+		"glm-5.2",
+		config => glmZcodeModelManagerOptions(config),
+		catalog("GLM ZCode (unofficial)", ["GLM_ZCODE_API_KEY"], { oauthProvider: "glm-zcode" }),
+	),
 	descriptor("github-copilot", "gpt-4o", config => githubCopilotModelManagerOptions(config)),
 	descriptor("google", "gemini-2.5-pro", config => googleModelManagerOptions(config)),
 	catalogDescriptor(

package/src/provider-models/openai-compat.ts

@@ -2278,6 +2278,12 @@ const MODELS_DEV_PROVIDER_DESCRIPTORS_CORE: readonly ModelsDevProviderDescriptor
 const MODELS_DEV_PROVIDER_DESCRIPTORS_CODING_PLANS: readonly ModelsDevProviderDescriptor[] = [
 	// --- zAI ---
 	anthropicMessagesDescriptor("zai-coding-plan", "zai", "https://api.z.ai/api/anthropic"),
+	// --- GLM ZCode (unofficial Z.AI OAuth) ---
+	anthropicMessagesDescriptor(
+		"glm-zcode-coding-plan",
+		"glm-zcode",
+		process.env.ZCODE_PLAN_ANTHROPIC_BASE_URL ?? "https://zcode.z.ai/api/v1/zcode-plan/anthropic",
+	),
 	// --- Xiaomi ---
 	openAiCompletionsDescriptor("xiaomi", "xiaomi", "https://api.xiaomimimo.com/v1", {
 		defaultContextWindow: 262144,

package/src/provider-models/special.ts

@@ -65,3 +65,15 @@ export interface ZaiModelManagerConfig {}
 export function zaiModelManagerOptions(_config: ZaiModelManagerConfig = {}): ModelManagerOptions<"anthropic-messages"> {
 	return { providerId: "zai" };
 }
+
+// ---------------------------------------------------------------------------
+// GLM ZCode (unofficial Z.AI OAuth)
+// ---------------------------------------------------------------------------
+
+export interface GlmZcodeModelManagerConfig {}
+
+export function glmZcodeModelManagerOptions(
+	_config: GlmZcodeModelManagerConfig = {},
+): ModelManagerOptions<"anthropic-messages"> {
+	return { providerId: "glm-zcode" };
+}

package/src/providers/anthropic.ts

@@ -2169,7 +2169,7 @@ function buildParams(
  * See: https://github.com/can1357/gajae-code/issues/814
  */
 function isZaiAnthropicEndpoint(model: Model<"anthropic-messages">): boolean {
-	if (model.provider === "zai") return true;
+	if (model.provider === "zai" || model.provider === "glm-zcode") return true;
 	const baseUrl = model.baseUrl;
 	if (!baseUrl) return false;
 	try {
@@ -2187,7 +2187,7 @@ function isZaiAnthropicEndpoint(model: Model<"anthropic-messages">): boolean {
  */
 function isNonSigningAnthropicEndpoint(model: Model<"anthropic-messages">): boolean {
 	// Known non-signing providers
-	if (model.provider === "zai" || model.provider === "deepseek") return true;
+	if (model.provider === "zai" || model.provider === "glm-zcode" || model.provider === "deepseek") return true;
 	const baseUrl = model.baseUrl;
 	if (!baseUrl) return false;
 	try {

package/src/stream.ts

@@ -88,6 +88,7 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	kilo: "KILO_API_KEY",
 	"vercel-ai-gateway": "AI_GATEWAY_API_KEY",
 	zai: "ZAI_API_KEY",
+	"glm-zcode": "GLM_ZCODE_API_KEY",
 	mistral: "MISTRAL_API_KEY",
 	minimax: "MINIMAX_API_KEY",
 	"minimax-code": "MINIMAX_CODE_API_KEY",

package/src/types.ts

@@ -122,6 +122,7 @@ export type KnownProvider =
 	| "kilo"
 	| "vercel-ai-gateway"
 	| "zai"
+	| "glm-zcode"
 	| "mistral"
 	| "minimax"
 	| "opencode-go"

package/src/utils/oauth/glm-zcode.ts

@@ -0,0 +1,321 @@
+/**
+ * GLM ZCode OAuth flow (UNOFFICIAL, opt-in).
+ *
+ * Replicates the reverse-engineered ZCode desktop-app login to Z.AI/GLM. This
+ * is NOT an official Z.AI OAuth client: it reuses ZCode's authorize page,
+ * broker, and a custom-protocol redirect. It may break at any time and may
+ * violate ZCode/Z.AI Terms of Service. Endpoints and the client id are
+ * overridable via `ZCODE_OAUTH_*` environment variables.
+ *
+ * Login flow:
+ *   1. Authorize:  GET  {authorize}?redirect_uri=zcode://oauth/callback&response_type=code&client_id=...&state=...
+ *                  (custom-protocol redirect → a CLI cannot catch it, so the user pastes the code/redirect URL)
+ *   2. Broker:     POST {broker}  { provider: "zai", code, redirect_uri, state }
+ *                       → { code: 0, data: { token: <ZCode JWT>, zai: { access_token: <upstream Z.AI token> }, expires_in } }
+ *
+ * Credential mapping (verified against the ZCode host bundle):
+ *   - `access`  = the **ZCode JWT** (`data.token`). This is the GLM coding-plan
+ *                 model credential: ZCode stores it under the `zcodejwttoken`
+ *                 key and sends it as `Authorization: Bearer` to the coding-plan
+ *                 gateway `${ZCODE_PLAN_ANTHROPIC_BASE_URL}` (default
+ *                 https://zcode.z.ai/api/v1/zcode-plan/anthropic), which
+ *                 validates the ZCode session and injects the upstream GLM key
+ *                 server-side. Model traffic does NOT go to api.z.ai directly.
+ *   - `refresh` = the upstream Z.AI OAuth access token (`data.zai.access_token`),
+ *                 kept for identity/userinfo only. ZCode's separate z/login
+ *                 "business token" is used by ZCode for billing/userinfo, NOT
+ *                 model calls, so it is intentionally never minted here.
+ *
+ * The ZCode JWT reaches the Anthropic-messages request as a plain bearer
+ * automatically (the gateway base is not api.anthropic.com). This provider must
+ * NEVER force `isOAuth=true`, which would route GLM into the Claude-Code OAuth
+ * header branch (claude-cli UA, `claude_` tool prefixes, Claude system prompt).
+ */
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions, parseCallbackInput } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+export const GLM_ZCODE_REFRESH_SKEW_MS = 2 * 60 * 1000;
+
+/** Default endpoints / client id. Override via the matching `ZCODE_OAUTH_*` env vars. */
+export const GLM_ZCODE_OAUTH_AUTHORIZE_URL = "https://chat.z.ai/api/oauth/authorize";
+export const GLM_ZCODE_OAUTH_CLIENT_ID = "client_P8X5CMWmlaRO9gyO-KSqtg";
+export const GLM_ZCODE_OAUTH_REDIRECT_URI = "zcode://oauth/callback";
+export const GLM_ZCODE_OAUTH_BROKER_TOKEN_URL = "https://zcode.z.ai/api/v1/oauth/token";
+export const GLM_ZCODE_USERINFO_URL = "https://chat.z.ai/api/oauth/userinfo";
+
+/**
+ * Default coding-plan ("start plan") Anthropic gateway base. ZCode derives this
+ * as `${zcodeBackend}/api/v1/zcode-plan/anthropic`. Model requests go here
+ * (NOT api.z.ai), authenticated with the ZCode JWT. Override via
+ * `ZCODE_PLAN_ANTHROPIC_BASE_URL`. Exported for the model descriptor / catalog.
+ */
+export const GLM_ZCODE_PLAN_ANTHROPIC_BASE_URL = "https://zcode.z.ai/api/v1/zcode-plan/anthropic";
+
+type FetchImpl = typeof globalThis.fetch;
+
+function envOr(name: string, fallback: string): string {
+	const value = process.env[name];
+	return value && value.trim().length > 0 ? value.trim() : fallback;
+}
+
+function resolveAuthorizeUrl(): string {
+	return envOr("ZCODE_OAUTH_AUTHORIZE_URL", GLM_ZCODE_OAUTH_AUTHORIZE_URL);
+}
+function resolveClientId(): string {
+	return envOr("ZCODE_OAUTH_CLIENT_ID", GLM_ZCODE_OAUTH_CLIENT_ID);
+}
+function resolveRedirectUri(): string {
+	return envOr("ZCODE_OAUTH_REDIRECT_URI", GLM_ZCODE_OAUTH_REDIRECT_URI);
+}
+function resolveBrokerTokenUrl(): string {
+	return envOr("ZCODE_OAUTH_BROKER_TOKEN_URL", GLM_ZCODE_OAUTH_BROKER_TOKEN_URL);
+}
+function resolveUserinfoUrl(): string {
+	return envOr("ZCODE_OAUTH_USERINFO_URL", GLM_ZCODE_USERINFO_URL);
+}
+
+/**
+ * The provider is configured whenever a client id is available. The real ZCode
+ * client id ships as the default, so this is true unless explicitly cleared.
+ */
+export function isGlmZcodeOAuthConfigured(): boolean {
+	return resolveClientId().length > 0;
+}
+
+/** Mask token-like substrings so broker/upstream/JWT tokens never leak into errors or logs. */
+function redactSecrets(text: string): string {
+	return text
+		.replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]")
+		.replace(/[A-Za-z0-9_-]{40,}/g, "[redacted]");
+}
+
+function validateHttpsEndpoint(rawUrl: string, label: string): string {
+	let parsed: URL;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		throw new Error(`GLM ZCode ${label} endpoint is not a valid URL`);
+	}
+	if (parsed.protocol !== "https:") {
+		throw new Error(`GLM ZCode ${label} endpoint must use https`);
+	}
+	return parsed.toString();
+}
+
+function requestSignal(signal: AbortSignal | undefined): AbortSignal {
+	const timeoutSignal = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+	return signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null;
+}
+
+async function postJson(
+	fetchImpl: FetchImpl,
+	url: string,
+	body: Record<string, unknown>,
+	label: string,
+	signal: AbortSignal | undefined,
+): Promise<unknown> {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: { Accept: "application/json", "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		signal: requestSignal(signal),
+	});
+	if (!response.ok) {
+		throw new Error(`GLM ZCode ${label} request failed: ${response.status} ${redactSecrets(await response.text())}`);
+	}
+	return response.json();
+}
+
+interface JwtPayload {
+	sub?: unknown;
+	email?: unknown;
+	account_id?: unknown;
+	uid?: unknown;
+	[key: string]: unknown;
+}
+
+function decodeJwtPayload(token: string): JwtPayload | undefined {
+	const parts = token.split(".");
+	const payload = parts[1];
+	if (parts.length !== 3 || !payload) return undefined;
+	try {
+		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as JwtPayload;
+	} catch {
+		return undefined;
+	}
+}
+
+interface Identity {
+	email?: string;
+	accountId?: string;
+}
+
+function identityFromJwts(tokens: readonly string[]): Identity {
+	for (const token of tokens) {
+		const payload = decodeJwtPayload(token);
+		if (!payload) continue;
+		const accountId =
+			(typeof payload.sub === "string" && payload.sub) ||
+			(typeof payload.account_id === "string" && payload.account_id) ||
+			(typeof payload.uid === "string" && payload.uid) ||
+			undefined;
+		const email =
+			typeof payload.email === "string" && payload.email.length > 0 ? payload.email.toLowerCase() : undefined;
+		if (accountId || email) {
+			return { accountId: accountId || undefined, email };
+		}
+	}
+	return {};
+}
+
+async function resolveIdentity(
+	fetchImpl: FetchImpl,
+	upstreamZaiAccess: string,
+	jwtCandidates: readonly string[],
+	signal: AbortSignal | undefined,
+): Promise<Identity> {
+	// Best-effort userinfo; never fail login if identity lookup fails.
+	try {
+		const userinfoUrl = validateHttpsEndpoint(resolveUserinfoUrl(), "userinfo");
+		const response = await fetchImpl(userinfoUrl, {
+			headers: { Accept: "application/json", Authorization: `Bearer ${upstreamZaiAccess}` },
+			signal: requestSignal(signal),
+		});
+		if (response.ok) {
+			const payload = (await response.json()) as unknown;
+			const data = isRecord(payload) && isRecord(payload.data) ? payload.data : isRecord(payload) ? payload : {};
+			const email = typeof data.email === "string" && data.email.length > 0 ? data.email.toLowerCase() : undefined;
+			const accountId =
+				(typeof data.id === "string" && data.id) ||
+				(typeof data.account_id === "string" && data.account_id) ||
+				(typeof data.sub === "string" && data.sub) ||
+				undefined;
+			if (email || accountId) {
+				return { email, accountId: accountId || undefined };
+			}
+		}
+	} catch {
+		// fall through to JWT decode
+	}
+	return identityFromJwts(jwtCandidates);
+}
+
+interface BrokerResult {
+	zcodeToken: string;
+	upstreamZaiAccess: string;
+	expiresIn: number;
+}
+
+function parseBrokerResponse(payload: unknown): BrokerResult {
+	const data = isRecord(payload) && isRecord(payload.data) ? payload.data : undefined;
+	const zcodeToken = data && typeof data.token === "string" ? data.token : undefined;
+	const zai = data && isRecord(data.zai) ? data.zai : undefined;
+	const upstreamZaiAccess = zai && typeof zai.access_token === "string" ? zai.access_token : undefined;
+	if (!zcodeToken || !upstreamZaiAccess) {
+		throw new Error("GLM ZCode broker response missing data.token or data.zai.access_token");
+	}
+	const expiresIn =
+		data && typeof data.expires_in === "number" && Number.isFinite(data.expires_in) ? data.expires_in : 3600;
+	return { zcodeToken, upstreamZaiAccess, expiresIn };
+}
+
+async function exchangeGlmZcodeCode(
+	fetchImpl: FetchImpl,
+	input: { code: string; state: string; redirectUri: string },
+	signal: AbortSignal | undefined,
+): Promise<OAuthCredentials> {
+	// Defensive: a pasted value may still be a full redirect URL or `code#state`.
+	const parsed = parseCallbackInput(input.code);
+	const code = parsed.code ?? input.code;
+	const brokerUrl = validateHttpsEndpoint(resolveBrokerTokenUrl(), "broker");
+	const brokerPayload = await postJson(
+		fetchImpl,
+		brokerUrl,
+		{ provider: "zai", code, redirect_uri: input.redirectUri, state: input.state },
+		"broker",
+		signal,
+	);
+	const { zcodeToken, upstreamZaiAccess, expiresIn } = parseBrokerResponse(brokerPayload);
+	const identity = await resolveIdentity(fetchImpl, upstreamZaiAccess, [zcodeToken, upstreamZaiAccess], signal);
+	// access = ZCode JWT (the coding-plan model credential); refresh = upstream
+	// Z.AI token (identity only — there is no documented JWT refresh grant).
+	return {
+		access: zcodeToken,
+		refresh: upstreamZaiAccess,
+		expires: Date.now() + expiresIn * 1000 - GLM_ZCODE_REFRESH_SKEW_MS,
+		email: identity.email,
+		accountId: identity.accountId,
+	};
+}
+
+export interface GlmZcodeOAuthFlowOptions {
+	fetch?: FetchImpl;
+}
+
+export class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthController, options: GlmZcodeOAuthFlowOptions = {}) {
+		super(ctrl, {
+			// Port 0 → a free random local port. The custom-protocol redirect
+			// never reaches it; login completes via manual code/redirect paste.
+			preferredPort: 0,
+			callbackPath: "/callback",
+			callbackHostname: "127.0.0.1",
+			callbackBindHostname: "127.0.0.1",
+			redirectUri: resolveRedirectUri(),
+		} satisfies OAuthCallbackFlowOptions);
+		this.#fetch = options.fetch ?? ctrl.fetch ?? globalThis.fetch;
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const authorizeUrl = validateHttpsEndpoint(resolveAuthorizeUrl(), "authorize");
+		const params = new URLSearchParams({
+			redirect_uri: redirectUri,
+			response_type: "code",
+			client_id: resolveClientId(),
+			state,
+		});
+		return {
+			url: `${authorizeUrl}?${params.toString()}`,
+			instructions:
+				"Complete Z.AI login in your browser. This is an UNOFFICIAL ZCode-based login — use at your own risk; it may stop working or violate ZCode/Z.AI Terms of Service. Because this CLI cannot receive the zcode:// redirect, paste the final redirect URL or authorization code when prompted.",
+		};
+	}
+
+	async exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials> {
+		return exchangeGlmZcodeCode(this.#fetch, { code, state, redirectUri }, this.ctrl.signal);
+	}
+}
+
+export async function loginGlmZcode(
+	ctrl: OAuthController,
+	options?: GlmZcodeOAuthFlowOptions,
+): Promise<OAuthCredentials> {
+	return new GlmZcodeOAuthFlow(ctrl, options).login();
+}
+
+export interface GlmZcodeRefreshOptions {
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+}
+
+/**
+ * The ZCode session JWT is the model credential. ZCode mints it from a one-time
+ * authorization code via the broker and exposes no documented refresh grant, so
+ * there is no autonomous refresh: an expired credential requires re-login
+ * (`/login glm-zcode`). Never return an expired credential as valid.
+ */
+export async function refreshGlmZcodeToken(
+	_credentials: OAuthCredentials,
+	_options: AbortSignal | GlmZcodeRefreshOptions = {},
+): Promise<OAuthCredentials> {
+	throw new Error(
+		"glm-zcode session expired; re-login required (`/login glm-zcode`). The ZCode coding-plan token has no documented refresh endpoint.",
+	);
+}

package/src/utils/oauth/index.ts

@@ -170,6 +170,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "Z.AI (GLM Coding Plan)",
 		available: true,
 	},
+	{
+		id: "glm-zcode",
+		name: "GLM ZCode OAuth (unofficial, opt-in)",
+		available: true,
+	},
 	{
 		id: "minimax-code",
 		name: "MiniMax Coding Plan (International)",
@@ -335,6 +340,11 @@ export async function refreshOAuthToken(
 			newCredentials = await refreshXaiToken(credentials.refresh);
 			break;
 		}
+		case "glm-zcode": {
+			const { refreshGlmZcodeToken } = await import("./glm-zcode");
+			newCredentials = await refreshGlmZcodeToken(credentials);
+			break;
+		}
 		case "kilo":
 		case "perplexity":
 		case "huggingface":

package/src/utils/oauth/types.ts

@@ -49,6 +49,7 @@ export type OAuthProvider =
 	| "vercel-ai-gateway"
 	| "vllm"
 	| "xai"
+	| "glm-zcode"
 	| "xiaomi"
 	| "xiaomi-token-plan-sgp"
 	| "xiaomi-token-plan-ams"

package/src/utils.ts

@@ -98,8 +98,10 @@ function sanitizeOpenAIResponsesHistoryItemForReplay(
 ): OpenAIResponsesReplayItem | undefined {
 	if (item.type === "item_reference") return undefined;
 
-	// providerPayload stores raw output items; replay strips item ids and keeps only normalized call_id.
-	const { id: _id, ...sanitizedItem } = item;
+	// providerPayload stores raw output items; replay strips fields that are output-only.
+	const { id: _id, ...itemWithoutId } = item;
+	const sanitizedItem =
+		item.type === "computer_call" ? sanitizeComputerCallForResponsesInput(itemWithoutId) : itemWithoutId;
 	if (typeof item.call_id === "string") {
 		sanitizedItem.call_id = normalizeReplayedResponsesHistoryCallId(item.call_id, normalizedCallIds);
 	}
@@ -107,6 +109,13 @@ function sanitizeOpenAIResponsesHistoryItemForReplay(
 	return sanitizedItem as unknown as OpenAIResponsesReplayItem;
 }
 
+function sanitizeComputerCallForResponsesInput(item: Record<string, unknown>): Record<string, unknown> {
+	// The Responses stream includes the performed computer action on output items,
+	// but the create input accepts only the call identity/status fields on replay.
+	const { action: _action, actions: _actions, ...inputSafeItem } = item;
+	return inputSafeItem;
+}
+
 function normalizeReplayedResponsesHistoryCallId(value: string, normalizedValues: Map<string, string>): string {
 	const normalized = normalizedValues.get(value);
 	if (normalized) return normalized;