@sayknow-cli/ai 0.2.7 → 0.3.1

package/src/providers/openai-responses-shared.ts

@@ -30,7 +30,7 @@ import {
 } from "../types";
 import { normalizeResponsesToolCallId } from "../utils";
 import type { AssistantMessageEventStream } from "../utils/event-stream";
-import { parseStreamingJson } from "../utils/json-parse";
+import { isCompleteJson, parseStreamingJson } from "../utils/json-parse";
 import { joinTextWithImagePlaceholder, NON_VISION_IMAGE_PLACEHOLDER, partitionVisionContent } from "./vision-guard";
 
 export function encodeTextSignatureV1(id: string, phase?: TextSignatureV1["phase"]): string {
@@ -710,6 +710,13 @@ export async function processResponsesStream<TApi extends Api>(
 							: "Unknown error (no error details in response)";
 				throw new Error(message);
 			}
+			// A response cut short for length (`incomplete`) may have stopped
+			// mid-tool-call. Any tool-call item still tracked in `items` never
+			// received its terminal `output_item.done`, so it was cut off; flag it
+			// (along with any finalized-but-unparseable JSON call) so the agent loop
+			// rejects it instead of executing repaired/partial arguments.
+			const openBlocks = new Set<unknown>(Array.from(items.values(), entry => entry.block));
+			flagTruncatedToolCalls(output, output.stopReason, block => !openBlocks.has(block));
 			if (output.content.some(block => block.type === "toolCall") && output.stopReason === "stop") {
 				output.stopReason = "toolUse";
 			}
@@ -728,6 +735,41 @@ export async function processResponsesStream<TApi extends Api>(
 	}
 }
 
+/**
+ * Mark tool-call blocks left incomplete by a length-truncated response so the
+ * agent loop rejects them instead of executing a best-effort partial parse.
+ *
+ * The universal signal is finalization: a call that never received its terminal
+ * `output_item.done` (passed in via `isFinalized`) was cut off mid-arguments.
+ * This covers both JSON function calls and raw-input custom tools without
+ * mis-flagging a *completed* custom tool whose raw input is not valid JSON. As a
+ * defensive secondary, a finalized JSON function call whose buffered arguments
+ * still don't parse (e.g. a misbehaving relay) is flagged too. No-op unless the
+ * turn stopped for length.
+ *
+ * Shared by both Responses providers (`openai-responses`, `openai-codex-responses`).
+ */
+export function flagTruncatedToolCalls(
+	output: AssistantMessage,
+	stopReason: StopReason,
+	isFinalized: (block: ToolCall) => boolean,
+): void {
+	if (stopReason !== "length") return;
+	for (const block of output.content) {
+		if (block.type !== "toolCall") continue;
+		if (!isFinalized(block)) {
+			block.incompleteArguments = true;
+			continue;
+		}
+		// Finalized: custom tools carry raw (non-JSON) input and are complete once
+		// finalized; only JSON function calls get the parse double-check.
+		if (!block.customWireName) {
+			const partial = (block as { partialJson?: string }).partialJson;
+			if (partial !== undefined && !isCompleteJson(partial)) block.incompleteArguments = true;
+		}
+	}
+}
+
 export function mapOpenAIResponsesStopReason(status: OpenAI.Responses.ResponseStatus | undefined): StopReason {
 	if (!status) return "stop";
 	switch (status) {

package/src/stream.ts

@@ -88,6 +88,7 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	kilo: "KILO_API_KEY",
 	"vercel-ai-gateway": "AI_GATEWAY_API_KEY",
 	zai: "ZAI_API_KEY",
+	"glm-zcode": "GLM_ZCODE_API_KEY",
 	mistral: "MISTRAL_API_KEY",
 	minimax: "MINIMAX_API_KEY",
 	"minimax-code": "MINIMAX_CODE_API_KEY",

package/src/types.ts

@@ -122,6 +122,7 @@ export type KnownProvider =
 	| "kilo"
 	| "vercel-ai-gateway"
 	| "zai"
+	| "glm-zcode"
 	| "mistral"
 	| "minimax"
 	| "opencode-go"
@@ -489,6 +490,14 @@ export interface ToolCall {
 	 * JSON function tools.
 	 */
 	customWireName?: string;
+	/**
+	 * Set when the provider detected the argument JSON was truncated — the model
+	 * hit its output-token limit (or the response was otherwise cut short) before
+	 * emitting a complete arguments object. The `arguments` field then holds a
+	 * best-effort partial parse and must not be executed as-is; the agent loop
+	 * rejects the call with a retryable error instead.
+	 */
+	incompleteArguments?: boolean;
 }
 
 export interface Usage {

package/src/utils/json-parse.ts

@@ -146,3 +146,21 @@ export function parseStreamingJson<T = Record<string, unknown>>(partialJson: str
 		}
 	}
 }
+
+/**
+ * Whether a string is a complete, well-formed JSON document (strict parse, no
+ * repair). Used to distinguish a tool-call argument blob that finished cleanly
+ * from one that was cut off mid-stream (truncation). An empty / whitespace-only
+ * string is treated as complete: a tool invoked with no arguments legitimately
+ * streams an empty buffer and must not be flagged as truncated.
+ */
+export function isCompleteJson(text: string | undefined): boolean {
+	const trimmed = text?.trim();
+	if (!trimmed) return true;
+	try {
+		JSON.parse(trimmed);
+		return true;
+	} catch {
+		return false;
+	}
+}

package/src/utils/oauth/glm-zcode.ts

@@ -0,0 +1,433 @@
+/**
+ * GLM ZCode OAuth flow (UNOFFICIAL, opt-in).
+ *
+ * Replicates how the ZCode desktop app turns a Z.AI login into usable GLM model
+ * access. This is NOT an official Z.AI OAuth client: it reuses ZCode's authorize
+ * page, broker, and a custom-protocol redirect. It may break at any time and may
+ * violate ZCode/Z.AI Terms of Service. Endpoints/client id are overridable via
+ * `ZCODE_OAUTH_*` environment variables.
+ *
+ * Verified end-to-end against the ZCode host bundle (`resolveZaiApiKey` /
+ * `resolveBizApiKey`) and live traffic:
+ *   1. Authorize: GET {authorize}?redirect_uri=zcode://oauth/callback&response_type=code&client_id=...&state=...
+ *      (custom-protocol redirect → a CLI cannot catch it, so the user pastes the code/redirect URL)
+ *   2. Broker:    POST {broker} { provider:"zai", code, redirect_uri, state }
+ *                  → { data: { token: <ZCode JWT>, zai: { access_token: <upstream Z.AI token> } } }
+ *   3. Business:  POST {z/login} { token: <upstream Z.AI token> } → { data: { access_token: <business token> } }
+ *   4. Provision: with the business token, GET getCustomerInfo → default org/project,
+ *      GET/POST .../api_keys (find/create a key named "zcode-api-key"),
+ *      GET .../api_keys/copy/{id} → secretKey ⇒ a real Z.AI API key "{id}.{secret}".
+ *
+ * Credential mapping:
+ *   - `access`  = the provisioned **Z.AI API key** ("{id}.{secret}"). Model requests go to
+ *                 `https://api.z.ai/api/anthropic/v1/messages` with `Authorization: Bearer <key>`
+ *                 (exactly like a dashboard key) — NO zcode.z.ai gateway, NO captcha.
+ *   - `refresh` = the upstream Z.AI OAuth access token (used to re-provision the key).
+ * The API key is long-lived, so `expires` is set far in the future.
+ *
+ * This provider must NEVER force `isOAuth=true`: the key is a plain Z.AI API key, and
+ * api.z.ai is not api.anthropic.com, so the Anthropic path already emits a plain bearer.
+ */
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions, parseCallbackInput } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+export const GLM_ZCODE_REFRESH_SKEW_MS = 2 * 60 * 1000;
+/** Provisioned API keys are long-lived; pin expiry far out so AuthStorage never force-refreshes. */
+const GLM_ZCODE_API_KEY_TTL_MS = 10 * 365 * 24 * 60 * 60 * 1000;
+/** Name ZCode gives the API key it auto-provisions (host bundle constant `FI`). */
+const GLM_ZCODE_API_KEY_NAME = "zcode-api-key";
+
+/** Default endpoints / client id. Override via the matching `ZCODE_OAUTH_*` env vars. */
+export const GLM_ZCODE_OAUTH_AUTHORIZE_URL = "https://chat.z.ai/api/oauth/authorize";
+export const GLM_ZCODE_OAUTH_CLIENT_ID = "client_P8X5CMWmlaRO9gyO-KSqtg";
+export const GLM_ZCODE_OAUTH_REDIRECT_URI = "zcode://oauth/callback";
+export const GLM_ZCODE_OAUTH_BROKER_TOKEN_URL = "https://zcode.z.ai/api/v1/oauth/token";
+export const GLM_ZCODE_ZAI_LOGIN_URL = "https://api.z.ai/api/auth/z/login";
+export const GLM_ZCODE_USERINFO_URL = "https://chat.z.ai/api/oauth/userinfo";
+/** Z.AI business API base (customer/org/project/api-key management). */
+export const GLM_ZCODE_ZAI_API_BASE = "https://api.z.ai";
+/** Model API base — the provisioned key is used here, exactly like a dashboard key. */
+export const GLM_ZCODE_ANTHROPIC_BASE_URL = "https://api.z.ai/api/anthropic";
+
+type FetchImpl = typeof globalThis.fetch;
+
+function envOr(name: string, fallback: string): string {
+	const value = process.env[name];
+	return value && value.trim().length > 0 ? value.trim() : fallback;
+}
+
+function resolveAuthorizeUrl(): string {
+	return envOr("ZCODE_OAUTH_AUTHORIZE_URL", GLM_ZCODE_OAUTH_AUTHORIZE_URL);
+}
+function resolveClientId(): string {
+	return envOr("ZCODE_OAUTH_CLIENT_ID", GLM_ZCODE_OAUTH_CLIENT_ID);
+}
+function resolveRedirectUri(): string {
+	return envOr("ZCODE_OAUTH_REDIRECT_URI", GLM_ZCODE_OAUTH_REDIRECT_URI);
+}
+function resolveBrokerTokenUrl(): string {
+	return envOr("ZCODE_OAUTH_BROKER_TOKEN_URL", GLM_ZCODE_OAUTH_BROKER_TOKEN_URL);
+}
+function resolveZaiLoginUrl(): string {
+	return envOr("ZCODE_OAUTH_ZAI_LOGIN_URL", GLM_ZCODE_ZAI_LOGIN_URL);
+}
+function resolveUserinfoUrl(): string {
+	return envOr("ZCODE_OAUTH_USERINFO_URL", GLM_ZCODE_USERINFO_URL);
+}
+function resolveZaiApiBase(): string {
+	return envOr("ZCODE_OAUTH_ZAI_API_BASE", GLM_ZCODE_ZAI_API_BASE).replace(/\/+$/, "");
+}
+
+/** Configured whenever a client id is available; the real ZCode client id ships as default. */
+export function isGlmZcodeOAuthConfigured(): boolean {
+	return resolveClientId().length > 0;
+}
+
+/** Mask token-like substrings so broker/upstream/business tokens never leak into errors. */
+function redactSecrets(text: string): string {
+	return text
+		.replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]")
+		.replace(/[A-Za-z0-9_-]{40,}/g, "[redacted]");
+}
+
+function validateHttpsEndpoint(rawUrl: string, label: string): string {
+	let parsed: URL;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		throw new Error(`GLM ZCode ${label} endpoint is not a valid URL`);
+	}
+	if (parsed.protocol !== "https:") {
+		throw new Error(`GLM ZCode ${label} endpoint must use https`);
+	}
+	return parsed.toString().replace(/\/+$/, "");
+}
+
+function requestSignal(signal: AbortSignal | undefined): AbortSignal {
+	const timeoutSignal = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+	return signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null;
+}
+
+async function postJson(
+	fetchImpl: FetchImpl,
+	url: string,
+	body: Record<string, unknown>,
+	label: string,
+	signal: AbortSignal | undefined,
+	bearer?: string,
+): Promise<unknown> {
+	const headers: Record<string, string> = { Accept: "application/json", "Content-Type": "application/json" };
+	if (bearer) headers.Authorization = `Bearer ${bearer}`;
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(body),
+		signal: requestSignal(signal),
+	});
+	if (!response.ok) {
+		throw new Error(`GLM ZCode ${label} request failed: ${response.status} ${redactSecrets(await response.text())}`);
+	}
+	return response.json();
+}
+
+async function getJson(
+	fetchImpl: FetchImpl,
+	url: string,
+	bearer: string,
+	label: string,
+	signal: AbortSignal | undefined,
+): Promise<unknown> {
+	const response = await fetchImpl(url, {
+		headers: { Accept: "application/json", Authorization: `Bearer ${bearer}` },
+		signal: requestSignal(signal),
+	});
+	if (!response.ok) {
+		throw new Error(`GLM ZCode ${label} request failed: ${response.status} ${redactSecrets(await response.text())}`);
+	}
+	return response.json();
+}
+
+interface JwtPayload {
+	sub?: unknown;
+	email?: unknown;
+	[key: string]: unknown;
+}
+function decodeJwtPayload(token: string): JwtPayload | undefined {
+	const parts = token.split(".");
+	const payload = parts[1];
+	if (parts.length !== 3 || !payload) return undefined;
+	try {
+		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as JwtPayload;
+	} catch {
+		return undefined;
+	}
+}
+
+interface Identity {
+	email?: string;
+	accountId?: string;
+}
+
+function parseBrokerResponse(payload: unknown): { upstreamZaiAccess: string; zcodeToken: string } {
+	const data = isRecord(payload) && isRecord(payload.data) ? payload.data : undefined;
+	const zcodeToken = data && typeof data.token === "string" ? data.token : undefined;
+	const zai = data && isRecord(data.zai) ? data.zai : undefined;
+	const upstreamZaiAccess = zai && typeof zai.access_token === "string" ? zai.access_token : undefined;
+	if (!zcodeToken || !upstreamZaiAccess) {
+		throw new Error("GLM ZCode broker response missing data.token or data.zai.access_token");
+	}
+	return { upstreamZaiAccess, zcodeToken };
+}
+
+async function resolveBusinessToken(
+	fetchImpl: FetchImpl,
+	upstreamZaiAccess: string,
+	signal: AbortSignal | undefined,
+): Promise<string> {
+	const zaiLoginUrl = validateHttpsEndpoint(resolveZaiLoginUrl(), "z/login");
+	const payload = await postJson(fetchImpl, `${zaiLoginUrl}`, { token: upstreamZaiAccess }, "z/login", signal);
+	const data = isRecord(payload) && isRecord(payload.data) ? payload.data : undefined;
+	const access = data && typeof data.access_token === "string" ? data.access_token : undefined;
+	if (!access) throw new Error("GLM ZCode z/login response missing data.access_token");
+	return access;
+}
+
+interface OrgProject {
+	organizationId: string;
+	projectId: string;
+	email?: string;
+	accountId?: string;
+}
+
+function pickDefaultOrgProject(customerInfo: unknown): OrgProject {
+	const data = isRecord(customerInfo) && isRecord(customerInfo.data) ? customerInfo.data : customerInfo;
+	const root = isRecord(data) ? data : {};
+	const orgs = Array.isArray(root.organizations) ? root.organizations : [];
+	const org = (orgs.find(o => isRecord(o) && o.isDefault) ?? orgs[0]) as Record<string, unknown> | undefined;
+	const organizationId = org && typeof org.organizationId === "string" ? org.organizationId : undefined;
+	const projects = org && Array.isArray(org.projects) ? org.projects : [];
+	const proj = (projects.find(p => isRecord(p) && p.isDefault) ?? projects[0]) as Record<string, unknown> | undefined;
+	const projectId = proj && typeof proj.projectId === "string" ? proj.projectId : undefined;
+	if (!organizationId || !projectId) {
+		throw new Error("GLM ZCode getCustomerInfo response missing default organization/project");
+	}
+	const email = typeof root.email === "string" && root.email.length > 0 ? root.email.toLowerCase() : undefined;
+	const accountId = typeof root.id === "string" ? root.id : typeof root.id === "number" ? String(root.id) : undefined;
+	return { organizationId, projectId, email, accountId };
+}
+
+/**
+ * Provision (or reuse) a Z.AI API key named "zcode-api-key" using the business token,
+ * mirroring ZCode's `resolveBizApiKey`. Returns "{apiKeyId}.{secretKey}".
+ */
+async function provisionZaiApiKey(
+	fetchImpl: FetchImpl,
+	businessToken: string,
+	signal: AbortSignal | undefined,
+): Promise<{ apiKey: string; identity: Identity }> {
+	const apiBase = resolveZaiApiBase();
+	const customerInfo = await getJson(
+		fetchImpl,
+		`${apiBase}/api/biz/customer/getCustomerInfo`,
+		businessToken,
+		"getCustomerInfo",
+		signal,
+	);
+	const { organizationId, projectId, email, accountId } = pickDefaultOrgProject(customerInfo);
+	const keysUrl = `${apiBase}/api/biz/v1/organization/${organizationId}/projects/${projectId}/api_keys`;
+
+	const listPayload = await getJson(fetchImpl, keysUrl, businessToken, "api_keys.list", signal);
+	const listData = isRecord(listPayload) && Array.isArray(listPayload.data) ? listPayload.data : [];
+	let entry = listData.find(k => isRecord(k) && k.name === GLM_ZCODE_API_KEY_NAME) as
+		| Record<string, unknown>
+		| undefined;
+
+	if (!entry) {
+		const created = await postJson(
+			fetchImpl,
+			keysUrl,
+			{ name: GLM_ZCODE_API_KEY_NAME },
+			"api_keys.create",
+			signal,
+			businessToken,
+		);
+		entry = (isRecord(created) && isRecord(created.data) ? created.data : created) as Record<string, unknown>;
+	}
+
+	const apiKeyId =
+		typeof entry.apiKey === "string" ? entry.apiKey.trim() : typeof entry.id === "string" ? entry.id : "";
+	if (!apiKeyId) throw new Error("GLM ZCode api_keys response missing apiKey id");
+
+	const copyPayload = await getJson(
+		fetchImpl,
+		`${keysUrl}/copy/${encodeURIComponent(apiKeyId)}`,
+		businessToken,
+		"api_keys.copy",
+		signal,
+	);
+	const copyData = isRecord(copyPayload) && isRecord(copyPayload.data) ? copyPayload.data : copyPayload;
+	const secretKey = isRecord(copyData) && typeof copyData.secretKey === "string" ? copyData.secretKey.trim() : "";
+	if (!secretKey) throw new Error("GLM ZCode api_keys copy response missing secretKey");
+
+	return { apiKey: `${apiKeyId}.${secretKey}`, identity: { email, accountId } };
+}
+
+async function resolveIdentity(
+	fetchImpl: FetchImpl,
+	upstreamZaiAccess: string,
+	fallback: Identity,
+	jwtCandidates: readonly string[],
+	signal: AbortSignal | undefined,
+): Promise<Identity> {
+	if (fallback.email || fallback.accountId) return fallback;
+	try {
+		const userinfoUrl = validateHttpsEndpoint(resolveUserinfoUrl(), "userinfo");
+		const response = await fetchImpl(userinfoUrl, {
+			headers: { Accept: "application/json", Authorization: `Bearer ${upstreamZaiAccess}` },
+			signal: requestSignal(signal),
+		});
+		if (response.ok) {
+			const payload = (await response.json()) as unknown;
+			const data = isRecord(payload) && isRecord(payload.data) ? payload.data : isRecord(payload) ? payload : {};
+			const email = typeof data.email === "string" && data.email.length > 0 ? data.email.toLowerCase() : undefined;
+			const accountId =
+				(typeof data.id === "string" && data.id) || (typeof data.sub === "string" && data.sub) || undefined;
+			if (email || accountId) return { email, accountId: accountId || undefined };
+		}
+	} catch {
+		// fall through
+	}
+	for (const token of jwtCandidates) {
+		const p = decodeJwtPayload(token);
+		const accountId = p && typeof p.sub === "string" ? p.sub : undefined;
+		const email = p && typeof p.email === "string" ? p.email.toLowerCase() : undefined;
+		if (accountId || email) return { accountId, email };
+	}
+	return {};
+}
+
+function credentialsFromApiKey(apiKey: string, upstreamZaiAccess: string, identity: Identity): OAuthCredentials {
+	return {
+		access: apiKey,
+		refresh: upstreamZaiAccess,
+		expires: Date.now() + GLM_ZCODE_API_KEY_TTL_MS,
+		email: identity.email,
+		accountId: identity.accountId,
+	};
+}
+
+async function provisionFromUpstream(
+	fetchImpl: FetchImpl,
+	upstreamZaiAccess: string,
+	zcodeTokenForIdentity: string | undefined,
+	signal: AbortSignal | undefined,
+): Promise<OAuthCredentials> {
+	const businessToken = await resolveBusinessToken(fetchImpl, upstreamZaiAccess, signal);
+	const { apiKey, identity: keyIdentity } = await provisionZaiApiKey(fetchImpl, businessToken, signal);
+	const identity = await resolveIdentity(
+		fetchImpl,
+		upstreamZaiAccess,
+		keyIdentity,
+		[zcodeTokenForIdentity ?? "", businessToken].filter(Boolean),
+		signal,
+	);
+	return credentialsFromApiKey(apiKey, upstreamZaiAccess, identity);
+}
+
+async function exchangeGlmZcodeCode(
+	fetchImpl: FetchImpl,
+	input: { code: string; state: string; redirectUri: string },
+	signal: AbortSignal | undefined,
+): Promise<OAuthCredentials> {
+	const parsed = parseCallbackInput(input.code);
+	const code = parsed.code ?? input.code;
+	const brokerUrl = validateHttpsEndpoint(resolveBrokerTokenUrl(), "broker");
+	const brokerPayload = await postJson(
+		fetchImpl,
+		brokerUrl,
+		{ provider: "zai", code, redirect_uri: input.redirectUri, state: input.state },
+		"broker",
+		signal,
+	);
+	const { upstreamZaiAccess, zcodeToken } = parseBrokerResponse(brokerPayload);
+	return provisionFromUpstream(fetchImpl, upstreamZaiAccess, zcodeToken, signal);
+}
+
+export interface GlmZcodeOAuthFlowOptions {
+	fetch?: FetchImpl;
+}
+
+export class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthController, options: GlmZcodeOAuthFlowOptions = {}) {
+		super(ctrl, {
+			preferredPort: 0,
+			callbackPath: "/callback",
+			callbackHostname: "127.0.0.1",
+			callbackBindHostname: "127.0.0.1",
+			redirectUri: resolveRedirectUri(),
+		} satisfies OAuthCallbackFlowOptions);
+		this.#fetch = options.fetch ?? ctrl.fetch ?? globalThis.fetch;
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const authorizeUrl = validateHttpsEndpoint(resolveAuthorizeUrl(), "authorize");
+		const params = new URLSearchParams({
+			redirect_uri: redirectUri,
+			response_type: "code",
+			client_id: resolveClientId(),
+			state,
+		});
+		return {
+			url: `${authorizeUrl}?${params.toString()}`,
+			instructions:
+				"Complete Z.AI login in your browser. This is an UNOFFICIAL ZCode-based login — use at your own risk; it may stop working or violate ZCode/Z.AI Terms of Service. Because this CLI cannot receive the zcode:// redirect, paste the final redirect URL or authorization code when prompted.",
+		};
+	}
+
+	async exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials> {
+		return exchangeGlmZcodeCode(this.#fetch, { code, state, redirectUri }, this.ctrl.signal);
+	}
+}
+
+export async function loginGlmZcode(
+	ctrl: OAuthController,
+	options?: GlmZcodeOAuthFlowOptions,
+): Promise<OAuthCredentials> {
+	return new GlmZcodeOAuthFlow(ctrl, options).login();
+}
+
+export interface GlmZcodeRefreshOptions {
+	signal?: AbortSignal;
+	fetch?: FetchImpl;
+}
+
+/**
+ * Re-provision the Z.AI API key from the stored upstream token. The key itself is
+ * long-lived, so this is rarely needed; if the upstream token has expired it fails
+ * loudly and the user must re-login.
+ */
+export async function refreshGlmZcodeToken(
+	credentials: OAuthCredentials,
+	options: AbortSignal | GlmZcodeRefreshOptions = {},
+): Promise<OAuthCredentials> {
+	const { signal, fetch: fetchImpl } =
+		options instanceof AbortSignal ? { signal: options, fetch: undefined } : options;
+	const upstream = credentials.refresh;
+	if (!upstream) {
+		throw new Error("glm-zcode credentials require re-login (`/login glm-zcode`); no stored upstream Z.AI token");
+	}
+	try {
+		return await provisionFromUpstream(fetchImpl ?? globalThis.fetch, upstream, undefined, signal);
+	} catch (error) {
+		throw new Error(
+			`glm-zcode credentials require re-login (\`/login glm-zcode\`); re-provisioning the Z.AI API key failed (${redactSecrets(String(error))})`,
+		);
+	}
+}

package/src/utils/oauth/index.ts

@@ -170,6 +170,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "Z.AI (GLM Coding Plan)",
 		available: true,
 	},
+	{
+		id: "glm-zcode",
+		name: "GLM ZCode OAuth (unofficial, opt-in)",
+		available: true,
+	},
 	{
 		id: "minimax-code",
 		name: "MiniMax Coding Plan (International)",
@@ -335,6 +340,11 @@ export async function refreshOAuthToken(
 			newCredentials = await refreshXaiToken(credentials.refresh);
 			break;
 		}
+		case "glm-zcode": {
+			const { refreshGlmZcodeToken } = await import("./glm-zcode");
+			newCredentials = await refreshGlmZcodeToken(credentials);
+			break;
+		}
 		case "kilo":
 		case "perplexity":
 		case "huggingface":

package/src/utils/oauth/types.ts

@@ -49,6 +49,7 @@ export type OAuthProvider =
 	| "vercel-ai-gateway"
 	| "vllm"
 	| "xai"
+	| "glm-zcode"
 	| "xiaomi"
 	| "xiaomi-token-plan-sgp"
 	| "xiaomi-token-plan-ams"

package/src/utils.ts

@@ -98,8 +98,10 @@ function sanitizeOpenAIResponsesHistoryItemForReplay(
 ): OpenAIResponsesReplayItem | undefined {
 	if (item.type === "item_reference") return undefined;
 
-	// providerPayload stores raw output items; replay strips item ids and keeps only normalized call_id.
-	const { id: _id, ...sanitizedItem } = item;
+	// providerPayload stores raw output items; replay strips fields that are output-only.
+	const { id: _id, ...itemWithoutId } = item;
+	const sanitizedItem =
+		item.type === "computer_call" ? sanitizeComputerCallForResponsesInput(itemWithoutId) : itemWithoutId;
 	if (typeof item.call_id === "string") {
 		sanitizedItem.call_id = normalizeReplayedResponsesHistoryCallId(item.call_id, normalizedCallIds);
 	}
@@ -107,6 +109,13 @@ function sanitizeOpenAIResponsesHistoryItemForReplay(
 	return sanitizedItem as unknown as OpenAIResponsesReplayItem;
 }
 
+function sanitizeComputerCallForResponsesInput(item: Record<string, unknown>): Record<string, unknown> {
+	// The Responses stream includes the performed computer action on output items,
+	// but the create input accepts only the call identity/status fields on replay.
+	const { action: _action, actions: _actions, ...inputSafeItem } = item;
+	return inputSafeItem;
+}
+
 function normalizeReplayedResponsesHistoryCallId(value: string, normalizedValues: Map<string, string>): string {
 	const normalized = normalizedValues.get(value);
 	if (normalized) return normalized;