zai-org/ZCode

What it claims

ZCode (v3.14.3 as of 2026-09-23, from zai-org) is an AI programming workbench shipping as a desktop Electron app, a browser Web UI, and a terminal Agent (TUI). The summary already names these; what the page adds is the concrete toolchain, the CLI/web run model, the packaging pipeline, and the network/auth defaults an adopter has to know before running it.

How to use it

Pinned toolchain (versions authoritative in mise.toml): Git, Node.js 24.14.0, pnpm 10.33.2. The Agent CLI and runtime live at apps/zcode-cli/ as a plain directory — no submodule init needed.

Bootstrap and dev modes (run from repo root):

pnpm bootstrap                 # workspace deps + desktop local assets + build:bootstrap
pnpm dev:desktop               # == dev:desktop:prod; builds desktop agent, starts Electron
pnpm dev:desktop:test          # test-env service config
pnpm dev:web                   # web dev server :5173 + backend :3030

pnpm bootstrap:with-remote prepares a mock-cdn for remote-workspace testing; default bootstrap skips remote assets. Set ZCODE_DATA_BASE_DIR for an isolated dev data dir; ZCODE_SERVER_WORKSPACE to point the web backend at a project.

The release package bundles TUI + Web + Agent under one zcode launcher — no Electron at runtime, but Node.js (per mise.toml) is still required:

zcode                                              # TUI
zcode --web                                        # web UI
zcode --web --workspace /path --port 3030 --no-open

Building a release:

pnpm build:zcode --base-url https://downloads.example.com/zcode/
pnpm build:zcode --skip-build   # repackage, reuse existing agent/backend/web builds
pnpm bundle:desktop -- --os win --arch x64   # desktop installer; default mac arm64

build:zcode requires ZCODE_DIST_BASE_URL (via .env, .env.local, or --base-url). Output in dist/zcode/: releases/<version>/zcode-<version>.tar.gz, sha256.txt, plus latest.json and install.sh. The install script pulls from the base URL, installs to ~/.zcode/runtime, and creates a zcode command in ~/.local/bin (overridable via ZCODE_DIST_HOME / ZCODE_DIST_BIN_DIR). Local desktop builds are unsigned; macOS may require sudo xattr -rd com.apple.quarantine /Applications/ZCode.app.

Limits — network and auth defaults worth checking

Web mode's security posture is default-on-trust for local use: it binds 127.0.0.1, auto-selects a free port, and runs with no access token by default. Only when you bind a non-local address (--host 0.0.0.0) does it auto-generate a token; use --token to set one or --no-token to disable auth entirely. The general HTTP server entry authenticates API/WebSocket via ZCODE_SERVER_AUTH_TOKEN (or authToken when created programmatically). Anyone exposing this beyond localhost must set this deliberately.

Migration: old "Lite" users must switch to the new build commands, env vars, and install script; new installs do not delete the old Lite directory and do not migrate or delete existing session data. The page defers licensing, third-party copyright, and stated execution/data risks to NOTICE.md and third-party/README.md — check those before adopting; the license is not stated inline here.