v1.6.2

Full Changelog: v1.6.1...v1.6.2

v1.6.1

Full Changelog: v1.6.0...v1.6.1

v1.6.0

Full Changelog: v1.5.0...v1.6.0

v1.5.0

Full Changelog: v1.4.0...v1.5.0

Native GLM ACP v1.4.0 — Awareness Core

Native GLM ACP v1.4.0

Native GLM ACP is now positioned as an open-source ACP-native coding agent runtime for Z.ai GLM models, with its repository renamed to Native-GLM-ACP.

Awareness Core

• Adds a bounded typed epistemic ledger for observations, assumptions, hypotheses, contradictions, unknowns, and capability limits.
• Issues harness-controlled evidence references and invalidates scope-overlapping evidence after relevant edits.
• Adds /awareness for inspectable knowledge, uncertainty, stale evidence, capability limits, completion coverage, and the next evidence need.
• Adds structured completion certificates and blocks persistent-goal completion until every criterion has fresh evidence, contradictions are resolved, and post-edit verification is fresh.
• Adds metadata-only evidence-coverage and prevented-false-completion observability.

Distribution

• Five frozen binaries: Linux x86-64/AArch64, macOS Intel/Apple Silicon, and Windows x86-64.
• Checksum-verifying Unix and Windows installers now use the renamed repository.
• Includes Python wheel/source distribution, ACP Registry manifest, icon, SHA-256 files, and provenance attestations.

Verification

• 463 tests passed.
• All five frozen executables passed version and size gates.
• All five published archive checksums were independently verified.
• Official ACP Registry schema, URL, and Terminal Auth verification passed.

Full changelog: v1.3.0...v1.4.0

v1.3.0

Native GLM ACP v1.3.0

This release hardens execution, worker promotion, plugin trust, evaluation, and observability while preserving the native five-platform installation experience.

Highlights

• Stronger OS-aware command containment with Linux Bubblewrap, macOS Seatbelt, and fail-closed capability reporting.
• Verification- and digest-gated worktree worker promotion with conflict-aware transactional rollback.
• Language-aware bounded @file, @folder, @symbol, and @diff context budgeting, including a runtime-free symbol-search fallback.
• Redacted failure-driven evaluation corpus and an observability dashboard for quality, latency, token, cache, sandbox, plugin, and resilience signals.
• Ed25519 plugin signing, trusted-publisher enforcement, hash-pinned packages, and permission-scoped data-only plugins.
• Bounded fuzzing, fault injection, and lifecycle failure checks.

Distribution

Five checksum-verified frozen binaries are published for Linux x86-64/ARM64, macOS Intel/Apple Silicon, and Windows x86-64. Installers remain user-local, require no Python or Node.js runtime, and expose both native-glm-acp and glm-acp.

Full changelog: v1.2.0...v1.3.0

v1.2.0

Native GLM ACP v1.2.0

This release adds the safe extensibility roadmap without weakening Native GLM ACP's existing permission, workspace, verification, or secret boundaries.

What’s new

• Conflict-aware checkpoints and /rollback — bounded snapshots are created before workspace mutations. Common secret files are excluded, exact agent-produced hashes are tracked, and rollback stops before writing if a later edit conflicts.
• Bounded context references — @file:, @folder:, @symbol:, and @diff stay inside workspace roots, enforce file/character limits, omit common secret paths, and enter context as untrusted data.
• Declarative policy engine — ordered allow/ask/deny rules cover tools, paths, and bounded command patterns. Invalid policy fails closed, nested workflow steps are evaluated, and policy cannot grant more authority than the active session mode.
• OS-level command sandboxing — optional or required Bubblewrap isolation on Linux exposes system runtimes read-only, mounts only declared workspace roots writable, hides the user home, and supports network isolation.
• Declarative workflows — static acyclic graphs of up to 12 allowlisted tool steps execute in dependency order and stop on failure; arbitrary orchestration code is not supported.
• Worktree-isolated implementation workers — opt-in editing workers use detached locked Git worktrees, require network-disabled OS isolation for commands, return unmerged diffs, and preserve dirty worktrees for review.
• Isolated user profiles — GLM_ACP_PROFILE separates credentials, sessions, telemetry, hooks, MCP config, cron state, checkpoints, worktrees, plugins, and private user memory while default preserves legacy paths.
• Hash-pinned plugin packages — permission-scoped, data-only packages enforce per-file hashes, an installed manifest pin, package bounds, promptware scanning, and rejection of executable content.

Verification

• 436 offline tests passed.
• Ruff passed for the complete runtime and new safety suite.
• pip-audit found no known dependency vulnerabilities.
• Wheel, sdist, and frozen executable builds passed.
• Frozen ACP JSON-RPC initialization passed and advertised version 1.2.0.
• Release CI built and verified Linux x86-64/ARM64, macOS Intel/Apple Silicon, and Windows x86-64 archives with SHA-256 files and provenance attestations.

Full changelog: v1.1.0...v1.2.0

v1.1.0

Native GLM ACP v1.1.0

This release adds seven coordinated quality and efficiency extensions to the native Z.ai GLM ACP agent:

• Semantic LSP navigation for symbols, definitions, references, hover, implementations, rename preparation, and call hierarchies.
• Transactional, SHA-256-pinned multi-file patching with syntax validation, exact rollback, and CRLF preservation.
• Bounded concurrent batch reads that reduce tool round trips and context overhead.
• A stable managed-prompt prefix with cache identity and cache-hit reporting.
• Metadata-only, secret-safe trajectory telemetry for measuring tool and turn behavior without storing prompts, outputs, reasoning, commands, or raw session IDs.
• Permission-gated isolated Playwright browser evidence for snapshots, console, network, screenshots, and allowlisted interactions.
• Hash-pinned lifecycle hooks for repository formatting and policy gates, with scrubbed environments and bounded execution.

Distribution

Version-pinned frozen binaries are published for Linux x86-64 and AArch64, macOS Intel and Apple Silicon, and Windows x86-64. Each archive includes a SHA-256 checksum and GitHub build-provenance attestation. The release also includes Python wheel/source distributions, the ACP Registry manifest and icon, and checksum-verifying Unix and Windows installers that expose both glm-acp and native-glm-acp without requiring a Python runtime or administrator privileges.

Verification

• 424 offline tests passed on Python 3.10, 3.11, 3.12, and 3.13.
• All five frozen targets passed their test suite, --version, and 31 MiB size ceiling.
• Dependency audit found no known vulnerabilities.
• The published Linux checksum and pinned public installer were verified end to end.
• The official ACP Registry builder validated all 40 catalog manifests and their release URLs.
• The official Registry authentication verifier downloaded v1.1.0 and passed Terminal Auth through zai-api-key-setup.

Full changelog: v1.0.0...v1.1.0

Native GLM ACP v1.0.0

Native GLM ACP 1.0 is the production-stable milestone for Z.ai GLM coding in Zed and other ACP clients.

Highlights

• Progressive root-to-target discovery for AGENTS, Claude, Hermes, GLM, and Cursor rules, with direct edits deferred until newly scoped instructions are loaded.
• Persistent /goal mode and /subgoal acceptance criteria, evaluated by a bounded auxiliary completion judge.
• Persistent, edit-fresh verification evidence that recognizes canonical project checks and rejects spoofed or status-masking commands.
• Automatic project facts, package-manager detection, and faster subprocess-free root discovery outside Git repositories.
• Immediate post-write Python, JSON, and TOML syntax checks plus optional Pyright, TypeScript, Go, and Rust LSP diagnostics.
• Unchanged-read deduplication and result-aware loop detection for repeated failures and no-progress reads.
• Opt-in Mixture of Agents: parallel independent GLM references with the primary model as the sole actor and aggregator.
• Python 3.10–3.13 compatibility and frozen binaries for Linux x86-64/ARM64, macOS Intel/Apple Silicon, and Windows x86-64.

Verification

• 413 offline tests pass.
• Dependency audit is clean.
• Every frozen executable is version-checked and kept below the release size ceiling.
• Published archives include SHA-256 checksums and GitHub build-provenance attestations.

Full changelog: v0.9.0...v1.0.0

v0.9.0

Full Changelog: v0.8.0...v0.9.0