feat(provider): add Z.ai GLM as a BYOK provider

[fpolica91]

What

Adds Z.ai GLM as a first-class BYOK provider, so you can use GLM-5.2 (and the rest of the GLM lineup) directly from z.ai — not routed through OpenRouter.

Why z.ai is a clean fit

Z.ai's API is OpenAI-compatible (confirmed against docs.z.ai): same /chat/completions shape, same SSE streaming, same tools/tool_choice function-calling. The only deltas are the base URL (https://api.z.ai/api/paas/v4 — note /v4, not /v1), Bearer auth on an id.secret-shaped key, and bare model ids (glm-5.2, not vendor/model). So the adapter reuses the existing to-openai.js / from-openai.js converters — it's a thin sibling of the OpenRouter adapter, minus the gateway-specific bits.

Changes

Area	File	Change
Adapter	peerd-provider/adapters/glm.js (new)	endpoint, default glm-5.2, runner glm-4.5-air, secret glm_api_key; reuses connect-timeout + error-classify + retry
Registry	peerd-provider/registry.js, index.js	register + export
Cost meter	peerd-provider/pricing.js	glm-5.2 / glm-4.6 rate card ($1.4/$4.4, cached $0.26)
Trim trigger	peerd-provider/context-window.js	glm-5.2 = 1M, glm-4.6 = 200K, glm-4.5-air = 128K
Egress	peerd-egress/fetch/allowlist.js	add https://api.z.ai (MV3 CSP already permits all https:)
Picker	background/model-catalog.js	glm catalog entries
Settings UI	options/sections/providers.js	Z.ai logo card + fallback row + copy; neutral key placeholder for the id.secret key shape
Test	tests/peerd-provider/glm-retry.test.ts (new)	retry-set + endpoint/auth/model coverage
Gate	packaging/check-tscheck.ts	bump // @ts-check floor 496 → 497

The chassis (provider status, setKey, test, model picker, settings validation, runner-model resolution, failover) all read the registry descriptor generically, so no per-route wiring was needed — registering the adapter is enough.

Out of scope (future work)

• Thinking mode — GLM surfaces reasoning via delta.reasoning_content (gated by extra_body.thinking.type). Surfacing it belongs in the shared from-openai.js parser (which would also benefit other reasoning-model providers), not this adapter. GLM-5.2 tool-calls and streams content fine without it; the field is silently ignored today, same as OpenRouter.
• GLM-4.5-Air pricing — left out of the rate card rather than guessed; an unknown id degrades to an honest "estimate unavailable" the user can override. GLM-5.2/4.6 (the flagship tier) are priced.

Verification

• bun run typecheck — clean
• bun run lint — clean
• bun run check:tscheck — 497/497 (floor bumped)
• bun run check:boundary — clean
• bun test ./tests — 2663 pass, 0 fail (incl. the 10 new callGlm tests)

🤖 Generated with Claude Code

[NotASithLord]

Adversarial review pass on the diff + CI.

Implementation: sound, and low risk. The adapter is a faithful, thin mirror of openrouter.js reusing to-openai.js/from-openai.js, the shared retry/backoff/connect-timeout plumbing, and the registry/DI contract (no direct peerd-egress import — safeFetch/getSecret injected as usual). The Authorization: Bearer key attaches at fetch-header time and never touches the request body — verified directly in glm.js, matches the stated BYOK posture. Pricing and context-window entries are honestly scoped (unpriced tiers correctly degrade to "estimate unavailable" rather than guessed numbers). tests/peerd-provider/glm-retry.test.ts covers the retry set (429/500/503/529 recover, 400/401/403/404 fail fast), endpoint/auth/model defaults, and stream-to-event shaping. check-tscheck.ts floor bump (497) matches the new // @ts-check file. No manifest change needed — https: CSP already covers the new host, consistent with the documented policy. CI is fully green (12/12 checks, including bun test, lint+boundary+drift, and both packaging targets).

Blocking: the commit is missing the DCO sign-off. 8a59290a has no Signed-off-by trailer — every other recent PR in this repo carries one (git commit -s), and it's a checklist item on essentially every accepted PR here. Please amend (or rebase) to add Signed-off-by: <name> <email> before merge.

Nit (non-blocking): no UI-level test for the new Z.ai provider row in options/sections/providers.js (providerLogo/keyPlaceholder branch), but that matches the test depth of the existing OpenRouter/Ollama rows, so not asking for more than the established bar.

Once the sign-off is added this looks mergeable as-is.

---

Generated by Claude Code

[NotASithLord]

Rebased onto current main (now including the OpenAI adapter from #—/main and the #119/#187/#189 merges): kept both adapters side by side in the registry, pricing, model catalog, and settings rows; re-derived the tscheck floor as 510 → 511 with a ledger line for glm.js. Full local battery green on the rebase: typecheck, lint, tscheck 511/511, boundary, imports, docpaths, packaged page boot, 2822 bun tests, no gen drift. CI 12/12 green. The DCO block is dropped — the checkbox is being removed from the PR template (#190).

---

Generated by Claude Code