Skip to content

ZC Workbench v0.2.0 (Public Preview)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 12:41
v0.2.0
29d0929
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ZC Workbench v0.2.0 : Public Preview

A focused, independent coding workspace for the terminal. Built by Striking Lions around the managed ZCode runtime.

This is a usable public preview, not a stable, independently audited release. We are publishing the implementation and the limits together. ZC is not affiliated with Z.ai or the developers of the upstream client.

Highlights

  • Native account-backed coding: log in with your supported Z.ai account and select an entitled model, including GLM-5.3 where available. The official ZCode runtime owns credential handling, model inference and tool execution. No API-key fallback is invented by ZC.
  • A more deliberate terminal interface: multiline composer, keyboard editing, mouse support, searchable conversation history, visible tool progress, light/dark/monochrome themes and export.
  • Work continuity: persisted local transcript, session resume, context recovery, status inspection and explicit cancellation without automatically replaying a possibly executed request.
  • Explicit permissions: guarded runtime mode is the default, full access requires a separate session-scoped /mode yolo confirmation, and reconnect returns to guarded mode.
  • Cross-platform packaging: macOS, Linux and Windows install scripts with a private pinned Node runtime. Installation preserves existing ZCode account credentials and does not replace system Node.

What has been verified

  • Automated GitHub Actions matrix: Node 24.14.0 and Node 24.x on Linux, macOS and Windows, package installation, actual runtime entry checks, a disposable Docker runner build, and dependency audit.
  • Operator-observed Linux VPS tests: Z.ai OAuth login, two consecutive authenticated GLM-5.3 turns using ZC's default native backend, temporary local credential removal blocking access, successful second login and authenticated request.
  • Operator-observed non-root disposable Docker runs: exact canary file read; exact file edit with unrelated sentinels unchanged; explicit full-access escalation denial; cold resume with preserved conversation context; and an in-flight Bash cancellation with acknowledged stop and two successive idle snapshots.

The live observations are limited to the tested account and Linux environment. They are not results of the public CI runners using personal credentials.

Important limitations

  • Token expiry: we have tested a simulated short-lived issuer and upstream credential-rotation fixtures, not an observed real Z.ai token expiring and automatically renewing.
  • Permission prompts: explicit full-access denial passed, but a separate live individual-tool approval/denial dialog was not observed. Guarded mode may execute ordinary commands without prompting and is not an OS sandbox.
  • Platform coverage: live interactive Windows/macOS terminal behavior, long-running network outage recovery, and full process-tree cancellation across failure cases remain unverified.
  • Security: no third-party security audit, accessibility certification, binary code signing or supply-chain provenance attestation has been performed. Local SHA-256 checksums are integrity checks, not signatures.
  • Distribution: this release is hosted on GitHub. @striking-lions/zc has not been published to npm as part of this release. The installer requires an internet connection and an appropriately entitled account.

Read the detailed validation record, security boundaries and production acceptance results before using ZC on important projects.

Download and install

Choose zc-0.2.0-install.zip under Assets. It contains the application tarball, install.sh, install.ps1, a quickstart and an internal SHA256SUMS.txt. A separate release asset SHA256SUMS.txt verifies the downloadable ZIP and the standalone .tgz. Review the installer before executing it.

macOS / Linux (ordinary user, not sudo):

unzip zc-0.2.0-install.zip -d zc-0.2.0
cd zc-0.2.0
bash install.sh --add-path

Windows PowerShell (ordinary, non-administrator terminal):

Expand-Archive .\zc-0.2.0-install.zip -DestinationPath .\zc-0.2.0
Set-Location .\zc-0.2.0
powershell -NoProfile -ExecutionPolicy Bypass -File .\install.ps1 -AddPath

Open a new terminal if PATH was updated, then enter your project and run:

zc --version
zc login
zc

For remote SSH login, use zc login --oauth --no-browser, open the resulting URL privately, then return to the terminal.

Upgrade guidance: close active tasks before replacing the launcher. The installers keep a previous launcher/config backup and do not intentionally delete existing account credentials.

Feedback

Report reproducible problems through the GitHub issue tracker, with the OS, terminal type, ZC and upstream runtime versions. Never include OAuth callback URLs, tokens, passwords, private source code or unredacted logs.

Thanks for testing an independent terminal workflow. We are releasing early with reproducible evidence and clear limitations, not a promise of perfection.

Assets 5
Loading