{"id":"zcode-provider","repo":"supermomonga/paseo-plugin-zcode-provider","url":"https://github.com/supermomonga/paseo-plugin-zcode-provider","name":"zcode-provider","description":"Unofficial Paseo provider plugin for ZCode, using the official stdio Services Server of the integrated ZCode CLI.","categories":["provider"],"platforms":[],"caveats":["Requires Paseo 0.8.0-beta.1+, and authenticated ZCode 3.11.2+.","Unofficial integration using ZCode's undocumented headless mode.","Supports macOS and Linux arm64/x64 and Windows x64; host initialization and model listing verified only on macOS arm64.","Under development; see the README for verification status and known limitations."],"images":["https://raw.githubusercontent.com/supermomonga/paseo-plugin-zcode-provider/e273390ca657888d185cfc13cc29656f5e72af28/images/zcode-conversation.png"],"themes":[],"health":{"manifestValid":true,"hasReadme":true,"hasLicense":true,"hasTests":true,"hasTypecheckScript":true,"updatedRecently":true},"scannedAt":"2026-10-15T12:35:10.939Z","addedAt":"2026-09-09T16:19:34+03:00","version":"0.3.0","security":{"status":"failed","blockingFindings":1,"advisoryFindings":0,"scannedAt":"2026-10-15T12:14:24.405Z","commit":"e273390ca657888d185cfc13cc29656f5e72af28"},"license":"MIT","paseoVersionRequirement":">=0.8.0","descriptionNodes":[{"type":"text","text":"Unofficial Paseo provider plugin for ZCode, using the official stdio Services Server of the integrated ZCode CLI."}],"caveatNodes":[[{"type":"text","text":"Requires Paseo 0.8.0-beta.1+, and authenticated ZCode 3.11.2+."}],[{"type":"text","text":"Unofficial integration using ZCode's undocumented headless mode."}],[{"type":"text","text":"Supports macOS and Linux arm64/x64 and Windows x64; host initialization and model listing verified only on macOS arm64."}],[{"type":"text","text":"Under development; see the README for verification status and known limitations."}]],"manifest":{"id":"zcode-provider","requirements":{"paseo":">=0.8.0"},"build":[["npm","ci","--include=dev"]]},"repoMeta":{"stars":6,"defaultBranch":"main","pushedAt":"2026-10-11T13:23:03Z"},"owner":{"login":"supermomonga","avatarUrl":"https://avatars.githubusercontent.com/u/377137?v=4"},"installNotesHtml":"<p>Enable <strong>Settings → Plugins → Enable plugins</strong> for the target daemon, then install the <a href=\"https://www.npmjs.com/package/paseo-plugin-zcode-provider\">npm package</a> and inspect:</p>\n<pre><code class=\"language-bash\">paseo plugin add npm:paseo-plugin-zcode-provider\npaseo plugin ls\n</code></pre>\n<p>You can also paste <code>npm:paseo-plugin-zcode-provider</code> into <strong>Settings → Plugins → Plugin source</strong>. npm packages require Paseo 0.9.0 or later and npm on the daemon host. Paseo installs the released version and compiles the plugin. Update with <code>paseo plugin update zcode-provider</code>. Plugins execute with the daemon user's permissions.</p>\n<p>To follow the <code>main</code> branch instead, install the Git repository with <code>paseo plugin add supermomonga/paseo-plugin-zcode-provider</code>. Paseo prepares the checkout with <code>npm ci</code>.</p>","readmeText":"# ZCode Provider for Paseo\n\nUse ZCode models, tools and conversations through Paseo's public Provider API. The plugin launches the **official stdio Services Server from the integrated ZCode CLI distribution**, which it can set up for you. Authentication, models, tools and conversation storage remain owned by ZCode. ZCode Desktop is not required.\n\n> Mode/Plan restoration is guaranteed when Paseo supplies both saved settings on resume. Without them, the pinned ZCode source can restore an older editing mode and drop Plan. That upstream defect remains unresolved and is outside the supported restoration contract. See [verification and remaining checks](docs/verification.md).\n\nThis is an unofficial plugin. It is not endorsed or maintained by ZCode or Z.ai. The official RPC/V4 implementation is public source, but it is not a stable third-party SDK.\n\n## Requirements\n\n| Setting        | Requirement                                                                                                                             |\n| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |\n| Paseo          | 0.8.0 or later; development SDK 0.11.0-beta.5                                                                                           |\n| Plugin Node.js | 22.12.0 or later (the Paseo daemon's runtime)                                                                                           |\n| Managed setup  | darwin-arm64, linux-x64, linux-arm64, win-x64, win-arm64                                                                                |\n| ZCode          | Managed: 3.14.3 (release `3.14.3-paseo.1`) with Node.js 24.21.0. Overrides: stable Server 3.14.0+ / Agent 0.16.9+ with Node.js 24.14.0+ |\n\n## Installation\n\nEnable **Settings → Plugins → Enable plugins** for the target daemon, then install the [npm package](https://www.npmjs.com/package/paseo-plugin-zcode-provider) and inspect:\n\n```bash\npaseo plugin add npm:paseo-plugin-zcode-provider\npaseo plugin ls\n```\n\nYou can also paste `npm:paseo-plugin-zcode-provider` into **Settings → Plugins → Plugin source**. npm packages require Paseo 0.9.0 or later and npm on the daemon host. Paseo installs the released version and compiles the plugin. Update with `paseo plugin update zcode-provider`. Plugins execute with the daemon user's permissions.\n\nTo follow the `main` branch instead, install the Git repository with `paseo plugin add supermomonga/paseo-plugin-zcode-provider`. Paseo prepares the checkout with `npm ci`.\n\n## Setup\n\nOpen **Settings → Plugins → zcode-provider → Settings**. The screen has two tabs: **Runtime** installs and removes the runtime, and **Account** signs in and manages model providers.\n\nOn the **Runtime** tab, choose **Download and install**. The screen lists every download, its SHA-256, size and license before you start. Setup runs on the machine hosting the daemon:\n\n- Node.js 24.21.0 from nodejs.org.\n- The ZCode runtime 3.14.3 from this repository's [releases](https://github.com/supermomonga/paseo-plugin-zcode-provider/releases/tag/zcode-runtime-v3.14.3-paseo.1) (`3.14.3-paseo.1`). ZCode does not publish its integrated CLI, so this is an **unofficial build** of the public source with the patches in [patches/zcode](patches/zcode) applied (ADR 19), made and verified by CI. The patches hide Computer Use and Browser Use, which cannot run here. It is not endorsed or maintained by ZCode or Z.ai.\n\nBoth archives are verified against SHA-256 values pinned in the plugin and extracted to the daemon user's data directory:\n\n| OS            | Destination                                           |\n| ------------- | ----------------------------------------------------- |\n| Windows       | `%LOCALAPPDATA%\\paseo-plugin-zcode-provider\\runtimes` |\n| macOS / Linux | `~/.local/share/paseo-plugin-zcode-provider/runtimes` |\n\nAn absolute `XDG_DATA_HOME` replaces the base directory on every OS. `PATH` and other installations are not changed. The plugin never installs anything until you start setup.\n\n**Remove** on the Runtime tab deletes the managed runtime; `paseo plugin remove` does not. ZCode settings, logins and conversations are kept.\n\n### Account and model providers\n\nThe **Account** tab uses ZCode's own account and provider services, the same ones ZCode Desktop uses, through a ZCode Server that the plugin starts while the screen is in use. Changes are stored in ZCode's data on the daemon machine and are shared with ZCode Desktop and the CLI there.\n\n- **Sign in**: choose Z.ai (international) or BigModel (China) and press **Sign in**. The sign-in page opens in your browser; the link is also shown, so you can finish on any device. The daemon receives the result, then selects the account's Coding Plan unless a plan is already chosen. The **Plans** section shows which of the account's plans (Coding Plan, Start Plan) are available. ZCode allows one signed-in account at a time.\n- **Model providers**: add any number of providers that use an API key, from a ZCode template (Z.ai, BigModel, Kimi, MiniMax, DeepSeek, Alibaba Cloud, OpenAI, Anthropic, xAI, OpenRouter and others) or a custom endpoint with its base URL, API format and model IDs. Providers and models can be turned off, edited and deleted.\n\nAPI keys are sent to ZCode, which stores them as Desktop does, and are never shown again. The plugin itself stores no credentials. Afterwards, choose **ZCode** when creating an agent; the model list is refreshed after each change on Paseo 0.9 or later.\n\n### Coding Plan usage\n\nOn Paseo 0.11 and later, Paseo's **Usage** screen and sidebar usage summary show a **ZCode** card for the signed-in account's Individual Coding Plan (Z.ai or BigModel). It lists the 5-hour, weekly, monthly tool-call and ZCode MCP quotas with their reset times, as ZCode Desktop does. The plugin asks ZCode's official usage service for this plan only, on the same ZCode Server as the Account tab. The service never uses an API key from the environment. Team Plan and Start Plan are not shown. Paseo 0.11.0-beta.5 does not yet show usage in a ZCode agent's popover.\n\n### Using your own runtime\n\nSet both variables in the daemon's environment and restart the daemon to bypass the managed runtime:\n\n```bash\nexport PASEO_ZCODE_RUNTIME=/absolute/path/to/zcode   # extracted integrated CLI distribution\nexport PASEO_ZCODE_NODE=/absolute/path/to/node       # ordinary Node.js 24.14.0 or later\n```\n\n`PASEO_ZCODE_RUNTIME` must contain `server/remote/zcode-server.cjs`, `agent/zcode.cjs`, its provider configuration, and `package.json`. Setting only one variable is an error. Newer stable versions are allowed, including major versions; passing the minimum check does not certify compatibility. A terminal export does not change an already running Desktop application. Electron, `process.execPath` and Desktop discovery are never used.\n\nSession environment variables are forwarded, subject to ZCode's own proxy, certificate and runtime environment handling.\n\nThe source baseline is `29628c9acdb81b703bbd4080c207a0e7ce5e276e` (ZCode `v3.14.3`). The managed runtime passed the stdio runtime contract on all five managed platforms in CI. See the [verification record](docs/verification.md) for exact coverage.\n\n## Behavior\n\n- Models and reasoning options come from ZCode. Editing modes are `build`, `edit`, and `yolo`; `settings.plan_mode` is independent.\n- Text, thoughts, tools, subagent progress, usage and history use V4 snapshots and deltas. Tool output is marked when ZCode truncates it. Usage is cumulative; repeated snapshots do not add it again.\n- Text submitted during generation uses native guidance. Attachments use the native queue. Paseo reports one run across these native turns and completes it only after all accepted input has been consumed and foreground work has ended.\n- Acceptance is reported once, after the native acknowledgement. Unknown delivery results are never automatically resent. Stop identifies the current native execution, disables automatic queue execution and removes pending input. A new explicit run enables the queue again.\n- As in ZCode Desktop, successful hooks are not shown. A finished hook invocation appears once, as a notification, only when a hook was blocked, failed, timed out or was cancelled; context compaction also appears once, when it ends. Paseo appends every notification it receives, so progress is not reported.\n- Native permission IDs, option values, questions and Plan approval retain their meanings. Question auto-resolution is disabled for each owned Server. Workspace hook trust is reviewed through the official CLI; it is not represented as “allow once.”\n- Each session owns its Server process and environment. Metadata requests use temporary Servers. Closing stdin gives ZCode time to clean up before process termination.\n\nThe plugin uses ZCode's own skills, MCP configuration and tools. Browser Use and Computer Use cannot run in the plugin's ZCode, even when ZCode Desktop has them enabled: the Computer Use helper accepts only the signed Desktop app, and only Desktop provides browsers. The plugin therefore hides them from the model (ADR 19); Desktop is not affected. Generic rewind, independent Paseo child agents, hook-review UI and Goal/Workflow controls are outside this migration. `prompt.output_schema`, custom system prompts and `persist:false` are unsupported. MCP `alwaysLoad` is unsupported; stdio MCP commands must be absolute paths. Provider options are unsupported: in Paseo 0.11 and later, `agents.providers.zcode.options` in Paseo's `config.json` makes sessions fail with `INVALID_CONFIGURATION`, and the `command` and `env` overrides there are not applied. Paseo does not show context usage reported before the first turn, and the plugin adds no substitute display; Coding Plan quota appears in Paseo 0.11's Usage screen (see [Coding Plan usage](#coding-plan-usage)).\n\n## Persistence\n\nNew handles use **version 3**. Versions 1 and 2 are rejected without migration or replacement. Old Paseo sessions are outside this migration.\n\nUnsent conversations are deferred drafts. Before the first prompt, the plugin atomically saves the logical-to-native ID mapping under `$XDG_STATE_HOME/paseo-plugin-zcode-provider/sessions-v3`, or `~/.local/state/paseo-plugin-zcode-provider/sessions-v3`. It stores identifiers and workspace paths, not message bodies. Preserve this directory for backup. A mapping write failure prevents sending. Corrupt mappings and missing native conversations fail explicitly; no replacement conversation is created.\n\nNew conversations support listing, resume and paged V4 history. Mode/Plan restoration requires both `mode` and `settings.plan_mode` saved by Paseo. The plugin applies them after native restore and confirms the resulting state before reporting the session ready. Omitted settings retain whatever ZCode returns, which can be stale on the pinned source; restoration of those values is not guaranteed. There is no private Plan restoration store. [ADR 14](docs/adr/0014-paseoの保存設定を再適用する復元を保証範囲とする.md) limits the guarantee to this supported path; settings-free restoration is checked separately with `npm run test:native-restore`. Existing ZCode databases may be migrated by ZCode itself on startup; the native tests isolate the home, configuration and database.\n\n## Diagnostics\n\n**Settings → Plugins → zcode-provider → Diagnostics** shows whether the managed runtime or the environment override is in use, the runtime and Node.js paths and versions, Server/Agent versions and hashes, minimum-version assessment and mapping location. The screen is read-only. Its optional version check does not prove that authentication or a model call succeeds. On Paseo 0.11 and later, **Settings → Providers** also shows ZCode as not installed until the runtime is set up and supported. Its diagnostic lists the runtime source, Server, Agent and Node.js versions and platform, or the reason the runtime cannot be used. This check reuses its result for 30 seconds and does not start ZCode, so sign-in problems still appear when a session starts.\n\n```bash\npaseo plugin logs zcode-provider\n```\n\nFor failures, report the operation, error code, structured diagnostic and versions/hashes. Native stderr, raw errors, credentials and conversation bodies are excluded from diagnostics. Review any additional material before sharing. Reports are not sent automatically.\n\n## Development and license\n\nSee [development](docs/development.md), [verification](docs/verification.md), [remaining work](docs/todo.md), [ADR 13](docs/adr/0013-公開ソースの公式stdio-serverとv4会話状態を採用する.md), [ADR 15](docs/adr/0015-プラグイン管理のzcodeランタイムとnode-jsを設定画面から導入する.md) and [ADR 19](docs/adr/0019-使えない公式プラグインを隠すビルド時パッチを管理下ランタイムに当てる.md).\n\nOriginal code is [MIT](LICENSE). Vendored ZCode RPC/contracts retain their upstream license and provenance. The ZCode runtime releases are Apache-2.0 builds of the upstream source and include ZCode's LICENSE, NOTICE.md and THIRD-PARTY-NOTICES.md. Releases named `<version>-paseo.<n>` modify that source with the patches in [patches/zcode](patches/zcode) (Apache-2.0), ship them in the archive and list them in `BUILD-INFO.json`; the earlier `3.14.3` release is unmodified; third-party components keep their own terms. Node.js is downloaded from nodejs.org, not redistributed. The icon retains Apache-2.0 attribution; the historical screenshot includes third-party UI and branding. See [NOTICE](NOTICE.md).\n"}