Bundled upstream support

Supporting files are included at skill-relative paths. See UPSTREAM-NOTICE.md for their pinned sources, licenses, hashes, and import changes.

ZCode Delegate

When to Use

• You want to delegate a bounded coding task to a separate zcode implementer (Z.AI ZCode) and then review its diff yourself.
• The user explicitly asked for delegation to this implementer.

You are the orchestrator. This skill lets you hand a bounded coding task to a separate implementer — the Z.AI ZCode CLI — then review what it produced and land it yourself. You write the brief and own the judgment; ZCode does the typing; you verify and commit.

Nothing here is specific to one orchestrating agent. The loop needs only the ability to run a shell command and read a file. (It is designed for and run on Claude Code; treat other orchestrators as designed-for, not yet proven.)

When NOT to use this

• The task is small enough to just do inline — delegation overhead is not worth it.
• ZCode is not installed, or its CLI has no model provider configured.
• You want to write the code yourself, or you only need a review.

Prerequisites (check once)

1. ZCode is installed. The CLI ships inside the desktop app — it is not on PATH and not on npm. The relay resolves it in this order: --zcode-path <file> or ZCODE_CLI first, then PATH, then the installed app bundle. On Linux the app is an AppImage with no fixed install path, so the flag or the environment variable is required there — the relay guesses nothing.
2. A model provider is configured for the CLI, with a key it can actually reach. Being signed into the desktop app is not enough — see below.
3. You are in (or will point --cd at) the target git repository.

The relay records the CLI version and how it was resolved into result.json, so a surprising install is visible after the fact.

Authenticating the headless CLI

Signing into the ZCode desktop app does not authenticate the CLI this relay drives. The CLI keeps its own config at ~/.zcode/cli/config.json, separate from the desktop app's, and nothing bridges the two. zcode login is the intended path, but where it fails with OAuth response is not valid JSON the way in is a Z.AI API key.

Two pieces are needed, and they are separate:

1. The provider block must exist in ~/.zcode/cli/config.json. It defines the provider, its endpoint and its models — the environment cannot supply this:

   {
     "provider": {
       "zai": {
         "kind": "anthropic",
         "options": { "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" },
         "models": { "glm-5.1": { "name": "GLM-5.1" } }
       }
     },
     "model": { "main": "zai/glm-5.1" }
   }
   

2. The key can live either in provider.zai.options.apiKey in that file, or in the environment as any one of ZAI_API_KEY, ZCODE_API_KEY, or ANTHROPIC_API_KEY. Prefer the environment — it keeps the secret off disk.

If a run fails with Model provider is missing an API key: <provider>, the provider block resolved but no key was found: set one of those variables and re-run.

Autonomy — read this before dispatching

ZCode's own term is mode. It has four values; only two are usable headlessly.

Two limits stated plainly, because ZCode cannot enforce them:

• plan mode refused edits in testing, but the relay does not treat that as a guarantee. It takes a Git fingerprint before the run and reports a tri-state readOnlyViolation afterwards. Confirm touchedFiles came back empty rather than assuming no edits.
• ZCode has no --allowed-tools. Only the --disallowed-tools denylist exists, and it is genuinely enforced. An explicit allowlisted tool surface is therefore impossible here — do not assume one.

The loop

Run these five steps per task. Steps 1, 4, and 5 are your judgment; 2 and 3 are mechanical.

1. Write the brief

ZCode sees only what you send — no repo memory, no chat history. Everything the task needs goes

…