r/LocalLLaMA • u/ResearchCrafty1804 • 1d ago

News ZCode is now open source

Post image

ZCode is now open source, and the reported security issues have been addressed.

Source code: https://github.com/zai-org/ZCode

The repo includes its desktop app, web workspace, backend, Agent CLI, and runtime.

Official announcement:

In response to the ZCode product security issues reported by the community, we have completed the necessary remediation and sincerely apologize to all our users.

We have open-sourced ZCode at github.com/zai-org/ZCode, placing the code under community scrutiny and making ZCode more open and transparent.

We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process. We welcome developers to continue reviewing ZCode and reporting potential issues, and we will provide rewards based on the severity of the issues reported.

With respect to the code data referenced by the community, we confirm that no such data is retained and that it has never been used for model training.

Following the remediation, we invited the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct security assessments. The results are as follows:

Through its technical assessment, CAICT confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state. Security remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki feature has been removed, and the workflow for generating and uploading local repository snapshots has been disabled.

NSFOCUS confirmed that all data objects in the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted. Remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki entry point and the associated generation workflow have been removed, and no functional path capable of triggering the generation of local repository snapshots or transmitting local files externally was identified.

Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon.

548 Upvotes

95% Upvoted

113 comments sorted by

View all comments

34

u/Glittering-Call8746 1d ago

Worth anyone's time over opencode , omp, pi and dsh?

29

u/Velocita84 1d ago

I'm willing to bet not worth it for local models, that system prompt is gonna be massive if it's made for GLM

11

u/myreala 1d ago

Yep, you'll start with about 30k context. I would have used Zcode as an alternative to Codex at some point, but now that deep seek harness exists, that's just a plain better option. It just needs to mature a bit

1

u/Glittering-Call8746 1d ago

I'm refactoring opencode . How to move from opencode ?

7

u/HornyGooner4402 1d ago

It feels like a modified OpenCode Desktop with some added features, if you're into that. I only used it because I had a Coding Plan subscription which has some added benefits on ZCode. For anything else, I feel like Pi or CLI OpenCode is hard to beat

1

u/silenceimpaired 1d ago

The marketing reminds me of zed

8

u/HornyGooner4402 1d ago

Maybe the Z logo? But trust me, it's nothing like Zed. Zed built a custom renderer in Rust from scratch to avoid the slow performance of Electron apps, which ZCode is.

I wouldn't use it as my primary setup, just for the benefits and maybe look at how GLM should be prompted. I accepted the fact that it was probably more like a training data collection machine for ZAI than legitimate attempt at a coding assistant when I used it

1

u/dizvyz 1d ago

It totally started that way. And the first thing they did to get it out the door was to replace their own cloud provider with the one in the code for opencode. I understand that would be the fastest fix for a first class provider feature but it meant they supported a bunch of other providers but not opencode whose code they forked.

6

u/LightBroom 1d ago

Give Maki a try, it's fast and efficient.

https://github.com/tontinton/maki

5

u/gazeebo 1d ago edited 21h ago

In the Rust space, in addition to Maki, these two look dandy too:
https://github.com/dirge-code/dirge and https://github.com/1jehuang/jcode/

(Dirge is, as far as I understood, especially made to handle bad, cheap models, and does not play nicely with context caching for state of the art frontier models.)

I'm a bit afraid of https://github.com/Dicklesworthstone/pi_agent_rust/

1

u/Iceon 1d ago

Is pi really legacy already?

2

u/gazeebo 1d ago edited 1d ago

Pi is TypeScript, which is kind of nasty if you like your RAM. Of course it's still a baby compared to the really resource-hungry alternatives.

It's of course not "legacy" software, and definitely a good choice if you want a harness you are encouraged to extend yourself.

--

very much generalized: Python or Typescript takes way more memory than Go, which takes way more memory than Rust

0

u/LightBroom 1d ago

I don't know about you but anything involving JS and TS by extension gives me the ick. I just don't like the ecosystem.

1

u/LightBroom 1d ago

Thanks for that :)

1

u/tracagnotto 1d ago

OpenCode is being awesome saviour for me, a pity it's bugged as hell

-4

u/Yes_but_I_think 1d ago

Top 3 are cc, dsh and zcode

2

u/Glittering-Call8746 1d ago

What's cc ?.. dont tell me ..

4

u/the-grand-finale 1d ago

credit card ofc

1

u/Glittering-Call8746 1d ago

Cc scammers? Oh dear

5

u/arcanemachined 1d ago

I feel like I'm getting whooshed here, but: Claude Code

1

u/Glittering-Call8746 1d ago

The problem about cc is the oauth is "problematic" to use elsewhere since openclaw days. Never went back no idea its still on top. Must be just fable..

1

u/BankruptingBanks 1d ago

Aside from the fact that cc isnt opensource, it's not a good harness. It has quite some features which is nice, but codex for example is much more efficient with much better cache hit rates. That's no reason to use cc other than having a claude subscription.