feat(accounts): link standalone GLM Coding Plans

[nwparker]

	Files	Added	Deleted	Net
Test	10	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1085	$\color{#cf222e}{\Huge{\mathbf{−}}}$​2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1083
Prod	41	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1223	$\color{#cf222e}{\Huge{\mathbf{−}}}$​25	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1198

ELI5

GLM Coding Plan subscribers can link Z.AI or BigModel in AI Provider Accounts without installing ZCode, then see the plan's usage in the status bar.

What Changed

Adds a site selector and protected key entry using the existing ZCode usage provider. A saved Orca key takes priority over the CLI fallback. Saving, replacing, forgetting, or changing sites clears old usage and rejects late refresh results; failed writes retain the draft. The key stays in the execution host's protected storage and never returns over IPC. Plaintext storage fallback is disclosed and quota errors redact echoed keys.

Paired web clients display the host's site and key-presence state, refuse unsupported secret writes, and clear stale host details when re-paired. The additive main merge retains Antigravity account settings, host selection, and current locale values. The workspace-layout type moved to its own file with exactly the same shape and export.

Why

Subscribers using GLM through other agents need account linking independent of ZCode PATH detection. Reusing the existing usage and credential infrastructure keeps one quota owner. This continues #23804 by @parkavenue9639, credited in the implementation; the CLI v2 credential adapter is separately reviewed in #24674.

Linked Issue

Addresses #23803 and the protected Accounts key request in #18506. Continues #23804. Native OAuth in #8476 and authenticated quota/platform acceptance remain outside this scope.

Visual Proof

The attached historical captures render the production Accounts page in hidden Electron with disposable homes and synthetic data. They cover the section, save/site/forget flow, and read-only web component. The real Z.AI response rejects a synthetic key; it is not authenticated quota acceptance. The component comparison had a status-bar harness error after capture; the separate normal Settings flow had no console errors. These images were not recaptured during the current source reconciliation.

Testing

Current exact head: f3adafd50d3c5a86f90cc6c63d00a051e69fdd35, tree 5c2dfdcd8a105b2cc00f94c844dc1be1c43af101, ordered parents 38f19b0abc4f4383cea40c33fda0d534b7d7622c and main 3793c58abd43aa7272b47dc072241af3bc5e0774.

• Fresh author execution: 337 tests in 40 files, no failures or skips. Independent final-source execution: 216 production tests plus three web-refusal checks; two production mutations fail as intended. These cohorts overlap and are not a combined unique-test total.
• Exact original source reproduces eight CI fixture failures. The accepted repairs add the concrete credential-status fixture and web namespace without removing account assertions.
• Full Node, CLI, and renderer typechecks, changed-code quality, locale, RPC, formatting and file-size gates pass. The actual normal installed-hook replay preserves the exact tree. The initial author test invocation failed before collection because it supplied two config flags; its failed log remains recorded, followed by separate passing runs.
• Independent review audited all 31,940 leaves and both parent contributions, including current locale retirements and updates; no unexplained source, proof or credit loss. All recorded independent GLM processes exited.

All fresh executions used private homes and caches, background mode, and disabled hooks/trust. No live account/keyring, paid model turn, newly rendered UI, Windows/Linux/SSH execution, or packaging acceptance is claimed. Fresh hosted CI and preservation of newer main changes remain required before merge.

AI Disclosure

Implementation and independent review used coding agents.

Review

Credentials stay on the execution host; remote fields remain optional. No agent-status store, readiness rule, or stream opcode changes. Folder workspaces require no Git metadata. Review cleared the exact source above; later merge objects require their own current-main checks.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer source copied.

Notes

The legacy CLI fallback remains; upstream ZCode 0.16.9's v2 writer is addressed separately by #24674. Original contributor credit and author-scoped screenshots are preserved. Close the superseded contributor PR only after this successor actually merges.

Checklist

• User behavior, mechanism and reuse explained
• Before/after proof attached with its actual scope
• Security, host ownership, races, folders and mixed-version behavior reviewed
• Full types, relevant tests, source-quality gates and normal hooks pass
• Fresh hosted CI on this head and current-main merge acceptance

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

📝 Walkthrough

Walkthrough

The change adds GLM Coding Plan account support for Z.AI and BigModel. It adds API-key storage, credential IPC, and rate-limit fetching that uses saved plan credentials or falls back to ZCode CLI credentials. Desktop settings now let users select a site, manage a key, and view usage. The status bar recognizes saved plan credentials. Web clients report credential details as unavailable and scope the site setting to the active runtime owner.

Priority: ➖ Normal

Merge Risk: 🟡 Moderate · up to f3ada

A failed key save may still persist the credential, and pairing another runtime can show the previous plan site. Fix both before relying on the new account flow.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to f3ada

Account keys remain on the host, outbound destinations are constrained, and outdated usage responses are rejected. However, storage failures can expose plaintext keys on permissive Windows setups or leave a failed key replacement persisted. These conditional failure cases weaken the saved-key protection guarantees.

Retained concerns

• Medium · security · inferred: The new plaintext credential fallback relies on a writer that creates credential bytes before restriction is confirmed and still publishes when staged Windows ACL restriction fails. If inherited permissions allow another local user to read the directory/file and restriction fails, that user could read the key before cleanup or restoration. Cleanup limits persistence but cannot revoke a completed read. The encrypted branch also ignores the writer's restriction-failure result, although encryption limits direct plaintext disclosure there. The writer predates this PR; the new GLM credential caller introduces this additional secret exposure.
• Medium · reliability · inferred: A failed save does not reliably preserve the previous persisted credential. The writer can throw after replacing the target, bypassing the store's boolean-failure rollback; restoration failures are also swallowed without confirming which envelope remains. IPC then reports failure without invalidating credential state, while a later uncached read or restart can activate the replacement. This creates disagreement between acknowledged credential ownership, persisted secret state, and subsequent authenticated requests. On POSIX, the retained 0600 mode limits cross-user disclosure but does not resolve the lifecycle inconsistency.

Security review details

Security Blast Radius

• inferred — The storage concerns affect the host user's saved plan key and its provider account. The confidentiality path requires local filesystem access, plaintext fallback, permissive inherited permissions, and failed restriction; remote unauthenticated reachability is not established. The upstream privileges granted by a stolen plan key are not supplied.

Security Findings and Attack Paths

• inferred — Under the stated Windows conditions, another local user could read a plaintext envelope while restriction is failing and before the caller removes or restores it. The envelope payload is base64, not encryption. This is a conditional disclosure path inferred from publication ordering, not evidence of successful exploitation.

Trust Boundaries and Controls

• observed — Outbound credential use requires HTTPS, an allowed hostname, and a standard HTTPS port. Requests reject redirects, limiting credential forwarding through a provider-controlled redirect response.
• observed — Paired-browser credential mutation is rejected by its API implementation, not merely disabled in the UI. Host-site values are filtered by environment identity and pairing revision when settings are read; this does not establish complete authorization for every host RPC or desktop IPC caller.

Resilience and Maintainability Implications

• inferred — The persistence failure paths can strand a replacement credential on disk despite a failed save acknowledgement. Subsequent uncached loading can make that key authoritative, so the otherwise effective generation guards do not repair disagreement between disk state and the acknowledged mutation.

Hardening Proposals

• proposed — Use a fail-closed credential transaction: require confirmed staging restrictions before publication, handle both boolean and exceptional failures, preserve the previous envelope until commit, and make recovery reconcile persisted credentials with acknowledged status. Apply the restriction-result policy consistently to encrypted and plaintext saves.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 50 functions across 52 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: linking standalone GLM Coding Plans through Accounts.
Description check	✅ Passed	The description explains the user-facing change, implementation, motivation, linked issues, visual proof, testing, AI use, review scope, and remaining validation. It also clearly states that fresh hos…

Full details: Docstring Coverage

Explanation

Docstring coverage is 8.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 50 functions across 52 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/main/zcode/zcode-plan-api-key-store.ts (1)

166-169: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Make clearZcodePlanApiKey delete the file before it clears the cache.

Line 167 sets cachedZcodePlanApiKey to null before rmSync runs. rmSync with force: true still throws on errors such as EACCES or EBUSY (Windows file lock). In that case the file stays on disk. hasZcodePlanApiKey() still returns true, and the next readZcodePlanApiKey() reads the old key back from disk. If rmSync throws, the IPC caller receives an error, so this risk is small. Remove the file first and clear the cache after the removal succeeds. Then the in-memory state matches the disk state.

Proposed fix

 export function clearZcodePlanApiKey(): void {
-  cachedZcodePlanApiKey = null
   rmSync(getZcodePlanApiKeyPath(), { force: true })
+  cachedZcodePlanApiKey = null
 }

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 446c29b9-e6f7-4f10-9de6-af071a1ae805

📥 Commits

Reviewing files that changed from the base of the PR and between b49abdb and 8dc022e.

📒 Files selected for processing (49)

• src/main/ipc/register-core-handlers/register-core-handlers.test.ts
• src/main/ipc/register-core-handlers/register-core-handlers.ts
• src/main/ipc/zcode-plan-credentials.test.ts
• src/main/ipc/zcode-plan-credentials.ts
• src/main/rate-limits/service-zcode-usage.test.ts
• src/main/rate-limits/service/service-account-refresh.ts
• src/main/rate-limits/service/service-configuration.ts
• src/main/rate-limits/service/service-fetch-policy.ts
• src/main/rate-limits/service/service-fetch-targets.ts
• src/main/rate-limits/service/service-full-cycle-application.ts
• src/main/rate-limits/service/service-full-cycle-preparation.ts
• src/main/rate-limits/service/service-state.ts
• src/main/rate-limits/service/service-types.ts
• src/main/rate-limits/zcode-usage-fetcher.test.ts
• src/main/rate-limits/zcode-usage-fetcher.ts
• src/main/runtime/runtime-client-settings.ts
• src/main/runtime/runtime-store-contract.ts
• src/main/startup/main-process-account-services.ts
• src/main/zcode/zcode-plan-api-key-store.test.ts
• src/main/zcode/zcode-plan-api-key-store.ts
• src/preload/api-types.ts
• src/preload/api/agent-account-api.ts
• src/preload/api/zcode-plan-credentials-bridge.ts
• src/preload/index.ts
• src/renderer/src/components/settings/AccountsPane.tsx
• src/renderer/src/components/settings/ZcodePlanAccountsSection.test.tsx
• src/renderer/src/components/settings/ZcodePlanAccountsSection.tsx
• src/renderer/src/components/settings/accounts-search.ts
• src/renderer/src/components/settings/use-zcode-plan-credentials.test.tsx
• src/renderer/src/components/settings/use-zcode-plan-credentials.ts
• src/renderer/src/components/settings/zcode-plan-usage-windows.tsx
• src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
• src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
• src/renderer/src/components/status-bar/usage-provider-settings-target.ts
• src/renderer/src/components/status-bar/use-status-bar-controller.ts
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/zh.json
• src/renderer/src/web/preload-api/web-agent-accounts-api.ts
• src/renderer/src/web/preload-api/web-preferences-store.ts
• src/renderer/src/web/preload-api/web-runtime-session.ts
• src/renderer/src/web/preload-api/web-zcode-plan-site.ts
• src/renderer/src/web/web-preload-api.ts
• src/renderer/src/web/web-zcode-plan-settings.test.ts
• src/shared/default-global-settings.ts
• src/shared/global-settings-types.ts
• src/shared/rate-limit-state-factory.ts
• src/shared/rate-limit-types.ts
• src/shared/rpc-contract/client-settings-params.ts
• src/shared/zcode-plan-sites.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

[pullfrog]

✅ No new issues found.

Reviewed changes

The only substantive commit since the prior reviewed version (299aab8) is the merge reconciliation 13cb1fd9e0 (the two following commits are empty chores). I traced the branch-patch range-diff and the working tree on both sides of the merge:

• Merged main's Antigravity usage gate into the GLM branch — AntigravityUsageEnabledResolver replaces the stale ClaudeAuthPreparationResolver import in service-configuration.ts; both resolvers coexist in service-state.ts.
• Kept the branch's zcode site routing alongside main's gate — usage-provider-settings-target.ts restores case 'zcode' → 'accounts-zcode' while antigravity/kimi still return null; the test asserts both.
• Dropped main-refactored dead import — service-full-cycle-preparation.ts no longer imports fetchCursorRateLimits and still reads the Cursor session via readCursorAuthSession.
• Preserved GLM wiring through the merge — resolveZcodePlanConfig, zcode generation/stale policy, credential store, IPC, and paired-web read-only paths are intact; no branch symbols were dropped.

I found no regressions introduced by the reconciliation. Ordering of clearZcodePlanApiKey (cache cleared before rmSync) is a pre-existing CodeRabbit nitpick unchanged by this merge, so I'm not re-raising it here.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

The only delta since the prior pullfrog review (ce1f85a, review #5393751659) is 38f19b0 ("test: complete GLM account fixtures and web API inventory") — 8 additive lines across two test files, no production code touched:

• Completed the Accounts lifetime fixture — AccountsPane.section-lifetime.test.tsx now supplies the zcodePlanCredentials.getStatus mock that the pane's GLM section dereferences on mount; without it use-zcode-plan-credentials.ts:20 throws on the undefined namespace.
• Listed the namespace in the web API inventory — web-preload-api-composition.test.ts adds zcodePlanCredentials to the exact-key assertion, in the same position it is registered in web-preload-api.ts.

Both files pass locally (12 tests). The production registration pre-dates this commit, so these are the minimal fixture and inventory entries that turn the two hosted failures green; nothing else changed.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

The only commit since the prior pullfrog review (38f19b0, review #5398282491) is the merge f3adafd ("Merge main 3793c58 into GLM plan integration"). I traced the range-diff and the merged tree:

• Merged main 3793c58 into the GLM branch — main's Antigravity accounts section and accounts-search entries, agent-state-rules settings, Cursor worker-thread refactor, and opencode-go source changes land alongside the branch's GLM wiring. service-full-cycle-preparation.ts only gained main's Cursor comment; the zcode plan-config/generation block and its stale/fetch policy are intact.
• Extracted OrcaWorkspaceLayout to stay under the max-lines ceiling — the shape moved to src/shared/orca-workspace-layout.ts and is re-exported from global-settings-types.ts, so existing importers keep working through the same entry point.
• Added an Accounts search-order test — accounts-search.test.ts covers Antigravity, Cursor, and GLM Coding Plan discovery and keyword matching.

No GLM credential/quota/file-store production file was touched by this merge (empty diff on the zcode store, IPC, fetcher, service wiring, web, and shared-site paths). Focused tests pass (accounts-search.test.ts — 5, ZcodePlanAccountsSection.test.tsx — 12).

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (2)

🟡 Minor · Restore the previous envelope when writeSecureFile throws. · zcode-plan-api-key-store.ts:87-138

src/main/zcode/zcode-plan-api-key-store.ts:87-138
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Restore the previous envelope when writeSecureFile throws.

writeSecureFile can rename the plaintext file before its published-path permission check. If that check throws, saveZcodePlanApiKey skips its rollback because rollback only handles a false return. The new plaintext key can remain on disk while the save reports an error. The cache is not updated on this path.

Suggested fix

-  const wroteRestricted = writeSecureFile(
-    keyPath,
-    encodeApiKeyEnvelope('plaintext', Buffer.from(trimmed, 'utf8'))
-  )
+  const restorePreviousEnvelope = (): void => {
+    if (!previousEnvelope) {
+      rmSync(keyPath, { force: true })
+    } else {
+      try {
+        writeSecureFile(keyPath, previousEnvelope.toString('utf8'))
+      } catch {
+        // Keep the previous credential available when restoration also fails.
+      }
+    }
+  }
+  let wroteRestricted: boolean
+  try {
+    wroteRestricted = writeSecureFile(
+      keyPath,
+      encodeApiKeyEnvelope('plaintext', Buffer.from(trimmed, 'utf8'))
+    )
+  } catch (error) {
+    restorePreviousEnvelope()
+    throw error
+  }
   // Why: an unrestricted plaintext credential must never be reported as saved.
   if (!wroteRestricted) {
-    if (!previousEnvelope) {
-      rmSync(keyPath, { force: true })
-    } else {
-      try {
-        writeSecureFile(keyPath, previousEnvelope.toString('utf8'))
-      } catch {
-        // Why: restriction is failing device-wide; the restored bytes keep the
-        // previous credential available instead of deleting it, and the thrown
-        // save error still tells the user the store is not secure.
-      }
-    }
+    restorePreviousEnvelope()
     throw new Error('GLM Coding Plan API key could not be stored securely on this device')
   }

🟡 Minor · Refresh settings after pairing a new runtime. · web-preferences-store.ts:78-195

src/renderer/src/web/preload-api/web-preferences-store.ts:78-195
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Refresh settings after pairing a new runtime.

When verifyAndAddFromPairingCode replaces the active environment, loadEnvironments() and connectEnvironment() do not fetch settings. The app store can therefore retain the previous runtime’s attested zcodePlanSite. ZcodePlanAccountsSection then uses that stale value to build the console URL for the new runtime.

Refresh settings after the active environment changes.

Suggested fix

 import { toast } from 'sonner'
 import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 ...
       await loadEnvironments({
         environmentId: result.environment.id,
         runtimeStatus: result.runtimeStatus
       })
+      await useAppStore.getState().fetchSettings()
       if (!allowLocalRuntime) {

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b2684096-4ce5-496f-88b4-346d1f846615

📥 Commits

Reviewing files that changed from the base of the PR and between 38f19b0 and f3adafd.

📒 Files selected for processing (9)

• src/main/rate-limits/service/service-full-cycle-preparation.ts
• src/renderer/src/components/settings/AccountsPane.tsx
• src/renderer/src/components/settings/accounts-search.test.ts
• src/renderer/src/components/settings/accounts-search.ts
• src/renderer/src/i18n/en-runtime-required.json
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/zh.json
• src/shared/global-settings-types.ts
• src/shared/orca-workspace-layout.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• src/renderer/src/i18n/en-runtime-required.json
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/zh.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.