{"slug": "zcode-embroiled-in-a-controversy-over-stealing-user-code-is-now-open-source", "title": "ZCode, embroiled in a controversy over stealing user code, is now open source", "summary": "ZCode, an AI coding workspace with desktop, browser, and terminal interfaces, has been released as open source under the zai-org GitHub organization following a controversy over the alleged theft of user code. The repository contains the clients, backend services, shared UI, and Agent CLI and runtime source code, and requires Git, Node.js 24.14.0, and pnpm 10.33.2, with mise.toml as the source of truth for tool versions. Developers bootstrap the workspace with `pnpm bootstrap`, run the desktop app via `pnpm dev:desktop`, and start the web development server on http://localhost:5173 with the backend on http://localhost:3030.", "body_md": "[简体中文](https://github.com/zai-org/ZCode/blob/main/README.md) | English\n\nZCode is an AI coding workspace with desktop, browser, and terminal interfaces. This repository contains the clients, backend services, shared UI, and Agent CLI and runtime source code.\n\n| Interface | Purpose | Development command | \n|---|---|---|\n| Desktop | Electron desktop application | `pnpm dev:desktop` | \n| Web / ZCode CLI distribution | Terminal and browser workspace; packages the TUI, Web client, backend, and Agent together | `pnpm dev:web` | \n| Agent CLI | The `zcode` terminal interface, which also provides the Agent runtime for Desktop and Web | `pnpm --filter @zcode/cli dev` | \n\nInstall Git, Node.js **24.14.0**, and pnpm **10.33.2**. [mise.toml](https://github.com/zai-org/ZCode/blob/main/mise.toml) is the source of truth for tool versions. Run all development and packaging commands below from the repository root.\n\n```\npnpm bootstrap\n```\n\n`pnpm bootstrap` installs workspace dependencies, prepares local desktop runtime assets, and runs `build:bootstrap`.\n\nThe Agent CLI and runtime source code lives in [apps/zcode-cli/](https://github.com/zai-org/ZCode/blob/main/apps/zcode-cli) as a regular directory included when you clone this repository. No separate checkout or Git submodule initialization is required.\n\nAdditional setup and build commands:\n\n| Command | Purpose | \n|---|---|\n| `pnpm install` | Install dependencies | \n| `pnpm prepare:desktop-runtime` | Prepare desktop runtime assets, including remote assets by default | \n| `pnpm prepare:remote-assets` | Prepare remote runtime assets separately | \n| `pnpm bootstrap:with-remote` | Set up dependencies and local and remote assets, then build the relevant packages sequentially; skip the desktop application bundle | \n| `pnpm build` | Recursively run each workspace package's build script, including its asset preparation steps | \n\nThe default `bootstrap` skips remote asset preparation and is suitable for local desktop development. Run the corresponding preparation command when working with remote workspaces or validating remote distribution assets.\n\n```\npnpm dev:desktop\n\n# Use the test environment\npnpm dev:desktop:test\n```\n\n`pnpm dev:desktop` defaults to `pnpm dev:desktop:prod` and uses production service configuration. The startup script prepares local runtime assets, builds the desktop Agent, then starts Electron and source watchers.\n\nSet `ZCODE_DATA_BASE_DIR` to use a separate development data directory. For example, on macOS / Linux:\n\n```\nZCODE_DATA_BASE_DIR=\"$HOME/.zcode-dev-home\" pnpm dev:desktop:test\n```\n\nUse development mode when editing Web or backend source code:\n\n```\npnpm dev:web\n\n# Set the backend workspace (macOS / Linux)\nZCODE_SERVER_WORKSPACE=/path/to/project pnpm dev:web\n```\n\nThis starts both the Web development server (default: `http://localhost:5173`) and the backend (default: `http://localhost:3030`). Open the Web development server in your browser. `/ws` and general `/api` requests are proxied to the local backend; `/api/v1/oauth/token` is proxied separately to the configured product service.\n\nAfter changing Agent source code, run `pnpm --filter @zcode/cli... build` and restart the service. To validate the complete distribution, extract and run it as described under Packaging → ZCode CLI distribution below.\n\nThe command-line distribution includes the TUI, Web client, and Agent behind one `zcode` command. With no arguments it starts the TUI; a leading `--web` starts Web mode; all other arguments go to the existing Agent CLI. Both modes run locally without Electron.\n\n```\n# Start the terminal UI by default\nzcode\n\n# Start the Web interface\nzcode --web\n\n# Set the project and port without opening a browser automatically\nzcode --web --workspace /path/to/project --port 3030 --no-open\n\n# Show CLI or Web options\nzcode --help\nzcode --web --help\n```\n\nIn Web mode, it uses the current directory as the workspace, listens on `127.0.0.1` without token authentication by default, selects an available port, and opens a browser. Use the URL printed in the terminal and press `Ctrl+C` to stop the service. For LAN access, use `--host 0.0.0.0`; listening on a non-local address generates an access token by default. Use the token-bearing URL printed in the terminal. Set a token with `--token`, or disable token authentication with `--no-token`.\n\nWhen starting the general Web service's HTTP entry directly, configure API/WebSocket authentication with `ZCODE_SERVER_AUTH_TOKEN`. When creating the service programmatically, use the `authToken` option.\n\nSee Packaging below for build instructions. `pnpm build:zcode` only creates the distribution; it does not replace an existing `zcode` on `PATH`. If the command still points to an older installation or another checkout, check it with `command -v zcode` on macOS / Linux or `where.exe zcode` on Windows.\n\nUse the source entry when developing the TUI or Agent:\n\n```\npnpm --filter @zcode/cli dev --help\npnpm --filter @zcode/cli dev\n\n# Build the CLI and its workspace dependencies\npnpm --filter @zcode/cli... build\nnode apps/zcode-cli/packages/cli/dist/zcode.cjs --help\n```\n\nThis entry runs the Agent CLI directly and does not handle the distribution's `--web` switch. Use `pnpm dev:web` for Web development, or the extracted `bin/zcode.mjs` shown below to test the unified command.\n\nThe root [.env.example](https://github.com/zai-org/ZCode/blob/main/.env.example) provides sample service URLs and build configuration. Copy it to `.env` as needed and place local overrides in `.env.local`. Select the Desktop development environment with `dev:desktop:test` or `dev:desktop:prod`.\n\n| Setting | Purpose | \n|---|---|\n| `ZCODE_DATA_BASE_DIR` | Base directory for application data, stored under its `.zcode/` subdirectory | \n| `ZCODE_SERVER_WORKSPACE` | Workspace path for the Web backend | \n| `ZCODE_BUILTIN_PROVIDER_CONFIG_FILE` | Path to a local provider configuration file; uses the built-in configuration when unset | \n| `ZCODE_DIST_BASE_URL` | Download base URL used by the CLI distribution installer | \n\nRuntime variables can be set explicitly in the environment of the startup command. See [config/README.md](https://github.com/zai-org/ZCode/blob/main/config/README.md) for the default configuration shipped with the client.\n\nSee [third-party/README.md](https://github.com/zai-org/ZCode/blob/main/third-party/README.md) for notice generation, distribution checks, and where the notices are included in each distribution.\n\n```\npnpm bundle:desktop\n\n# Set the target platform and CPU architecture\npnpm bundle:desktop -- --os win --arch x64\n\npnpm bundle:desktop -- --help\n```\n\nThe default target is macOS arm64, and the default output directory is `packages/desktop/dist/`. `--os` accepts `mac`, `win`, or `linux`; `--arch` accepts `x64` or `arm64`. Packaging and signing require the tools and configuration for the target platform.\n\nRun `pnpm build:zcode` to build the CLI/TUI, backend, and Web client, collect the TUI native libraries, workers, and runtime dependencies, then assemble the distribution. Running the distribution still requires Node.js; use the version specified in `mise.toml`.\n\nBefore packaging, set the download base URL with `ZCODE_DIST_BASE_URL` in `.env`, `.env.local`, or the process environment, or pass it through `--base-url`. The URL below is a placeholder; replace it with your hosting URL when publishing:\n\n```\npnpm build:zcode --base-url https://downloads.example.com/zcode/\n\n# When ZCODE_DIST_BASE_URL is already configured\npnpm build:zcode\n\n# Repackage existing Agent, backend, and Web build outputs\npnpm build:zcode --skip-build\n\n# Show options for the version, output directory, and more\npnpm build:zcode --help\n```\n\nThe version defaults to the root `package.json` version. Output is written to `dist/zcode/`:\n\n- `releases/<version>/zcode-<version>.tar.gz` : runtime package.\n- `releases/<version>/sha256.txt` : checksum file.\n- `latest.json` and`install.sh` : version index and installer.\n\nUpload the entire directory to the configured download base URL. The installer downloads the runtime package from that URL, installs it to `~/.zcode/runtime` by default, and creates the `zcode` command in `~/.local/bin`. Override these directories with `ZCODE_DIST_HOME` and `ZCODE_DIST_BIN_DIR`, respectively.\n\nExisting Lite users should switch to the new build command, environment variables, and installer. Installation does not remove old Lite directories or migrate/delete session data.\n\nTo test a packaged build locally, extract and run it directly without uploading or installing it:\n\n``` js\nzcode_version=$(node -p \"require('./dist/zcode/latest.json').version\")\nmkdir -p dist/zcode/debug\ntar -xzf \"dist/zcode/releases/$zcode_version/zcode-$zcode_version.tar.gz\" \\\n  -C dist/zcode/debug\n# Start the TUI by default\nnode dist/zcode/debug/zcode/bin/zcode.mjs\n\n# Start Web mode\nnode dist/zcode/debug/zcode/bin/zcode.mjs --web \\\n  --workspace \"$PWD\" --port 3030 --no-open\n```\n\nOpen `http://127.0.0.1:3030` to validate the complete flow, with one backend serving the Web pages and running the Agent. The port must be available; if `pnpm dev:web` is already running, choose another `--port`.\n\n| Directory | Responsibility | \n|---|---|\n| `packages/desktop` | Electron Main, Host, Renderer, and desktop packaging | \n| `packages/web` | Web client | \n| `packages/server` | HTTP / WebSocket services and remote connections | \n| `packages/zcode-server-cli` | Standalone server startup and process management | \n| `packages/ui` | Shared React components, hooks, and Zustand state | \n| `packages/services` | Business services and persistence | \n| `packages/shared` ,`packages/rpc` ,`packages/client` | Shared protocols and types, RPC framework, and Agent client SDK | \n| `packages/provider` ,`packages/provider-node` | Common provider capabilities and Node implementations | \n| `apps/zcode-cli` | Agent CLI, TUI, runtime, and tools | \n| `scripts` ,`config` ,`third-party` | Build and maintenance scripts, built-in configuration, and third-party notice materials | \n\nSee [NOTICE.md](https://github.com/zai-org/ZCode/blob/main/NOTICE.md) for feature and promotion scope, maintenance policy, execution and data risks, licensing, and third-party copyright information.", "url": "https://wpnews.pro/news/zcode-embroiled-in-a-controversy-over-stealing-user-code-is-now-open-source", "canonical_source": "https://github.com/zai-org/ZCode/blob/main/README.en.md", "published_at": "2026-09-21 02:37:38+00:00", "updated_at": "2026-09-21 02:53:33.187089+00:00", "lang": "en", "topics": ["ai-products", "ai-tools", "ai-agents", "developer-tools"], "entities": ["ZCode", "zai-org", "GitHub", "Node.js", "pnpm", "Electron", "Agent CLI"], "alternates": {"html": "https://wpnews.pro/news/zcode-embroiled-in-a-controversy-over-stealing-user-code-is-now-open-source", "markdown": "https://wpnews.pro/news/zcode-embroiled-in-a-controversy-over-stealing-user-code-is-now-open-source.md", "text": "https://wpnews.pro/news/zcode-embroiled-in-a-controversy-over-stealing-user-code-is-now-open-source.txt", "jsonld": "https://wpnews.pro/news/zcode-embroiled-in-a-controversy-over-stealing-user-code-is-now-open-source.jsonld"}}