The 313MB archive was encrypted for a Z.ai-held key, while the app's privacy controls did not stop packaging or retries.
By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)
· Published
Primary source: [Tokenstead](https://tokenstead.ai/guides/zcode-silent-git-history-upload)
Why it matters #
Coding agents need broad repository access to work, but ZCode's reported snapshot pipeline puts the desktop runtime - including what it collects and who holds the keys - at the center of developer trust.
ZCode, the desktop coding agent from Z.ai, a Tsinghua-born AI company led by CEO Zhang Peng and co-founded by computer scientist Tang Jie, repeatedly tried to upload a developer's full workspace, including its Git history, according to a reverse-engineering report published on September 18th.
The developer, who uses the name ferstar, found a 313MB encrypted archive inside ZCode's local data directory while clearing disk space. The archive represented a 345.5MB commercial workspace containing 42,411 files. Its accompanying metadata recorded 564 failed upload attempts, ferstar wrote in a detailed walkthrough of the application. Tokenstead's account of the findings traced the same upload pipeline and its relationship to ZCode's settings and privacy disclosures.
Ferstar's test establishes the behavior of one installation. It cannot establish how broadly Z.ai deployed the mechanism across ZCode versions, accounts or regions. The application's packaged code, local manifest and network activity nevertheless provide a specific account of what ZCode collected and where the encrypted payload was intended to go.
The disclosure lands directly on the strategy Zhang and Tang have pursued with ZCode: turning Z.ai's open-weight GLM models into a first-party development environment that can compete with Cursor, Claude Code and other coding agents. Z.ai was formed in 2019 from technology developed at Tsinghua University's Knowledge Engineering Group. Tang, a Tsinghua professor who helped lead the Wu Dao model project and created Zhipu.AI with his team, has spent years pushing language models beyond research demonstrations and into commercial products. Zhang runs the Hong Kong-listed company built around that work.
That expansion gives Z.ai a closer relationship with developers and their repositories. Repository handling is determined by the desktop application and its cloud connections, regardless of whether the underlying GLM weights can be downloaded.
The payload was mostly Git history
Ferstar traced the archive through a plaintext packaging manifest. The .git directory accounted for 86.6% of the payload. Git LFS data made up 196.1MB, or 56.8%, while .git/objects contributed another 102.2MB, or 29.6%. Source code and documentation represented about 46.2MB.
That distinction matters because a Git object store contains substantially more than the files visible in a working directory. Depending on a repository's history, it can preserve deleted credentials, old configuration files, unpushed branches, internal hostnames and unreleased work. A full snapshot therefore exposes the repository's lineage rather than the narrow set of files required to answer a prompt.
According to ferstar's reconstruction of ZCode's packaged app.asar code, the client requested upload credentials from zcode.z.ai. The server returned an object key, size limits, Alibaba Cloud Object Storage Service form credentials and an RSA public key. ZCode then compressed the workspace, encrypted it with AES-256-CTR, wrapped the symmetric key using RSA-OAEP-SHA256 and attempted to send the encrypted archive directly to Alibaba Cloud's storage service. Alibaba Cloud would call back to Z.ai's backend to register the snapshot after receipt.
The key arrangement is the most consequential part of the design. Ferstar said none of the private keys on the test machine could unwrap the archive's encryption key. The corresponding private key was held on the server side, leaving the local user and the ZCode client unable to decrypt the ciphertext stored on the user's own computer.
Checkpoint and rollback functions offer a plausible product reason to capture workspace state. ZCode's agent documentation says the product combines workspace state, file references, execution modes and Git branch context during long-running development tasks. The server-held decryption key and the inclusion of full repository history give Z.ai access to a much wider data set than a local rollback mechanism would require.
ZCode's switches did not stop the pipeline
Ferstar also compared ZCode's visible settings with the application's code. The "Optimize Experience" control governed whether user content could be used for model training, according to the analysis. It did not prevent the application from packaging or attempting to upload snapshots.
A separate "Repo Snapshot Indexing" switch controlled whether the server indexed an uploaded snapshot. Ferstar found that disabling it did not stop local packaging or the upload process. The capture component was started whenever the application had a valid login token, with snapshot events triggered before prompts and after task completion. One active session produced 62 capture events, according to the local logs.
ZCode's current privacy policy, effective June 15th, says the service collects text, files, commands and code submitted through conversations. It also says the product's optimization program is disabled by default and requires an opt-in before user content is applied to product or model training.
Those disclosures describe prompted content and model-improvement consent. They do not describe the host-level workflow ferstar documented: creating an archive of the workspace and Git history outside the agent's visible tools, then preparing it for storage using a key controlled by Z.ai.
Encryption protects data in transit and at rest from parties without the private key. Here, the party operating the service controls that key. The encryption therefore does not prevent Z.ai from reading the uploaded repository.
Ferstar recommends blocking ZCode from writing to its local checkpoints directory at the operating-system level. That approach prevents the archive from being created, although it also disables the application's checkpoint rollback feature. Deleting the pending archive alone did not work in the test; ZCode created another copy and resumed its retry sequence.
The model license stops at the desktop app
Z.ai has leaned heavily on downloadable model weights as it works to win developers. RuntimeWire reported in August that Z.ai released GLM-5.3 weights for coding and defensive security. Days earlier, Z.ai offered up to 5 trillion free tokens to recruit ZCode users, saying at the time that the coding product had reached 1 million users.
That distribution push makes ZCode strategically important to Zhang and Tang. Downloadable weights can spread through third-party tools without giving Z.ai ownership of the developer interface. ZCode creates that direct channel, with control over accounts, subscriptions, product telemetry and the agent runtime wrapped around GLM.
The reverse-engineering report shows how much remains outside a model release. Developers can inspect downloadable weights while the desktop runtime that reads their repositories, manages permissions and communicates with cloud services remains closed. Running GLM locally does not keep a workspace local when the surrounding application maintains a separate upload pipeline.
Developing the model and runtime together can improve how an agent handles long-running work. It also concentrates responsibility. ZCode's product controls and disclosures need to match what its host application does with a repository, especially when the payload includes years of engineering history and only Z.ai holds the key.