Z.ai opens ZCode source after a disputed repository-snapshot upload path

Описание и применение

Z.ai открыл исходный код ZCode после сообщения о том, что клиент может загружать снимки репозитория, содержащие внутренние данные Git. Открытый исходный код позволяет независимым аудиторам проверить, что путь к репо‑вики удалён, но отсутствие стороннего аудита требует самостоятельного тестирования.

Задача

A ZCode Desktop client was reported to generate repository snapshots that included Git internals (.git/objects, .git/logs, .git/refs) and upload them through a Repo Wiki workflow, potentially exposing sensitive data.

Результат

Open‑source release allows security teams to independently verify that the Repo Wiki snapshot upload path has been removed and that no Git metadata is transmitted. However, the absence of a third‑party audit means users must perform their own testing to confirm remediation.

Рабочий процесс

• 1. Download ZCode v3.14.0 source from GitHub.
• 2. Build the desktop client locally.
• 3. Create a disposable test repository with sample commits and secrets.
• 4. Run the client with repoSnapshotIndexingEnabled set to false.
• 5. Capture outbound traffic and inspect any uploaded data.
• 6. Verify that no .git/objects, .git/logs, or .git/refs are included in the snapshot or upload.

Доказательства

Z.ai says v3.14.0 removed the Repo Wiki entry point and repository-snapshot workflow; the claim has not received a complete independent audit.

Источник

The unresolved documentation conflict is concrete. ZCode’s current Repo Wiki documentation still says the feature sends filtered code context to a selected model service and stores generated output locally under ~/.zcode/v2/repo-wiki/<workspace-hash>/wiki.json.

Источник