feat(providers): Z.ai Start Plan provider (OAuth login, in-process traceless captcha, gateway wire)

gui/.mimosa/hook-state/sess_866f3f9a-3097-4f86-af44-a594358fdc75.json

@@ -0,0 +1 @@
+{"touched":[],"bashMutation":true,"reportedFindings":[],"findingEvents":[],"baseline":null,"stateErrors":[],"omittedReportedFindings":0,"omittedFindingEvents":0,"processing":null,"updatedAt":"2026-09-14T17:03:07.070Z"}

gui/src/i18n/de.ts

@@ -858,6 +858,7 @@ export const de: Record<TKey, string> = {
   "logs.col.model": "Modell",
   "logs.col.effort": "Aufwand",
   "logs.col.provider": "Anbieter",
+"logs.col.account": "Konto",
   "logs.col.status": "Status",
   "logs.col.tokens": "Tokens",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/en.ts

@@ -907,6 +907,7 @@ export const en = {
   "logs.col.model": "Model",
   "logs.col.effort": "Effort",
   "logs.col.provider": "Provider",
+"logs.col.account": "Account",
   "logs.col.status": "Status",
   "logs.col.tokens": "Tokens",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/fr.ts

@@ -888,6 +888,7 @@ export const fr: Record<TKey, string> = {
   "logs.col.model": "Modèle",
   "logs.col.effort": "Niveau",
   "logs.col.provider": "Fournisseur",
+"logs.col.account": "Compte",
   "logs.col.status": "État",
   "logs.col.tokens": "Jetons",
   "logs.col.tokPerSec": "jetons/s",

gui/src/i18n/ja.ts

@@ -818,6 +818,7 @@ export const ja: Record<TKey, string> = {
   "logs.col.model": "モデル",
   "logs.col.effort": "負荷",
   "logs.col.provider": "プロバイダー",
+"logs.col.account": "アカウント",
   "logs.col.status": "状態",
   "logs.col.tokens": "トークン",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/ko.ts

@@ -889,6 +889,7 @@ export const ko: Record<TKey, string> = {
   "logs.col.model": "모델",
   "logs.col.effort": "추론 강도",
   "logs.col.provider": "프로바이더",
+"logs.col.account": "계정",
   "logs.col.status": "상태",
   "logs.col.tokens": "토큰",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/ru.ts

@@ -875,6 +875,7 @@ export const ru: Record<TKey, string> = {
   "logs.col.model": "Модель",
   "logs.col.effort": "Уровень",
   "logs.col.provider": "Провайдер",
+"logs.col.account": "Аккаунт",
   "logs.col.status": "Статус",
   "logs.col.tokens": "Токены",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/tr.ts

@@ -894,6 +894,7 @@ export const tr: Record<TKey, string> = {
   "logs.col.model": "Model",
   "logs.col.effort": "Çaba",
   "logs.col.provider": "Sağlayıcı",
+"logs.col.account": "Hesap",
   "logs.col.status": "Durum",
   "logs.col.tokens": "Jetonlar",
   "logs.col.tokPerSec": "jeton/sn",

gui/src/i18n/zh-TW.ts

@@ -712,6 +712,7 @@ export const zhTW: Record<TKey, string> = {
   "logs.col.model": "模型",
   "logs.col.effort": "推理強度",
   "logs.col.provider": "供應商",
+"logs.col.account": "帳戶",
   "logs.col.status": "狀態",
   "logs.col.tokens": "Token 數",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/zh.ts

@@ -870,6 +870,7 @@ export const zh: Record<TKey, string> = {
   "logs.col.model": "模型",
   "logs.col.effort": "推理强度",
   "logs.col.provider": "提供方",
+"logs.col.account": "账户",
   "logs.col.status": "状态",
   "logs.col.tokens": "Token 数",
   "logs.col.tokPerSec": "tok/s",

gui/src/pages/Logs.tsx

@@ -155,6 +155,8 @@ export interface LogEntry extends LogFailureAttribution {
   timestamp: number;
   model: string;
   provider: string;
+  /** Pool/account label the turn was served under (e.g. "p83fa8d", "main"); absent when unattributed. */
+  accountLogLabel?: string;
   surface?: LogSurface;
   conversationId?: string;
   /**
@@ -571,6 +573,34 @@ export default function Logs({ apiBase }: { apiBase: string }) {
       controller.abort();
     };
   }, [apiBase]);
+  // Opaque log labels → human attribution (email masked per proxy privacy settings).
+  // Fetched once per page: labels are stable for the lifetime of an account.
+  const [accountLabels, setAccountLabels] = useState<Map<string, string>>(new Map());
+  useEffect(() => {
+    const controller = new AbortController();
+    let cancelled = false;
+    fetch(`${apiBase}/api/account-labels`, { signal: controller.signal })
+      .then(res => (res.ok ? res.json() as Promise<{ labels?: Array<{ label?: unknown; email?: unknown; plan?: unknown }> }> : null))
+      .then(body => {
+        if (cancelled || !body?.labels) return;
+        const map = new Map<string, string>();
+        for (const row of body.labels) {
+          if (typeof row.label !== "string" || !row.label) continue;
+          const parts: string[] = [];
+          if (typeof row.email === "string" && row.email) parts.push(row.email);
+          if (typeof row.plan === "string" && row.plan) parts.push(row.plan);
+          if (parts.length > 0) map.set(row.label, parts.join(" · "));
+        }
+        if (!cancelled) setAccountLabels(map);
+      })
+      .catch(() => {
+        // Older proxy without the endpoint: fall back to the raw opaque labels.
+      });
+    return () => {
+      cancelled = true;
+      controller.abort();
+    };
+  }, [apiBase]);
   // The hash is the source of truth for the active tab (#logs vs #logs/debug),
   // so refresh/bookmark/back-forward keep the tab choice.
   const [tab, setTab] = useState<LogsTab>(readTabFromHash);
@@ -880,6 +910,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
               <col className="logs-col-model" />
               <col className="logs-col-effort" />
               <col className="logs-col-provider" />
+              <col className="logs-col-account" />
               <col className="logs-col-status" />
               <col className="logs-col-request" />
               <col className="logs-col-duration" />
@@ -893,6 +924,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
                <th className="log-col-model">{t("logs.col.model")}</th>
                <th>{t("logs.col.effort")}</th>
                <th>{t("logs.col.provider")}</th>
+               <th>{t("logs.col.account")}</th>
                <th>{t("logs.col.status")}</th>
                 <th>{t("logs.col.request")}</th>
                <th className="num log-col-duration">{t("logs.col.duration")}</th>
@@ -901,7 +933,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
             <tbody>
               {paddingTop > 0 && (
                 <tr>
-                  <td colSpan={10} className="logs-virtual-spacer" style={{ height: paddingTop }} />
+                  <td colSpan={11} className="logs-virtual-spacer" style={{ height: paddingTop }} />
                 </tr>
               )}
               {virtualRows.map(virtualRow => {
@@ -986,6 +1018,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
                       9% column and painted over the provider cell. */}
                   <td className="mono log-reasoning-cell" title={reasoningWire}>{effortLabel(log)}</td>
                   <td className="muted">{formatProviderDisplayName(log.provider, t)}</td>
+                  <td className="muted mono" title={log.accountLogLabel}>{accountLabels.get(log.accountLogLabel ?? "") ?? log.accountLogLabel ?? "—"}</td>
                   <td>
                     <span className="log-status-cell">
                       <span className="mono font-semibold" style={{ color: statusColor(log.status) }}>{log.status}</span>
@@ -1006,7 +1039,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
               })}
               {paddingBottom > 0 && (
                 <tr>
-                  <td colSpan={10} className="logs-virtual-spacer" style={{ height: paddingBottom }} />
+                  <td colSpan={11} className="logs-virtual-spacer" style={{ height: paddingBottom }} />
                 </tr>
               )}
             </tbody>

gui/src/styles.css

@@ -2091,13 +2091,14 @@ table.logs-table {
   min-width: 1100px;
   table-layout: fixed;
 }
-.logs-table col.logs-col-time { width: 12%; }
-.logs-table col.logs-col-tokens { width: 9%; }
+.logs-table col.logs-col-time { width: 10%; }
+.logs-table col.logs-col-tokens { width: 8%; }
 .logs-table col.logs-col-rate { width: 7%; }
 .logs-table col.logs-col-cost { width: 8%; }
-.logs-table col.logs-col-model { width: 15%; }
-.logs-table col.logs-col-effort { width: 9%; }
-.logs-table col.logs-col-provider { width: 13%; }
+.logs-table col.logs-col-model { width: 13%; }
+.logs-table col.logs-col-effort { width: 8%; }
+.logs-table col.logs-col-provider { width: 11%; }
+.logs-table col.logs-col-account { width: 8%; }
 .logs-table col.logs-col-status { width: 8%; }
 .logs-table col.logs-col-request { width: 11%; }
 .logs-table col.logs-col-duration { width: 8%; }

package.json

@@ -81,6 +81,7 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@napi-rs/keyring": "1.3.0",
     "bun": "1.4.0",
+    "happy-dom": "^20.11.6",
     "zod": "4.4.3"
   },
   "devDependencies": {

scripts/test-layout/layout.json

@@ -1786,7 +1786,9 @@
     "zhipu-bigmodel-responses-quota.test.ts": "providers",
     "zz-ci-api-usage-isolation.test.ts": "ci-workflows",
     "zz-ci-storage-policy-isolation.test.ts": "ci-workflows",
-    "zz-pr-coderabbit-readiness-revalidation.test.ts": "ci-workflows"
+    "zz-pr-coderabbit-readiness-revalidation.test.ts": "ci-workflows",
+    "devin-cli-authmode-migration.test.ts": "providers",
+    "zcode-start-plan.test.ts": "providers"
   },
   "migrated": [
     "adapters",
@@ -1812,4 +1814,4 @@
     "web-search",
     "windows"
   ]
-}
+}

src/adapters/registry.ts

@@ -10,6 +10,7 @@ import { createDevinAdapter } from "./devin";
 import { createGoogleAdapter } from "./google";
 import { createKiroAdapter } from "./kiro";
 import { createMimoFreeAdapter } from "./mimo-free";
+import { createZcodeStartPlanAdapter } from "./zcode-start-plan";
 import { createOpenAIChatAdapter } from "./openai-chat";
 import { createOllamaNativeAdapter } from "./ollama-native";
 import { createResponsesPassthroughAdapter } from "./openai-responses";
@@ -134,6 +135,10 @@ export const ADAPTER_REGISTRY = {
     contractParent: "openai-chat",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createMimoFreeAdapter(provider),
   },
+  "zcode-start-plan": {
+    contractParent: "anthropic",
+    create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createZcodeStartPlanAdapter(provider),
+  },
   qoder: {
     contractParent: "codebuddy",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createQoderAdapter(provider),

src/adapters/zcode-identity.ts

@@ -0,0 +1,95 @@
+/**
+ * ZCode client identity headers.
+ *
+ * Z.ai attributes GLM Coding Plan traffic to the client that sent it, and grants the
+ * ZCode harness an increased usage allowance (150%) over third-party clients. These
+ * builders reproduce the official client's LLM companion headers so plan-metered
+ * destinations are attributed correctly:
+ *
+ *   - Identity: `HTTP-Referer`, `User-Agent: ZCode/<version>` (optionally with the AI SDK
+ *     suffix the client appends on Anthropic-wire calls), `X-ZCode-App-Version`, `X-Title`,
+ *     `X-Release-Channel`, `X-Client-Language`/`-Timezone` (always sent, "unknown"
+ *     fallback), `X-Platform`, `X-Os-Category`, `X-Os-Version`, and `X-ZCode-Agent: glm`
+ *     last. No `X-Device-Mid` on LLM calls.
+ *   - Attribution: fresh `x-request-id`/`x-zcode-trace-id` per request and
+ *     `x-zcode-session-type: main`; the coding-plan routes also carry `x-query-id` and
+ *     `x-session-id`, which the plan gateway route omits.
+ *
+ * Eligibility is endpoint-based: only destinations that meter a plan subscription —
+ * the coding paths (`/api/coding/paas/v4`, the BigModel Responses v1 route) and the
+ * zcode.z.ai plan gateway — qualify. Pay-as-you-go endpoints (`/api/paas/v4`) have no
+ * subscription quota, so identifying there would be pointless noise.
+ */
+import { randomUUID } from "node:crypto";
+import { arch, platform, release } from "node:os";
+
+const ZCODE_APP_VERSION = process.env.ZCODE_PLAN_APP_VERSION?.trim() || "3.11.2";
+const ANTHROPIC_SDK_UA = "ai-sdk/anthropic/3.0.81";
+const ZCODE_PLAN_ORIGIN = "https://zcode.z.ai";
+
+function printable(value: string | undefined): string | undefined {
+  const v = value?.trim();
+  return v && /^[\x20-\x7e]+$/.test(v) ? v : undefined;
+}
+
+function osCategory(p: string): string {
+  if (p === "darwin") return "macos";
+  if (p === "win32") return "windows";
+  return "linux";
+}
+
+function clientLanguage(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+function clientTimezone(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+/** True for the plan-gateway send URLs this adapter targets. */
+export function isZcodePlanMeteredEndpoint(sendUrl: string | undefined): boolean {
+  if (!sendUrl) return false;
+  const url = sendUrl.replace(/\/+$/, "").toLowerCase();
+  return url === "https://zcode.z.ai/api/v1/zcode-plan/anthropic/v1/messages"
+    || url === "https://zcode.z.ai/api/v1/zcode-plan/anthropic/v1/messages?beta=true";
+}
+
+/** Companion headers the official client sends on every LLM completion. */
+export function buildZcodeIdentityHeaders(opts: { userAgentSuffix?: string } = {}): Record<string, string> {
+  const version = printable(ZCODE_APP_VERSION);
+  const osPlatform = printable(process.env.ZCODE_IDENTITY_PLATFORM ?? platform()) ?? "";
+  const osArch = printable(process.env.ZCODE_IDENTITY_ARCH ?? arch()) ?? "";
+  const osRelease = printable(process.env.ZCODE_IDENTITY_RELEASE ?? release());
+  const releaseChannel = process.env.ZCODE_ENV?.trim().toLowerCase() === "test" ? "test" : "production";
+  return {
+    "HTTP-Referer": ZCODE_PLAN_ORIGIN,
+    "User-Agent": `ZCode/${version ?? "unknown"}${opts.userAgentSuffix ? ` ${opts.userAgentSuffix}` : ""}`,
+    ...(version ? { "X-ZCode-App-Version": version } : {}),
+    "X-Title": "Z Code@cli",
+    "X-Release-Channel": releaseChannel,
+    "X-Client-Language": clientLanguage(),
+    "X-Client-Timezone": clientTimezone(),
+    ...(osPlatform && osArch ? { "X-Platform": `${osPlatform}-${osArch}` } : {}),
+    ...(osPlatform ? { "X-Os-Category": osCategory(osPlatform) } : {}),
+    ...(osRelease ? { "X-Os-Version": osRelease } : {}),
+    "X-ZCode-Agent": "glm",
+  };
+}
+
+/** Fresh per-request attribution headers; scope selects the coding-plan-only pair. */
+export function buildZcodeTraceHeaders(scope: "start-plan" | "coding-plan" = "coding-plan"): Record<string, string> {
+  return {
+    "x-request-id": randomUUID(),
+    "x-zcode-session-type": "main",
+    "x-zcode-trace-id": randomUUID(),
+    ...(scope === "coding-plan" ? { "x-query-id": randomUUID(), "x-session-id": randomUUID() } : {}),
+  };
+}