feat(providers): ZCode — Z.ai Start Plan provider (OAuth login, traceless captcha, client attribution)

docs-site/src/content/docs/guides/providers.md

@@ -178,6 +178,7 @@ ocx login command-code # Command Code browser OAuth (or import ~/.commandcode/au
 ocx login orcarouter-oauth # OrcaRouter browser consent + PKCE
 ocx login devin       # Cognition/Devin Auth0 browser sign-in
 ocx login github-copilot  # GitHub device flow → Copilot token (Copilot Pro/Business)
+ocx login zcode-start-plan  # Z.ai Start Plan via the ZCode gateway (browser authorize → poll)
 ocx login codex        # Codex account pool (aliases: chatgpt, openai; needs a running proxy)
 ocx logout <provider>
 ```
@@ -195,6 +196,7 @@ ocx logout <provider>
 | `devin` | `devin` | `https://server.codeium.com` | Experimental unofficial Cognition/Devin bridge. Login opens Auth0 browser sign-in, then exchanges the token via Cognition's `RegisterUser` for a long-lived API key; models are discovered per account with `GetCascadeModelConfigs`. Not shown in the dashboard preset by default. Chat and usage reporting are verified against a live account across three models. |
 | `devin-cli` | `devin` | `https://server.codeium.com` | Imports the credential your installed Devin CLI already holds (`devin auth login` writes it to its own `credentials.toml`), then streams over Cognition's Connect-RPC api-server like the `devin` provider — no browser sign-in and no key to paste. Model discovery and context windows come from your account's own catalog. |
 | `github-copilot` | `openai-chat` | `https://api.githubcopilot.com` | Experimental. GitHub device flow + `copilot_internal` exchange (VS Code OAuth client). Requires an active Copilot subscription; not an official third-party API. |
+| `zcode-start-plan` | `zcode-start-plan` | `https://zcode.z.ai/api/v1/zcode-plan/anthropic` | Serves the Z.ai Start Plan quota from the ZCode plan gateway — no ZCode desktop app needed. Login is the gateway's own OAuth CLI flow (`ocx login zcode-start-plan` → browser → poll); the stored plan JWT has no expiry and is re-obtained by re-login when the gateway rejects it. The gateway requires the official ZCode identity system blocks, client identity headers, and solves Aliyun WAF captcha challenges with an in-process traceless solver confined to a worker thread. Quota reads `billing/balance`; the `GLM-5.3-Flash` row accepts images. Per-window rate limits on a fresh identity surface as ordinary 429s. |
 
 Google Antigravity account and provider quota probes use fixed Google accounting endpoints, including the models fallback. They support transparent Fake-IP DNS for those destinations while retaining TLS verification, redirect rejection and private-address checks. A custom provider base URL changes model requests, not quota destinations; `NO_PROXY` continues to select the direct-route policy.
 

docs-site/src/content/docs/reference/adapters.md

@@ -504,3 +504,37 @@ or a permission grant. Unmarked clients retain their existing behavior. This
 repair runs before the separate provider `responsesSnapshotRepair` option and
 does not enable that broader lifecycle repair. Existing tool-search, custom-tool,
 function-completion and undeclared-tool handling keep their established order.
+
+## `zcode-start-plan`
+
+**Targets:** the ZCode plan gateway's Anthropic-wire messages endpoint at
+`zcode.z.ai/api/v1/zcode-plan/anthropic/v1/messages`.
+**Auth:** the plan JWT from `ocx login zcode-start-plan` (the gateway's OAuth CLI flow),
+sent as `Authorization: Bearer`. The JWT carries no `exp` claim; when the gateway rejects
+it, the account is marked for re-login — there is no silent refresh.
+
+- Requests mirror the official desktop client's LLM calls: the identity header set
+  (`User-Agent: ZCode/<version> ai-sdk/anthropic/3.0.81`, `X-Title`, `X-ZCode-Agent: glm`
+  last, no device id) plus fresh per-request attribution ids and
+  `x-zcode-session-type: main`.
+- The gateway inspects the request body: the official ZCode system blocks are prepended to
+  `system` (the dynamic powered-by line merged into the trailing Environment block), the
+  client's two-phase `cache_control` marking is applied, and `metadata.user_id` is decoded
+  from the JWT. Without these the gateway answers biz code 3012. The Claude Code identity
+  block that the inner oauth-mode Anthropic adapter would add is stripped so the model sees
+  one identity.
+- Aliyun WAF captcha challenges (biz 3007 in the body, or the verify-param response
+  header) mint a fresh verify param and replay the request once. The traceless solver runs
+  the official Aliyun Captcha 2.0 SDK inside a happy-dom window that lives entirely in a
+  dedicated worker thread — its window aliasing, exception handlers, and any stall can
+  never touch the server thread. A crash or hang fails only the pending solve.
+- Business errors that arrive inside HTTP 200 bodies (for example `1005`, a per-window
+  rate limit) are mapped to real statuses (429/502) instead of surfacing as truncated
+  streams. A 3012 WAF block surfaces as `upstream_error`.
+- Quota: per-account probe of `billing/balance` (requires the `X-Device-Mid` header,
+  persisted per install under the OpenCodex home; `ZCODE_DEVICE_MID` overrides). Balance
+  rows become custom quota windows.
+- The static model list comes from the gateway's client config — the Anthropic route has
+  no `/models` listing, so live discovery stays off.
+
+See the [provider guide](/guides/providers/) for login instructions and operational notes.

gui/src/i18n/de.ts

@@ -748,6 +748,7 @@ export const de: Record<TKey, string> = {
   "logs.col.model": "Modell",
   "logs.col.effort": "Aufwand",
   "logs.col.provider": "Anbieter",
+"logs.col.account": "Konto",
   "logs.col.status": "Status",
   "logs.col.tokens": "Tokens",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/en.ts

@@ -797,6 +797,7 @@ export const en = {
   "logs.col.model": "Model",
   "logs.col.effort": "Effort",
   "logs.col.provider": "Provider",
+"logs.col.account": "Account",
   "logs.col.status": "Status",
   "logs.col.tokens": "Tokens",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/fr.ts

@@ -778,6 +778,7 @@ export const fr: Record<TKey, string> = {
   "logs.col.model": "Modèle",
   "logs.col.effort": "Niveau",
   "logs.col.provider": "Fournisseur",
+"logs.col.account": "Compte",
   "logs.col.status": "État",
   "logs.col.tokens": "Jetons",
   "logs.col.tokPerSec": "jetons/s",

gui/src/i18n/ja.ts

@@ -710,6 +710,7 @@ export const ja: Record<TKey, string> = {
   "logs.col.model": "モデル",
   "logs.col.effort": "負荷",
   "logs.col.provider": "プロバイダー",
+"logs.col.account": "アカウント",
   "logs.col.status": "状態",
   "logs.col.tokens": "トークン",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/ko.ts

@@ -779,6 +779,7 @@ export const ko: Record<TKey, string> = {
   "logs.col.model": "모델",
   "logs.col.effort": "추론 강도",
   "logs.col.provider": "프로바이더",
+"logs.col.account": "계정",
   "logs.col.status": "상태",
   "logs.col.tokens": "토큰",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/ru.ts

@@ -765,6 +765,7 @@ export const ru: Record<TKey, string> = {
   "logs.col.model": "Модель",
   "logs.col.effort": "Уровень",
   "logs.col.provider": "Провайдер",
+"logs.col.account": "Аккаунт",
   "logs.col.status": "Статус",
   "logs.col.tokens": "Токены",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/tr.ts

@@ -784,6 +784,7 @@ export const tr: Record<TKey, string> = {
   "logs.col.model": "Model",
   "logs.col.effort": "Çaba",
   "logs.col.provider": "Sağlayıcı",
+"logs.col.account": "Hesap",
   "logs.col.status": "Durum",
   "logs.col.tokens": "Jetonlar",
   "logs.col.tokPerSec": "jeton/sn",

gui/src/i18n/zh-TW.ts

@@ -614,6 +614,7 @@ export const zhTW: Record<TKey, string> = {
   "logs.col.model": "模型",
   "logs.col.effort": "推理強度",
   "logs.col.provider": "供應商",
+"logs.col.account": "帳戶",
   "logs.col.status": "狀態",
   "logs.col.tokens": "Token 數",
   "logs.col.tokPerSec": "tok/s",

gui/src/i18n/zh.ts

@@ -760,6 +760,7 @@ export const zh: Record<TKey, string> = {
   "logs.col.model": "模型",
   "logs.col.effort": "推理强度",
   "logs.col.provider": "提供方",
+"logs.col.account": "账户",
   "logs.col.status": "状态",
   "logs.col.tokens": "Token 数",
   "logs.col.tokPerSec": "tok/s",

gui/src/pages/Logs.tsx

@@ -142,6 +142,8 @@ export interface LogEntry {
   timestamp: number;
   model: string;
   provider: string;
+  /** Pool/account label the turn was served under (e.g. "p83fa8d", "main"); absent when unattributed. */
+  accountLogLabel?: string;
   surface?: LogSurface;
   conversationId?: string;
   /**
@@ -443,6 +445,34 @@ export default function Logs({ apiBase }: { apiBase: string }) {
       controller.abort();
     };
   }, [apiBase]);
+  // Opaque log labels → human attribution (email masked per proxy privacy settings).
+  // Fetched once per page: labels are stable for the lifetime of an account.
+  const [accountLabels, setAccountLabels] = useState<Map<string, string>>(new Map());
+  useEffect(() => {
+    const controller = new AbortController();
+    let cancelled = false;
+    fetch(`${apiBase}/api/account-labels`, { signal: controller.signal })
+      .then(res => (res.ok ? res.json() as Promise<{ labels?: Array<{ label?: unknown; email?: unknown; plan?: unknown }> }> : null))
+      .then(body => {
+        if (cancelled || !body?.labels) return;
+        const map = new Map<string, string>();
+        for (const row of body.labels) {
+          if (typeof row.label !== "string" || !row.label) continue;
+          const parts: string[] = [];
+          if (typeof row.email === "string" && row.email) parts.push(row.email);
+          if (typeof row.plan === "string" && row.plan) parts.push(row.plan);
+          if (parts.length > 0) map.set(row.label, parts.join(" · "));
+        }
+        setAccountLabels(map);
+      })
+      .catch(() => {
+        // Older proxy without the endpoint: fall back to the raw opaque labels.
+      });
+    return () => {
+      cancelled = true;
+      controller.abort();
+    };
+  }, [apiBase]);
   // The hash is the source of truth for the active tab (#logs vs #logs/debug),
   // so refresh/bookmark/back-forward keep the tab choice.
   const [tab, setTab] = useState<LogsTab>(readTabFromHash);
@@ -752,6 +782,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
               <col className="logs-col-model" />
               <col className="logs-col-effort" />
               <col className="logs-col-provider" />
+              <col className="logs-col-account" />
               <col className="logs-col-status" />
               <col className="logs-col-request" />
               <col className="logs-col-duration" />
@@ -765,6 +796,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
                <th className="log-col-model">{t("logs.col.model")}</th>
                <th>{t("logs.col.effort")}</th>
                <th>{t("logs.col.provider")}</th>
+               <th>{t("logs.col.account")}</th>
                <th>{t("logs.col.status")}</th>
                 <th>{t("logs.col.request")}</th>
                <th className="num log-col-duration">{t("logs.col.duration")}</th>
@@ -773,7 +805,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
             <tbody>
               {paddingTop > 0 && (
                 <tr>
-                  <td colSpan={10} className="logs-virtual-spacer" style={{ height: paddingTop }} />
+                  <td colSpan={11} className="logs-virtual-spacer" style={{ height: paddingTop }} />
                 </tr>
               )}
               {virtualRows.map(virtualRow => {
@@ -858,6 +890,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
                       9% column and painted over the provider cell. */}
                   <td className="mono log-reasoning-cell" title={reasoningWire}>{effortLabel(log)}</td>
                   <td className="muted">{formatProviderDisplayName(log.provider, t)}</td>
+                  <td className="muted mono" title={log.accountLogLabel}>{accountLabels.get(log.accountLogLabel ?? "") ?? log.accountLogLabel ?? "—"}</td>
                   <td>
                     <span className="log-status-cell">
                       <span className="mono font-semibold" style={{ color: statusColor(log.status) }}>{log.status}</span>
@@ -878,7 +911,7 @@ export default function Logs({ apiBase }: { apiBase: string }) {
               })}
               {paddingBottom > 0 && (
                 <tr>
-                  <td colSpan={10} className="logs-virtual-spacer" style={{ height: paddingBottom }} />
+                  <td colSpan={11} className="logs-virtual-spacer" style={{ height: paddingBottom }} />
                 </tr>
               )}
             </tbody>

gui/src/styles.css

@@ -2109,13 +2109,14 @@ table.logs-table {
   min-width: 1100px;
   table-layout: fixed;
 }
-.logs-table col.logs-col-time { width: 12%; }
-.logs-table col.logs-col-tokens { width: 9%; }
+.logs-table col.logs-col-time { width: 10%; }
+.logs-table col.logs-col-tokens { width: 8%; }
 .logs-table col.logs-col-rate { width: 7%; }
 .logs-table col.logs-col-cost { width: 8%; }
-.logs-table col.logs-col-model { width: 15%; }
-.logs-table col.logs-col-effort { width: 9%; }
-.logs-table col.logs-col-provider { width: 13%; }
+.logs-table col.logs-col-model { width: 13%; }
+.logs-table col.logs-col-effort { width: 8%; }
+.logs-table col.logs-col-provider { width: 11%; }
+.logs-table col.logs-col-account { width: 8%; }
 .logs-table col.logs-col-status { width: 8%; }
 .logs-table col.logs-col-request { width: 11%; }
 .logs-table col.logs-col-duration { width: 8%; }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.53.0",
+  "version": "2.52.0",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",
@@ -71,6 +71,7 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@napi-rs/keyring": "1.3.0",
     "bun": "1.4.2",
+    "happy-dom": "^20.14.3",
     "zod": "4.4.3"
   },
   "devDependencies": {

scripts/test-layout/layout.json

@@ -1372,7 +1372,9 @@
     "zz-ci-storage-policy-isolation.test.ts": "ci-workflows",
     "zz-pr-coderabbit-readiness-revalidation.test.ts": "ci-workflows",
     "devin-cli-login.test.ts": "providers",
-    "devin-cli-authmode-migration.test.ts": "providers"
+    "devin-cli-authmode-migration.test.ts": "providers",
+    "zcode-start-plan.test.ts": "providers",
+    "zcode-attribution.test.ts": "adapters"
   },
   "migrated": [
     "adapters",
@@ -1398,4 +1400,4 @@
     "web-search",
     "windows"
   ]
-}
+}